Understanding direct and indirect exposure, wallet risk ratings, and what regulators really expect from your compliance framework when dissecting with hops and exposure.

In the world of crypto on-chain analytics, we have found one question that echoes across jurisdictions, client engagements, and regulatory discussions:

“How many hops do you trace for illicit activity or sanctions exposure?”

This deceptively simple question has significant implications for regulated and unregulated entities operating in the crypto ecosystem. From Regulated Funds and VASPs to unregulated DAOs and Foundations, determining what constitutes meaningful exposure and how far back one must trace it, is central to not just remaining compliant in a rapidly evolving regulatory landscape, but also safeguarding the company’s reputation and risk.

What Are “Hops” in the On-Chain World?

Without complicating this too much, one can use the following example to define this topic:

• 1 hop: A direct transfer from a sanctioned or high-risk wallet to another wallet.

Example: Designated Address A → End-user Address B

• 2 hops: A transaction that routes through one intermediary.

Example: Address A → Address C → End-user B

• 3 hops or more: Multiple intermediary steps between the originating and final wallet.

Example: Address A → Address C → Address D → End-user B

While some may assume that exposure becomes negligible after a few hops, we have seen, and regulators have warned that even multiple hops indirect exposure can breach sanctions compliance if not properly identified and managed.

Direct vs. Indirect Exposure: Why It Matters

• Direct Exposure refers to a wallet that receives funds directly from a sanctioned entity or wallet.
  E.g., Wallet A receives 1 BTC from Garantex – this is direct sanctions exposure.
• Indirect Exposure occurs when funds originate from a sanctioned source, but pass through one or more intermediary wallets.
  E.g., Wallet A receives 1 BTC from Wallet B, who received funds from Garantex.

Whether exposure is direct or indirect, 1 hop or 10 hops ways, all can represent a breach depending on local laws and global regulatory expectations and have an impact on the reputational view of your company.

An Example of some sophisticated tactics used

As crypto investigators, regulators and industry players become more upskilled and informed, so does illicit actors and criminals. Each day new tactics, skills and methodologies are applied by these role players to launder money, break the flow of funds chain and obfuscate funds.

One tactic that we have seen on multiple occasions, is when illicit actors and criminals would create multiple wallets within minutes, transfer the funds through these wallets to the end user within a short period of time and sometimes go above and beyond to chain hop as well, a tactic used to obfuscate the source and break the “exposure” and “hop” count. Therefore, following a direct exposure only or a “3 hop count” would have ruled out this behaviour, where a holistic view and risk-based approach will pick this up as high-risk activity for further investigation.

How We Approach Exposure at Provenance

When working with both regulated entities (like Funds and VASPs) and unregulated ones (like DAOs or Foundations), we take a risk-based, holistic and contextual approach rather than applying a blunt instrument like a fixed “hop count” or “tick box” approach.

At Provenance, our screening methodology is anchored on three key pillars:

1. Regulatory Requirements
   We tailor our screening depth and reporting standards to the applicable laws and guidance of each client’s jurisdiction, whether that’s under CIMA in the Cayman Islands, MiCA in the EU, the Financial Action Task Force (FATF) Recommendations, or other local regulatory regimes. Compliance begins with knowing what’s expected.
2. Sanctions Compliance
   Given the global focus on sanctions enforcement, we place a strong emphasis on detecting both direct and indirect exposure to sanctioned entities or jurisdictions. This includes integrating screening lists from OFSI, OFAC, the UN, and other relevant bodies to ensure full coverage.
3. Reputational Risk
   Even when something isn’t a clear-cut regulatory or legal breach, associations with darknet markets, ransomware, or illicit actors can pose severe reputational risks. We help clients make informed decisions by identifying potential red flags in counterparties or wallets, even when not strictly required by law.

In addition to these pillars, we prioritize:

• Holistic Wallet Screening: Beyond just counting hops, we analyse wallet behaviour, review all assets held, transaction history, and counterparty exposure.
• Contextual Flow Analysis: We follow the movement of funds across chains and protocols to understand the intent and nature of interactions, not just proximity to risk.
• Tool-Driven Risk Ratings: Depending on the analytical tool in use, such as TRM Labs, Elliptic, or Chainalysis, each wallet typically receives a risk score based on a proprietary internal engine. These engines screen for numerous high-risk activities and exposures, both direct and indirect. Importantly, these scores can be customized to reflect your company’s specific risk appetite and regulatory obligations.
• Directional Insight: We differentiate between incoming and outgoing exposure. For example, having exposure to a Stolen Funds wallet does not necessarily imply wrongdoing. A wallet might be a victim rather than a participant in illicit activity, which should be investigated and viewed with the needed expertise and understanding of the exposure.
• High Risk Categories: When we screen wallets, we focus on indicators such as ownership, exposure, and association with high-risk categories, both in a sending and receiving direction. For enhanced reviews, we conduct deeper dives into exposure to services, behavioural patterns, transactional history, and counterparty links. Categories flagged in this process may include:
  • Sanctions
  • Terrorism Financing
  • Mixing Services
  • Privacy Protocols
  • High-Risk Jurisdictions
  • No-KYC Exchanges
  • Ransomware
  • Stolen Funds
  • Scam Activity
  • Fraud Shops
  • Illicit Actor Organizations
  • Darknet Markets
  • Child Abuse Content
  • Crypto ATMs
  • Gambling Services
• Chain Awareness: We stay alert to cross-chain activity and obfuscation techniques. Chain-hopping and DEX interactions often indicate attempts to hide the origin of funds.

Final Thoughts: It’s Not Just About Distance, It’s About Diligence

The concepts of “hops” and “exposure” provides a useful lens for mapping risk, but it should not be treated as a rigid rule. Real-world compliance requires flexibility, nuance, and deep domain expertise and experience in order to accurately and appropriately make an informed decision.

If you’re unsure whether your crypto operation has sufficient visibility into sanctions or high-risk exposure, now is the time to reassess. At Provenance, we specialize in implementing and optimizing risk-based approaches tailored to your jurisdiction and business model.

Let’s connect to ensure you’re not just following the rules but understanding the risks behind them.