Why off-ramp providers struggle to get the counterparty data they need
Pooja Shah, Rain
Moment at 55:20Episode 6 · Stablecoins Go Mainstream: Inside the New Payments Stack
Blockchain Compliance Integration
In short
Blockchain compliance integration wires KYC onboarding, transaction screening (KYT), AML monitoring, and Travel Rule into your product and enforces the rules in code, so non-compliant transactions are blocked, not just logged. We integrate the specialist screening and identity providers and build the on-chain enforcement, as an engineering partner, not the screening tool or the policy owner.
Reviewed by Luis Medeiros, Field CTO at ProtofireLast reviewed: October 2026
7,000+
KYC-verified users on Swarm Markets, the DEX we built the trading core for
95+
protocols delivered
$2B+
secured on the Safe deployments we built across 120+ EVM networks
1M+
developers on Solhint, which we maintain
Trusted by teams building on-chain
Blockchain compliance integration is the engineering that lets a regulated on-chain product meet its KYC, AML, and Travel Rule obligations without those checks living in a spreadsheet next to the product. It has two halves. The onboarding and screening half decides who may use the product and whether a given transaction is allowed: identity verification (KYC), wallet and transaction screening against sanctions and risk (KYT), and ongoing AML monitoring.
The enforcement half makes those decisions binding on-chain, so a non-compliant transaction cannot simply be recorded and dealt with later, it is blocked or gated in code. Specialist providers, such as Chainalysis, TRM, Elliptic, and Sumsub, supply the screening and identity data; the integration is the engineering that wires them into your product and turns their signals into enforced rules.
Protofire builds that layer as an engineering partner, not as a compliance vendor or a legal advisor. We built the DEX core and subgraph for Swarm Markets, a BaFin-licensed DEX at launch where only KYC-verified wallets can trade and Swarm's own permissioning layer decides who is eligible, and we build the KYC, AML, and Travel Rule hooks into stablecoin and RWA products across our practice.
We integrate the screening and identity providers you or your counsel choose, enforce the rules in code, and keep your compliance team and their perimeter in control, we build the plumbing, not the policy.
Compliance is screening plus on-chain enforcement
Providers supply the signals; we wire them in and enforce the rules in code.
01
Identity (KYC)
Integrate identity verification (KYC/KYB) so only verified users onboard.
02
Screening (KYT)
Wire wallet and transaction screening against sanctions and risk scores.
03
Enforcement
Gate or block transactions on-chain when a rule fails, not after settlement.
04
Travel Rule
Exchange required originator and beneficiary data between institutions on transfers.
05
Monitoring & reporting
Ongoing AML monitoring, case handling hooks, and audit-ready reporting.
01
What is blockchain compliance integration?
These acronyms cover different obligations, and a regulated product usually needs all of them. KYC (and KYB for businesses) is identity verification at onboarding: proving who a user is before they can transact. KYT (know your transaction) is screening a wallet or transaction against sanctions lists and risk scores, both before allowing it and continuously afterward.
AML monitoring is the ongoing surveillance that flags suspicious patterns for review. The Travel Rule (FATF Recommendation 16, applied to virtual-asset providers through Recommendation 15) requires institutions to exchange originator and beneficiary information with transfers; FATF lets countries apply a lighter regime to virtual-asset transfers under USD or EUR 1,000 (the names and wallet addresses still travel but need not be verified), while the EU sets no minimum amount for transfers between crypto-asset service providers.
Each is provided as a service by specialists, and each has to be integrated into your product and, where it matters, enforced on-chain. We build that integration and enforcement; the identity and screening data come from providers you choose.
The difference between a compliance demo and a compliant product is enforcement. It is easy to screen a transaction and log the result; it is the engineering that makes a failed check actually block or gate the transaction on-chain, before value moves, that regulators and institutional counterparties care about.
We build permissioning and gating into the contracts and transaction flows, using screening results and identity claims as inputs, so an ineligible user or a sanctioned counterparty is stopped at the moment of the transaction rather than caught in a report afterward. It is also the standard we built to on the DEX core for Swarm Markets, a BaFin-licensed DEX at launch where only KYC-verified wallets can trade.
Regulation is tightening on a clock. In the EU, MiCA brings crypto-asset service providers under authorization or notification, routes compared in our MiCA license routes guide, with compliance obligations, and since 30 December 2024 the EU Travel Rule has required a provider to send originator and beneficiary data with every crypto-asset transfer it makes for a customer to another provider, with no minimum amount, and to obtain and hold the same data for transfers to or from a self-hosted wallet, which makes originator and beneficiary data exchange a build requirement.
Products that were informal about compliance are being forced to formalize it to keep operating in regulated markets. We help teams meet these requirements as engineering: integrating the screening and Travel Rule providers, building the enforcement, and producing the audit trail, so compliance is part of the product rather than a manual process bolted alongside it.
For a CASP mapping these obligations onto its own stack, our MiCA compliance stack blueprint wires onboarding, screening, Travel Rule, records and continuity so each obligation produces its own evidence. Two companion blueprints cover moving clients off a lapsed VASP registration and onboarding the client book of providers that had to wind down.
The move itself, from client consent to deposit sweeps and Travel Rule re-wiring, is covered by MiCA migration engineering.
02
What we deliver
Integration of the identity (KYC/KYB) and transaction-screening (KYT) providers you or your counsel choose, such as Chainalysis, TRM, Elliptic, or Sumsub, into your onboarding and transaction flows, with the results turned into signals your product can act on.
Permissioning and gating built into the contracts and transaction flows, so eligibility and screening outcomes are enforced on-chain, an ineligible or sanctioned transaction is blocked at execution, not logged after settlement. For token-level eligibility (who may hold an asset), we build the ERC-3643 permissioned-token layer.
Travel Rule data exchange between institutions, ongoing AML monitoring hooks, and the audit-ready reporting a regulator or auditor expects, wired into the indexing that makes on-chain activity queryable.
03
Who is compliance integration for?
Exchanges, payment providers, and CASPs operating in regulated markets who need KYC, KYT, AML, and Travel Rule built into their product and enforced, not run as a manual process beside it, especially those coming under MiCA or similar regimes. RWA and security-token issuers who need investor eligibility and transfer rules enforced on-chain, often alongside the permissioned-token layer. Stablecoin and fintech products that need compliance hooks inside their payment flows without the compliance layer becoming the product. DeFi protocols moving toward compliant or permissioned versions who need screening and gating that fit an on-chain, non-custodial model. The common requirement is that compliance has to be engineered into the product and enforced at the moment of the transaction, and you want the integration built by a team that has shipped it for a regulated venue, while your compliance function and counsel keep control of the policy.
04
We built compliance into a regulated venue, in code
Protofire is a blockchain development company with 250+ shipped projects across 60+ networks and 95+ protocols since 2016. Our compliance-engineering credentials are first-hand: we built the DEX core and subgraph for Swarm Markets, a BaFin-licensed DEX at launch for crypto and tokenized real-world assets, where only KYC-verified wallets can trade and Swarm reports 7,000+ verified users.
Swarm holds the license and runs its own KYC and permissioning layer. We build ERC-3643 permissioned tokens and the KYC, AML, and Travel Rule hooks in stablecoin and RWA products across our practice. We maintain Solhint, the Solidity linter used by 1M+ developers, so the enforcement logic that gates real transactions is held to the standard we set for the ecosystem. We are the engineering partner: your compliance team and counsel own the policy and the perimeter, and we build and enforce it in code.
“The part of compliance that is real engineering is enforcement: turning a failed screening check into a transaction the contract actually blocks, before value moves.”
FAQ
What is blockchain compliance integration?
Blockchain compliance integration is the engineering that builds a regulated product's compliance obligations, KYC, AML, transaction screening (KYT), sanctions checks, and the Travel Rule, into the product itself and enforces them on-chain. It has two parts. The first is integrating the specialist providers that supply the data: identity verification for onboarding, and wallet and transaction screening against sanctions and risk. The second, and the harder part, is enforcement: turning a failed check into an action the product actually takes, blocking or gating a transaction on-chain before value moves, rather than screening it and dealing with a violation afterward. We build both halves. The identity and screening data come from providers you or your counsel choose; we wire them in, enforce the rules in code, and produce the audit trail, while your compliance team keeps control of the policy.
What is the difference between KYC, KYT, AML, and the Travel Rule?
They are related but distinct obligations. KYC (know your customer, or KYB for businesses) is verifying a user's identity at onboarding, before they can transact. KYT (know your transaction) is screening a wallet or transaction against sanctions lists and risk scores, both before allowing it and on an ongoing basis. AML (anti-money-laundering) monitoring is the continuous surveillance that flags suspicious activity for review and reporting. The Travel Rule (FATF Recommendation 16, applied to virtual-asset providers through Recommendation 15) requires financial institutions to exchange originator and beneficiary information with transfers; FATF lets countries apply a lighter regime to virtual-asset transfers under USD or EUR 1,000 (the names and wallet addresses still travel but need not be verified), while the EU sets no minimum amount for transfers between crypto-asset service providers. A regulated product typically needs all four, each provided by specialist services and each integrated into the product and, where it matters, enforced on-chain. We build the integration and enforcement for all of them.
Do you provide the KYC or screening service yourselves?
No. We are the engineering partner, not a compliance vendor or a legal advisor. The identity verification and transaction-screening data come from specialist providers, such as Chainalysis, TRM, Elliptic, or Sumsub, that you or your counsel select; we integrate them into your product and build the on-chain enforcement, monitoring, and reporting around them. We also do not set the policy: which rules apply, which jurisdictions and thresholds are in scope, and what counts as acceptable risk are decisions your compliance function and counsel own. Our job is to make those decisions real in the product, to turn a screening result or an eligibility rule into an enforced on-chain control, and to give your team and your auditors a system they can trust and inspect. This keeps you in control of everything a regulator cares about while we own the engineering.
How do you enforce compliance on-chain rather than just reporting it?
By building the check into the transaction path, so a failed check stops the transaction instead of merely recording it. In practice, screening results and identity claims become inputs to the contracts and flows: a transfer to a sanctioned wallet is blocked, an unverified user cannot execute a gated action, and an ineligible investor cannot receive a permissioned token. For token-level eligibility we use the ERC-3643 standard, where the token itself refuses a non-compliant transfer; for product-level flows we build the gating into the application and its contracts. The engineering care is in the edge cases, a check that is slow or unavailable, a status that changes mid-transaction, so the control fails safe rather than open. It is the same discipline we brought to the DEX core we built for Swarm Markets, a venue that launched under BaFin licenses.
Can you help us meet MiCA and Travel Rule requirements?
We can build the engineering side of it. MiCA brings crypto-asset service providers under a licensing regime with real compliance obligations, and the Travel Rule requires exchanging originator and beneficiary data on transfers, with no minimum amount in the EU, which is a build requirement. We integrate the screening, identity, and Travel Rule providers, build the on-chain enforcement and the audit trail, and wire in the monitoring and reporting an auditor expects, so the compliance obligations are met in the product rather than in a manual process beside it. What we do not do is provide the legal interpretation or the license itself, that is for your counsel and your compliance function. We work to their requirements and turn them into a system that enforces and evidences compliance, which is exactly the part that is engineering. Which Travel Rule network or vendor fits, from TRUST and Notabene to an in-house build on an open protocol, is compared in our EU Travel Rule guide.
Discussed on The Protocol Roundtable
All episodesGet a proposal
Tell us what you are building. An engineer reads it, we have a short call, and the written proposal follows within one business day.
Budget
I accept the
Privacy PolicyI agree to receive new research announcements as well as information about Protofire services and special offers
An NDA is available from the first message and can cover anything you share. How it works