Skip to content

Ordellum AnalyticsLaunching

Compliance monitoring

Transactions are analysed at three speeds, so obvious risks are stopped in milliseconds and complex patterns are still caught.

Each tier is tuned to the kind of pattern it looks for. Select a tier to see what it checks.

Detection tiers

Real-time — under 100 milliseconds

Fast checks that run in memory with no database query, designed for immediate response.

Sanctions match
Names or addresses on OFAC, EU or UN lists
Blacklist match
Known bad actors
Velocity anomaly
More than 50 transactions or $100K in an hour
Amount threshold
A single transfer above $10K or $50K within 24 hours
Structuring
Splitting a large amount into several smaller transfers to stay below reporting thresholds.
Layering
Moving funds through chains of wallets — fanning out, fanning in, peeling off or cycling — to obscure their origin.
Mixer interaction
Routing funds through mixing services or privacy bridges that break the visible link between sender and recipient.
Cross-chain hopping
Bridging funds rapidly across several networks to escape single-chain monitoring.
Wash trading
Trading with oneself or a coordinated group to inflate volume or prices.

Lists screened and how often they refresh

  • Source: OFAC SDN

    Refresh
    Every 2 hours
    Approximate entries
    12,000+
  • Source: EU Consolidated

    Refresh
    Daily
    Approximate entries
    8,000+
  • Source: UN Security Council

    Refresh
    Daily
    Approximate entries
    1,500+
  • Source: UK HMT

    Refresh
    Daily
    Approximate entries
    3,000+
  • Source: On-chain sources

    Refresh
    Real-time
    Approximate entries
    Variable
  1. Step 1: Exact match

    Normalised addresses and identifiers are compared directly, in about a millisecond.

  2. Step 2: Fuzzy match

    Spelling distance, phonetic similarity and known aliases catch near-matches with high confidence.

  3. Step 3: Network match

    Wallets up to two hops away and members of a known cluster are flagged for review.

A lending protocol and an NFT marketplace face different threats. Analytics carries rule sets for sixteen dApp types.

Threats monitored by dApp type

DeFi — monitored threats

Type-specific rules watch for the abuse patterns most common in DeFi applications.

  • Flash-loan abuse
  • Sandwich attacks
  • Oracle manipulation
Alert lifecycle
  1. Stage 1: Created

    A rule or score threshold raises an alert.

  2. Stage 2: Auto-triage

    The alert is prioritised as low, manual or urgent review.

  3. Stage 3: Investigation

    Analysts review evidence; false positives are closed or kept under observation.

  4. Stage 4: SAR preparation

    Confirmed suspicions get a draft report and evidence bundle.

  5. Stage 5: Client approval

    The regulated entity approves and files the report itself.