Crypto compliance operates on partial information, contested attribution, and adversarial naming. Three failure modes compound in practice.
No canonical source controls who owns an address. Multiple analytics firms disagree. Exchange KYC names conflict with on-chain labels. The question isn’t which attribution has the highest score — it’s which attribution’s evidence disqualifies the others.
"Morozov_A", "А. Морозов", "alexm1992". Possibly the same entity across two scripts and a pseudonym. Traditional string matching returns zero cross-script candidates. Translation at index time introduces ambiguity rather than resolving it.
A transaction-monitoring system flags an address. The alert contains a score and a verdict. No source, no passage, no evidence. The analyst cannot assess the flag. The customer cannot dispute it. The regulator cannot audit it.
Latin, Cyrillic, Arabic, CJK and more — original-script storage, transliteration, nickname, and spelling-variant tolerance. Resolve "Morozov_A", "А. Морозов", and "Alexei Morozov" as candidates for the same entity — with confidence and coherence reported independently, without normalising at index time.
When analytics firms disagree on a wallet’s owner, Kloom holds the disagreement as structured uncertainty rather than forcing a verdict. Confidence (numeric) reports how strongly the evidence supports the merge; coherence (qualitative: certain / likely / possible / unlikely / excluded) reports the resulting epistemic state; blocking_evidence carries the specific conflicts when a merge is contested. Three signals, not one collapsed verdict.
Register a standing query against a counterparty cluster at onboarding. When the underlying graph evolves — new sanctions designations, new adverse-media mentions, new attribution signals — the query re-evaluates automatically and fires into your monitoring pipeline.
Every flagged transaction comes with the citable mentions that produced the flag — source, passage, confidence, and the per-component scores. An analyst can assess it. A customer can dispute it. A regulator can audit it.
A standing query registered at onboarding re-evaluates automatically as the underlying graph evolves — new sanctions designations, new adverse-media mentions, new attribution signals from analytics providers.
When a transaction fires against a cluster that has crossed the confidence threshold, the alert carries the full evidence payload. Not just a score — the sources, passages, and per-component breakdown an analyst needs to act.
"A flagged transaction comes with the citable basis for the flag — not a score the analyst has to trust blindly."
Wallet 0x7f3a…8b2c submitted during customer onboarding. Four attribution sources ingested. Cluster confidence: 0.54 · coherence: possible — below alert threshold. Standing query #CRY-8821 registered against SDN, PEP, and adverse-media corpora.
On-chain analytics firm submits updated attribution: 0x7f3a…8b2c linked to "Alexei Morozov" at 0.82 confidence. Cluster confidence updates from 0.54 to 0.71. Still below the 0.75 alert threshold.
OFAC SDN list updated. New entry: "Alexei Morozov". Cluster re-evaluated against the updated graph — confidence crosses 0.77. Alert threshold (0.75) exceeded. Standing query fires.
Inbound transaction detected from 0x7f3a…8b2c. Alert #CRY-ALT-0514 delivered to transaction monitoring pipeline. Evidence payload included: 5 attribution sources, OFAC citation, confidence 0.77, coherence: likely, blocking_evidence: OFAC SDN #SDN-03421.
Crypto compliance operates under the same regulatory pressure as traditional finance — and the evidence standard is the same. Kloom is built so every output in the system is citable, and every decision is reproducible.
Every alert ships with the citable mentions that produced it — source, passage, confidence, and per-component scores. An analyst can assess it. A customer can dispute it. A regulator can audit it.
When attribution is contested, the cluster state holds the disagreement as structured uncertainty. Confidence and coherence reported as two independent signals — not collapsed to a binary verdict that destroys the signal.
Kloom runs inside your perimeter. The PKG ships as a single binary you operate; Name Intelligence additionally ships as a standalone library for teams that want screening without the graph above it. Either way, wallet addresses, KYC data, and attribution signals never leave your trust boundary.
Handles and names stored in the script and language in which they arrive. Cross-script matching — Cyrillic pseudonyms against Latin KYC names — is a retrieval-time concern, not an index-time normalisation that destroys the original.
Parse–retrieve–rerank pipeline for handles and names. 19 scripts, adversarial spelling, cross-script retrieval.
standalone libraryAppend-only record of every attribution and mention. Blocking evidence in the response envelope — citable per flag.
Structured uncertainty surface for automated pipelines. Agents consume coherence, certainty, and blocking evidence — not just a verdict.
Continuous reshaping as attribution signals arrive. Cluster state evolves — no destructive merges, every state reproducible.
A demo runs against a representative set of wallet addresses or counterparty data from your environment and returns attributed entities you can audit end to end.