SoK: Web3 RegTech for Cryptocurrency VASP AML/CFT Compliance

TL;DR

This paper systematically reviews Web3 RegTech solutions for cryptocurrency AML/CFT compliance, highlighting their capabilities, gaps, and future research directions in leveraging blockchain properties for compliance.

Contribution

It develops three taxonomies to organize Web3 RegTech, analyzes 69 platforms, and identifies key capabilities, challenges, and research gaps in decentralized compliance technologies.

Findings

Web3 RegTech enables transaction graph analysis and real-time risk assessment.

Significant gaps exist between academic prototypes and industry deployment.

Challenges include cross-chain tracking, privacy, and scalability.

Abstract

The decentralized architecture of Web3 technologies creates fundamental challenges for Anti-Money Laundering and Counter-Financing of Terrorism compliance. Traditional regulatory technology solutions designed for centralized financial systems prove inadequate for blockchain's transparent yet pseudonymous networks. This systematization examines how blockchain-native RegTech solutions leverage distributed ledger properties to enable novel compliance capabilities. We develop three taxonomies organizing the Web3 RegTech domain: a regulatory paradigm evolution framework across ten dimensions, a compliance protocol taxonomy encompassing five verification layers, and a RegTech lifecycle framework spanning preventive, real-time, and investigative phases. Through analysis of 41 operational commercial platforms and 28 academic prototypes selected from systematic literature review (2015-2025), we demonstrate that Web3 RegTech enables transaction graph analysis, real-time risk assessment, cross-chain analytics, and privacy-preserving verification approaches that are difficult to achieve or less commonly deployed in traditional centralized systems. Our analysis reveals critical gaps between academic innovation and industry deployment, alongside persistent challenges in cross-chain tracking, DeFi interaction analysis, privacy protocol monitoring, and scalability. We synthesize architectural best practices and identify research directions addressing these gaps while respecting Web3's core principles of decentralization, transparency, and user sovereignty.