TRM Labs sees the on-chain risk, Forest runs the decision around it

A neobank decides to let its customers hold and move stablecoins. The product is a few weeks of work. The compliance question is the whole game. Every incoming transfer now arrives from a wallet that may be one hop from a sanctioned mixer, a ransomware address, or a darknet market, and the team has no way to see it. A bank transfer carries a name and an IBAN. A crypto transfer carries an address, and an address says nothing until someone maps it to the entity behind it.

That mapping is a discipline of its own, and not one a fintech builds in-house. It’s what TRM Labs does.

What TRM Labs does: blockchain intelligence across 184+ chains

TRM Labs is a blockchain intelligence platform. It maps crypto addresses tied to illicit activity (sanctions, ransomware, fraud, scams) and attributes wallets to the real entities behind them across 184+ blockchains.

Three things sit at the core:

• Wallet screening: a point-in-time risk check on an address, with API results returned in under 400 milliseconds.

• Transaction monitoring: ongoing alerts when a wallet’s risk profile shifts over time.

• Forensics: an investigation surface to trace fund flows across chains, now with AI agents built for investigators.

When OFAC sanctions a wallet, TRM’s attribution picks it up and flags the customers exposed to it.

For a regulated business, this is the price of entry. In Europe, MiCA is in force today, and blockchain intelligence has become standard practice for anyone holding a crypto license: crypto-native players, payment processors adding crypto rails, neobanks distributing wallets, traditional banks stepping on-chain.

Where TRM’s job ends, and the operations start

TRM draws this distinction itself, and it’s the reason the partnership makes sense. In TRM’s own framing, the unit of value is the API: TRM returns structured risk context, and the caller decides what to do with it. TRM deliberately doesn’t build the workflow surface: no alert triage for ops teams, no orchestration across other compliance tools, no case management tying it all together.

That’s not a gap in TRM’s product. It’s a choice about where their job ends. A risk score on a wallet is an input. Someone still has to route the alert, decide whether to hold the transfer, pull in the fiat context on the same customer, escalate to an investigator, and document why the call was made, in a form a regulator will accept months later. That layer, between the intelligence and the resolution, is where crypto compliance lives or dies.

How a TRM wallet screening runs inside a Forest workflow

That layer is Forest. In Forest Workflows, a TRM screening call is a step like any other: a transfer comes in, the workflow calls TRM, gets the risk context back, and applies the rules your compliance team defined. Below a risk threshold, the transfer clears. Above it, the funds are held and a case opens with the on-chain exposure already attached, routed to the right reviewer. If it needs deeper work, the reviewer deep-links into TRM’s forensics. If it can be resolved, it’s resolved in Forest, and the decision is logged at the record level.

One case for crypto and fiat risk, one audit trail

The point that matters for a MiCA-regulated business: the same case carries both the crypto signal from TRM and the fiat signal from the rest of your stack. It’s held, cleared, escalated, and documented in one workspace rather than two disconnected systems. A regulator doesn’t want to hear that crypto risk lived in one tool and fiat risk in another. They want one auditable view of who was flagged, who reviewed it, and why. Forest produces that trail as the workflow runs.

This also holds when an AI agent handles part of the triage. Forest runs it under the same permission model and audit log as a human analyst: a role, defined rights, a trace on every action. An automated wallet-screening decision is as reviewable as a manual one.

That’s the direction Forest is heading, and one we already deploy with clients through partners like TRM Labs: best-in-class on-chain intelligence, run inside workflows a compliance team controls, with the proof built in. The two teams are working together on this model.

On-chain intelligence is only worth the decision it drives

TRM solved a hard half of the problem: seeing, in real time, what an address is and what it’s been near. But seeing the risk and acting on it under MiCA are different jobs. A risk score that lands in an unmonitored queue, or a hold with no documented rationale, doesn’t make a crypto license defensible. It just moves the exposure somewhere quieter. The faster and richer the intelligence, the more the decision around it becomes the real subject.

That’s Forest’s job: turning a stream of on-chain risk signals into decisions made by the right people or AI agents, under the right rules, across both crypto and fiat, with what it takes to prove it. TRM says what the wallet is. Your team decides who acts and how, and Forest keeps the record.

If you’re adding crypto rails and the compliance question is bigger than the product question, that’s precisely the conversation we have every day. Come show us the flow you’re trying to stand up.