Crypto Compliance on a Startup Budget: What Small CASPs Actually Need vs What Enterprise Vendors Sell

If you've ever requested a demo from a blockchain analytics vendor, you know the routine: a sales call, a scoped use case, and a quote that depends on products, chains, users, transaction volume, and support terms.

Many products were built for large exchanges, financial institutions, and law-enforcement investigation teams. A small CASP should not use unsourced average contract values as its budget baseline. Use public vendor prices where they exist, and treat every other number as either a signed quote or a clearly labelled planning assumption.

This article separates three things: what MiCA and EBA GL/2024/15 actually require, what vendors publicly price, and which budget figures remain assumptions until a vendor or regulator confirms them.

---

What do compliance vendors publicly price?

Start with the numbers you can defend. As of July 10, 2026, the official public pricing picture is limited:

Chainalysis, TRM, Elliptic, Crystal, and Scorechain may still be appropriate vendors. The point is narrower: if the vendor does not publish a price, do not put a third-party average into a board budget as fact. Use a signed quote, or mark the number as an assumption.

---

What do MiCA and EBA GL/2024/15 actually require?

Before deciding what to buy, you need to know exactly what regulators require. The rules are specific — and they specify outcomes, not vendors.

Sanctions screening: the non-negotiables

Under EBA GL/2024/15 (final guidelines on internal policies and controls for implementing restrictive measures), CASPs must screen customers and transfers against applicable restrictive measures. For an EU CASP, that means:

• EU restrictive measures — the EU Consolidated Financial Sanctions List is the baseline for EU-regulated entities
• National restrictive measures — any sanctions or measures applicable in the CASP's home Member State
• UN, OFAC, UK OFSI and other third-country lists — not universal EBA mandates, but often necessary where the CASP has the relevant legal nexus, counterparty exposure, currency exposure, correspondent relationship, or national-supervisor expectation

EBA GL/2024/15 requires regular customer-base screening, risk-based trigger events, and screening of crypto-asset transfers before making crypto-assets available to the beneficiary. The system must retain usable evidence: what data was screened, which restrictive measures dataset was used, when screening happened, the result, and the action taken.

Transaction monitoring

You must monitor crypto-asset transfers for restrictive-measures exposure and circumvention risk. EBA GL/2024/15 says CASPs should consider blockchain analysis for transaction monitoring where appropriate based on the volume and number of transfers. That is a risk-based technology decision, not a mandate to buy a named investigation platform.

KYC / customer due diligence

Identity verification at onboarding (government ID + liveness check), ongoing monitoring for changes in risk profile, and enhanced due diligence for high-risk customers. This is a separate function from sanctions screening — you need both, but they can be handled by different tools.

---

What do enterprise vendors sell on top of what’s required?

Here's what you may be paying for when you buy a full enterprise blockchain analytics suite — capabilities that can be valuable, but are separate from the baseline control question:

• Deep blockchain investigation tools — multi-hop tracing, network graph visualization, address clustering. Useful for fraud investigation teams at large exchanges. Overkill for a small CASP's compliance workflow.
• Proprietary intelligence databases — labeled addresses, entity databases built from years of on-chain data collection. These are genuinely valuable for sophisticated threat hunting. Not required by MiCA.
• Analyst workbench environments — multi-analyst collaborative investigation platforms with case management. You need one compliance officer, not an investigation department.
• Dark web monitoring and threat intelligence feeds — emerging risk alerts from illicit markets. Relevant for law enforcement partners and large exchange security teams.
• Custom API integrations at enterprise scale — useful when your measured throughput, latency, and workflow requirements justify them. Do not buy capacity against a generic enterprise default.

EBA GL/2024/15 requires an effective, tested screening framework and appropriate controls for circumvention risk. It does not prescribe a commercial investigation workbench. If you run a large exchange or custody platform, those features may be justified by risk and volume. If you are a narrow-scope CASP, prove the need before buying them.

---

What can you budget from public prices?

Here is the narrow version you can defend from official vendor pages. The on-chain line is a planning assumption until you have either an internal build estimate or a signed vendor quote.

This is not a market average. It is a budget envelope made from two public vendor minimums plus a labelled assumption for on-chain screening. If your CASP needs high-volume API monitoring, multi-chain investigations, travel-rule tooling, or outsourced alert handling, get quotes and replace the assumption.

---

What must you pay for with no shortcuts?

Budget optimization doesn't mean cutting corners on the things that actually matter. These are the items where trying to save money creates real regulatory and legal risk:

The MLRO

Budget for a named AML/CFT compliance officer function with enough authority, time, tools, and access to management. EBA's AML/CFT compliance officer guidelines allow proportionality, but they do not let a firm outsource away ultimate responsibility. Treat salary or retainer figures as local hiring assumptions unless you have a signed employment offer or service agreement.

Applicable sanctions coverage

EBA GL/2024/15 is explicit about applicable Union and national restrictive measures. Do not overstate that into a universal EU mandate to screen OFAC and UK OFSI for every CASP. Do document why each list is in or out of scope. For a Cyprus CASP, CySEC thematic work and circulars can make UN, U.S., and UK coverage a practical supervisory expectation even where the legal basis is not the same as EU restrictive measures.

Complete audit trails

Every screen must be logged: what data was screened, against which dataset or list version, when, what the result was, and what action was taken. "We screened but the logs weren't retained" is weak evidence. MiCA Article 68 record-keeping and EBA GL/2024/15 both push toward durable, retrievable records that a supervisor can inspect.

External AML audit

Do not rely on vendor dashboards as your only assurance. Budget for periodic independent or internal control testing of your AML/CFT and restrictive-measures framework. Exact audit fees are jurisdiction- and scope-specific; use a signed proposal, not a generic market average.

CASP authorization itself

Before any of this, you need authorization or a valid notification route. MiCA Article 67 and Annex IV require prudential safeguards of at least the higher of one quarter of fixed overheads or EUR 50,000, EUR 125,000, or EUR 150,000 depending on the services. That is capital, not a software cost. In Cyprus, CySEC PS-03-2024 sets CASP application fees by service: EUR 5,000 for exchange and transfer services, EUR 8,000 for execution/placing/reception/advice/portfolio services, EUR 10,000 for custody, and EUR 30,000 for operating a trading platform, with cumulative fees where several services coexist. Annual fixed supervision fees under the same schedule are EUR 5,000, EUR 8,000, EUR 10,000, or EUR 20,000 by service type, plus a variable turnover surcharge above EUR 500,000 in crypto-asset-services revenue, capped at EUR 500,000.

---

What can you skip entirely?

Just as important as knowing what you must have is knowing what you don't need — especially when vendors will try to sell you everything:

• Blockchain investigation workbenches — multi-hop address tracing and network graph tools. Useful for fraud and source-of-funds investigations, but not a named MiCA requirement for every CASP.
• Real-time threat intelligence feeds — emerging dark web market wallets and ransomware address databases. Valuable for high-risk business models; justify them from the risk assessment.
• Enterprise API quotas — buy capacity against measured transfer volume and latency requirements, not against an enterprise default.
• Dedicated account management and SLAs — you're paying for an enterprise relationship. A small team can operate with self-serve tooling and standard support.
• Proprietary entity databases — Chainalysis and TRM Labs have spent years building labeled address databases from law enforcement partners and proprietary data. These are genuinely powerful for investigations. They're not what MiCA requires from you.

---

The bottom line

The crypto AML vendor market is split between public self-serve pricing, quote-based compliance platforms, and enterprise investigation suites. A small CASP should budget each line according to source quality: official price, regulator fee schedule, signed quote, or labelled assumption.

What you actually need is customer due diligence, screening against applicable restrictive measures, pre-transfer controls for crypto-asset transfers, alert handling, record retention, and evidence that the system is adequate for your size, nature, complexity, and exposure. The public-priced parts of that stack can be under $5,000/yr before usage, on-chain tooling, engineering, and audit work. The rest needs quotes or explicit assumptions.

The non-negotiables — AML/CFT responsibility, legal/regulatory work, control testing, authorization, capital, and evidence retention — are where your compliance budget actually goes. Tools are only defensible when their coverage, limitations, testing, and records are documented.

Frequently asked questions

What is the minimum AML software cost for a MiCA-compliant CASP?

There is no universal minimum software cost in MiCA. Public prices that can be used as inputs include ComplyAdvantage Starter from $99/month and Sumsub Compliance from a $299/month minimum plus $1.85 per verification. Crypto wallet and transfer monitoring must be priced from a signed quote, an internal build estimate, or a clearly labelled assumption.

Should a small CASP buy Chainalysis Reactor for baseline compliance?

Not solely for baseline list screening. Chainalysis describes Reactor as an investigations product that works with KYT to escalate risk-based alerts into full investigations. If you need investigation capability, evaluate it. If you need baseline restrictive-measures screening and audit evidence, price that specific scope first.

What AML tools do small CASPs actually need under MiCA?

A small CASP needs identity verification and customer due diligence, customer and beneficial-owner screening, pre-transfer screening of crypto-asset transfers against applicable restrictive measures, documented alert handling, and records that can be produced to the supervisor. OFAC, UK OFSI, and UN screening may be necessary, but the basis should be legal nexus, national-supervisor expectation, or documented risk assessment — not a blanket statement that EBA mandates all three for every EU CASP.

What is the difference between affordable AML software and enterprise AML software for crypto?

Affordable tools usually focus on a narrow control: identity verification, customer screening, wallet checks, alert logs, or reporting. Enterprise platforms add investigation workbenches, proprietary intelligence, analyst collaboration, high-volume APIs, and premium support. The right choice depends on service type, transfer volume, chain coverage, custody risk, and how much investigation work your team actually performs.

Can regulators require a CASP to use specific AML software vendors?

No specific commercial vendor is mandated. Regulators assess whether the system is adequate: applicable restrictive measures coverage, required data fields, timing before release of crypto-assets, testing, calibration, outsourcing controls, alert handling, and records. A cheap tool with weak evidence fails; an expensive tool with poor configuration can fail too.