Skip to main content

Goldsky

VASP and counterparty due diligence data

Talk to our team

What is VASP and counterparty due diligence?

VASP and counterparty due diligence is profiling a virtual asset service provider (VASP), token issuer or other counterparty by what its wallets have done onchain, before you take it on and for as long as you work with it.

Banks, custodians and exchanges run it on the firms they send money to or hold assets for, because a counterparty’s exposure to sanctioned or high-risk wallets becomes theirs once funds move between them.

Goldsky loads the history of the counterparty’s wallets, keeps your risk provider’s verdict with the call that produced it and watches the wallets afterwards; verifying the firm, rating the risk and deciding whether to onboard it stay with your providers and your compliance team.

Who runs VASP and counterparty due diligence?

Global and custodian banks, crypto exchanges, stablecoin payment companies and the transaction monitoring vendors that serve them.

How VASP and counterparty due diligence works

The diagram follows one counterparty from its application, through verification, history and scoring, to the ongoing review of its wallets after your team decides. Your setup may differ.

Your business, step 1: Counterparty appliesA VASP or issuer applies, listing its wallets
Your business, step 2: KYC/KYB providerVerify the firmKYB confirms who owns and runs it
Your business, step 4: Screening providerScore the exposureRisk ratings for the wallets it dealt with
Goldsky, step 3: TurboLoad its historyPast activity of its wallets, chain by chain
Your business, step 6: Decide on onboardingYour compliance team approves or declines
Goldsky, step 5: ComposeRecord the verdictA task fetches the score and keeps it
Your business, step 8: Review on changeFlagged activity reopens the file
Goldsky, step 7: TurboKeep watchingIts wallets stay on your live list
  • Goldsky
  • Your provider

How to run VASP and counterparty due diligence

A one-time pipeline loads the history of the counterparty’s wallets into your database, and a task Goldsky hosts calls your risk provider about the wallets it dealt with and keeps the answer. Once your team approves the firm, its wallets go on a live watch list.

What you’ll need

  • Goldsky Turbo
  • Goldsky Compose
  • A business verification (KYB) provider
  • A blockchain risk provider that rates wallets
  • A database for the wallet history, the watch list and matches
  • A case management or compliance system where your team decides

  1. Take the counterparty’s application and wallet list

    Due diligence starts from the firm and the wallets it says it controls.

    The counterparty states who it is, what it does and which addresses it uses on which chains. Wallets it doesn’t declare fall outside the review, so ask for every address it sends from, receives on or holds client assets in.

  2. Verify who owns and runs the firm

    You need to know the legal entity and the people behind it before its wallets mean anything.

    Your business verification provider confirms the company, its owners and its licenses under your policy. A firm whose ownership can’t be confirmed shouldn’t reach the onchain review at all.

  3. Load the history of its wallets

    Handled by Goldsky Turbo

    A counterparty’s past activity shows who it has dealt with, which is what your risk review looks at.

    Every transfer in and out of each declared wallet, on every chain it uses, has to land in one place your team can query, which is also where a bank checks that a crypto client holds the assets it claims. A history cut off at a recent date can hide the dealings that matter most.

    With Goldsky, a Turbo Pipelines job filters a chain’s transfers to the counterparty’s addresses from the earliest block, writes them to your database and exits when it reaches the block you set.

    Run a one-time backfill job (opens in a new tab)

  4. Score the exposure of the wallets it dealt with

    The history shows which wallets the firm traded with; a risk provider knows which of those are sanctioned, stolen-funds or high-risk.

    Your risk provider rates the counterparty’s wallets and the wallets they transacted with. Its rating depends on its own attribution, so keep the date and version of each answer with it.

  5. Record the risk verdict with its inputs

    Handled by Goldsky Compose

    Your onboarding decision has to show what the provider said, when and about which wallets.

    Each request to the provider and its answer are kept together, and a failed call is retried without asking twice for an answer you already have. A score copied by hand into a case note loses the question that produced it.

    A Compose task calls your risk provider with ctx.fetch, which records the URL and response of every call on the task run and retries by the rules you set. The task can then store the verdict in a collection.

    Make auditable calls with fetch (opens in a new tab)

  6. Decide whether to onboard the counterparty

    A person accountable for the relationship approves it or declines it, on the record.

    Your compliance team reviews the verification, the history and the risk verdict, and sets any limits or conditions. If the decision isn’t written down with its reasons, you can’t show later why the firm was accepted.

  7. Keep watching its wallets

    Handled by Goldsky Turbo

    A counterparty that was clean at onboarding can deal with a risky wallet the following week.

    The approved wallets go on a list that is checked against every new transfer, and the list changes as the firm adds or retires addresses. A list that only updates on a release leaves new wallets unwatched until then.

    Goldsky’s Turbo Pipelines keeps the list in a dynamic table, which lives in a Postgres database you can run yourself. A SQL filter with dynamic_table_check() catches transfers where the firm’s wallets are sender or recipient, and an inserted address is picked up without a redeploy.

    Watch addresses with dynamic tables (opens in a new tab)

  8. Reopen the file when activity changes

    Ongoing due diligence means the relationship is reviewed again when something new turns up.

    Your rules decide which transfers reopen the review, such as a new counterparty your provider rates high-risk or volumes far above what the firm declared. Rules that look at volume over a period run in your database, because they depend on many transfers together.

What you control

Your team
  • Take the counterparty’s application and wallet list
  • Decide whether to onboard the counterparty
  • Reopen the file when activity changes
Your providers
  • KYC/KYB provider
  • Screening provider

Security and deployment

  • SOC 2 Type IIIndependently audited security controls.
  • Dedicated infrastructureSingle-tenant options for production workloads.
  • Data residencyCloud, on-premises or co-located.

More use cases that monitor transactions

Run VASP and counterparty due diligence with Goldsky

We’ll map it to your systems and show you what Goldsky runs, so your team builds the product, not the pipelines underneath it.

Talk to our team

© Endless Sky Inc. All rights reserved.

PrivacyTermsSecurity

System status