Nia Labs

Module 3 of 4Risk Management

Meridian moves from a proposal to a live exposure. Your team learns to read the chain, screen it, control it, and decide what to do with a transfer nobody can explain.

Download the brochure Try the explorer taster
  • 3 sessions
  • About 5.5 hours
  • Intermediate
  • Online or in person

Outcomes

By the end of the module, you can

  1. Answer five questions about any on-chain activity: what can I see, what might it mean, what risks apply, what should I ask, and when do I escalate?
  2. Classify signals as transaction anomalies, exposure risks or suspicious behaviour.
  3. Apply allowlists, denylists and sanctions screening with on-chain analytics.
  4. Assess a custodian or crypto service provider as a third-party risk.
  5. Build a risk register that Risk, Compliance and Audit can all use.
  6. Make and defend an Allow, Monitor or Deny decision on incomplete information.

Sessions

Two sessions to build it. One lab to use it.

Session 1120 minutes, virtual-live

Blockchain visibility

One wallet, followed all session on a simulated explorer.

  1. Explorers and on-chain data, live
  2. Risk categories: transactions, exposure, behaviour
  3. Operational and interface risk: wallets, custody, access
  4. Smart contract vulnerabilities, without code
  5. Guided practice on the mock explorer
  6. Commitments and preview
Session 2120 minutes, virtual-live

Controls and sanctions

Monitoring frameworks, sanctions enforcement on-chain, and provider risk.

  1. Token allowlists and denylists
  2. Sanctions compliance on-chain: OFAC and analytics tools
  3. Assessing crypto service providers
  4. Structured risk assessment approaches
  5. Building the risk register
  6. Commitments and lab preview
Session 390 minutes, virtual lab

Application lab: the 2:47am transfer

Thirty days of simulated activity, a sanctions advisory and a custodian file. Teams decide, then defend.

  1. Briefing and team set-up
  2. Phase 1: identify risk signals
  3. Phase 2: allow, monitor or deny
  4. Phase 3: sanctions and provider check
  5. Phase 4: make and defend a decision
  6. Debrief and programme close

Lab spotlight

The 2:47am transfer

A large outflow leaves Meridian's wallet at 2:47am on a Sunday, to an address that is not sanctioned, not verified and never seen before. The client has not answered the request for information. Around it sit thirty days of activity with signals that are obvious, subtle and ambiguous.

  • Allow
  • Monitor
  • Deny

What teams do

  • Log risk signals from a simulated explorer: layering, unhosted wallets, unverified contracts, fee spikes.
  • Apply a control decision to each flagged transaction, with a rationale and an owner.
  • Cross-check a sanctions advisory naming two wallets under review.
  • Find the top two gaps in the custodian's due diligence summary.
  • Write a one-paragraph escalation note, then defend it under challenge.
The simulated explorer: a month of wallet transactions with some flagged by the participant
Flagging transactions on the simulated explorer in the public taster. The full lab adds sanctions advisories, the custodian file and the ambiguous transfer.

Four roles per team

  • Risk LeadOwns the risk signal log and the escalation recommendation.
  • Compliance LeadApplies the sanctions and AML lens.
  • Audit ObserverChallenges evidence quality and documents control gaps.
  • Decision OwnerSynthesises the team view and presents the decision.

What the debrief draws out

  • Blockchain risk is not binary.
  • Risk, Compliance and Audit see the same data differently, and that tension is useful.
  • Controls only work if someone owns them.
  • Escalation is a skill.

Who it is for

A cross-functional room, on purpose.

No coding background needed. The module works best with Risk, Compliance, Audit and Technology in the same breakout.

Financial crime, AML and sanctions

Teams screening crypto-linked clients and counterparties.

Operational and third-party risk

Owners of custodian and crypto service provider relationships.

Internal audit and relationship managers

Colleagues who must evidence controls or explain a client's activity.

Run this module alone, or as part of the programme.

The brochure covers all four modules, the labs, the three formats and the facilitator.

Download the brochure Enquire about this module