How to Read a Crypto Source-of-Wealth Report

A crypto source-of-wealth report should let a compliance officer answer one question without going back to the client: is it plausible that this person built this wealth in this way, and does the evidence support it? Reading one well means testing each section against that question, not counting pages or admiring Chainalysis graphs.

This guide is written for the person on the receiving side: the compliance officer, MLRO or onboarding analyst at a bank, an asset manager or another institution who receives a source-of-wealth (SOW) report on a client with crypto-origin wealth. It walks through the report section by section, shows what a strong answer looks like in each one, and lists the signals of a weak report.

What a Source-of-Wealth Report Should Tell You

A source-of-wealth report explains how the client accumulated their overall net worth and gives you the evidence to judge whether that explanation is plausible. SOW is the economic, business or commercial activities that generated the customer's net worth. In Switzerland, the FINMA Anti-Money Laundering Ordinance (AMLO-FINMA, Article 15) lists the origin of the client's assets and wealth among the additional clarifications required for higher-risk relationships, alongside checks such as politically exposed person status. Crypto-origin wealth often falls into this category.

Keep SOW and source of funds (SOF) apart while you read. In crypto, SOF looks upstream: it covers the money behind the initial purchases, meaning where the fiat that first went into crypto came from. SOW covers what happened next: how those purchases became the current holdings through holding, appreciation and conversions, evidenced by exchange records and on-chain tracing. A complete crypto report covers both, in separate sections. If you need a refresher, see our explainer on the difference between source of wealth and source of funds.

Reading the Report Section by Section

Most crypto KYC/AML reports follow a similar sequence, even when the headings differ. Read them in order: each section relies on the one before it.

1. Scope, author and mandate

• Who prepared the report, under which regulatory status, and for whom
• Which wallets, exchanges and time period are covered, and which are excluded
• The date of the analysis: on-chain screening results age quickly
• Whether the author stands behind the findings or disclaims all responsibility

A report that does not list the addresses analysed cannot be checked, however detailed the rest may be.

2. Client profile and net worth estimate

The KYC/AML report should include an estimate of net worth and, at a minimum, the main contributors to the majority of the wealth. Look for the split between crypto and other assets, the current holdings at a stated valuation date, and the associated price.

3. Wealth narrative and timeline

This is the core of the report. A strong narrative is a dated chronology: the income that funded the first purchases, the acquisitions, the events that created most of the gains (long-term holding, mining, DeFi activity, an ICO allocation, trading), any conversions, and the position today. Check that the amounts reconcile from one step to the next. Gaps are not uncommon, but significant gaps or material inconsistencies undermine plausibility. A good report names its gaps and mitigates the risk in between gaps.

4. Proof of wallet ownership

Every address attributed to the client should come with proof of control, typically a satoshi test (a small transfer from the address) or a signed message. Past wallets matter as much as current ones, because they carry the history. Without this section, the analysis may be describing someone else's coins. Under Swiss financial regulations, proof of control (or ownership verification) is a mandatory Anti-Money Laundering (AML) requirement established by the Swiss Financial Market Supervisory Authority (FINMA). Whenever a customer transfers virtual assets between a FINMA-supervised Virtual Asset Service Provider (VASP) and an external, unhosted (self-custodied) wallet, the VASP must verify that the client controls that external wallet.

5. On-chain analysis, flow of funds and risk exposure

Blockchain analytics tools such as Chainalysis, Scorechain, Elliptic or TRM Labs measure exposure to risk categories: sanctioned addresses, mixers, darknet markets, high-risk exchanges. Read the direct and indirect exposure, the number of hops, the share of value concerned and, above all, the analyst's explanation for each alert. A score is an input, not a conclusion. Our article on what a blockchain forensics report contains covers the tools in more detail.

Chainalysis Reactor is used during Enhanced Due Diligence (EDD) to verify a prospective client's Source of Funds (SoF) and Source of Wealth (SoW) when their capital comes from cryptocurrency. Compliance analysts use its visual graph interface to trace crypto assets backward from the client's current wallet to their original fiat on-ramp or legitimate earning event, ensuring no exposure to sanctioned entities or illicit activity.

6. Exchange records and fiat entry points

Look for account statements, trade histories or read-only API exports from each exchange, and the bank transfers that funded the first purchases. When looking at fiat transfers to exchanges there should be supporting corroboration regarding the source of funds of the fiat amount sent to the exchange to purchase cryptocurrencies such as: salary statements, inheritance documentation, business income or other sources of funds.

When a platform has closed, the report should state how its activity was reconstructed, as described in our guide to proving funds from an exchange that no longer exists. This is typically done through a combination of supporting elements such as: emails confirming deposits and/or with the exchange in question, charts from Chainalysis Reactor showing the activity of the client associated with a wallet they performed proof of control with or sometimes the defunct exchange allows users to extract their trading history.

7. Corroborating documents

In traditional finance, corroboration is defined as information from a source independent of the customer, such as registries, banks, accountants, lawyers or notaries. For crypto, this usually means proof of income at the time of the first purchases, tax filings where relevant, mining hardware invoices and electricity bills, ICO participation records or a SAFT, exchange trading history, proof of ownership of accounts on platforms such as BitcoinTalk, each where applicable. Every document should be referenced to the step of the timeline it supports, providing the reader with evidence for each claim the KYC/AML report makes.

8. Source of funds for the initial incoming transfer

This section covers the specific amount: the wallets it leaves from, the conversion route and the account the fiat will arrive from. It should link back to the wealth narrative, so you can see that the funds being transferred are part of the wealth already explained.

9. Conclusion and residual risk

A strong conclusion states what was verified, what could not be, and the residual risk with the reasons for it. A one-line "no issues found" gives you nothing to put in your own file.

Strong Report vs Weak Report: A Side-by-Side Check

The quickest way to judge a report is to compare each section with what a strong version would contain.

Red Flags a Report Should Address, Not Hide

A report is weak when it leaves known risk indicators unanswered. The FATF report on virtual asset red flag indicators (September 2020), drawn from more than 100 case studies, groups them into six categories, including one dedicated to the source of funds or wealth. It cites funds coming directly from mixing services, links to sanctioned or fraud-related addresses, and wealth drawn disproportionately from providers that lack AML controls. The FATF also stresses that a single indicator is not proof of criminal activity.

The question is not whether a flag exists, but whether the report identifies, explains and mitigates the risk. Watch for:

• One or more wallets without proof of control
• A risk score reproduced without interpretation
• Exposure to a mixer or a sanctioned address mentioned in passing, then dropped
• Timeline gaps that are not acknowledged
• Wealth that does not match the client's earlier financial profile, with no explanation
• An author with no regulatory status and no accountability for the findings

For how these flags arise during the audit itself, see how a crypto source-of-funds audit works.

What Changes When a Regulated Intermediary Prepares the File

When the report comes from a regulated financial intermediary, that intermediary has carried out and documented its own due diligence on the client, and it stands behind its findings under its own regulatory obligations. The KYC/AML report comes in a format ready for a compliance officer to review. Your institution keeps the final responsibility for the relationship, as it always does when it relies on a third party (FATF Recommendation 17), but much of the evidence is already collected, checked and explained. That lowers both the work and the risk on your side.

alt.co is a brand of Altcoinomy SA, a Swiss financial intermediary supervised by VQF under the Swiss Anti-Money Laundering Act (AMLA). Its compliance team writes the source-of-wealth and source-of-funds narratives, investigates and explains each risk flag, and answers the follow-up questions raised by the receiving institution. Compliance intake typically takes 5 to 15 business days, depending on the complexity of the history. Our article on what compliance officers think about crypto explains why this structure matters on the bank's side.

The report never replaces your own assessment. Your institution still decides, case by case, under its own risk appetite.

Frequently Asked Questions

What is a cryptocurrency source-of-wealth report?

It is a document that explains how a client built their overall wealth when part or all of it comes from cryptocurrency assets. It combines a dated narrative, proof of wallet ownership, on-chain analysis, exchange records and independent documents, so that a compliance team can judge whether the explanation is plausible.

Is a low risk score enough to accept crypto-origin wealth?

No. A low score only says that the analysed addresses show little exposure to known risk categories. It does not prove who controls the wallets, how the wealth was built or whether the amounts are consistent with the client's profile. Those answers come from the narrative and the supporting documents.

What makes a source-of-wealth report weak?

A weak report lists data without explaining it. Typical signs are wallets without proof of control, a timeline whose amounts do not reconcile, gaps that are not acknowledged, risk alerts copied from a tool without interpretation, and a conclusion that states "no issues found" without saying what was actually verified.

Does the report replace the institution's own due diligence?

No. The report is evidence for your assessment, not a substitute for it. When it is prepared by a regulated intermediary that has already performed its own due diligence, much of the work is documented for you, but the onboarding decision remains with your institution, case by case.

Can an institution see a sample alt.co report?

Yes. Banks and other institutions that receive crypto source-of-wealth files can request a sample report from alt.co. It shows how the sections described in this guide are structured in practice and what level of evidence to expect. Requests can be made through the contact page.

Related Topics

alt.co is a Geneva-based, Swiss-regulated financial intermediary (Altcoinomy SA) supervised by VQF and audited by BDO SA. We help crypto holders access private banking in Switzerland and Monaco.

Continue Reading