How can crypto AML candidates show case notes without exposing client or exchange data?

Yes, crypto AML candidates can build public proof without exposing client or exchange data, but the sample should be simulated, anonymized, or based on public-chain examples — not copied from real internal investigations. A practice case note works best when it shows how the candidate thinks through wallet risk, transaction monitoring alerts, sanctions exposure, suspicious flow patterns, escalation logic, and documentation discipline.

The main point is that hiring teams are not only checking whether someone knows AML terminology. They are checking whether the candidate can write a clear investigation note that separates facts, assumptions, risk indicators, missing information, and recommended next steps.

For me, the safest format would be a mock wallet risk investigation note or fictional suspicious transaction monitoring case study where the candidate shows public-chain observation, source-of-funds reasoning, red-flag classification, sanctions-screening logic, and why the case should be closed, monitored, or escalated.

The sample should avoid customer identity, real exchange names, internal alert IDs, private wallet labels, screenshots from compliance tools, client data, or anything that looks taken from live work.

This kind of proof may be more useful for Web3 compliance candidates than listing certifications alone, because it shows judgment, confidentiality awareness, and practical AML case-documentation skills.

Curious how others would approach this — should candidates use fully fictional cases, public-chain examples, or anonymized investigation patterns from past work?

From the hiring side, I would probably look at the structure of the note more than the “case” itself.

A sample like this should make it easy to see whether the candidate can separate observed blockchain activity, risk interpretation, missing context, and final recommendation. Many candidates write very confidently, but the real skill is knowing where the evidence ends and where the assumption begins.

For example, a good mock blockchain forensics investigation report could say: this wallet interacted with a mixer, this wallet received funds from a high-risk cluster, this transaction pattern looks unusual for normal retail activity, but attribution is not confirmed without more exchange-side or KYC context. That kind of writing shows maturity.

I would also prefer candidates to include a small “data hygiene note” at the top of the sample, saying that the case is fictional, public-chain based, or fully anonymized and does not include customer identity, exchange data, client screenshots, private labels, or real internal alert information.

That one line itself becomes a hiring signal because confidentiality awareness is part of crypto AML analyst work, not an extra skill.

Maybe the best portfolio format is not “look at this real case I handled,” but “look at how I document wallet risk, transaction monitoring alert review, sanctions exposure screening, suspicious flow analysis, escalation reasoning, and compliance case closure without exposing sensitive data.”

One thing I feel candidates miss here is that the sample does not have to look like a real employer case file.

In fact, it probably should not.

For crypto AML candidates, the safer route is to show a small public-chain case note where everything is either simulated, anonymised, or based on open wallet activity. That is enough to show how crypto AML candidates can show case notes without exposing client data, because the recruiter is not trying to verify the exact client. They are trying to see how you think.

For example, take one public wallet flow and write:

What triggered the review?

What did you observe on-chain?

Which part is a fact?

Which part is only an assumption?

What extra information would you ask from KYC / customer records / internal alerts?

Would you close, monitor, escalate, or request more information?

A portfolio piece is much stronger than saying “I worked on transaction monitoring” with no proof.

This is also where many entry-level AML analyst candidates get rejected despite KYC transaction monitoring projects. They list tools and certifications, but the portfolio does not show whether they can separate suspicious behaviour from confirmed wrongdoing.

A good blockchain investigation sample should not sound like “this wallet is criminal.”

It should sound more like:

“This wallet shows exposure to high-risk counterparties, but ownership and intent are not confirmed. Based on the pattern, I would escalate/request more information/continue monitoring.”

That small difference shows judgment, and judgment is what Web3 compliance teams are really trying to hire for.