Onchain investigation tooling bills along four dimensions: per check, per watched address, per monthly tier, and per enterprise contract. The monthly-price version of the question has a short answer elsewhere. This piece is about how the category actually bills, because the dimension a team buys on, not the sticker it sees, is what decides the real annual spend. Two programs of the same headcount can land far apart on the same list prices, purely on case mix.
The Four Billing Dimensions
Per-check billing is the pay-as-you-go model. You buy screening credits in packages and use them one check at a time. Phalcon Compliance sells packages from 50 to 2,000 credits starting at $95, with a per-check price between $1.10 and $1.90 and credits valid for twelve months. Package purchases unlock analytics and audit report export; every supported chain is already covered on the free tier. This dimension suits intermittent demand: occasional checks, irregular casework, a program finding its volume.
Per-address billing is the monitoring model. Watched addresses are priced by tier, and you pay for scope rather than activity. Phalcon Compliance's Monitor add-on prices that scope, not activity, from $40 per month for 10 concurrent addresses to $500 for 200. Monitoring is billed in parallel to screening rather than consuming it. This dimension suits duties that never switch off: watch lists that must stay watched whether or not anything fires.
Monthly-tier billing is the subscription model, where team features live. Flat monthly plans bundle a screening volume with program features, and price rises in steps as volume and features grow. Phalcon Compliance's published ladder runs from Essential, at $39 to $469 per month for 25 to 500 screenings, up to Scale, at $699 to $4,200 per month for 750 to 5,000 screenings. Essential adds SAR and STR reporting, and raises the cap on the custom risk engines that packages already include; API access and webhooks open at the Scale tier. Annual billing saves up to 30 percent, depending on tier. This dimension suits steady volume: a program that knows its monthly check count.
Enterprise contracts are the negotiated model. Unlimited volume, multi-seat teams, integrations, and support terms, priced by consultation. This dimension suits institutions, and it is where the category's legacy pricing lives.
| Billing model | Unit priced | Typical fit | Reference points |
|---|---|---|---|
| Per check | Screening credits | Intermittent checks, irregular casework | Packages 50 to 2,000 credits from $95; $1.10 to $1.90 per check |
| Per watched address | Monitoring scope | Watch lists that must stay watched | Monitor add-on, 10 addresses at $40/mo to 200 at $500/mo |
| Monthly tier | Bundled volume plus features | Steady monthly check volume | Essential from $39/mo; Scale from $699/mo |
| Enterprise contract | Negotiated scope | Institutions, integrations, multi-seat teams | Quoted by consultation; setup negotiated separately |
What the Market Actually Charges
The two ends of the market are far apart. On the contract end, enterprise analytics contracts are quoted per institution and rarely published, which is exactly what makes budgeting hard: the number that matters is not a published rate but a negotiation. That is the established vendor model: depth, integration, and a threshold below which the model does not open at all.
On the pay-as-you-go end, the same category's toolkit is reachable from $39 per month, with per-check pricing between $1.10 and $1.90 and monitoring from $40 per month. A small program running 200 checks a month sits inside the Essential band, which spans $39 at 25 checks to $469 at 500. Adding a starter monitoring bundle keeps the total in the low hundreds per month for the same core data layer. The contract end buys volume headroom, integrations, and accountable support; the pay-as-you-go end buys the same data with commitments you can walk away from. Between those poles, most teams should model both and let arithmetic, not habit, pick.
Hidden Costs Beyond the Sticker
Five cost lines hide behind every sticker in this category. Setup and integration fees, which contract pricing often carries as a separate line and pay-as-you-go pricing usually does not. Training and onboarding, billed in some plans and unbudgeted in analyst time in every plan. Multi-year bundling, where the discount is real but the lock-in is the price, and a program that shrinks mid-term pays for volume it no longer has. Per-seat charges for additional analysts, which scale with headcount rather than usage and surprise exactly the teams that grow. And export and evidence gating, whether report generation and data export are included in the tier or priced above it, a line that looks trivial until a case file must survive review.
The habit that surfaces all five: price the workflow, not the product. The four numbers that drive spend are monthly check volume, the watched-address count, analyst seats, and the set of records the program owes. A vendor conversation that opens from those figures finds the hidden lines before the contract does.
How to Model Your Own TCO
Map the case mix to the billing dimension. Occasional checks and irregular casework model best on per-check packages: annual cost is checks times unit price, and nothing runs when nothing happens. Duties that never switch off add the address dimension: watched-address tiers priced against the watch list, independent of check volume. Steady monthly volume crosses over to subscription tiers, and the crossover arithmetic is simple, when monthly checks consistently exceed what a tier bundles, the tier wins. Institutional volume, multi-team access, and integration needs point at contracts, which is the only dimension that prices those in from the start.
The workflow being priced exists because requirements do. Under frameworks such as the FATF's updated standards for virtual asset service providers and FinCEN's CVC program guidance, licensing, monitoring, and reporting duties define the checks, watched addresses, and records a program must carry. Size the model against those duties first, then let arithmetic pick the dimension.
Model annually, not monthly: credits expire, tiers stack with monitoring add-ons, and annual discounts of up to 30 percent change the comparison. For the monitoring side of the stack priced on its own, see how much blockchain monitoring tools cost. For the feature tiers behind the pricing, read what investigation teams should expect from forensics software. And for the API dimension as volume grows, see the crypto fund tracing API for investigators.
