What is the difference between a compliance scoring tool and a compliance enforcement tool?

A scoring tool (e.g. a wallet-risk or transaction-monitoring scanner) analyzes activity and assigns a risk score or alert, usually after the transaction has already been submitted or settled. An enforcement tool evaluates the action before it executes and can return a hard DENY, so the transaction never reaches its destination. Intaglio is an enforcement tool: it sits in the agent's request path, not beside it.

Is a risk score enough for MiCA compliance?

A risk score alone does not stop a non-compliant transaction from executing. MiCA Title V Chapter 2 requires CASPs to have systems and procedures to detect and prevent violations (Art. 68) — a control that only flags a problem after settlement is weaker evidence of 'prevention' than one that blocks the action before it happens. [VERIFY]: whether a specific regulator treats post-hoc scoring as sufficient for a specific obligation is a supervisory question, not something this page can certify.

How does Intaglio's enforcement API work?

An agent (or a proxy in front of it) calls POST /v1/actions with the proposed action. Intaglio evaluates it against the agent's active APL policy and returns APPROVE, DENY, or REQUIRE_APPROVAL before the agent is permitted to proceed. POST /v1/x402/forward additionally tunnels the request to the upstream target only if the action is approved.

Can a scoring tool be added on top of an enforcement layer?

Yes — scoring/monitoring tools are complementary, not a substitute. They are useful for retrospective investigation and portfolio-level risk visibility. Enforcement is what stops the specific transaction in front of the agent right now.

Enforcement vs. scoring

MiCA compliance API: enforcement vs. scoring

Most "compliance" tools built for crypto agents score or monitor a transaction after it has already happened. A compliance enforcement API evaluates the action before it executes and can refuse to let it proceed. The difference is not semantic — it is the difference between documenting a violation and preventing one.

Two categories of product

Scoring / monitoring

Evaluates after the fact, often post-settlement
Produces a risk score or alert
Requires a human or downstream system to act on the signal
Cannot itself stop the transaction

Enforcement (Intaglio)

Evaluates before the action executes
Returns APPROVE / DENY / REQUIRE_APPROVAL
DENY means the request never reaches the upstream target
Every decision is hash-chained for audit, whatever the outcome

What this looks like as an API call

An agent (or the proxy in front of it) submits the proposed action. The decision comes back before anything is sent to the bank, exchange, or on-chain program:

curl -X POST http://localhost:3001/v1/actions \
  -H "Authorization: Bearer <agent-secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "action": {
      "rail": "x402",
      "amount": { "value": 500, "currency": "USD" },
      "timestamp": "2026-07-06T00:00:00Z"
    }
  }'

# 200 OK
# { "decision": { "outcome": "DENY" }, "record": { "record_id": "...", "self_hash": "sha256:..." } }

Because the response is returned synchronously in the request path, the agent's code path can branch directly on decision.outcome — there is no polling loop waiting for a scoring service to flag the transaction hours later.

Why this matters for MiCA

MiCA Title V Chapter 2 (Art. 66-73) requires CASPs to run governance, AML/CFT, and safekeeping controls, not just report on them retrospectively. Article 68 in particular calls for systems and procedures to detect and prevent money laundering and terrorist financing — prevention is a pre-execution property. A scoring tool alone satisfies detection; it does not, by itself, prevent anything.

[VERIFY] Regulatory sufficiency of any specific control design is a supervisory determination, not something this page certifies. Confirm with counsel for a specific CASP license application.

Start enforcing policy today

MiCA CASP enforcement is active as of July 1, 2026.

Open dashboard Read the APL spec