Structuring
Split transactions
"Many small transactions to get around thresholds (structuring) are a classic pattern that KYT must flag."
KYT Crypto Transaction Monitoring
KYT (Know Your Transaction) is the monitoring of the behavior and risk of on-chain transactions. We help you implement it at your crypto firm: rules, risk scoring, blockchain analytics, alerts and reporting, built into your anti-money laundering program and required of a CASP under MiCA.
Need transaction monitoring (KYT)? Free assessment
Tell us how you operate and we will tell you which KYT rules and controls you need.
- 50+ entities advised
- Reply within 24 h
- No commitment
- Key legislation
- Law 10/2010
- Suspicious transaction reporting
- SEPBLAC
- KYT system steps
- 10 steps
How we help
Your transaction monitoring, end to end
Six workstreams to implement solid KYT at a crypto firm: rules, scoring, on-chain analytics, alerts, reporting and control governance.
Rules
Risk rules and scenarios
We design the rules and scenarios that trigger alerts (thresholds, patterns, typologies), calibrated to your firm’s risk profile and customer base.
Learn more →
ThresholdsPatternsTypologies
On-chain
On-chain analytics and scoring
We integrate blockchain intelligence to score the risk of wallets and addresses based on their exposure to mixers, the darknet or funds of illicit origin.
Learn more →
Risk scoringTraceabilityExposure
Sanctions
Integration with screening
We connect KYT with sanctions screening to cover, at the same time, behavioral risk and the risk of dealing with listed persons or addresses.
Learn more →
ScreeningOFAC/EU
Alerts
Alert management
We define the alert review workflow, how false positives are cleared and how alerts that require investigation are escalated, with every decision traceable.
Learn more →
TriageEscalation
Reporting
Reporting to SEPBLAC
We prepare the suspicious transaction report to SEPBLAC when an alert confirms grounds for suspicion, with the right supporting documentation.
Learn more →
SEPBLACSuspicious transaction
Governance
KYT in the CASP application
We document the monitoring policy, roles and controls as part of the governance and compliance required of a CASP under MiCA.
Learn more →
MiCAPolicy
Situations
What good KYT detects
Monitoring is not meant to slow down the business, but to detect early the patterns that reveal money laundering risk or funds of doubtful origin.
Mixers
Funds that pass through mixers
"Wallets exposed to mixers or anonymization services raise the transaction’s risk score."
Illicit origin
Exposure to flagged addresses
"Funds linked to the darknet, scams or thefts are flagged by on-chain intelligence and require review."
Anomalous behavior
Out-of-profile behavior
"Activity that does not match the customer’s declared profile is an alert worth investigating."
What is at stake
Without monitoring, risk is invisible
Transaction monitoring is an ongoing due diligence obligation. Not having it, or having it poorly calibrated, leaves the firm blind to money laundering and exposed to the supervisor.
Law 10/2010
Ongoing monitoring
Due diligence includes ongoing monitoring of the business relationship and of transactions.
MiCA
Required of CASPs
A CASP must demonstrate solid monitoring controls as part of its governance and compliance.
Poorly calibrated rules: too many alerts overwhelm the team; too few let real risk through.
No on-chain analytics: ignoring blockchain traceability leaves out the risk specific to crypto.
SEPBLAC
Reporting
When there are grounds for suspicion, the obligation arises to report the suspicious transaction to the supervisor.
No audit trail: failing to document how alerts were analyzed makes it impossible to prove due diligence during an inspection.
Want to implement transaction monitoring?
We help you define the rules, integrate on-chain analytics, manage alerts and document the control within your compliance program.
Frequently asked questions
KYT and monitoring: common questions
What is KYT (Know Your Transaction)?
It is the monitoring of the behavior and risk of transactions. Unlike KYC, which identifies the customer at the outset, KYT watches transactions on an ongoing basis to detect patterns, anomalies or exposure to funds of illicit origin.
How is it different from KYC?
KYC (Know Your Customer) answers "who is the customer?"; KYT answers "what are they doing, and with what risk?" They are complementary: one identifies, the other monitors activity throughout the business relationship.
Is transaction monitoring mandatory?
Yes. Law 10/2010 on the prevention of money laundering requires ongoing monitoring of the business relationship and of transactions. In crypto, that monitoring relies on KYT tools with on-chain analytics.
What role does on-chain analytics play?
It lets you score the risk of wallets and addresses based on their blockchain history: exposure to mixers, the darknet, scams or sanctions. This is what sets crypto KYT apart from traditional bank monitoring.
How does KYT relate to sanctions screening?
They are complementary. Screening checks against lists of persons and entities; KYT analyzes the behavior and on-chain risk of transactions. It is advisable to integrate them into a single control framework.
What happens when an alert is triggered?
It is analyzed, then cleared if it is a false positive or escalated for investigation. If grounds for suspecting money laundering are confirmed, the obligation arises to report the suspicious transaction to SEPBLAC, documenting each step.
Does MiCA require transaction monitoring?
A CASP must have solid governance and a solid compliance program, and monitoring is an essential part of that framework, together with sanctions screening and due diligence. A well-designed KYT strengthens the authorization application.
What is the Travel Rule and how does it fit in?
The Travel Rule requires information on the originator and the beneficiary to accompany transfers of crypto-assets. KYT and the handling of that information complement each other to cover the risk in transfers between providers.
Do I need a tool, or is a process enough?
In crypto, the volume and on-chain complexity make an analytics tool almost essential, but the tool is not enough: it needs well-calibrated rules, an alert process and governance to back it. We help you with both layers.
Operational guide
How to implement KYT that works
Good KYT is not just a tool: it is a system of calibrated rules, on-chain analytics, alert management and governance. The key is to detect real risk without drowning the team in false positives.
Define your risk
Rules and thresholds are not universal: they depend on your model, your customer base and your risk appetite. Good calibration is what separates useful KYT from noisy KYT.
Add on-chain analytics
Crypto risk lives on the blockchain: exposure to mixers, the darknet or flagged addresses. Without on-chain intelligence, monitoring falls short.
Document every alert
Analyze, clear or escalate, and report if there are grounds for suspicion. Every decision must be traceable so you can prove due diligence to SEPBLAC and the supervisor.
A KYT system in 10 steps
- Assess the risk of your firm, your model and your customer base.
- Define the rules, scenarios and thresholds that trigger alerts.
- Integrate on-chain intelligence to score wallets and addresses.
- Connect KYT with sanctions screening and with KYC.
- Set up real-time screening and periodic transaction review.
- Design the alert management workflow: triage, clearance and escalation.
- Define the criteria for reporting suspicious transactions to SEPBLAC.
- Document the monitoring policy, roles and traceability.
- Periodically calibrate the rules based on false positives and the risk detected.
- Build the control into your governance and your CASP application under MiCA.
Does your KYT go hand in hand with list screening? See sanctions screening or the general anti-money laundering framework.
KYT in practice
From transaction to decision: how monitoring works
KYT lives in every transaction: the risk is assessed, the wallet is scored, an alert is generated if needed and a decision is made on what to do. This panel sets out how to build effective, demonstrable monitoring.
1) RulesDefine rules and scenarios
We calibrate thresholds, patterns and typologies to your firm’s risk profile so that you detect what matters without being flooded with alerts.
- Thresholds
- Typologies
- Risk appetite
2) On-chainScore on-chain risk
We integrate blockchain intelligence to score wallets and addresses based on their exposure to mixers, the darknet or illicit funds.
- Risk scoring
- Exposure
- Traceability
3) AlertsManage alerts
We analyze alerts, clear false positives and escalate those that require investigation, using clear and traceable criteria.
- Triage
- Investigation
- Escalation
4) ReportingReport and document
If an alert confirms grounds for suspicion, we prepare the suspicious transaction report to SEPBLAC and keep an audit trail of the whole process.
Tip: the supervisor does not only check whether you have a tool, but whether the rules are justified, the alerts resolved and the decisions documented. Calibration and traceability are the proof.
Quick decisionWhat do I do with the transaction?
Low risk
Transaction within parameters: it is processed and recorded.
Medium risk
Alert to analyze: review, and enhanced due diligence if needed.
High risk
Clear grounds for suspicion: blocking, escalation and reporting to SEPBLAC.
KYT playbook
KYT vs. KYC and screening, block by block
Question
What is the customer doing, and with what risk?
Who is the customer, and are they on a list?
Timing
Ongoing, throughout the business relationship.
At onboarding and recurrently against lists.
Focus
The behavior and risk of transactions.
Identity and presence on sanctions lists.
Crypto
On-chain analysis of wallets and addresses.
Screening of listed persons, entities and addresses.
Outcome
Alert, analysis and, if needed, reporting to SEPBLAC.
Blocking and reporting when there is a list match.
Mistakes that leave your KYT limping
Avoiding them is what separates monitoring that protects you from monitoring that is merely decorative.
- Generic rules not calibrated to the firm’s real risk.
- Doing without on-chain analytics and sticking to traditional monitoring.
- Generating alerts that no one analyzes or resolves in time.
- Not documenting the triage or the decisions on each alert.
- Treating KYT as something separate from KYC and sanctions screening.
Operational glossary
Key KYT concepts
If you are going to implement transaction monitoring at your crypto firm, these terms come up in the policy, in alerts and in your dealings with SEPBLAC. Understanding them helps you design a solid control.
KYTMonitoring
Know Your Transaction
Ongoing monitoring of the behavior and risk of transactions, complementary to KYC.
Watches what the customer does.
KYCIdentity
Know Your Customer
Identifying and knowing the customer at onboarding and throughout the business relationship.
Watches who the customer is.
On-chain analyticsBlockchain
Blockchain intelligence
Study of the history of wallets and addresses to score their risk exposure.
Specific to the crypto environment.
Risk scoringRisk
Risk score
A value that summarizes the risk level of a wallet, address or transaction based on multiple factors.
Determines whether an alert fires.
MixerAnonymization
Mixing service
A service that mixes funds to make them harder to trace. Exposure to mixers raises the risk.
A common red flag.
StructuringPattern
Transaction splitting
Splitting transactions to get around control thresholds. It is a typical pattern that KYT must detect.
Also known as "smurfing."
Travel RuleTransfers
Information accompanying transfers
The obligation for originator and beneficiary information to accompany transfers of crypto-assets.
Complements KYT.
SEPBLACSupervisor
AML supervisor
The authority to which suspicious transactions detected through monitoring are reported.
Recipient of the reports.
Law 10/2010AML
Anti-money laundering
The Spanish framework that requires ongoing monitoring of the business relationship and of transactions.
Legal basis for KYT.
Contact
Book a call
Tell us about your operations and your customer base, and we will tell you which rules, on-chain analytics and alert process your monitoring needs.
KYT: transaction monitoring at a crypto firm
KYT (Know Your Transaction) is the ongoing monitoring of the behavior and risk of transactions. Unlike KYC, which identifies the customer, KYT watches what the customer does, and with what risk, throughout the business relationship. In crypto, it relies on on-chain intelligence to score the risk of wallets and addresses, which sets it apart from traditional bank monitoring.
An ongoing due diligence obligation
Law 10/2010 on the prevention of money laundering and terrorist financing requires ongoing monitoring of the business relationship and of transactions. Transaction monitoring is how you meet that obligation: detecting patterns, anomalies or exposure to funds of illicit origin in time.
What it detects and how it works
Well-designed KYT flags patterns such as transaction structuring, exposure to mixers, funds linked to flagged addresses or behavior outside the customer’s profile. It combines rules and thresholds calibrated to the firm’s risk with on-chain scoring, and generates alerts that must be analyzed, cleared or escalated.
KYT, KYC and sanctions screening
They are complementary pieces of the same framework. KYC identifies the customer; sanctions screening checks them against lists; KYT monitors the behavior of transactions. Integrating them avoids gaps and strengthens the firm’s position with the supervisor.
KYT and MiCA
A CASP authorized under MiCA must demonstrate solid governance and a solid compliance program, and transaction monitoring is an essential part of that framework. When an alert confirms grounds for suspicion, the obligation arises to report the suspicious transaction to SEPBLAC. Documenting the rules, alerts and decisions is what allows you to demonstrate due diligence.
MiCA and crypto compliance
Related areas
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
Legislation and links reviewed in .