Know Your Transaction (KYT): The Complete Crypto Transaction Monitoring Guide
Every deposit and every withdrawal on a crypto exchange is a decision a compliance team owns in real time. KYT sits at that decision point, reading each transaction, scoring its risk, and producing an action before funds move, plus a record that holds up after they do. Phalcon Compliance, BlockSec's KYT and KYA engine, brings real-time screening, glass-box scoring, ongoing monitoring, STR export, and an audit trail into one workflow. This hub explains KYT as a product discipline, then maps it onto a platform you can evaluate.
Screen transactions with Phalcon Compliance · Explore the KYT API
Explore This KYT Hub
What KYT Is
KYT, or Know Your Transaction, is real-time onchain transaction risk screening. A KYT engine takes an address or transaction, reads its on-chain behavior and counterparty exposure, and returns a risk result a compliance team can act on at the point of decision. The defining property is that KYT is proactive: it runs before or during a transaction, not after the funds are gone.
KYT Versus Blockchain Analytics Versus Identity Checks
Three layers get conflated in crypto compliance conversations, and each answers a different question.
Identity verification confirms a document matches a person at onboarding, but it is blind to the wallet afterward. KYT fills that gap by reading the transaction continuously, so an address clean at onboarding but later receiving mixer exposure is still caught. Blockchain analytics follows funds after an exploit or a sanctions designation, producing an evidence trail rather than a real-time decision. A sound program runs all three.
Why VASPs Need KYT
Under the FATF risk-based approach for virtual asset service providers, the obligation attaches to behavior, not to a label. FATF Recommendation 10 requires a VASP to monitor transactions on an ongoing basis and identify suspicious activity, Recommendation 11 requires auditable records, and Recommendation 20 requires suspicious transactions to be reported to the financial intelligence unit, which sits downstream of the monitoring control. A VASP that screens wallet addresses, scores them explainably, and records every disposition is doing that work. FinCEN's AML program rule (31 CFR 1022.210) and suspicious activity reporting rule (31 CFR 1022.320), read with FinCEN's 2019 virtual currency guidance (FIN-2019-G001), together make ongoing monitoring necessary for crypto exchanges and other US money services businesses.
The KYT and Travel Rule Boundary
Travel Rule, set out in FATF Recommendation 16, is a separate obligation. KYT maps to Recommendations 10 and 11, monitoring transactions and keeping auditable records, with a risk score, a disposition, and an audit trail as its output. The Travel Rule maps to Recommendation 16, transmitting originator and beneficiary information between VASPs when a transfer takes place. Conflating the two produces either a monitoring gap or a transmission gap; a VASP subject to both needs two controls, one for each obligation.
What a KYT Engine Must Do
A KYT product stands on four capabilities, and together they define what a KYT tool has to do before it counts as a serious one.
Real-Time Pre-Transaction Screening
A fiat wire can be recalled or frozen; a confirmed blockchain transfer cannot be. That is why a risk answer arriving after a withdrawal has cleared is a report, not a control. The latency budget is tight, with a working ceiling in the hundreds of milliseconds end to end. BlockSec specifies sub-100ms API response for Phalcon Compliance real-time single checks; any internal SLA should be measured against the firm's own traffic. The gate maps the score to a disposition defined as code:
Allow has to be the majority of volume, Hold catches the ambiguous cases, and Block does the prevention work nothing after the fact can replicate. The strength is in the audit chain: every disposition has to be reproducible months later, down to which score was returned, which indicators drove it, and which action the gate took.
Explainable Glass-Box Risk Scoring
Every KYT engine returns a risk score; the question is whether it returns the evidence behind it. Phalcon Compliance quantifies illicit exposure with two figures: Exposure Value, the absolute amount of illicit funds that reached the address through traced paths, and Exposure Percentage, that value as a share of total inflows. On top of exposure, the score aggregates 17 Risk Indicator categories drawn from more than 600 million labeled addresses, covering the surfaces examiners expect, from sanctioned entities and darknet markets to mixers, stolen funds, and ransomware. Each indicator is a labeled, attributable signal that can be inspected and written into a filing, and a Behavioral Risk Engine layers on top, catching layering and structuring patterns that may not yet carry a label.
Ongoing Monitoring Versus One-Time Screening
One-time screening is a snapshot; ongoing monitoring is the video. A wallet screened clean at onboarding picks up exposure the moment it receives funds from a sanctioned, mixer, or fraud-linked counterparty, because the blockchain does not freeze an address's counterparty list at screening time. In Phalcon Compliance, Monitor mode re-analyzes already-screened addresses on a dynamic schedule when their risk changes, without consuming the per-check Screening quota, so the team can say the address was clean when checked, watched since, and alerted the moment that changed, which is the statement an examiner looks for.
Multi-Chain Coverage
Chain-hopping through bridges, mixers, and decentralized exchanges is the default laundering method, and a single-chain engine loses visibility the moment funds cross to a second network. Phalcon Compliance covers ten chains natively: Ethereum, Tron, BNB Chain, Polygon, Base, Optimism, Avalanche C-Chain, Arbitrum, Bitcoin, and Solana, with the list extended on a regular cadence. Coverage gaps show up not as alerts but as silence, and the question is whether the tool covers every chain the institution transacts on, not how many in total.
Tune Rules and Cut False Positives
A KYT product is only as good as the rules configured inside it. The capabilities above describe what the engine can do; rules decide what it actually does inside a specific firm, with a specific risk appetite. A rule is a hypothesis with a shelf life: counterparty clusters evolve, mixers give way to bridges, and sanctions designations update, so an untuned rule set drifts.
False positives are the structural cost of getting this wrong. False-positive rates in crypto monitoring are consistently high, and they vary widely precisely because configuration quality varies. The mechanical trap is that suppressing noise by raising a global threshold also suppresses the next real signal sharing the pattern. Glass-box design is the way out: a team working with named Risk Indicators can weight down the specific indicator producing noise and preserve the ones carrying signal, while a black-box score only offers the overall threshold. The tuning workflow, the five prebuilt rule templates, and a default rule set built around the FATF risk-based approach are covered in the Spoke guides below.
Generate SARs and Pass Examinations
KYT is not finished when the firm's gate blocks a transaction on its output; it is finished when it produces the records a regulator expects. In the United States the report is a Suspicious Activity Report filed with FinCEN within 30 calendar days of initial detection; elsewhere the equivalent is a Suspicious Transaction Report under FATF Recommendation 20. A crypto SAR has to describe a graph, tracing funds across ownerless addresses through mixers and bridges in a narrative a non-specialist can follow, which is why drafting a defensible filing can take hours. A defensible filing rests on four evidence blocks: the fund flow, the exposure quantification, the named Risk Indicators that fired, and the disposition rationale. Phalcon Compliance collapses the assembly into a single case export, available on Essential and above, carrying the trace, exposure figures, and indicators with the audit trail attached.
The audit trail is the other half of the output, because a control that ran but left no record is, from the examiner's chair, indistinguishable from a control that did not run. Phalcon Compliance records all three layers, the alert trail, the investigation trail, and the disposition trail, through its Audit Trails, Audit Logs, and Risk Engine Details, each exportable as PDF or CSV. A regulatory exam is a test of the program's records rather than its intent, and reconstruction after the request is itself evidence the records were never kept. The filing workflow, the auto-close debate, and the mock-exam checklist are covered in the Spoke guides below.
A firm building a KYT program eventually faces a vendor decision, and the cost of a wrong choice lands months later when a regulator asks why a screening failed. Selection runs on six axes, each tested by measurement rather than vendor claim.
The recurring red flags mirror the axes: a black-box score leaves the team defending held transactions without evidence, single-chain coverage forces a blind spot, no audit trail forces manual reconstruction under examination, and a rigid subscription with no PAYG path signals who the vendor built the product for. Weigh the axes against the firm's own profile: a high-volume exchange weights latency and pricing, a smaller VASP weights rule configurability and audit trail.
The legacy pricing pattern is a quote-based enterprise subscription, custom-scoped on chains, seats, API volume, and region, which locks mid-market teams out of the category. The emerging pattern is pay-as-you-go (PAYG), driven by what operators call subscription fatigue: teams locked into annual contracts overpaying for unused volume or undercovered when volume spikes. PAYG collapses the procurement step and converts a fixed annual overhead into a variable cost. Phalcon Compliance uses PAYG as the entry point to a five-tier structure:
The path through the tiers is sequential: start at Free or PAYG to validate the scoring and size the volume, move to Essential when interactive screening becomes routine, to Scale when screening needs to live inside a product flow, since real-time API access is gated to Scale and Enterprise, and reach Enterprise for multi-seat collaboration or a master services agreement. The headline decision runs on volume: low fits PAYG, high and predictable fits a subscription.
Where KYT Goes Next
KYT continues to change in three areas: screening and monitoring converging into a single continuous surface, Risk Indicator evidence exposed programmatically so a firm's own systems can route, escalate, or block on it, and PAYG maturing as the default commercial model. Teams that put real-time screening, glass-box scoring, ongoing monitoring, STR output, and an audit trail in place now will be better prepared as each trend matures. The next step is concrete: screen transactions with Phalcon Compliance against the framework above rather than against a sales deck.
