What is transaction monitoring for a VASP?

The applicable duty to monitor customer activity over time: screen transactions and addresses, review risk signals, triage alerts and record decisions. The sources and paths of funds, including relevant cross-chain exposure, are assessed according to the business’s risk profile and local requirements.

How is monitoring different from screening?

Screening is a point in time check, the door check at onboarding or deposit. Monitoring is continuous, watching behavior after approval, because risk attached to an address changes with new activity.

Where do the checks sit in the pipeline?

Screen before the institution authorises a withdrawal. For a deposit already completed onchain, screen before internal crediting or further handling where policy requires. The institution makes and executes the decision; screening cannot stop an already completed chain transfer.

What does a five level risk grade mean operationally?

No Risk, Low and Medium indicate no triggered findings, limited exposure and moderate exposure. High indicates significant exposure; Critical is the highest severity, such as a blacklisted address or direct involvement with an illicit entity. The institution maps the grades to its own review and escalation policy.

Why are there so many false positives?

Broad rules designed to reduce missed suspicious activity can also flag legitimate traffic. Measure false positives within your own reviewed queue and use documented tuning and triage; no universal industry proportion or zero-miss guarantee is assumed.

Can monitoring records survive an exam?

Screening results, audit logs and exports support review, while the institution records its rationale, approvals and other required evidence. Whether the full file meets an examination requirement depends on applicable law and the institution’s controls, not on an export alone.

Transaction Monitoring for VASPs: From Requirement to Workflow

The Short Answer

Transaction monitoring is the duty to watch customer activity continuously: every deposit and withdrawal screened, risk signals read, alerts triaged, decisions recorded. Screening is the check at the door; monitoring keeps watching after the door opens. The work lands in three places: wiring the checks into the flow, running the queue without drowning, and leaving records an examiner accepts. The VASP compliance hub collects the related guides.

Four-step monitoring loop: screen deposits and withdrawals, read risk signals, triage alerts, and record decisions

The FATF standards provide the international AML baseline for ongoing monitoring. Risk-based monitoring should assess the sources and paths of funds relevant to the business, including exposure involving bridges, decentralised exchanges and mixing services. A particular route is context to review, not proof of wrongdoing.

Wire the Checks into Your Flow

Monitoring in the operational flow can support a repeatable control. Call the screening API before authorising a withdrawal. For an incoming deposit already settled onchain, screen its transaction and address before internal account crediting or further handling where the institution’s policy requires. Record the results and the institution’s decisions; the screening tool does not stop completed onchain transfers.

Timing depends on the flow. Withdrawal screening informs the institution before it authorises funds to leave; deposit screening informs its treatment of funds already received. The screening call sits in the relevant approval or review path, holds at peak volume, and returns a risk assessment the institution can act on under its own policy rather than executing the action itself.

Three properties decide whether the wiring survives. Latency: the screening response cannot be the bottleneck, and on this site's engine it comes back in under 100 milliseconds (per BlockSec), built for the approval path, not for batch reports. Throughput at peaks: market moves produce bursts, and the check has to hold when everything else spikes. Failure behavior: a failed call defaults to a ticket and a human decision, never a silent pass.

The mechanics of integration, endpoints, fields, rate limits, code, are deliberately not this page's subject. The KYT family carries the API tutorials end to end, and this page stays at the workflow layer the API plugs into.

What the Alerts Are Telling You

An alert is a signal with a grade. The signals read in three families: who the other side is, from sanctions labels to mixer tags; what the behavior looks like; and where the funds have been, the path through bridges, DEXes, and mixers. Grades arrive on five levels, No Risk through Critical, the language your policy routes on.

Reading levels into actions is a policy act, written before the queue arrives. No Risk means no triggered risk findings; Low and Medium indicate limited and moderate exposure. High means significant risk exposure; Critical is the highest severity, including blacklisted addresses or direct involvement with illicit entities. The engine grades; the institution decides review, restrictions and reporting under its own policies and applicable law.

The grades as a routing table:

Risk grade	What it usually means	Typical routing
No Risk	No triggered risk findings	Routine handling and periodic review under policy
Low	Limited risk exposure	Review proportionate to the exposure
Medium	Moderate risk exposure	Priority human review under policy
High	Significant risk exposure	Prompt review and escalation under policy
Critical	Highest severity: blacklisted addresses or direct involvement with illicit entities	Immediate human assessment of restrictions and whether reporting is required

Cross chain exposure deserves its own line in a business’s risk assessment: funds that bridged chains or touched a mixer on the way in carry a different story than funds from a known exchange hot wallet. A setup that cannot see across chains cannot read it. Bridge and chain counts belong in the procurement checklist.

A practical reading habit: labels outweigh signals, and direct labels outweigh indirect ones. A Critical grade resting on a direct sanctions finding is a different decision from a medium built from indirect behavioral signals, and a policy worth having treats the two differently, in writing, before either arrives.

For the related licensing and compliance guides, see the VASP compliance hub.

Running the Alert Queue

The queue is where monitoring lives or dies. False positives consume review time and can obscure genuine risk; their frequency depends on the rules and business context. Broad rules intended to reduce missed suspicious activity may fire often. The answer is a measured triage method, not an unsupported industry percentage or a quieter engine.

Three moves make the queue workable. First, a triage desk: one queue, worked in priority order, severe alerts first, so the critical never waits behind the routine. Direction rule tuning: the same rule set on an exchange, with its known platform wallets, and on a payments service, with its stream of new addresses, produces completely different noise. A whitelist: addresses checked and trusted, suppressed from repeat firing, each with an owner and a review date.

The discipline matters as much as the moves. Teams should review or remove temporary whitelist entries on their scheduled dates. Tuning changes get written down, one at a time, so an examiner asking why a threshold moved gets an answer. And the queue gets measured, sampling alerts monthly and letting your actionable count drive the next pass.

What this section is not, deliberately, is a claim that any tool makes false positives disappear. The full playbook, thresholds, whitelist governance, severity routing, and measurement, is its own guide: how to reduce false positives.

Keep the Records Explainable

An examiner asks why a transaction was allowed, how the grade was derived and where the evidence is. Screening results, audit logs and exports support the answer; the institution adds review reasons, approvals and any external evidence. Teams should be able to explain a risk assessment without rebuilding the process from memory.

The record has a shape: what was seen, what fired, what the grade was, who decided, when. Systems that write this trail as they run produce it on request; systems that expect to reconstruct it produce it under pressure, and the difference shows.

United States expectations for money services businesses are published by FinCEN and read as a fair template for what examiners ask elsewhere: retention periods, retrievability, and the reporting path.

Escalating an alert into a case does not automatically require an STR or SAR. The institution assesses the facts against local reporting requirements, prepares a draft where appropriate, reviews it and submits it itself. Phalcon Compliance currently exports STR drafts for Hong Kong and Singapore; this is distinct from its risk engines supporting rules for 27+ jurisdictions (per BlockSec). The VASP AML guide maps the wider duty set.

Putting It Together

The engine behind this site's compliance line is Phalcon Compliance: KYA and KYT screening on one label data. Three facts. API screening in under 100 milliseconds, built for the approval path. Pricing that starts free, three checks a month, then credits or a subscription. And pipeline concurrency for deposit and withdrawal flows (per BlockSec).

The honest limits travel with the facts. Screening lowers risk; it does not remove it, and a clean result is a statement about today. The API sits on the Scale and Enterprise plans, a real gate worth confirming before integration work starts, not a formality to discover in week six. And the engine provides grades and evidence; the policy and the decisions remain the operator's work.

Start where your volume is. Three free checks a month after registration, run manually, teach what labels and signals look like. When the first check gets skipped for lack of time, move the checks into the pipeline; the Phalcon Compliance page carries the product detail. The family map is the VASP compliance hub.