Know Your Transaction is screening a payment's parties, counterparties, and, in crypto, its on-chain exposure at the moment the money moves. It adds transaction-level context that customer-level KYC alone misses, because even a clean customer can route risky funds.
What is KYT, in plain English?
Know Your Transaction judges the risk of a payment at the point it moves, rather than only reviewing it after settlement. It looks at who is sending, who is receiving, where the funds are heading, and, for crypto, what the money has touched on-chain. The output is a risk read on the transaction itself, in real time or near real time, so a firm can allow, hold, or block before the money leaves.
KYT complements KYC. KYC tells you who the customer is; KYT tells you what they are doing right now. A fully verified, low-risk customer can still receive funds from a sanctioned address or send to a high-risk exchange, and only transaction-level screening will catch that. In crypto especially, KYT leans on address risk, exposure to mixers, and links to known illicit clusters.
The craft of KYT is tuning. Set it too loose and bad flows pass through; set it too tight and you choke legitimate payments with false positives and friction. Good KYT concentrates scrutiny on exposure that actually matters, such as mixers, high-risk or no-KYC exchanges, and sanctioned counterparties, without freezing the ordinary movement around it.
KYC versus KYT
What changes | KYC alone | KYC plus KYT |
Focus | Who the customer is at onboarding. | Who the customer is, plus what each payment is doing. |
Timing | Point-in-time checks and periodic review. | Real-time or near-real-time at the moment of movement. |
Blind spot | A clean customer routing risky funds looks fine. | Risky counterparties and on-chain exposure surface as they happen. |
Action | Approve, review, or exit the relationship. | Allow, hold, or block the specific transaction. |
What it looks like in practice
In practice
A crypto exchange has a fully verified customer with a clean onboarding record. One afternoon the customer receives a deposit, and KYT flags that the incoming funds passed through a mixing service two hops earlier and carry exposure to an address tied to a known theft.
The deposit is held automatically before it credits, and an analyst reviews the on-chain trace. Because the exposure is direct and material, the funds are frozen pending investigation and a report is filed. Nothing about the customer's identity was wrong; the risk lived entirely in the transaction, which is exactly what KYC on its own would have missed.
Why KYT matters to operators
Identity is a snapshot; money moves continuously. A customer who passed every onboarding check can still become a conduit for illicit funds the day after approval, whether knowingly or not. KYT is the control that watches the movement, not just the person, and in crypto it is often the only practical way to see risk that lives on-chain rather than in a customer file.
It is also where detection and customer experience collide most directly. Every hold or block has a cost in friction and abandoned payments, so the value of KYT sits in its calibration: catching the flows that matter while waving through the ones that do not. A team that tunes it well protects both the balance sheet and the checkout.
What to watch for
- Mixer and tumbler exposure. Funds that recently passed through a mixing service, obscuring their origin, are a core KYT red flag.
- Sanctioned or listed addresses. Direct or close exposure to a sanctioned wallet demands a hold and likely a block.
- High-risk and no-KYC venues. Flows to or from exchanges with weak controls raise the risk of the counterparty leg.
- Structuring in the flow. Many small transactions engineered to stay under thresholds, visible only at the transaction layer.
- False-positive load. If nearly everything is flagged, thresholds are too tight and analysts will start rubber-stamping; tune before that happens.
Quick questions
How is KYT different from transaction monitoring?
They overlap heavily. KYT emphasizes screening the parties and, in crypto, on-chain exposure at the moment of movement, while transaction monitoring often refers to the broader ongoing analysis of activity patterns over time. In practice many firms use them together.
Is KYT only for crypto?
No, but it is most associated with crypto because on-chain data makes counterparty and exposure analysis unusually rich. In fiat, KYT-style checks screen counterparties and payment details against risk data in real time as payments are made.
Can KYT block a payment before it settles?
Yes, that is the point of running it in real time or near real time. A risky transaction can be held or blocked before the money leaves, rather than being caught only in an after-the-fact review.
What does on-chain exposure mean?
It measures how close a transaction sits to known illicit activity by tracing the flow of funds across the blockchain. Direct exposure to a mixer or a sanctioned address is high risk; distant, indirect links carry less weight.
Why is tuning so important?
Because KYT sits directly in the payment path. Too loose and illicit flows pass; too tight and legitimate customers get frozen and abandon. The whole value is in separating the movement that matters from the movement that does not.
Does a clean KYC result make KYT unnecessary?
No. KYC and KYT answer different questions. A customer can pass every identity check and still route funds tied to crime, which is exactly the gap KYT is built to close.
Go deeper
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.