KYC tells you who your customer is on the day they sign up. It says nothing about what their wallets do afterwards. Know Your Transaction (KYT) closes that gap: it continuously monitors blockchain activity, re-scores addresses on a schedule, and alerts you the moment a clean counterparty stops being clean. This article explains how KYT works in practice, how it differs from the identity checks you already run, how to deploy it without drowning your team in alerts, and what regulators actually expect from ongoing monitoring.
Why a one-time check is not enough
Blockchain risk is dynamic in a way that traditional customer risk is not. A person's identity does not change after onboarding. A wallet's exposure changes constantly, because exposure is a function of who the wallet transacts with — and that is entirely outside your control.
An address that screened perfectly clean in January can receive ransomware proceeds in March, interact with a mixer in April, or land on a sanctions list in June. If your compliance file holds only an onboarding snapshot, you are exposed for every single day after it, and you will not know until someone else tells you.
Regulators have noticed. Ongoing monitoring is increasingly an explicit expectation within a risk-based AML programme, not a nice-to-have. A static PDF generated six months ago does not demonstrate control; it demonstrates that you once had control, briefly.
What KYT actually does
A KYT system attaches a monitor to the addresses you care about — customer deposit wallets, treasury addresses, high-volume counterparties, settlement addresses — and re-analyzes them automatically without anyone having to remember.
On Arya Crypto a monitor re-checks each tracked address on a schedule as frequent as every two hours. Each run screens new inflows and outflows against the same 100+ sanctions and risk sources used for one-off checks, recalculates the risk score, and compares it to the previous state. When the score crosses a threshold you defined, you get an alert. When nothing changes, you get silence — which is exactly what you want from a monitoring system.
The critical design property is that monitoring is differential. It is not merely re-running a check; it is detecting change. A wallet that has sat at a score of 12 for four months and suddenly jumps to 68 is far more interesting than a wallet that has always been at 65, and a good monitor surfaces the former loudly.
KYT versus KYC: different questions entirely
The two disciplines answer different questions and are not interchangeable, though they are routinely confused.
KYC asks: is this person who they claim to be? It is an identity question, answered with documents, a liveness check and watchlist screening, and it is answered once at onboarding.
KYT asks: is this money coming from — or going to — somewhere it should not? It is a behavioural question, answered continuously with on-chain data, and it never finishes.
A complete compliance posture needs both, because they fail in different directions. Perfect KYC with no KYT means you know exactly who is moving tainted funds through your platform. Perfect KYT with no KYC means you can see the tainted funds but have no idea who to report.
- KYC: identity documents, liveness, watchlist and PEP match at onboarding.
- KYT: continuous screening of transfers, counterparty categories, exposure share, score change over time.
- Together: a defensible, auditable AML programme.
What triggers an alert
Not every change deserves your attention, and understanding what a monitor can detect helps you decide what to act on.
New sanctions exposure is the highest-severity signal: funds arrived from, or moved toward, a newly designated address. This should page someone.
New high-risk category exposure — a first-time interaction with a mixer, darknet market, or scam cluster — is the second tier. It usually deserves same-day review rather than an immediate freeze, because a single small interaction is not automatically evidence of wrongdoing.
Score drift is the subtlest and often the most informative. A counterparty whose high-risk-exchange share has crept from 4% to 22% over six weeks is telling you something about a change in their business, even if no single transaction crossed a threshold. Drift alerts belong in a weekly review queue, not a pager.
Sanctions list updates deserve special mention: sometimes nothing about the wallet changed at all — the world changed around it. An address you cleared last month can be re-scored today simply because a new designation was published.
Alerts your team can actually handle
The most common KYT failure is not missed risk. It is alert fatigue: a system tuned so sensitively that analysts learn to dismiss alerts reflexively, at which point the monitoring is worse than useless because it creates a false record of diligence.
Tune thresholds by category rather than using one global cut-off. Sanctions exposure deserves an immediate, interrupting alert. A marginal increase in high-risk-exchange share can wait for the morning queue. Gambling exposure may not warrant an alert at all depending on your jurisdiction and risk appetite.
Set volume expectations deliberately. If your monitoring produces more alerts per day than your team can genuinely investigate, you do not have a monitoring programme — you have a queue that grows forever. Start conservative, measure how many alerts turn out to be actionable, and loosen or tighten from evidence rather than intuition.
Every re-check on Arya Crypto is recorded with its score history, so an analyst opening an alert sees the trajectory rather than just today's number. That context is usually what makes a decision obvious.
The nightly report and the audit trail
Alerts handle exceptions. Reports handle assurance — the ongoing demonstration that your programme is running.
Arya Crypto generates a nightly PDF report summarising every tracked address: current score, category breakdown, and what changed since the previous run. This is a genuinely useful artifact in three separate conversations. For auditors, it is evidence that monitoring is continuous rather than occasional. For your banking partner, it is a concrete answer to "how do you supervise your counterparties?" For your own management, it is a portfolio-level view of where risk is concentrating.
Keep these reports. A defensible programme is one you can reconstruct after the fact, and the reconstruction is far easier when the daily record already exists.
Which addresses to monitor
You do not need to monitor everything, and trying to will generate cost and noise without improving your risk posture. Prioritise by exposure.
High-volume counterparties come first: the OTC desks, market makers, payment partners and institutional clients through whom most of your value flows. A change in their risk profile affects you most.
Treasury and settlement addresses are next. These are your own addresses, and their exposure is your exposure directly, with no intermediary to blame.
Customer deposit addresses for higher-tier accounts follow. Monitoring every retail deposit address may not be economical, but monitoring the top decile by volume usually is.
Addresses involved in a past incident should stay monitored long after the incident closes. If funds from a theft passed through an address once, that address is worth watching.
Cost: why monitoring is cheaper than screening
A common objection is that continuous monitoring must be prohibitively expensive at volume. In practice it is not, because a re-check is a fundamentally cheaper operation than a first-time check.
The first screening of an address requires assembling its full transaction history and computing exposure from scratch. A re-check reuses that work: the graph is already built, the labels are already attached, and only the delta since the last run needs analysis. On Arya Crypto that difference is reflected directly in pricing — an automatic KYT monitor run costs a fraction of a full address screening.
Model it before you commit. Take your realistic monitored-address count, multiply by check frequency, and compare against your token allowance. Most teams find that monitoring their top 100 counterparties every few hours costs less than they expected, and considerably less than a single missed sanctions incident.
Deploying KYT through the API
At small scale, creating monitors from the dashboard is fine. At operational scale, monitoring should be provisioned automatically as part of your onboarding flow.
The pattern is straightforward: when a counterparty is onboarded and their addresses are known, call the API to create a monitor for each address. Register a webhook to receive results, so alerts arrive in your systems rather than waiting to be discovered. Route webhook payloads into whatever your team actually watches — a Slack channel, a case management system, an internal dashboard.
Because monitors, one-off checks, KYC and KYB all draw on the same token balance and the same audit trail, an analyst investigating an alert can pull the full history of that address without switching tools or reconciling two systems that disagree.
Getting started without over-engineering
Start small and deliberately. Put your ten highest-volume counterparties under monitoring. Define two alert thresholds — one that interrupts, one that queues. Route alerts to a channel your team actually reads, and assign a named owner for triage. Run it for a month.
Then look at the evidence. How many alerts fired? How many were genuinely actionable? Did anything important arrive that you would otherwise have missed? Adjust thresholds from that data, then expand coverage.
This is far more effective than the common alternative, which is to enable monitoring on everything at once, generate several hundred alerts in week one, and quietly stop looking at them by week three. A small monitoring programme that people actually act on beats a comprehensive one that everyone ignores.
A worked example: the alert that mattered
Consider a payment provider with a long-standing settlement counterparty — two years of clean history, thousands of transfers, never a flag. Under monitoring, the address re-checks every few hours and returns a stable low score for months.
Then one Tuesday the score moves from 9 to 54. The alert fires. The category breakdown shows the cause immediately: 31% of recent inflows arrived two hops from a cluster that was designated by OFAC eleven days earlier. Nothing about the counterparty's behaviour looked unusual — the volumes were normal, the timing was normal. What changed was the designation, and the re-analysis of history that followed it.
The provider pauses settlement, contacts the counterparty, and learns they had onboarded a new client whose funds carried the exposure. The relationship continues under tighter limits with weekly review. Without monitoring, that exposure would have accumulated silently until an auditor or a bank found it — and by then the conversation is very different, because the question stops being "what did you do about it" and becomes "why did you not know".
This is the ordinary, unglamorous value of continuous monitoring: not dramatic interceptions, but knowing about a change in the days after it happens rather than the quarter after.
What KYT does not solve
KYT is a control, not a guarantee, and being clear about its limits helps you place it correctly among your other defences.
Monitoring detects change in on-chain exposure. It cannot detect off-chain fraud, collusion between counterparties, or a customer who is entirely legitimate on-chain while running a criminal enterprise elsewhere. It will not tell you that a counterparty's business model has quietly changed in a way that is legal but no longer within your risk appetite.
It also depends on knowing which addresses belong to whom. If a counterparty settles from addresses you have never been told about, monitoring the addresses you do know provides incomplete coverage. This is why address disclosure belongs in your counterparty agreements, not just in your technical setup.
Used properly, KYT turns compliance from a periodic snapshot into a running record. That is a substantial improvement — but it works alongside identity verification, transaction limits, staff training and human judgement rather than replacing any of them.
Monitoring frequency: how often is often enough
Not every address needs the same cadence, and getting this right saves real money without sacrificing coverage.
High-volume settlement addresses for active partners deserve the highest frequency available — as often as every two hours — because at that volume an undetected problem compounds fast. The difference between catching something in two hours and catching it in a day can be dozens of additional transactions.
Customer addresses under precautionary watch after a medium score are fine on a daily cadence. These addresses are usually low-activity, and the point of watching them is to catch a trend rather than a moment.
Your own treasury wallets sit in between: daily in normal times, stepped up during periods of intense activity such as monthly settlement runs or after a merger.
The general rule: match frequency to how fast harm accumulates, not to how anxious you feel. Revisit the allocation quarterly — partners who looked peripheral can become central within a few months, and the reverse is equally true.
A short checklist to launch this week
If you want to turn this article into action, here is what you can genuinely finish in one week with no engineering work at all.
- Day one: list every business partner you regularly send funds to or receive funds from. The list is usually shorter than you expect.
- Day two: collect their settlement addresses and run one check on each to establish a documented baseline.
- Day three: put each under KYT monitoring from the dashboard, with deliberately conservative thresholds.
- Day four: name one person responsible for reading alerts, and write down on a single page when an alert escalates and to whom.
- Day five: create a shared folder for archiving the nightly reports, and confirm they are actually arriving.
After a month you will have real data on your own alert volume — the right foundation for any automation that follows.
Put your first address under KYT monitoring — Pricing · Services · KYT · KYC · KYB · Exchange · Prop