What Is KYT in Crypto? Know Your Transaction Explained

KYT (Know Your Transaction) is the screening of crypto transactions and wallet addresses for links to illicit activity: sanctioned entities, scams, darknet markets, ransomware, mixers and stolen funds. KYC tells you who your customer is. KYT tells you where their money came from and where it is going.

Exchanges, OTC desks, payment companies and other virtual asset service providers (VASPs) use KYT to decide whether to credit a deposit, release a withdrawal, hold funds for review or escalate a case. This guide covers how KYT works, the signals behind it, how to read a risk score, and who is expected to run it.

What KYT means in practice

A public blockchain records every transfer, but it does not record who controls an address. KYT tools close that gap by combining on-chain data with attribution: labels that link addresses to exchanges, sanctioned parties, scam operations, gambling sites, bridges and so on.

When a customer deposits 25,000 USDT, a KYT check answers questions like these:

• Is the sending address itself on a sanctions list or tied to a known illicit service?
• Did the funds pass through a mixer, a scam cluster or a hacked wallet a few hops back?
• Does the wallet behave like a normal user, or like someone splitting amounts to stay under reporting thresholds?
• Is the exposure meaningful (thousands of dollars, recent) or trivial (a few cents of dust sent by a stranger)?

The output is usually a risk level or score, plus the reasons behind it. What you do next depends on your risk appetite: accept, accept with monitoring, hold and request information, reject, or file a suspicious transaction report.

KYT vs KYC

The two are complementary. A fully verified customer can still deposit funds stolen in a hack, and an anonymous self-hosted wallet can have a perfectly clean history. You need both views.

	KYC (Know Your Customer)	KYT (Know Your Transaction)
Question it answers	Who is this person or company?	Where did these funds come from and where are they going?
Main inputs	ID documents, liveness, sanctions and PEP screening, company registries	Blockchain transactions, address attribution, sanctions data, behavioral patterns
When it runs	At onboarding and periodic refresh	On every deposit and withdrawal, plus ongoing wallet monitoring
Typical red flag	Forged document, sanctioned individual	Funds from a mixer, sanctioned address, scam or ransomware wallet

Pre-transaction vs post-transaction screening

Pre-transaction screening

Pre-transaction checks happen before you act. For withdrawals, you screen the destination address before broadcasting. If the customer is trying to send funds to a sanctioned address or a known scam wallet, you can stop the transfer instead of explaining it later. For deposits, some firms screen the expected source address when a customer declares it in advance, for example on an OTC trade.

Post-transaction screening

Incoming crypto cannot be refused at the protocol level. Once a deposit lands on your address, it is there. Post-transaction screening analyses the funds after they arrive and before you credit them to the customer's balance or let them move on. If the result is high risk, you can hold the funds, ask the customer for source-of-funds information and escalate.

Most compliance programs need both. A common setup: screen every withdrawal destination in real time, screen every deposit before crediting, and keep monitoring wallets you have a relationship with, because an address that looked clean last month can receive funds from a newly identified scam today.

What signals KYT uses

Good KYT looks at more than one label on one address. The main signal groups are:

1. Direct exposure. The counterparty address itself belongs to a sanctioned entity, a darknet market, a scam, a ransomware operator or another high-risk category.
2. Indirect exposure. Funds reached the address through one or more intermediate hops from a risky source. The further away and the smaller the share, the weaker the signal.
3. Sanctions data. Addresses listed on the OFAC SDN list and other official sources, and entities linked to them.
4. Entity type and share of flow. For exchanges and other large services, one touch means little. What matters is how much of the flow is risky.
5. Behavioral patterns. Evenly spaced transfers that look automated, amounts just under common thresholds such as $10,000, $5,000, $3,000 or $1,000 (structuring), an unusual share of round amounts, and activity concentrated in odd hours.
6. Amount and recency. A $5,000 transfer from a sanctioned address last week is a different situation from $3 of unsolicited dust two years ago.

An evidence-based risk score vs a bare percentage

Many tools return something like "Risk: 78%". That number alone does not help an MLRO who has to justify a decision to a regulator or an auditor. Which transaction caused it? Which source labeled the counterparty? When did it happen? Would the score be the same tomorrow?

An evidence-based score answers those questions. Every risk factor is tied to a specific transaction, a data source and a timestamp. If a factor cannot be backed by evidence, it should not count.

This is how Cryptic AI's KYT is built. An AI agent investigates the wallet itself: it chooses which tools to call, follows the money across hops, and cross-checks several blockchain data providers (Chainalysis, Global Ledger, Breadcrumbs) with its own attribution database, BTC clustering, OFAC sanctions data and OSINT. Factors without evidence are rejected.

The final 0 to 100 score is then calculated by a deterministic engine, not by the language model. The same data always produces the same score, and each score breaks down into components. A few of the rules:

• A sanctioned address itself scores no lower than 90.
• Direct contact with a sanctioned entity of $1,000 or more within the last 30 days scores no lower than 90.
• Dust under $10 does not inflate the score.
• For exchanges, the risk level depends on the share of risky flow, not on a single touch.

Separating investigation (AI) from scoring (fixed rules) matters for audits. You can show exactly why an address got 92 and confirm it would get 92 again.

Who needs KYT

FATF Recommendation 15 extends the international AML/CFT standards to virtual asset service providers, and that includes ongoing monitoring of customer activity. Recommendation 16, the Travel Rule, adds requirements on originator and beneficiary information for transfers. In the EU, crypto-asset service providers authorised under MiCA are also subject to EU AML rules, and the Transfer of Funds Regulation (EU) 2023/1113 has applied since 30 December 2024.

In practice, KYT is expected or strongly advisable for:

• Centralised exchanges and brokers handling customer deposits and withdrawals.
• OTC desks, where single trades are large and counterparties often use self-hosted wallets.
• Payment companies and crypto payment gateways accepting stablecoins from merchants' customers.
• Custodians and wallet providers.
• Banks and fintechs onboarding crypto businesses, which need to assess where client funds originate.

Even where no specific rule names KYT, regulators and banking partners will ask how you detect illicit funds. Stablecoin issuers can also act: Tether, for example, can freeze USDT held at specific addresses. Accepting tainted funds can leave you holding a frozen balance.

What to look for in a KYT tool

• Explainability: every risk factor linked to a transaction, source and timestamp.
• Reproducibility: the same input produces the same score.
• More than one data source: attribution from a single provider has blind spots.
• Proportionality: dust and distant hops should not trigger false alarms.
• Monitoring: ongoing wallet monitoring with rules and alerts, not only one-off checks.
• Reporting: exportable reports with the link graph, fund flows and a transaction appendix for case files.

FAQ

Is KYT the same as blockchain analytics?

Blockchain analytics is the underlying capability: tracing funds and attributing addresses. KYT is the compliance process built on top of it, applied to your customers' transactions with defined thresholds and actions.

Can KYT block an incoming deposit?

No. Anyone can send funds to a public address. KYT lets you decide what happens next: hold the funds, request information, refuse to credit them or report.

Does a high KYT score mean the customer is a criminal?

Not by itself. It means the funds carry exposure that needs review. Victims of scams and users of exchanges that later turned out to be risky can show high exposure too. The evidence behind the score is what lets an analyst tell the difference.

How often should wallets be re-screened?

Attribution data changes as new scams, hacks and sanctions designations are identified. Continuous monitoring of active customer wallets catches risk that a one-time check at deposit would miss.

If you want to see what an evidence-based investigation looks like on your own transaction flow, take a look at Cryptic AI KYT. To test it on a single address first, the free AML wallet check sends you a report with the evidence behind every factor.