KYT is neither a law nor a single product. The letters are used mostly in crypto and payments, and one blockchain analytics vendor sells a product under that name. The FCA describes the same work without them: ongoing monitoring "means scrutinising transactions to ensure that they are consistent with what the firm knows about the customer" (FCA FCG 3.2.5, 29 November 2024). In a bank or a payment firm, KYT is the per transaction part of AML transaction monitoring, the program of rules, alerts, cases and filings.
What is KYT, and why is it important?
Picture a payment firm whose customer, a florist, receives about 40 card payouts a month of 50 to 300 dollars and pays two local wholesalers (all figures illustrative). One morning the account sends 9,800 dollars to a new beneficiary in another country. The florist's identity has not changed. The transfer does not fit what the firm knows, and KYT is the check that notices.
KYT's full form is know your transaction. In AML it means reading each transaction against the customer's expected activity, the counterparty and the route, then deciding whether it needs a closer look. It is important because an identity check at onboarding says nothing about the money that moves a year later. Outside finance the same letters name other things; here KYT means the AML control.
KYT vs KYC vs transaction monitoring
Table 1. KYT, KYC and transaction monitoring compared.
| Term | What it checks | When it runs | Data it reads | Output | Who decides |
|---|---|---|---|---|---|
| KYC | Who the customer is | At onboarding and at each review | ID documents, ownership, screening results | A verified identity and a risk rating | The onboarding analyst |
| KYT | Whether one transaction fits the customer | Each transaction, before release or after settlement | Amount, counterparty, route, account history | A risk score, a hold or an alert | The analyst who reviews the alert |
| Transaction monitoring | The whole relationship over time | Continuously, plus scheduled reviews | All transactions, rules, past cases | Alerts, cases and reports | The MLRO or BSA officer, for filings |
UK law uses neither set of letters. MLR 2017 regulation 28(11) calls the work ongoing monitoring and pairs the scrutiny of transactions with keeping customer records up to date.
Which AML regulations require KYT?
Anti money laundering (AML) and counter terrorist financing (CTF) rules require the check under other names, the UK's Money Laundering Regulations 2017 (MLR 2017) among them.
Table 2. The rules behind a KYT check, by jurisdiction.
| Jurisdiction | Rule | Words of the rule | What it means for a KYT check |
|---|---|---|---|
| International | FATF Recommendations 10(d) and 20 | Transactions "consistent with the institution's knowledge of the customer, their business and risk profile"; suspicions reported "promptly" to the FIU | The standard the national rules below follow |
| United States | 31 CFR 1020.210(a)(2)(v) | "Conducting ongoing monitoring to identify and report suspicious transactions" | A bank's program must include the check |
| United States | 31 CFR 1020.320 and 1022.320 | A SAR where a transaction "involves or aggregates at least $5,000" at a bank, or at least $2,000 at a money services business; filed "no later than 30 calendar days" after initial detection | The check starts the filing clock |
| United States | FinCEN guidance, 9 May 2019, p. 13 | "Exchangers and administrators generally qualify as money transmitters under the BSA, while users do not" | A crypto exchange checks at the money services line |
| United Kingdom | MLR 2017 regulation 28(11)(a) | "Scrutiny of transactions ... (including, where necessary, the source of funds)" | Source of funds is in scope |
| United Kingdom | MLR 2017 regulation 33(1)(f) | "Unusually complex or unusually large", "an unusual pattern", "no apparent economic or legal purpose" | The signals a KYT score reads |
| European Union | AMLR (EU) 2024/1624 Articles 26(1) and 34(2)(d), from 10 July 2027 | Monitoring of transactions "throughout the course of a business relationship", with "the origin and destination of the funds" where necessary; a closer look where a transaction lacks "an apparent economic or lawful purpose" | One check across every product the customer holds |
KYT compliance therefore means meeting these duties. None of the texts says the check must run in real time.
From Ufuk Gürdaş, reviewer of this entry: "A US crypto exchanger generally qualifies as a money transmitter under FinCEN's 2019 guidance, so its SAR line is 2,000 dollars where a bank's is 5,000, and a KYT alert floor copied from a bank playbook sits above the line the exchange reports at."
Why do financial institutions use KYT?
The duty attaches to the customer relationship, so any firm in finance that moves customer money runs some form of the check. A bank reads card spend, wires and cash deposits, and the same read catches transaction fraud such as a payment from a taken over account. A payment firm reads payouts and merchant settlements, where transaction laundering hides one business's card sales inside another merchant's account. Lenders run it on loans: a balance paid off early from a third party's account raises the question of where that money came from. Exchanges add wallets, covered below.
In transaction monitoring software a team writes its own rules and backtests them on its own transaction history before they go live, and an analyst still decides what each alert means.
How does KYT work?
Follow the florist's 9,800 dollar transfer through five steps (illustrative):
- Collect data. The payment arrives with sender, beneficiary, amount, bank and country. The system adds the customer's 12 month history and onboarding profile.
- Score risk. A new beneficiary, a new country and an amount more than 30 times the largest usual payout each raise the score, and each signal is recorded so the analyst can see why.
- Monitor. The score meets the threshold set for the florist's segment. Above it, the transfer is held or an alert opens.
- Investigate. An analyst asks the florist for the invoice and checks the beneficiary. A matching supplier invoice closes the alert, with the reason on file.
- Report. If the answer does not hold, the case goes to the MLRO, who decides whether to file a suspicious activity report. A US bank has 30 calendar days from initial detection.
What does a KYT check look at?
KYT verification reads one transaction on six points. The amount is set against the customer's usual range, and "unusually large" is a regulation 33 trigger. The counterparty may be new, connected or high risk, and geography covers the countries of the sender, the beneficiary and each bank. Velocity counts transfers in a short window. Pattern means splits, round trips and "an unusual pattern of transactions"; purpose asks whether the payment has an "apparent economic or legal purpose" at all.
What does KYT mean in crypto?
In crypto, KYT adds the blockchain. Every deposit and withdrawal has an address, and chain analytics shows what that address has dealt with. To screen one address, the free crypto wallet risk check runs it against OFAC, UN and EU sanctions and ransomware threat intelligence.
The FCA treats chain data alone as too little. Among its poor practice examples is a cryptoasset business that assumes blockchain analysis is enough and "fails to do its own transaction monitoring based on the knowledge of its customers" (FCG 3.2.5). The chain shows where the coins have been, and the customer file shows whether this customer has a reason to send them.
Cryptocurrencies follow the same rules. FATF Recommendation 15 has virtual asset service providers "regulated for AML/CFT purposes", and FinCEN's 2019 guidance says exchangers generally qualify as money transmitters. Recommendation 16 adds the travel rule: originator and beneficiary information stays with the transfer "throughout the payment chain".
What are the challenges of implementing KYT?
Four possible challenges, each with its usual solution:
- Data quality. A score is only as good as the counterparty and country fields, so a missing field needs its own rule.
- False positives. A threshold copied from another firm alerts on normal customers; the guide to transaction monitoring rules shows how to backtest one on the firm's own history first.
- Cost. Each alert costs analyst time, so thresholds are set by risk.
- Siloed products. Card, wire and crypto desks that score one customer separately miss the pattern between them. From 10 July 2027, AMLR Article 26(1) makes an EU firm's due diligence cover every product and service a customer holds.
Emerging technologies shape the future of KYT: models read more signals and AI agents draft alert narratives. Their importance for businesses depends on the record an examiner or auditor reads, which shows that the analyst decided.
Timing is the choice these rules leave to the firm: run the check before a payment is released, while it can still stop the money, or after it settles, when it can only lead to a report.
Related terms
- Transaction laundering. A hidden business's card sales run through an approved merchant.
- Transaction fraud. A payment made or diverted by deception.
- Travel rule. Sender and recipient details sent with a transfer.
- Ongoing monitoring. The legal duty KYT meets.
- False positives and false negatives. Alerts on clean activity; missed real cases.
- Mirror trading. Matched trades that move money abroad.
