What KYT is
Know your transaction screens onchain activity against categories of concern. It tells you about the money an address has touched, and nothing at all about the person holding it.
KYT stands for know your transaction. It is the chain-side half of a compliance programme: given an address or a transfer, what has this money touched, and should anybody be concerned about it.
It is often described as the onchain equivalent of transaction monitoring, which is close enough to be useful and wrong in one way that matters. Traditional monitoring watches activity inside your own institution, where you know who both parties are. KYT watches a public ledger where you usually know neither.
What it checks
- Counterparty attribution
Who the other address is understood to belong to. An exchange, a gambling service, a darknet market, a sanctioned entity or nothing at all.
- Exposure
How much of the value reaching this address can be traced back to a category of concern, and how many hops away that category sits.
- Behaviour
Patterns in how the funds move. Amounts clustered under a threshold, rapid hops with no economic purpose, a sudden change in how an address is used.
None of these is an identity. KYT can tell you that funds came from a service associated with ransomware. It cannot tell you that your customer is a criminal, or even that your customer knew.
Direct and indirect exposure
Direct exposure is a transfer straight from the source of concern. Indirect exposure means the funds passed through something else first, and that is where judgement starts, because value mixes as it moves. How many hops to follow, and how to apportion value through a pool, are choices a vendor makes rather than facts the chain supplies.
How a risk score is produced
A score is a vendor’s opinion expressed as a number, resting on choices about which categories count, how heavily each weighs and where the band boundaries fall. The same address can score 30 with one vendor and 70 with another without either being wrong.
What it cannot tell you
| KYT answers | KYT does not answer |
|---|---|
| What this address has been exposed to | Who controls this address |
| How close that exposure sits | Whether your customer knew |
| What a vendor attributes the counterparty to | Whether the attribution is still current |
| How the funds moved | Why they moved |
The right-hand column is what the investigation is for. Screening tells you where to look and roughly how worried to be. Everything after that comes from your own records, your customer and whatever you can establish about why the money moved.
Related
Addresses and wallets
An address is a destination that anyone can create, for free, without telling anybody. Everything else said about one, including who owns it and what it is for, was added later by somebody making an inference.
What a typology is
A typology is a named pattern of financial crime, written down precisely enough that two people looking at the same case reach the same view about whether it fits.
Where findings come from
What the agent consults for a finding. A source that does not answer contributes nothing.
Last checked against the product on .