Share via:
- Updated on: October 27, 2026
Crypto transaction monitoring checks every blockchain address and transfer a firm touches, continuously, for exposure to sanctions, fraud, and other illicit activity. Most teams already run crypto transaction monitoring, and most teams have the same complaint: it produces alerts, and an alert is not a decision. Someone still has to work out who the counterparty is, whether the risk is real, and what to do before funds move or a report is due.
Decision intelligence for digital assets is the discipline of putting verified evidence in front of every decision an organization makes about digital assets. Applied to monitoring, it means the context an analyst assembles by hand – who the counterparty is, what the evidence says, what the screening history shows – is available in the same place as the alert: in Crystal Expert’s Monitor, the Ask Crystal summary reads the transfer, its alerts, the counterparty and the customer’s history with it, and writes the review on request. That assembly time is where compliance teams spend their hours, and it is also what an examiner asks about later, because an examination looks at the decisions a team made, not at how long its alert queue was.
Key takeaways
Crypto transaction monitoring scores the deposits, withdrawals and counterparty addresses a firm touches against the public ledger, so a counterparty the firm never onboarded can still be identified and screened – the structural difference from fiat AML monitoring, which only sees the institution’s own payment records.
An alert is a starting point: the decision needs counterparty identity, evidenced attribution, and what changed since the last check.
Monitoring with decision context screens before funds are credited, re-screens continuously, and alerts on change – not only at onboarding.
Risk scoring runs from 0 to 100% across 26 risk categories – each score backed by field-verified attribution and sanctions coverage.
The audit trail is the product: every automated screen and every decision carries evidence a supervisor can trust.
What is transaction monitoring in crypto?
Transaction monitoring in crypto is the ongoing screening of transfers and the addresses behind them, before and after funds move. The structural difference from traditional AML monitoring is the data: a bank’s monitoring system reads the institution’s own payment records, while crypto transaction monitoring reads a public ledger. That means it can see where funds came from and where they went next, including counterparties your institution never onboarded.
The practice is often called KYT, for Know Your Transaction: verifying what a transfer did and which entity sent or received it. KYT is one of the four checks a digital-asset compliance program runs, alongside KYC, KYB, and, for autonomous flows, Know Your Agent. Our KYT compliance explainer covers the check itself in depth; this guide is about what happens after the check fires.
Why an alert is not a decision
Monitoring systems do what they promise: they flag. A transfer touches a sanctioned cluster two hops out, a counterparty’s risk score crosses a threshold, a dormant address wakes up, and an alert lands in the queue. Competent teams triage these queues every day, and the triage itself is not the problem.
The problem is what each alert costs to turn into a decision. The analyst has to establish who the counterparty actually is, check whether that attribution rests on evidence or on someone’s label, reconstruct what changed since the wallet was last screened, and write up reasoning an examiner can follow. Done by hand, across tools, that is the slowest step in the pipeline, and it is invisible in monitoring metrics. Transaction monitoring tells you what happened. The decision that follows – an analyst’s call on a complex alert, or a rule the firm has configured for the binary cases – still has to establish what it means.
Alert-only monitoring | Monitoring with decision context | |
|---|---|---|
What the system produces | A flag and a score | A flag with the evidence behind it |
Counterparty identity | A label to verify elsewhere | An entity checked against the physical world |
When risk changes later | Found at the next manual review | Re-screened continuously, alerted on change |
What the analyst does next | Assembles context across tools | Reads the assembled context and decides |
What the examiner gets | A queue log and case notes | The decision with its evidence attached |
Source: Comparison by Crystal Intelligence, 2026. For informational purposes only. Download as CSV.
What decision context adds to monitoring
Decision context is not a longer report. It is the specific set of answers a monitoring alert lacks, available where the alert is worked: in Monitor, the Ask Crystal summary assembles them on request from the transfer, its alerts, the counterparty and the customer’s history.
Identity, evidenced. Screening runs against 130,000+ entities verified in the field, so the counterparty behind an address is an organization with a name, a jurisdiction, and evidence open to inspection – not a tag scraped from a forum. Risk scores run from 0 to 100% across 26 risk categories, and they are an input, not the verdict: each firm sets the thresholds and rules that turn a score into an alert, a hold, or a pass, according to its own risk policy.
Screening before the money settles, not after. Screening can run before funds are credited, not only after: a sending address and its exposure are checked pre-transaction, so the credit decision is made with the evidence rather than ahead of it. The cost of skipping that step is highest in sanctions screening: a deposit from an address one hop from a designated entity that is credited first and checked later is already a reportable event, and unwinding it is far harder than declining it.
Change, watched continuously. A wallet screened clean at onboarding does not stay clean by decree. Monitored addresses are re-screened continuously, with alerts on a risk-score increase, a move between risk bands, or a balance change, and monitored addresses can be grouped by customer. Sanctions coverage spans 20+ issuing authorities, applied as designations land.
A record the supervisor can trust. Every screen, score, and decision lands in an audit trail with timestamps and entity evidence – the difference between telling an examiner what the process was and showing them how a decision was made. This is not hypothetical: WhiteBIT stopped $150M in illicit flows running monitoring this way.
How monitoring fits decision intelligence
In the decision intelligence framework, monitoring is where the Timely pillar earns its claim: what matters reaches you before you go looking. Data without AI is slow. AI without attribution is a guess. Monitoring with decision context is all three working on the compliance team’s fastest-moving problem.
It also has to fit the systems you already run. Monitoring connects through a documented REST API and works alongside KYC and Travel Rule providers, including Notabene, 21 Analytics, and Sumsub, so on-chain risk lands in the stack your team uses rather than in a second queue. And as payments begin to move at machine speed, the same monitoring foundation is what makes Know Your Agent checks possible: a per-decision screen has to resolve in the time an agent takes to pay.
Frequently asked questions
What is transaction monitoring in crypto?
Crypto transaction monitoring is the ongoing check of the blockchain addresses and transfers a firm touches for exposure to sanctions, fraud, darknet markets, and other illicit activity, run before and after funds move. Because it reads a public ledger, it can screen counterparties an institution never onboarded.
How is crypto transaction monitoring different from traditional AML monitoring?
A fiat AML system only ever sees the payments the institution itself processed. Crypto transaction monitoring reads the public ledger, so it sees the history and destination of funds beyond your perimeter, and it can screen a counterparty before the relationship exists.
What is KYT, or Know Your Transaction?
KYT is the compliance check that verifies what a transfer did and who was on the other side of it, typically per transfer and scored against your risk policy. It is one of four checks alongside KYC, KYB, and KYA – our KYT compliance explainer covers it in depth.
Can transactions be screened before funds are credited?
Yes. Pre-transaction screening scores the sending address, and the exposure behind it, while the credit is still a decision rather than a fact, so that decision is made with the evidence in front of it rather than after the fact.
What happens when a screened wallet becomes risky later?
Monitoring with decision context re-screens continuously and alerts on change: a risk-score increase, a move between risk bands, or a balance change. A wallet cleared at onboarding is not assumed clean forever.
What should a transaction monitoring audit trail contain?
The decision, its timestamp, the risk score and categories at decision time, the counterparty’s evidenced identity, and the screening history that led there. If a supervisor cannot reconstruct why a transfer was cleared, the monitoring worked and the record failed.
Monitor for the decision, not the alert queue
A monitoring program is judged by the decisions it produces: cleared transfers that stay defensible, escalations that hold up, reports filed with evidence attached. Alerts are the raw material. Context is what turns them into calls your team can stand behind, at the speed the money actually moves. Crystal Expert, our blockchain analytics tool, runs monitoring this way across 330+ blockchains: 210M+ transfers verified, 30M+ flagged, every screen carrying its evidence.
