Crypto Transaction Monitoring: AML Guide for 2026

Last updated: 4 October 2026

Crypto transaction monitoring is the ongoing review of customers' deposits, withdrawals and transfers to detect money laundering, sanctions evasion and fraud. It combines two layers. The first is behavioural rules on your own platform data. The second is blockchain analytics that traces where funds came from and where they go, often called KYT (know your transaction). Exchanges, custodians and other virtual asset service providers (VASPs) use it to screen transfers before they settle, raise alerts, investigate them and file suspicious activity reports where required.

Most compliance teams do not fail their audit because they lack a transaction monitoring system. They fail because the system they bought generates ten thousand alerts a month, four analysts triage the loudest two hundred, and nobody can explain to an examiner why the other 9,800 were closed.

AML transaction monitoring is the control that watches customer activity after onboarding and flags what looks like money laundering, sanctions evasion, or fraud. In crypto it has to do that across two very different data domains at once: conventional fiat rails and a public blockchain. This guide covers how it works, the design decisions that determine whether it produces signal or noise, and what regulators expect to see.

Educational only, not legal or compliance advice. Confirm your obligations with qualified counsel in your jurisdiction.

What is AML transaction monitoring?

AML transaction monitoring is the continuous review of customer transactions against expected behaviour and known risk patterns, to detect and report suspicious activity. It is the operational half of an AML programme: KYC establishes who someone is at onboarding, and monitoring asks whether what they subsequently do is consistent with that.

The regulatory basis is the requirement to conduct ongoing due diligence on the business relationship and to file suspicious activity reports. In practice that means three obligations: detect anomalous activity, investigate it, and document the outcome either way. The third is the one firms most often under-build, and the one examiners test hardest.

KYT versus transaction monitoring

You will see KYT (know your transaction) and blockchain transaction monitoring used almost interchangeably with crypto transaction monitoring. Strictly, KYT is the on-chain layer: scoring each incoming and outgoing transfer by the risk of the addresses and entities it touches. Products such as Chainalysis KYT are built for exactly this. Transaction monitoring is the broader obligation. It also covers off-chain behaviour such as fiat deposits, trading patterns and account activity, plus the investigation and reporting workflow that follows an alert. A KYT feed is one input to a monitoring programme, not the whole programme.

Why crypto monitoring is a different problem

Traditional bank monitoring reads an internal ledger: your own records of your own customers' transfers. Crypto monitoring has to reconcile that with a public ledger you do not control.

The last row is the important one. A blockchain gives you something banking never had: complete, permanent transaction history for any counterparty. That is a genuine analytical advantage, and it is why crypto transaction monitoring leans so heavily on fund-flow tracing rather than only on behavioural thresholds.

The irreversibility cuts the other way, though. A bank can often claw back a wire. Once a withdrawal confirms on-chain, monitoring that fires afterwards has documented a loss rather than prevented one. This is why pre-transaction screening matters as much as post-transaction alerting.

The 2026 picture in numbers

The two largest blockchain analytics firms published their annual crime figures in January 2026. Their methods differ, but they point the same way:

• Volume hit a record. Chainalysis (8 January 2026) found that illicit addresses received at least $154 billion in 2025, up 162% year on year. TRM Labs (10 January 2026) put the figure at $158 billion, up from $64.5 billion in 2024.
• Sanctions drove most of it. Chainalysis reports a 694% rise in value received by sanctioned entities. TRM attributes the jump mainly to sanctions activity linked to Russia, better attribution and large hacks.
• Stablecoins dominate. Chainalysis found that stablecoins made up 84% of illicit transaction volume in 2025. Monitoring that is tuned mainly for BTC and ETH is now pointed at the wrong assets.
• The illicit share is still small. TRM puts illicit activity at 1.2% of attributed on-chain volume in 2025, and Chainalysis puts it below 1%. That is exactly why false positives dominate alert queues: almost everything you monitor is legitimate.

How monitoring systems actually work

Rules-based detection

The foundation is deterministic rules: thresholds and patterns encoded as logic. Common examples include structuring (many transfers just below a reporting threshold), rapid in-and-out movement of funds, dormant accounts suddenly transacting at volume, and transfers to or from high-risk jurisdictions.

Rules are transparent and easy to explain to a regulator, which matters more than it sounds. Their weakness is that they are static: anyone who learns your thresholds can transact just under them.

Behavioural and anomaly models

The complement is statistical. Instead of asking whether a transaction crosses a fixed line, these models ask whether it is unusual for this customer, given their own history and their peer group. A 50,000 dollar transfer is unremarkable for an institutional account and highly anomalous for a retail user who has never exceeded 500.

These catch novel patterns that rules miss, at the cost of explainability. If your model cannot articulate why it flagged something, your analysts cannot defend the decision. The realistic architecture is both: rules for the known and the auditable, models for the unknown.

On-chain analytics

The crypto-specific layer. Rather than examining the transaction in isolation, analytics traces where the funds came from and where they go, attributing addresses to entities: exchanges, mixers, darknet markets, ransomware operators, sanctioned services.

The output is exposure rather than a binary verdict. "These funds are two hops from a sanctioned exchange, via a mixer" is a materially different alert from "large deposit received." Platforms such as Crystal Intelligence provide this attribution and tracing alongside real-time monitoring, which is what turns a raw blockchain record into a usable risk signal.

Screening at the gate

Because on-chain settlement is final, the highest-value control runs before a transaction executes: screening deposit and withdrawal addresses against sanctions lists and risk databases at the point of the request. Our guide to sanctions screening software covers this layer in detail.

Common crypto red flags and typologies

Rules and models are only as good as the typologies they encode. Patterns that crypto monitoring programmes routinely cover include:

• Direct or indirect exposure to sanctioned entities, including funds a few hops removed from a designated address.
• Mixers and privacy services in the funding path of a deposit.
• Chain-hopping: moving value quickly across chains through a crypto bridge to break the trail, often combined with swaps on a DEX.
• Peel chains: a large balance split into a long series of small transfers, each peeling off a little value.
• Rapid in-and-out: deposits withdrawn almost immediately to a different address, with no trading in between.
• Structuring: transfers kept just under reporting or Travel Rule thresholds.
• Nested services: an unlicensed exchange or OTC desk operating through an account at your platform.
• Scam and fraud proceeds: deposits traced to known scam clusters, drainer contracts or hacked funds. See wallet drainers and approval phishing.
• Profile mismatch: activity inconsistent with the customer's declared occupation, source of funds or onboarding risk rating.

How to set up crypto transaction monitoring, step by step

1. Write the risk assessment first. Cover your products, chains, customer types, geographies and the typologies above. Every threshold you set later should trace back to it.
2. Screen at the gate. Check deposit and withdrawal addresses before execution against sanctions and risk data, and decide which exposure levels block, hold or simply flag.
3. Connect identity data. Monitoring needs to know who the customer is. Feed in KYC results and ongoing PEP and watchlist screening so that a PEP or sanctions change re-rates the customer.
4. Segment customers and set rules. Run separate thresholds for retail, professional and institutional accounts, and add behavioural models on top.
5. Build the case workflow. One case per customer, with on-chain and fiat evidence together, a documented decision and a named decision-maker.
6. Report and retain. File suspicious activity reports as your regime requires, and keep alerts, investigations and reports for the statutory period.
7. Tune and test. Review rule performance on a schedule, and have someone independent of the team that built the rules validate them.

The false positive problem

This is where most programmes live or die. Industry-wide, the overwhelming majority of AML alerts are closed without a report being filed. A 95% false-positive rate is not unusual, and every one of those alerts consumed analyst time.

The failure mode is predictable. Thresholds get set conservatively because nobody wants to be the person who tuned down a rule that later missed something. Alert volume outgrows the team. Analysts start closing alerts quickly to clear the queue. Quality drops precisely because volume was meant to increase safety.

What helps:

• Segment customers before you set thresholds. One rule set applied to retail and institutional users guarantees noise on one side and blindness on the other.
• Tune against outcomes, not intuition. Track which rules produce filed reports and which produce only closures. A rule that has never contributed to a report in twelve months is a candidate for retirement, and you should document that reasoning.
• Risk-score rather than binary-flag. Ranking alerts lets a finite team work the most probable cases first.
• Consolidate related alerts. Fifteen alerts on one customer over three days is one investigation, not fifteen.
• Measure analyst time per alert. If it is falling, that is usually a warning rather than a productivity gain.

Leaving a system untuned looks conservative, but it converts a detection control into a queue-clearing exercise, and examiners increasingly recognise the pattern.

What regulators expect

Requirements vary by jurisdiction, but the recurring themes are consistent.

1. Risk-based calibration. Your monitoring should reflect a documented assessment of your own risks, not a vendor default. Be able to explain why your rules are your rules.
2. Coverage of all products. Every asset, chain, and rail your customers can use needs to be in scope. Gaps in coverage are a common finding.
3. Timeliness. Detection has to be fast enough to act on. Weekly batch review of an irreversible settlement layer is difficult to defend.
4. Documented investigation. Every alert needs a decision, a rationale, and an identifiable decision-maker. An undocumented correct decision looks identical to a wrong one.
5. Independent testing. Model validation and periodic tuning reviews, performed by someone other than the team that built the rules.
6. Record retention. Alerts, investigations and reports kept for the statutory period and retrievable on request.

Two 2026 developments raise the bar. The FATF's seventh targeted update on virtual assets, published on 15 July 2026, drew on survey responses from 147 jurisdictions. It found that 83% of surveyed jurisdictions have Travel Rule legislation in force, up from 73% a year earlier, but that many have not yet taken any supervisory or enforcement action (Notabene summary, July 2026). The next phase is supervisors checking whether controls work. In the EU, the AML Regulation, Regulation (EU) 2024/1624, applies directly from 10 July 2027 and puts crypto-asset service providers under the same single rulebook as banks. For the authorisation side, see CASP licensing under MiCA.

Monitoring also connects directly to the Travel Rule: counterparty data received with an inbound transfer is an input to your risk assessment, and missing or inconsistent data is itself a monitoring signal.

Choosing a system

Beyond the feature list, the questions that separate vendors:

• Does it monitor on-chain and fiat activity in one case file, or two disconnected systems?
• How quickly does a newly designated sanctions address propagate into live screening?
• Can your compliance team modify rules without a vendor engineering ticket?
• What is the demonstrated false-positive rate on data resembling yours? Insist on a proof of concept using your own transaction history.
• Does the audit trail satisfy your examiner, or only your operations team?
• Which chains are actually covered, at what depth of entity attribution?

Crypto transaction monitoring tools

Vendors split roughly into blockchain-analytics specialists, platforms that combine fiat and on-chain monitoring, and identity and screening providers that feed customer risk into monitoring. In alphabetical order, described from each vendor's own product pages (checked 4 October 2026):

Most programmes combine an on-chain analytics vendor with a separate identity and screening provider, and some add a fiat or case-management layer. For pricing, chain coverage and a fuller side-by-side comparison, see best crypto transaction monitoring software.

Monitoring and non-custodial DeFi

A clarification worth making. AML transaction monitoring is an obligation of regulated intermediaries: exchanges, custodians, payment providers, and other businesses that hold customer funds or execute transactions on their behalf.

JewelSwap is non-custodial. Across MultiversX, Sui and Radix, users interact with smart contracts directly from wallets they control, and the protocol does not hold user assets or process transactions for them. There is no customer account base to monitor because there are no customer accounts. That is an architectural fact rather than a compliance position, and it changes the moment any business builds custody, fiat on-ramps or brokerage on top. Our AML compliance guide for exchanges and VASPs covers the full programme those businesses need.

Frequently asked questions

What is AML transaction monitoring?

The continuous review of customer transactions against expected behaviour and known risk patterns to detect potential money laundering, sanctions evasion or fraud. It covers detecting anomalous activity, investigating it, and documenting the outcome whether or not a report is filed.

What is KYT in crypto?

KYT, or know your transaction, is the on-chain part of crypto transaction monitoring. It scores each incoming and outgoing transfer by the risk of the addresses and entities involved, such as sanctioned services, mixers or scam clusters. It is one input to a transaction monitoring programme, alongside behavioural rules and the investigation workflow.

How is crypto transaction monitoring different from traditional AML?

Crypto monitoring reconciles internal records with public blockchain data. It gains complete counterparty transaction history and fund-flow tracing, which banking never had, but loses reversibility: once a transfer confirms on-chain it cannot be recalled, so pre-transaction screening carries more weight.

Why do AML systems generate so many false positives?

Because thresholds are usually set conservatively and applied across customer types that behave very differently. Rates above 90% are common. The fix is segmenting customers before setting thresholds, tuning rules against whether they actually produce filed reports, and risk-ranking alerts rather than treating them as binary.

Is rules-based or AI-based monitoring better?

Neither alone. Rules are transparent and defensible to a regulator but static and easy to transact around. Behavioural models catch novel patterns but are harder to explain. Effective systems run both, using rules for known typologies and models for anomaly detection.

How quickly must monitoring detect suspicious activity?

Requirements vary, but the practical standard for crypto is that detection must be fast enough to act before settlement is final. Because on-chain transfers are irreversible, screening at the point of request is generally more valuable than alerting after the fact.

What tools are used for crypto transaction monitoring?

Most firms combine a blockchain analytics provider for on-chain risk, such as Chainalysis, Crystal, Elliptic, Merkle Science or TRM Labs, with an identity and AML screening provider for customer risk, and a case-management layer for investigations. Some platforms, such as Solidus Labs, monitor fiat and on-chain activity together.

What are common red flags in crypto transactions?

Exposure to sanctioned addresses, funds routed through mixers, rapid chain-hopping across bridges, peel chains, deposits withdrawn immediately without trading, transfers structured under thresholds, and activity that does not match the customer's profile or declared source of funds.

Do DeFi protocols need transaction monitoring?

Monitoring obligations attach to regulated intermediaries holding customer funds or transacting on their behalf. A genuinely non-custodial protocol has no customer accounts to monitor. Businesses that add custody, fiat on-ramps or brokerage on top of DeFi do fall in scope.

Keep reading

• Crypto AML Compliance for Exchanges and VASPs
• Sanctions Screening Software for Crypto
• What Is the Travel Rule? FATF Rule 16 Explained
• Crypto KYC Platform: Best Software and Providers
• Best Crypto Transaction Monitoring Software
• PEP and Watchlist Screening for Crypto
• Free Crypto Sanctions Screening
• GENIUS Act Explained: The US Stablecoin Law in 2026
• Crypto Glossary: 40 DeFi and Crypto Terms Explained