Regulators are tightening requirements, customers expect instant payments, and the compliance team is overloaded with alerts. Over recent years, the COREDO team has implemented dozens of KYT (Know Your Transaction) projects for fintech companies in the EU, the United Kingdom, the Czech Republic, Slovakia, Cyprus and Estonia, as well as in Singapore and Dubai. In this article I systematize the approach that has proven effective at COREDO: from architecture and risk-scoring models to legal liability and the AML team’s KPIs.
What is KYT and how does it integrate into AML processes?
KYT (Know Your Transaction) for fintech is the continuous analysis of blockchain transactions in real time with risk scoring at the level of each operation. Unlike KYC, which answers the question «who is the client», KYT answers the question «what is happening with their transaction right now». For payment and crypto services this is the foundation of blockchain payments compliance and the key to managing operational risk.
Regulatory frameworks: AMLD5/AMLD6, FATF and the Travel Rule
European AMLD5 and AMLD6 have shaped expectations for transaction monitoring policies, sanctions screening obligations and suspicious activity reporting. Recommendations of FATF, including the Travel Rule, require matching on‑chain and off‑chain data and transmitting payer/beneficiary attributes between providers. In practice this means the need for on‑chain sanctions screening, compliance with watchlists (OFAC, EU, UN) and automation of SAR/STR reporting.
Architecture: from streaming to investigations
The solution developed at COREDO is typically built as a streaming pipeline. Block indexing and mempool parsing provide minimal latency, and data streaming (Kafka, Kinesis) delivers events to the risk-scoring core. We enrich transactions with additional data: address attribution, exchanges, OTC entities, cascades of transit wallets. This increases accuracy and reduces false positives when monitoring on-chain.
For graph analytics of transactions we often use Neo4j or TigerGraph, and for full-text search and event analytics: ElasticSearch. Such a stack delivers performance benchmarks for latency/throughput at millions of transactions per day and the ability to scale monitoring for cross-chain payments. SLAs are important for transaction monitoring: alert latency, API availability, incident handling time, and the speed of sanctions updates.
Blockchain fraud detection systems integrate via API and webhooks for alerts with subsequent processing in case management and analyst workflows. Audit trail, multi-level access control, encryption and key management form a secure perimeter. For global providers, SaaS KYT multi-tenancy and a clear policy on TCO, CAPEX and OPEX are useful when implementing KYT.
Analytics and models: a hybrid of rule-based and ML
COREDO’s practice confirms: the best effectiveness is achieved by a hybrid of rule-based detectors and machine learning models for KYT. Heuristic rules quickly catch known patterns, while unsupervised training detects anomalies in new flows. Supervised models for risk scoring increase the prioritization of investigations and reduce the conversion of alerts into SARs where justified.
Feature engineering for transaction scoring takes into account the degree of connectivity to sanctions tags, the depth and breadth of paths, temporal patterns, amounts, and repeatability. Backtesting of the transaction risk-scoring model is necessary before go-live: we check metrics on historical data and stress scenarios (for example, spikes after a token listing). As a result, the client gets a reduction in alert fatigue and an increase in the operational efficiency of the AML team.
On-chain risks: DeFi, mixers and privacy coins
On‑chain analytics of transactions must take DeFi specifics into account. Monitoring DeFi transactions focuses on DEX and AMM transaction patterns, bridges and token transit flows, wrapped tokens and multichain tracking. The impact of L2 and rollup on transaction monitoring is expressed in increased speed and the need to index smart contract events.
We track leaked wallets and key leaks, and also build an incident response plan upon detection of money laundering. For legal investigations, chain‑of‑custody for on-chain evidence is important: immutable logs, hash fixations and procedural integrity. This simplifies interaction with lawyers and regulators and reduces the risk of disputes over the evidentiary base.
Integrating KYT into processes: from onboarding to SAR
Integration with wallets and payment gateways provides pre-credit holds and real-time operation of the KYT API. AML/KYC orchestration platforms help tie KYT to KYC and sanctions screening, and also implement automated decisioning for low-risk scenarios. Proper implementation of a transaction monitoring policy formalizes thresholds, roles, and escalations.
At COREDO we set up SAR automation and regulator reporting, which reduces manual delays and improves submission quality. SOC/AML team organization and processes include triage levels, playbooks, and SLAs for incident closure. Key metrics — alerts-to-SAR ratio, analyst efficiency, average investigation time, and repeat-alert rate.
How to choose a KYT platform and assess ROI
We perform Due Diligence on blockchain analytics providers, including open sources and commercial solutions, as well as open source tools for blockchain analytics as a supporting layer. It is critical to check which SLAs matter for monitoring transactions in fintech: RPO/RTO, alert latency, tag update frequency, support for new networks and the quality of customer support. Vendor comparison: this is not a feature race, but a check of alignment with your risk scenarios and jurisdictions.
Implementation plan: from pilot to production
The pilot begins with defining target risks and selecting networks/tokens. Next: configuring sanctions lists and watchlists, integrating with enrichment sources and setting up API integrations and webhooks for alerts. After that, backtesting on historical data, determining thresholds, training staff and running in parallel mode with manual oversight.
Implementing a real-time KYT API requires performance testing, latency/throughput benchmarks and fault-tolerance plans. We build in model risk governance (model governance), regular testing and rule validation, as well as drift detection and model monitoring. DevOps and MLOps for production KYT systems simplify releases, disaster resilience and traceability of changes.
COREDO case studies: what worked in practice
- European payments provider with expansion into the United Kingdom and Singapore. The COREDO team implemented KYT integration with internal KYC and sanctions screening, deployed on‑chain sanctions screening and SAR automation. We combined graph algorithms for on‑chain investigations with rule‑based detectors, achieving a double‑digit reduction in false positives and shortening investigation time. As a result the company accelerated PI/EMI licensing and preserved SLAs for client‑facing payments.
- An OTC desk in Dubai with multichain flows. The solution developed at COREDO emphasized on‑chain transaction analytics to detect bridges, wrapped tokens and AMM anomalies. We set up address and wallet tracking, address attribution and clustering, as well as an incident response plan for detected money laundering. This enabled proper handling of cross‑chain flows and meeting the local regulator’s AML requirements for fintech companies.
- Fintech in the Czech Republic/Slovakia expanding into the EU. COREDO’s practice confirmed that integrating KYT into the onboarding process speeds up KYC through dynamic risk scoring of initial transactions. We ensured compliance with AMLD5/AMLD6, correlation of on‑chain and off‑chain data and automated reporting. The company gained transparency of chains and reduced incident costs.
- Licensing of a crypto service in Estonia and launch in the United Kingdom. The COREDO team prepared an AML policy, implemented address identification and wallet tagging, and deployed case management and workflow for analysts. A key element was explainable AI for fintech compliance: the regulator valued the transparency of scoring and the completeness of logs, which simplified the audit process.
Legal aspects: liability and cross-border data
Processes and team: how to avoid overload and burnout
Case management and workflow for analysts with investigation templates and playbooks reduce cognitive load. SOC/AML team organization and processes increase predictability and manageability of SLAs. COREDO’s experience shows that clearly defined roles, task rotation and quality control reduce turnover and increase the resilience of the AML function.
Data, vendors and security
Multi‑tenancy of SaaS KYT and data security require segmentation, encryption, access management and monitoring. DevOps and MLOps for production KYT systems help maintain release quality and rollbacks. Log auditability and an immutable trail simplify audits and build trust with the regulator and partners.
Cross-chain and the future: L2, rollups and new risks
The impact of L2s and rollups on transaction monitoring is growing: the volume of smart contract events increases, speed rises and attribution becomes more complex. Best practices for building a blockchain monitoring pipeline include deterministic indexing, retry queues, schema versioning and consistency checks. Scaling to millions of transactions per day requires horizontally scalable shards and backup strategies.
Total on‑chain traceability versus privacy‑enhancing tech is a balance between compliance and privacy. At COREDO we follow the principle of ‘minimum necessary’ storage of personal data and maximally preserve technical signals for risk detection. Past cases of address sanctioning and lessons learned help adjust rules and models in advance for new patterns.
Practical checklist: where to start and what to measure
- Determine target risk scenarios: sanctions, mixers, DeFi bridges, privacy coins, leaked keys.
- Choose the architecture: SaaS KYT vs on‑prem considering CAPEX/OPEX, GDPR and multi‑jurisdictional constraints.
- Build the pipeline: mempool parsing, streaming (Kafka/Kinesis), graph database (Neo4j/TigerGraph), search (ElasticSearch).
- Configure sanctions lists: OFAC, EU, UN, local watchlists, and the policy for updating them.
- Enable hybrid analytics: rule‑based detectors + ML (supervised/unsupervised), explainable AI.
- Run a backtest: precision/recall/F1 metrics, false negative tests, drift detection.
- Launch a pilot: TTV, SLA, reduction of false positives, alerts‑to‑SAR ratio, analyst efficiency.
- Formalize processes: case management, playbooks, incident plan, SAR automation.
- Prepare for audit: immutable logs, chain‑of‑custody, data‑sharing regulations between branches.
- Plan for growth: L2/rollups, DeFi risks, new networks, regular validation of rules and models.
How COREDO supports a project from licensing to production
COREDO covers the entire cycle: from registering legal entities in the EU, the UK, the Czech Republic, Slovakia, Cyprus and Estonia, to structuring in Singapore and Dubai. We assist with obtaining licenses (crypto, payments, forex and banking), develop AML policy, design KYT architecture and implement blockchain payments compliance. This approach eliminates gaps between the legal framework, processes and technology.
Conclusion
KYT is not just real-time analysis of blockchain transactions. It is the foundation of your license, payment speed, and market trust. When transaction monitoring is linked with KYC, sanctions screening, and clear investigation processes, fintech gains control over risk and predictable economics. COREDO’s experience in the EU, Asia, and the CIS shows: a well-designed KYT reduces operational costs, speeds time-to-market, and stands up to audits.
If you are building a payment service, a crypto platform, or expanding presence across multiple jurisdictions, start with a clear architecture, transparent metrics, and a pilot on real-world scenarios. The COREDO team has walked this path dozens of times and knows how to reconcile the requirements of AMLD5/AMLD6, the FATF Travel Rule, GDPR, and the specifics of DeFi. That way you’ll gain not just compliance but a competitive advantage—a resilient, scalable risk control built into the product.