What is KYT (know your transaction)?

Blockchain analytics screening that exchanges run on deposits and withdrawals to see whether an address is linked to sanctions, ransomware, darknet markets, or a known hack.

A flagged deposit can freeze an account while the exchange asks where the funds came from. It complements kyc, which identifies the person rather than the coins.

The part that surprises people is that a flag does not require you to have done anything. Screening scores an address by its connections, and connections can be inherited from counterparties you never chose, which is why a legitimate user can trip a review.

How it works

Public blockchains record every transfer, so an analytics provider can build a graph of addresses and follow value between them. Addresses get labeled from a mix of sources: sanctions designations published by authorities, addresses recovered in law enforcement actions, exchange deposit addresses identified through their own patterns, and clustering that groups addresses under common control.

An exchange sends each incoming and outgoing address to a provider and receives a risk assessment. That assessment typically considers direct exposure, meaning the counterparty itself, and indirect exposure, meaning what the funds touched a few hops back. A withdrawal to a flagged address may be blocked outright. A deposit from one may be credited but frozen pending review.

The legal driver is sanctions compliance rather than general suspicion. The United States Office of Foreign Assets Control publishes designated addresses in its Specially Designated Nationals list, and a firm that processes a transfer involving one has a strict liability problem. Reporting obligations follow separately: in the United States, a venue that identifies suspicious activity files a suspicious activity report and is generally prohibited from telling the customer it did so.

Two known imprecisions matter. Clustering heuristics are inferences and can be wrong. And exposure from mixers or from a chain of intermediate hops attaches to funds that pass through, so receiving coins that were previously in a flagged wallet several transfers ago can produce a score you had nothing to do with.

Example

Illustrative walkthrough. You sell an item privately and are paid in Bitcoin. Your buyer bought those coins from someone who had withdrawn them from a mixing service. You deposit them to an exchange. The screen returns indirect exposure to a mixer two hops back, and the venue holds the deposit pending a source of funds explanation. You provide the sale details and the counterparty's information, and the deposit is released after review. You did nothing wrong at any point, and the delay was still real.

Why it matters when you buy

Buying on a regulated exchange and holding there involves no screening exposure of this kind. It arises when you move coins in from elsewhere, which is why the origin of funds you deposit matters more than most people expect. The exchange pages cover each venue's disclosures, and exchange freezes and withdrawals covers what to do when a balance is held.

Related terms

• kyc: verifying the person rather than the funds
• chain analysis: the graph analysis behind a score
• ofac screening: sanctions lists applied to addresses
• mixer: a common source of indirect exposure
• suspicious activity report: the filing a flag can trigger
• travel rule: identity data sent alongside transfers

Questions

Can I check an address before depositing?

Some analytics providers offer free lookups, and they are indicative rather than authoritative. They will not necessarily match the specific provider and thresholds your exchange uses.

What happens if my deposit is flagged?

The venue typically holds it and asks for an explanation of where the funds came from. Documentation of the transaction and counterparty is what resolves it, and timelines vary widely.

Does using a privacy tool get me banned?

Many regulated venues treat exposure to mixing services as high risk, and some decline the deposit outright. Policies differ, and the venue's own terms are where the rule is stated.