The three procedures answer three different questions. KYC (Know Your Customer) — who is your customer. KYB (Know Your Business) — what company is in front of you and who really owns it. KYT (Know Your Transaction) — where the money came from and where it goes. The first two happen once, at the entrance. The third one never ends.
Confusing them is expensive: a company rolls out identity verification, considers compliance done, and then gets its first deposit blocked by a partner bank. This is especially true for stablecoins — according to the latest FATF targeted update on virtual assets, they now account for most of the illicit on-chain activity being detected.
Three questions, three checks: KYC, KYB and KYT compared
The simplest way to separate them is by what they examine: a person, a company, a transaction.
| KYC | KYB | KYT | |
|---|---|---|---|
| What it checks | an individual | a legal entity | an address and a transaction |
| Core question | who are you | what company is this and who owns it | where did this money come from |
| When it happens | at customer onboarding | when onboarding a partner or corporate client | at every operation |
| How often | once, with periodic review | once, with periodic review | continuously |
| Data sources | documents, biometrics, sanctions and PEP lists | company registries, licences, ownership structure | blockchain analytics, address labels, risk scoring |
| What you get | a confirmed identity | a confirmed company and its beneficial owners | a risk assessment of specific funds |
The key difference is not depth but timing. KYC and KYB answer «who is this» at the moment you meet. KYT answers «what is this money» every time the money moves.
KYC: who your customer is
Customer identification is the most familiar procedure: an ID document, a selfie with a liveness check, screening against sanctions lists and lists of politically exposed persons.
Higher-risk customers go through Enhanced Due Diligence: additional documents, proof of source of funds, more frequent profile reviews.
What KYC does not show: it confirms that a person is who they claim to be, but says nothing about the money that person handles. A passport does not contain a wallet history.
What KYC in cryptocurrency is and how to complete verificationRead more
KYB: what business you are dealing with
When the customer is a company rather than a person, the scope of the check grows sharply. You verify registration and current status, jurisdiction, licences, the nature of the business, the sanctions status of the company and its management — and the ownership structure.
Beneficial owners are the most common blind spot. A company can be registered impeccably while a sanctioned individual sits behind a chain of holdings. In the European Union, beneficial ownership disclosure starts at 25% or more of shares or voting rights — a single threshold set by the updated EU AML package.
For crypto businesses, KYB matters not only for corporate customers but also when onboarding merchants, partner exchange services and agents.
KYT: where the money comes from and where it goes
Transaction monitoring is the only one of the three that continues after onboarding. It looks at the funds rather than the customer: which addresses the coins came from, which services they passed through, whether their history includes mixers, sanctioned addresses, darknet markets, stolen funds or exchanges without verification.
Both directions need screening. Incoming operations protect you from accepting funds that get your own deposit frozen at a partner bank or exchange. Outgoing ones protect you from sending funds to a sanctioned address, which turns a routine operation into a violation.
What KYT is in crypto and how transaction monitoring worksRead more
Why KYC without KYT leaves the risk open
Picture a typical situation: a customer passes full verification on Monday — documents in order, no sanctions hits. On Tuesday they deposit funds that, two transfers earlier, left a wallet linked to an exchange hack.
The reverse is equally true: KYT does not replace identification. Analytics show that funds are risky, but not who stands behind the address or whether you can work with that person.
How the three checks work together
In practice, the procedures line up along the customer lifecycle:
- 1. A customer arrives — KYC runs for an individual, KYB for a company.
- 2. Based on the result, the customer receives a risk profile and limits.
- 3. Every operation passes through KYT screening, both inbound and outbound.
- 4. A triggered rule creates an alert: the operation is paused and a compliance officer reviews the case.
- 5. If suspicions are confirmed, internal measures and a report to the supervisor follow, and the customer's risk profile is revised.
All three are parts of one anti-money laundering system. KYC and KYB decide who you let in; KYT decides what you let through.
What AML in cryptocurrency is and how it worksRead more
What your business actually needs
The set of procedures depends on who you work with and how.
| Type of business | KYC | KYB | KYT |
|---|---|---|---|
| Crypto exchange | required | for corporate clients | required |
| P2P platform | required | — | required |
| OTC desk | required | required | required |
| Crypto processing and payments | depends on the model | required, for merchants | required |
| Exchange service | required | — | required |
| Custodial wallet | required | — | required |
If resources are tight and you cannot roll out everything at once, most teams start with transaction monitoring. The reason is practical: KYT connects through an API faster than a document verification process can be built, and it closes the most frequent incident — a blocked deposit and a dispute with a banking or exchange partner.
What regulation requires
Requirements differ in detail across jurisdictions, but they agree on the essentials: identify the customer and monitor the operations, both at once.
- FATF. Recommendation 15 extends anti-money laundering requirements to virtual asset service providers; Recommendation 16 — the Travel Rule — requires originator and beneficiary data to travel with the transfer.
- European Union. MiCA governs crypto-asset service providers, while the updated AML package sets common requirements for identification, beneficial ownership and monitoring; the AMLR applies from 10 July 2027, with supervision coordinated by the newly created AMLA.
- United States. The Bank Secrecy Act and FinCEN rules require financial institutions, crypto services included, to monitor operations and report suspicious ones.
Five common mistakes
Where to start
The easiest way to work out which procedures you need is to look at your actual flow of operations. We show risk assessments from several providers at once — Crystal Intelligence, VALEGA Chain Analytics and BitOK — along with the discrepancies between them, so that decisions are not based on a single opinion.
AML is the whole anti-money laundering system: policies, procedures, reporting. KYT is a specific instrument inside it, responsible for checking transactions and addresses.
