KYT (Know Your Transaction): What It Is, How Transaction Monitoring Works, and Where the Travel Rule Fits In

KYT is one of those compliance-conversation abbreviations that’s almost always mistaken for either a legal requirement or a phrase from the FATF Recommendations. Neither is true: behind the term is an industry practice that both the law and the regulator are familiar with — just under different names.

What KYT Is, in Simple Terms

KYT is the monitoring of a customer’s transactions and the assessment of their risk throughout the relationship: a system or a specialist checks each transaction against the customer’s profile, their behavioral history, and a set of rules, in order to spot a deviation and flag it in time. The term arose by analogy with KYC (Know Your Customer) and took hold primarily in the crypto industry, where it came to mean monitoring virtual asset transfers.

The phrase “KYT is continuous transaction control” comes up often, but no source actually requires the word “continuous” — it’s more accurate to speak of ongoing monitoring: it runs throughout the customer relationship, not only at onboarding.

Why KYT Isn’t a Statutory Term

This can be checked directly. The word “KYT” doesn’t appear even once in the Russian translation of the FATF Recommendations (an unofficial translation by MUMCFM, hosted on the EAG website; 192 pages, updated in June 2026) — nor does it appear in Articles 6 and 7 of 115-FZ, read in full. Russian legislation itself uses the word “operation” (операция), not “transaction” (транзакция), at all.

The closest regulatory equivalent in Russia isn’t “KYT” — it’s the wording in Bank of Russia Regulation No. 860-P of 18 June 2025: a credit institution’s internal control rules must include “a program for identifying, in customer activity, transactions subject to mandatory control, digital ruble transactions subject to mandatory control, suspicious transactions, suspicious digital ruble transactions, suspicious activity, and suspicious digital ruble activity” — one of the programs making up the internal control rules. In other words, what the industry calls KYT, the regulator calls a program for identifying transactions and suspicious activity.

KYT, KYC, and AML: What’s the Difference

The three terms are often lined up in a scheme like “KYC is who, KYT is what, AML is risk,” but that simplification is misleading in two places at once: KYT doesn’t “come after” KYC — they feed each other — and AML doesn’t “include” KYT as a sub-item in a scheme; it’s the legal framework within which both practices exist.

The line between KYC and KYT is blurry: the results of transaction monitoring can become grounds for updating customer information, and the customer profile built during KYC verification sets the expected behavior that new transactions are compared against. Under 115-FZ, information is updated at least once every three years for low-risk customers, at least once a year for the rest, and within seven business days if doubts arise about the accuracy of the data — these timeframes belong to KYC, not KYT, but they’re exactly what shapes the profile that monitoring relies on. For how these requirements are met in practice, see the NeuroVision AML solutions page.

How Transaction Monitoring Works

The logic of monitoring is a chain, not a single mechanism; each step in it solves its own task:

Rules, Thresholds, and the Customer Profile

Rules and thresholds are the basic mechanism of monitoring. Some are set by law — for example, the mandatory control thresholds under 115-FZ. Some the organization sets itself, in its internal control rules, based on its own risk assessment. The rules come first; everything else — the customer profile, behavioral history, models — is built on top of them. Without a customer profile, a rule turns into a crude filter on amount alone: the profile and transaction history are needed to tell a specific customer’s normal behavior apart from what’s atypical for them.

From Alert to Specialist Decision

An alert isn’t an accusation or a ready-made conclusion — it’s an indication that a transaction or a set of a customer’s transactions needs human attention. Reviewing it is the job of a designated compliance officer, who weighs the alert against the customer’s history, other transactions, and the data available — and the final decision depends on that context.

Where Machine Learning Helps, and Where Rules Are Enough

Machine learning is not a mandatory element of monitoring — no regulatory source reviewed requires it. Some systems apply machine learning to find anomalies and reduce the share of false positives, but rules and thresholds remain the basic mechanism. A separate add-on is link analysis (the industry calls it graph analysis): it helps reveal chains of transfers and connected accounts, but it too isn’t a mandatory requirement — it’s a decision an organization makes on its own.

Why False Positives Are Unavoidable

The broader and cruder a rule is, the more transactions it flags without real grounds — this is a manageable quantity, not a system defect. The topic of false positives, and how they’re reduced without losing the quality of the check, is covered in detail in the article “False Positives in AML Screening”.

It’s worth separately noting: real-time monitoring is not a mandatory requirement of the standard. For example, the Interpretive Note to Recommendation 16 (INR.16, paragraph 28), as rendered in the unofficial Russian translation prepared by MUMCFM, explicitly allows that a receiving financial institution’s measures for detecting transfers lacking the required information may include post-event monitoring or, where feasible, real-time monitoring — meaning both options are named on equal footing.

What Signs Raise a Transaction’s Risk

Some signs are direct statutory grounds for documenting information under Article 7(2) of 115-FZ:

• a confusing or unusual nature of the deal, with no obvious economic sense or obvious lawful purpose
• a deal inconsistent with the purposes of the organization’s activity as set out in its founding documents
• repeated transactions or deals whose nature gives grounds to believe their purpose is evading mandatory control procedures (the industry calls this structuring)
• a transaction by a customer about whom the authorized body has sent an inquiry
• a customer’s refusal to carry out a one-off transaction that raises suspicion
• a customer’s decision to refuse to establish a relationship or to terminate one, where there are reasonable grounds to suspect this is connected with the conduct of internal controls

In addition, as industry indicators not tied to any specific provision: rapid transit of funds, a sharp change in transaction volume, atypical geography, a departure from the customer’s usual behavior, and unusual transfer chains.

None of the signs listed on its own means a crime has occurred, and none automatically makes a transaction suspicious. Under the law, it’s grounds for documenting the information and further assessment: suspicion arises among the organization’s staff as a result of applying the internal control rules — it doesn’t trigger on its own.

A separate note on source freshness: the signs of unusual deals used to be tied to Bank of Russia Regulation No. 375-P, but that regulation has been superseded — replaced by Regulation No. 860-P of 18 June 2025. The specific indicator codes from the annex to 860-P aren’t given here: that level of detail requires a separate check.

The Travel Rule: What It Is and Who It Affects

The Travel Rule is a rule requiring a transfer to be accompanied by information about the sender and the recipient. The term “Travel Rule” doesn’t appear in the Russian translation of the FATF Recommendations at all — not once across 192 pages; it’s an industry name that took hold in the crypto industry.

In June 2025, FATF revised Recommendation 16 — exactly what changed, and how virtual assets fit into it, is covered below, in the section on implementation. The Russian translation of the FATF Recommendations, prepared by MUMCFM and hosted on the EAG website, was updated in June 2026 and contains the revised Recommendation 16, “Payment Transparency.” The translation is unofficial: FATF publishes the original text of the standard. The verbatim data requirements and thresholds below are given according to the translation of the FATF Recommendations updated in June 2026.

How Recommendation 15 and Recommendation 16 Are Connected

The precise structure has three layers, and collapsing them into the single phrase “the Travel Rule is Recommendation 16” is a mistake:

• Recommendation 15, “New Technologies,” requires countries to ensure virtual asset service providers (VASPs) are regulated for AML-CFT purposes, licensed or registered, and subject to effective monitoring systems
• the Interpretive Note to Recommendation 15 (INR.15), paragraph 7(b), extends the requirements of Recommendation 16 to virtual asset transfers
• Recommendation 16, “Payment Transparency,” sets out the substance of the requirement itself: a transfer must be accompanied by information about the sender and the recipient

FATF itself frames this link in its July 2026 report: “The Travel Rule applies the FATF’s payment transparency requirements (FATF Recommendation 16) to the VA context.”

What Data Is Transmitted, and Who’s Responsible

The obligations are spelled out in the Interpretive Note to Recommendation 15 (INR.15), paragraph 7(b):

• The ordering VASP obtains and holds required and accurate originator information and required beneficiary information on virtual asset transfers, submits it to the beneficiary VASP or financial institution immediately and securely, and makes it available to appropriate authorities upon request
• The beneficiary VASP obtains and holds required originator information and required and accurate beneficiary information, and makes it available to authorities upon request

Notice the asymmetry in the word “accurate”: for the ordering VASP, accuracy is required for the originator’s data; for the beneficiary VASP, for the beneficiary’s data. A feature specific to virtual assets: the information can be transmitted directly or indirectly, and it doesn’t have to accompany the transfer itself — for bank transfers, the data travels with the payment message, while for virtual assets a separate channel is more often used.

The data set for a cross-border payment or transfer of value above the minimum threshold (INR.16, paragraph 9):

• the name of the sender and the recipient
• the account number of the sender and the recipient, if an account is used; if there’s no account, a unique transaction reference number (paragraph 9(b))
• the sender’s address, as well as the recipient’s country and city
• the sender’s date of birth, if the sender is a natural person
• if the sender and/or the recipient is a legal entity, where available: an associated BIC (Business Identifier Code), an LEI (Legal Entity Identifier), or a unique official identifier

Is There a Threshold Below Which the Rule Doesn’t Apply

This is the most common distortion on the topic: there are two different thresholds of USD or EUR 1,000, and they’re constantly confused.

What’s Happening With Implementation: FATF Data for 2026

According to FATF, on 18 June 2025 it published amendments to Recommendation 16, agreed at its June 2025 plenary meeting, and renamed it — it’s now called “Payment Transparency.” Countries are expected to be ready to implement the updated requirements by the end of 2030 — a deadline for countries, not for individual companies. The revision responds to a changing payment landscape: the diversity of payment products and market participants, new technologies and messaging standards, and the evolution of risks.

The revision also extends to virtual asset transfers: the Interpretive Note to Recommendation 15 points to the updated data set — name, account number or a unique transaction reference number, the sender’s address, the recipient’s country and city, the sender’s date of birth if a natural person, and for legal entities a BIC, an LEI, or a unique official identifier — or to equivalent information as applied to virtual assets. The minimum threshold is retained: countries may adopt a threshold of no more than USD/EUR 1,000 for cross-border payments and transfers of value, excluding cash withdrawals, and, under the new provision, separately for domestic transfers. As of publication, FATF’s guidance on applying the revised Recommendation 16 hadn’t yet been finalized: the draft was out for public consultation from 24 June to 21 August 2026 and, according to FATF, doesn’t change the obligations of the updated recommendation but clarifies how they apply.

How far the Travel Rule has actually been implemented in practice is shown by the FATF report “Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs” from July 2026: 83% of respondents (91 of 109 jurisdictions) had passed legislation implementing the Travel Rule, with another 11 of 109 reporting that they were in the process of doing so. A more telling figure: 60% (55 of 91) of the jurisdictions that had already passed such legislation had not yet issued findings or guidance, or taken supervisory or enforcement action against VASPs over Travel Rule compliance. The gap between passing a law and actually applying it is the thing worth remembering from this data.

KYT in Crypto Services vs. Banks: What’s Different

The general logic of monitoring is the same: a stream of transactions, rules and thresholds, risk assessment, detecting deviations, an alert, human review. But the implementation differs markedly.

A Russian detail almost nobody writes about: Federal Law No. 283-FZ of 4 August 2026 added new types of mandatory-control transactions to Article 6 of 115-FZ — the purchase and sale of digital currencies, the acquisition and redemption of digital rights, and also crediting digital currencies or digital rights to an identifier address administered by a digital depositary from an identifier address not administered by a digital depositary, and the reverse transfer. This is the closest Russian equivalent to the topic of non-custodial wallets, and the threshold for these transactions is the common one — ₽1 million. Law No. 283-FZ took effect on 1 September 2026, and it sets no separate deadline for these provisions — meaning they’ve been in effect since that date.

KYT and 115-FZ: The Russian Framework

Mandatory Control: There’s No Single Threshold

The claim “mandatory control starts at ₽600,000” is contradicted by the text of the current version of the law — thresholds vary by type of transaction:

There’s no single mandatory-control threshold: the law sets different thresholds for different types of transactions. The baseline threshold under Article 6(1) is ₽1 million, and “₽600,000” is the threshold only for transactions between a separate state defense order account and any other accounts (paragraph 1.4); movement between separate state defense order accounts, starting from the second credit, is controlled from ₽10,000,000.

Suspicious Transactions and Reporting Deadlines

Mandatory control and detecting suspicious transactions are different procedures, with different timeframes and different starting points. Information on mandatory-control transactions is submitted to the authorized body no later than three business days following the day the transaction is carried out (Article 7(1)(4)). Information on suspicious transactions is sent no later than three business days following the day such transactions are detected — regardless of whether the transaction itself is on the Article 6 list (Article 7(3)).

Bank of Russia Regulation No. 860-P separately distinguishes between “suspicious transactions” and “suspicious activity”: a single transaction can be normal even when a customer’s overall pattern of conduct isn’t.

The obligation to maintain internal control rules and appoint a designated compliance officer responsible for implementing them doesn’t fall on every company — only on the organizations listed in Article 5 (banks, professional securities market participants, insurance organizations, pawnshops, payment acceptance operators, and others) and the persons specified in Article 7.1 (attorneys, notaries, persons providing legal and accounting services) — and only when carrying out certain transactions on a customer’s behalf or by their instruction. For more on exactly who 115-FZ applies to and how financial monitoring works, see the article “AML/CFT in Simple Terms”; the requirements of 115-FZ as they apply to fintech companies are covered in the article “Fintech Compliance Under Federal Law 115-FZ”.

Why Mandatory Control Isn’t KYT

Equating “KYT = mandatory control” is wrong. Mandatory control is a list of transaction types set by law (including transactions Rosfinmonitoring is entitled to define under Article 6(1.9)): if a transaction is on the list and exceeds the threshold, the information is sent regardless of whether it raises suspicion or not. A KYT system works not only off formal mandatory-control thresholds, but also off risk assessment and deviations. The internal control rules are an organization’s internal document, including, among other things, a program for identifying such transactions; a KYT system is a tool that helps implement that program. The two concepts partly overlap, but they aren’t the same.

Checking transactions and their parties against the lists of persons connected to extremism and terrorism, as well as against sanctions lists, is a separate task, applied to both the customer and the parties to the transaction. For more on how list screening and politically exposed person (PEP) risk assessment work, see the article “How Sanctions Screening, PEP Checks, and Risk Profiling Work”.

How KYT Differs From Anti-Fraud

Overlaps are possible, and that’s normal: both systems look at the flow of transactions and build rules on top of it. But the roles differ — the task, who receives the result, and the time horizon are all different. For more on the architecture of a system that hunts for fraud in real time, see the article “Anti-Fraud System: Architecture and Real-Time Fraud Monitoring”.

How to Build Transaction Monitoring: Where to Start

For an organization implementing or revising transaction monitoring, the usual sequence looks like this:

• determine whether the organization is subject to Article 5 or Article 7.1 of 115-FZ, and exactly which transactions fall under mandatory control
• set out, in the internal control rules, a program for identifying transactions subject to mandatory control and suspicious transactions, and appoint a designated compliance officer
• set thresholds and rules — both the statutory ones and the organization’s own, based on its customer risk assessment
• build a customer profile and typical behavior pattern, to distinguish normal transactions from atypical ones
• build in screening against the lists of persons connected to extremism and terrorism and against sanctions lists
• set up a route for specialist review of alerts and a procedure for recording decisions
• as the transaction flow grows — consider automating data collection, rule application, and initial risk assessment, while leaving the decision on disputed alerts to a specialist

According to its product page, the NeuroVision KYT platform supports configuring custom scenarios and triggers — amount limits, transaction types, geography, frequency, links between accounts — connecting to sanctions lists, KYC databases, core banking systems, and payment gateways, and support for STR/SAR reporting formats (suspicious transaction reports). Some systems also apply machine learning to find anomalies in customer behavior.

FAQ

What is KYT, in simple terms?

KYT is the ongoing monitoring of a customer's transactions and the assessment of their risk: a system or a specialist checks a transaction against the customer's profile and behavioral history, to spot a deviation. It's the industry name for the practice, not a statutory term.

How does KYT differ from KYC?

KYC is establishing and verifying information about the customer themselves, at onboarding and when data is updated. KYT is monitoring the customer's transactions throughout the relationship. They don't hand off to each other in sequence: the results of monitoring can become grounds for updating customer information, and the profile built during KYC sets the expected behavior for KYT.

What is the Travel Rule, and who does it affect?

The Travel Rule is a rule requiring a transfer to be accompanied by information about the sender and the recipient. The term “Travel Rule” is an industry name, not a definition from the standard; in the FATF Recommendations its substance is set out in Recommendation 16 and extended to virtual assets through the Interpretive Note to Recommendation 15 (INR.15, paragraph 7(b)). It affects virtual asset service providers (VASPs) and financial institutions sending or receiving such transfers.

Is there a threshold below which the Travel Rule doesn't apply?

The requirement doesn't disappear at any amount. There's an optional threshold of no more than USD/EUR 1,000, below which a country may allow a reduced data set — just the sender's and recipient's names and each party's account number or a unique transaction reference number. This is separate from the customer due diligence threshold, also USD/EUR 1,000, but under a different provision.

What does KYT stand for?

Know Your Transaction. By analogy with KYC (Know Your Customer), but the object of attention isn't the customer's identity — it's their transactions.

How does KYT differ from AML?

AML (Anti-Money Laundering) is an organization's entire set of measures against money laundering and terrorist financing — the legal and organizational framework. KYT is one of the practices within that framework, alongside KYC: specifically, monitoring transactions and assessing their risk.

Which transactions are subject to mandatory control under 115-FZ, and is there a single threshold?

There's no single threshold. The baseline threshold for most types of transactions is ₽1 million; for real estate deals, not less than ₽5 million; for transactions between a separate state defense order account and other accounts, ₽600,000 (movement between separate state defense order accounts, starting from the second credit, is from ₽10 million); for a postal money order, ₽100,000; for transactions on the instructions of a foreign-citizen or foreign-legal-entity customer, ₽50,000 or ₽500,000 respectively; and for a number of transactions there's no threshold at all. The full list and thresholds are set out in Article 6 of 115-FZ.

What counts as a suspicious transaction?

A transaction or a pattern of a customer's conduct that the organization's staff, applying the internal control rules, come to suspect is aimed at money laundering or terrorist financing. Grounds for documenting it include, for example, a confusing deal with no obvious economic sense, or repeated transactions suggesting an attempt to evade mandatory control. No single sign on its own proves a violation.

What's the deadline for reporting to Rosfinmonitoring?

The deadline depends on the type of transaction. For mandatory-control transactions — no later than three business days following the day the transaction is carried out. For suspicious transactions — no later than three business days following the day they're detected. The starting points differ: the first is counted from when the transaction occurs, the second from when it's discovered.

Is KYT mandatory under Russian law?

The term “KYT” doesn't exist in the law, so it can't be mandatory in that form. But the obligation to monitor transactions and identify mandatory-control transactions and suspicious transactions does exist — it applies to the organizations listed in Article 5 of 115-FZ and the persons specified in Article 7.1, and is implemented through internal control rules that include a program for identifying such transactions.

Does a bank need KYT, and does a crypto service — is there a difference?

The logic of monitoring is the same for both, but the implementation differs. At banks, information about the other party to a transaction is almost always held by the servicing financial institution, and the data travels with the payment message. At crypto services, the other party to a transfer may have no servicing provider at all, and Travel Rule information is transmitted through a separate channel.

Can transaction monitoring be fully automated?

Part of the process — data collection, applying rules, and initial risk assessment — lends itself to automation, and some systems use machine learning for this. But the decision on an alert that needs attention is made by a specialist: no regulatory source treats an automated system as a replacement for that review.