KYT for crypto is a check of every deposit and withdrawal of digital currency within the flow of a customer's operations, not of a single address before a deal. NeuroVision assesses a transaction taking into account the customer's history and the signal for the counterparty's address, checks whether the payer and recipient data came with the transfer, which Article 7.2-1 of 115‑FZ requires from 1 September 2026, and flags mandatory monitoring transactions. Disputed transactions go to the queue of the responsible employee with a decision log.
Crypto transaction monitoring answers not the question “is the address clean” but the question “is the customer behaving normally”. An address check before a deal is on a separate page; here it is one of the signals of every transaction.
Receipts from external addresses, transfers to external addresses, exchange into roubles, transfers between customers inside the platform. Each transaction comes with its time, the amount in currency and in roubles, and the counterparty's address.
The sender's or recipient's address is taken into account at the moment of each transaction, not only at the first deal. The result of the address check is a separate signal; how it is obtained is described on the address check page.
Usual amounts, frequency and range of addresses. A transfer ten times larger than usual or a first withdrawal to a new address is a signal even if the recipient has no flags.
One external address tops up the accounts of different customers, or several customers withdraw to one address. A single address does not show this — only the flow of all the platform's transactions does.
Whether the full name and identifier address came with the transfer, and for amounts over RUB 60,000 the address, date of birth and INN; whether the payer's data match the results of their identification. In detail — in the next section.
Purchase and sale of cryptocurrency and movements between the depository's addresses and external addresses from RUB 1 million receive a flag and a reporting deadline — three business days. Which transactions fall into this list — below.
Federal Law of 4 August 2026 No. 283‑FZ added Article 7.2-1 to 115‑FZ: from 1 September 2026 a transfer of digital currency and digital rights goes together with information about the payer and the recipient. In international practice the same requirement is called the Travel Rule — what it is under FATF standards is explained in the article on KYT and the Travel Rule. In monitoring, each row below is a separate transaction check.
Exchange of digital currency for roubles and back, except for deals where a central counterparty is a party (subpara. 8, para. 1, Art. 6). Threshold — RUB 1 million.
Acquisition of digital rights on issue and their redemption (subpara. 9). More about CFA operators — on the page for CFA platforms.
Digital currency or rights arrive at an address administered by a digital depository from an address it does not administer (subpara. 10).
The reverse movement: from the depository's address to an address outside its administration (subpara. 11). This is where the trail of funds most often breaks.
Transactions with persons, accounts and addresses linked to states that do not comply with the FATF recommendations; the list is determined by the Government (subpara. 2, para. 1, Art. 6).
Digital currency or rights as payment under a contract between a resident and a non-resident — from RUB 10 million (para. 1.12, Art. 6).
From 1 September 2026 Article 6 of 115‑FZ explicitly names transactions with digital currency and digital rights. Information about them is sent to Rosfinmonitoring no later than three business days after the transaction (para. 3, Art. 7). Monitoring sets the flag automatically — the employee sees the deadline and the grounds.
Mandatory monitoring is not the same as suspicion: a transaction can be legitimate and still subject to reporting. Suspicious transactions are identified under internal control rules at any amount.
Five steps for every deposit and withdrawal. For a withdrawal the check runs before the order is executed, for a deposit — before crediting to the customer's account.
Your system sends the transaction: customer, token, amount, counterparty address, and the payer and recipient information if it came with the transfer. The rouble equivalent is calculated at the time of the transaction.
The set of information is checked for the amount: up to RUB 60,000 or over, and whether the payer's data match the customer's profile form. No data — an “incomplete information” flag and an action from your rules.
The signal for the counterparty's address is taken into account, and the transaction is compared with the customer's profile and recent transactions: whether there is structuring, transit or addresses shared with other customers.
The result is a risk level based on the sum of the rules triggered, their list, and a mandatory monitoring flag if the transaction is on the list in Art. 6 and above the threshold.
Low risk — the transaction goes through. The rest go to the responsible employee's queue: the decision, grounds and time are saved with the transaction and go into the report.
Many transfers just under RUB 60,000
Nine withdrawals of RUB 58–59 thousand within two hours to different addresses — this is how the full set of data and the mandatory monitoring threshold are bypassed. The rule adds up the customer's amounts over a time window.
An account as a transit point
A receipt from an external address and a withdrawal of almost the whole amount within an hour, with no trading or exchange. The platform becomes a link in the chain, and the customer — a conduit.
Funds are run through intermediate wallets
The customer withdraws to a new address, from there the funds are scattered in small parts and after several steps converge on one address. The link is visible in the history, not in the recipient's address alone.
Collecting funds from strangers
Transfers arrive in the account from dozens of different addresses and from different payers, then everything leaves in a single withdrawal. A typical trace of a money mule and of collecting money from fraud victims.
One wallet — several accounts
Different customers top up their accounts from one external address or withdraw to one. A sign of nominee customers and of limit evasion — check who is behind the accounts.
115‑FZ
A flow of transactions
For every stopped transaction you can see which rules were triggered. The employee checks the reasons rather than guessing from a single sign.
Internal control rules become “if — then” conditions: amount, direction, time, counterparty country. The thresholds of RUB 60,000 and RUB 1 million come from the law; the employee adds their own rules in the back office.
A withdrawal of RUB 300 thousand is usual for a trader and unusual for a customer who has been topping up the account with RUB 5 thousand for a year. Comparison with the customer's own history helps filter out unnecessary alerts.
The result of the counterparty address check is one of the rule signals alongside the amount, customer profile and flow. How the address is checked — on a separate page.
The rule runs in observation mode: it counts which transactions it would have stopped but does not intervene. The results show how many schemes it finds and how many honest customers it affects.
From 1 September 2027 a digital depository executes a transfer of more than RUB 100 thousand to an address it does not administer, and of more than RUB 300 thousand to third parties, no earlier than after 48 hours, and before the transaction checks it against the information of the “Antifrod” state system (parts 7, 9, 11, Art. 45 of 282‑FZ). Monitoring puts such a withdrawal in a queue with a timer and during those hours finishes calculating the flow's risk. How to connect to the “Antifrod” state system
Article 7.2-1 is addressed to those who execute transfers, Article 6 — to all subjects of 115‑FZ through which transactions pass. The others need monitoring so as not to become a link in someone else's chain.
Monitoring is only as accurate as the profile is complete. Customer data are also needed for the check under part 4 of Art. 7.2-1: the payer's information must match the results of their identification.
Who opened the account — from the KYC session and database checks.
External addresses from which the customer tops up the account and to which they withdraw.
The customer's transaction history on the platform.
Monitoring is priced by the number of transactions and the deployment option. Customer database checks — per the price matrix, with no subscription fee.
on request
Flow rules, data checking under Art. 7.2-1, mandatory monitoring flags, a queue and a log. The price depends on the number of transactions per month
5 ₽
per check: Rosfinmonitoring lists, sanctions, passport validity and others
36 ₽
per check: sanctions and PEP in one request — for non-residents
Address check before a deal — on a separate page, customer KYC by passport — from RUB 16, with liveness — from RUB 29.
We start the pilot in observation mode on a copy of your flow: the rules count but do not intervene. NeuroVision engineers support the integration.
Terms of 115‑FZ, 282‑FZ and KYT practice that appear in the rules and the log.
This is monitoring of a customer's crypto transactions: every deposit and withdrawal of digital currency is compared with the customer's profile and history of transactions, the signal for the counterparty's address is taken into account, the payer and recipient data are checked, and disputed transactions are sent for review to the responsible employee. A general overview of KYT is in the blog article, monitoring of rouble transactions — on the page KYT.
The law does not contain the words “Travel Rule”, but from 1 September 2026 Article 7.2-1 of 115‑FZ applies: a digital depository and an information system operator ensure the transfer of information about the payer and recipient in a transfer of digital currency and digital rights. Over RUB 60,000 — the full set, up to RUB 60,000 — full name and identifier address. How the Travel Rule works under FATF standards is described in the article on KYT and the Travel Rule.
A wallet check assesses a single address before a deal. KYT looks at the flow of a customer's transactions over time and finds what a single address does not show: structuring below the threshold, transit, shared addresses across different customers. The address check result is here one of the signals for every transaction.
KYT solves the AML/CFT task: it looks for laundering and for transactions that must be reported under 115‑FZ. Fraud monitoring protects the customer's money from theft under 161‑FZ: transfers made under dictation, account takeover. More — on the page fraud monitoring.
From 1 September 2026 — purchase and sale of digital currency (except for deals with a central counterparty), acquisition of digital rights on placement and their redemption, receipt to a depository address from an external address and withdrawal to an external address (subparas. 8–11, para. 1, Art. 6 of 115‑FZ), from RUB 1 million. Separately — transactions with addresses linked to states outside the FATF recommendations, and settlements under foreign trade contracts from RUB 10 million.
The recipient's side identifies such transfers and may refuse crediting or not credit the funds until it receives full information, and then complete the transaction (parts 8–10, Art. 7.2-1). In monitoring, such a transfer receives an “incomplete information” flag and goes into the queue.
Technically yes, which is why the monitoring rules add up the customer's transfers over a time window and flag series of amounts just below the threshold. In addition, where money laundering is suspected, the full set of data is collected for any amount (part 3, Art. 7.2-1).
We agree the list of networks and tokens at connection: tell us which you need, and we will explain the options and timescales.
No. Reports on mandatory monitoring and suspicious transactions are sent by your organisation through its personal account on the Rosfinmonitoring website — no later than three business days. Monitoring prepares a list of such transactions with grounds and deadlines and keeps the decision log.
Monitoring is priced by the number of transactions and the deployment option — leave a request and we will send a quote. Customer database checks — per the price matrix: RUB 5 per check, international screening — RUB 36.
Tell us which directions and volumes you need to monitor — we will offer a pilot in observation mode and send a quote.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a callThe company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
