Transaction monitoring (KYT) best practices for payments

Transaction monitoring, often referred to as KYT or know-your-transaction, is the discipline of reviewing payment activity to detect behaviour indicative of money laundering, sanctions evasion, fraud or terrorist financing. For banks, money services businesses and fintechs settling in stablecoins, transaction monitoring must reconcile two worlds: the structured messaging of correspondent banking and the public, pseudonymous ledgers on which stablecoin value moves. The practices below describe how to build a monitoring programme that is risk-based, defensible and proportionate to both.

Ground transaction monitoring in a risk-based approach

A monitoring programme should be calibrated to the institution’s assessed risk rather than applied uniformly. Rules, scenarios and thresholds ought to reflect the customer’s profile, the products in use, the jurisdictions and corridors involved, and the settlement asset. A low-value domestic remittance carries different risk from a high-value cross-border stablecoin transfer to a newly observed counterparty, and the monitoring logic should distinguish between them. Aligning scenarios to recognised typologies — such as those published by FATF and national financial intelligence units — keeps coverage current as laundering methods evolve.

Combine behavioural baselines with real-time and retrospective monitoring

Static thresholds alone produce blunt results. Mature programmes establish behavioural baselines for each customer or segment, so that deviations — sudden velocity changes, structuring patterns, dormant accounts reactivating, or transactions inconsistent with a stated business model — surface as anomalies. Monitoring should operate across two horizons. Real-time screening can hold or decline a payment before settlement, which is essential for sanctions exposure and high-risk corridors. Retrospective monitoring runs over completed activity to detect patterns that only emerge across time and multiple transactions.

• Define scenarios against documented typologies and review them as new methods emerge.
• Segment customers and build behavioural baselines so anomalies are measured against expected activity.
• Apply real-time screening where pre-settlement intervention is required, and retrospective analysis for pattern detection.
• Feed verified KYC, KYB and beneficial-ownership data into monitoring so alerts are assessed against known identity.
• Document the rationale for every rule, threshold and parameter to support audit and regulatory review.

Extend KYT to on-chain stablecoin flows

Where settlement occurs on a public ledger, transaction monitoring must incorporate on-chain analytics. Wallet and address screening, exposure scoring and provenance tracing allow an institution to assess whether funds originate from or are destined for sanctioned entities, darknet markets, mixers or other illicit sources. Counterparty risk should be evaluated both before accepting an inbound transfer and before releasing an outbound one. On-chain intelligence is most effective when combined with off-chain identity: linking a verified customer to the wallets they control turns a pseudonymous address into an accountable relationship.

Monitoring is only as strong as the identity behind it. Without verified KYC and KYB feeding the engine, even sophisticated scenario logic is scoring transactions against strangers.

Tune the engine and triage alerts with discipline

An untuned system generates volumes of false positives that overwhelm analysts and obscure genuine risk. Thresholds and scenarios should be tuned using historical outcomes, above-the-line and below-the-line testing, and regular review of alert-to-case conversion rates. Alert triage benefits from a structured case-management workflow: consistent investigation steps, access to customer and counterparty context, and clear evidentiary records. The objective is not the fewest alerts but the right alerts, with sufficient quality of data for an analyst to reach a sound disposition.

Escalate, report and govern the model

When an investigation supports a reasonable suspicion, the programme must escalate promptly and, where required, file a suspicious activity report or suspicious transaction report with the relevant authority, such as FinCEN or the applicable financial intelligence unit. Escalation paths, decision rights and timelines should be defined in advance. Equally important is model governance: monitoring rules and any analytical models require periodic validation, independent review, version control and a documented change history. Treating the monitoring system as a governed model rather than a fixed configuration ensures it remains effective and explainable to regulators.

Transaction monitoring is most effective when identity, messaging and settlement are joined rather than handled in isolation. StableNet attaches KYT, Travel Rule, KYC, KYB and sanctions screening directly to stablecoin settlement and ISO 20022 messaging, so that monitoring decisions are made with full transaction context rather than reconstructed after the fact.