How KYC and KYT work
EU law shows the shape most regimes follow. Article 13 of Directive (EU) 2015/849, which covers investment firms among other obliged entities, defines customer due diligence as identifying and verifying the customer from reliable, independent sources, identifying beneficial owners, understanding the purpose of the relationship and “ongoing monitoring of the business relationship including scrutiny of transactions”, with documents kept up to date. Regulation (EU) 2024/1624, which moves these duties into a directly applicable regulation, applies from 10 July 2027.
Singapore's MAS Notice PSN02 for digital payment token services, last revised on 30 June 2025, spells out the transaction half: scrutinise transactions against the customer's risk profile and source of funds, watch for unusually large or unusual patterns, and apply enhanced measures to transfers with entities that are not supervised financial institutions.
KYT is the industry's name for doing that on-chain. Chainalysis, for example, describes its KYT product as assessing the risk of incoming and outgoing transactions and alerting within seconds of a transaction occurring on-chain.
What each check covers
| KYC | KYT | |
|---|---|---|
| When | Before onboarding, and again when documents expire or risk changes | On every deposit, withdrawal and transfer |
| Evidence | Identity documents, proof of address, beneficial owners, source of funds | Counterparty addresses, amounts, patterns, sanctions and risk indicators |
| Outcome | Approve, reject or ask for more; a risk rating | Credit, hold for review or report |
What to ask a vendor
- Which actions are blocked until KYC is approved: trading, deposits, withdrawals?
- How are expiring documents caught, and who re-verifies?
- Is a sending address screened before a crypto deposit is credited, and by which provider?
- Where do screening hits go, and who can release them?
Where EntropyX Labs fits, and where it does not
Brokerage CRM carries the KYC side: a document upload pipeline with reviewer queues, a document vault with expiry alerts, and funding and withdrawal actions gated on KYC status and the risk flags your team defines; identity-verification providers are connected per engagement. On the transaction side, EntropyX PSP has risk hooks for an address-screening provider and limits before a USDT deposit is credited, and Crypto Tools traces flows, clusters addresses, flags anomalies and exports evidence. The AML policy, the screening provider and every decision stay with you.