Transaction monitoring is the continuous screening of transfers into and out of a business, raising an alert whenever a transfer's counterparty or pattern meets the firm's criteria for a human look. In crypto it combines on-chain intelligence about the counterparty address with the firm's own view of the customer. A single screening answers one question once; monitoring keeps answering it for as long as the relationship lasts.
One clean check is a snapshot. Customers change counterparties, counterparties get designated, services get identified after an enforcement action, and none of that arrives on a schedule that matches your review cycle. Monitoring is what turns a series of snapshots into a position you can defend.
It is also the control that produces the record. When a supervisor asks how you would have known, the answer is not "we screened at onboarding" — it is a queue of dated alerts, each with a named reviewer and a written outcome.
The volume argument settles the rest. A desk clearing hundreds of transfers a day cannot check them by hand, and the ones a person would have picked out by instinct are rarely the ones that matter. Monitoring applies the same rule to every transfer and puts a human where the rule says a human is needed.
An alert names the transfer, the counterparty address, the verdict, the recommendation and the drivers in plain words, with the entity named where the address is attributed. In the workspace the alert has an owner, an escalation path and an audit trail; categories are filters, so a desk can pull every open case touching one category without re-running anything.
Through the API the same check runs before a deposit is credited or a withdrawal released, and a webhook carries the alert into whatever system your operators already live in. Addresses on a watchlist are re-checked as intelligence changes, which is how a counterparty that was clean at onboarding surfaces later without anyone remembering to look.
Screening is a single check on a single address. Monitoring is the standing process that screens every transfer, keeps the results, and raises the ones that need a person.
Not by itself. Loading historical counterparty addresses into a watchlist is how desks close that gap when they start a programme — the addresses are then re-checked as intelligence changes.
A named person. The point of a queue is that every alert has an owner and a documented outcome; an alert nobody owns is worse than no alert, because it exists in the record unresolved.
Also available in: · · ·
No. An alert is a prompt to look. A reporting obligation begins when your review concludes the activity is suspicious under your local rules, which is a separate decision with its own process.
Send any wallet to the Telegram bot and get a verdict in seconds. Three checks a day, free, no signup. Desks that screen every deposit run it on plans from $199/mo.