Pre-Sweep vs. Post-Sweep: When Does KYT Screening Actually Protect You?

Your bank partner has asked in writing how you screen incoming crypto deposits. At most exchanges and payment providers the honest answer is that screening happens after the deposit has already been credited.

KYT compliance, or Know Your Transaction, is the practice of assessing the risk of an incoming blockchain transaction and the address that sent it. It screens the sending address against exposure to sanctioned, stolen or laundered funds, and returns a risk verdict.

KYC tells you who opened the account. KYT tells you what arrived in it.

Why Bolt-On KYT Always Answers After the Money Moves

Every control in a deposit pipeline has one moment where the answer can still change what happens. Before the sweep, funds sit on a receiving address under your rules and can be held. After the sweep, they are pooled with everything else, and reversing the credit becomes an accounting exercise with a customer on the other end of it.

A bolt-on monitoring tool observes deposits through an external data feed and cannot pause your internal collection job. That is a structural property of the architecture, and it applies to every vendor built that way regardless of how good the product is. The tool watches a chain it does not control, subscribes to confirmations, enriches them, scores them, and raises an alert into a queue. By the time a human opens that queue, your own automation has usually already done its job.

Where in the Deposit Lifecycle Can the Answer Still Change the Outcome?

Take a normal Tuesday at a mid-size payment service provider. A merchant's customer sends USDT on TRON to a generated receiving address. Confirmation lands, the webhook fires, the balance shows, the sweep job runs on its schedule, and the funds move to a collection address and onward to cold storage. Total elapsed time is minutes.

Without pre-movement screening, the monitoring vendor's alert arrives somewhere after that sequence completes. The compliance lead now opens a file on funds that have already been consolidated, already been credited to a merchant balance, and possibly already been paid out. The work is real, and none of it prevents anything. What it produces is a report.

With screening inside the deposit engine, the risk assessment runs against the sending address on the receiving record itself, and the sweep is the thing that gets blocked. The funds stay where they landed. The compliance lead is looking at an address that still holds the money.

What Do FATF and the Travel Rule Actually Require Here?

The FATF's seventh Targeted Update of 16 July 2026 keeps virtual asset service providers inside the Recommendation 15 risk-based standard, where supervisors expect risk to be assessed and mitigated. A log of the risk meets neither expectation. It also found 83% of surveyed jurisdictions have now passed Travel Rule legislation, up from 73% in 2025, with a further 11 jurisdictions reporting that they are putting the rule in place.

The same update is blunter about what comes next. The FATF finds that many jurisdictions have yet to translate legal frameworks into effective supervision and enforcement in practice, and that jurisdictions with materially important VASP activity make up approximately 97% of the global virtual asset market. Read that as a supervision backlog that is closing, and the question shifts from whether you have a policy to what your system did at 3am on a Sunday.

The asset mix matters for the same reason. The FATF reports that most identified on-chain illicit activity now involves stablecoins (16 July 2026), and Chainalysis, in research published 8 January 2026, found illicit addresses received at least $154 billion in 2025, a 162% year-over-year increase, with stablecoins accounting for 84% of all illicit transaction volume and illicit activity remaining below 1% of all attributed crypto transaction volume.

Stablecoin deposits are the bulk of what a payment provider actually receives, which is also where the exposure concentrates. If you need the background on how these assets work, our guide to stablecoins covers that ground. If you are working through the European rulebook alongside this, our note on asset segregation under MiCA covers the custody side.

How Does Screening Work Inside the Deposit Engine?

CoinGet automatically screens sending addresses for risk on each receiving record once address risk auto check is enabled. In practice that means no manual step: each incoming deposit triggers a risk check on the address that sent it. The subject of the screening is the address the funds came from, assessed at the moment the deposit is recorded.

the address risk auto check toggle and its restriction options

Two restrictions sit on top of that assessment, and they are what turn a score into a control. As the address risk auto check documentation sets out, Collection Restriction automatically disables the collection function for the corresponding receiving address when the sending address comes back High or Severe, and Callback Restriction automatically marks the received notice callback for that receiving record as failed at the same thresholds. Either can be re-enabled or re-initiated manually after review. The risk levels are none, low, medium, high and severe.

The system delivers the result through the deposit callback, returning both a numerical status code and a clear risk rating. According to the address risk auto check documentation, code 0 indicates a successful check, while -1 means the feature is turned off. Codes 1 through 4 signal that a check could not return a usable result—whether due to an unsupported network, request verification failure, an auto-check exception, or historical data lacking a KYT record. Monitoring these status codes ensures that any unassessed deposits receive prompt compliance review. Enabling or updating these settings requires Google Authentication for added security.

The reason the block works is that the sweep belongs to the same system. The deposit engine controls the sweep, so screening built into that engine stops movement before funds leave the address. Auto-collection consolidates assets from multiple addresses into main wallets based on time, balance, or custom rules, which our walkthrough on streamlining digital asset collection with CoinGet sets out step by step, and collected funds route automatically to cold storage.

collection (sweep) address configuration

Adjacent controls in the same pipeline are worth knowing about while you are scoping. A public API endpoint validates address formats before funds move, digital signature verification helps confirm every deposit address is legitimate against phishing or redirection attacks, and real-time deposit notifications give operational visibility for every incoming transaction.

On the outbound side, our approval flow product lets you define reviewer tiers, thresholds, and escalation logic for high-value transactions. Identity-side checks against proprietary and custom databases, plus duplicate entry detection, sit in our KYC product.

Does KYT Compliance Screening Cover Every Chain You Accept?

KYT risk screening covers a defined set of mainnets and tokens. It does not cover every chain, so confirm the current list with CoinsDo against your own deposit mix before you scope anything around it. This article is not publishing that list.

If your deposit pipeline includes chains outside the supported set, those deposits return kytCode 1 and you need a plan for them before your bank partner finds the gap first. Our overview of wallet infrastructure choices is a useful place to map your chain coverage against your architecture.

When Is a Monitoring Vendor the Right Buy?

Buy the monitoring vendor when your obligation is investigation, which is the work that starts after the funds have moved. Case management with audit trails, cross-venue graph analysis, entity attribution, sanctions list tooling your regulator already recognises, coverage across chains no deposit engine supports, and the ability to answer a subpoena about a wallet cluster: those are genuine products and no deposit engine replaces them.

Take the screening that lives in the deposit engine when the question is whether these specific funds should move. That is the decision with a deadline attached, and it is the one your bank partner is really asking about. A monitoring vendor produces a better file. A deposit engine produces a held balance.

For most mid-size exchanges and payment providers, my read is that you want the in-engine screening first and the monitoring vendor second, in that order, because the second one is optional until your caseload justifies it. Teams sizing this against custody platforms are answering a wider build-versus-buy question at the same time.

KYT compliance evidence a bank partner accepts shows which deposits were screened, what verdict returned, and what the system did. CoinsDo never holds your private keys, so if the partnership ends you keep the keys and can move the assets wherever you want.

Where to Look Next

If you are weighing this against custody platforms, our comparison of alternatives in the custody market is the place to take the build-versus-buy question next. The mechanics above sit in CoinGet, so the product page covers instant address generation, the collection rules, and where the screening toggle lives.

If you are still at the architecture stage, the deposit address generation walkthrough and the wallet-as-a-service overview cover the layer underneath.

The verdict, restated for the person who has to defend it: screening that cannot stop a sweep is documentation, and documentation is what you produce after the decision. Put the check where the sweep is.

Answer the Questions Your Bank Partner Will Ask

What is the difference between KYT and KYC?

KYC verifies the identity of the person or business opening an account. KYT assesses the risk of the transaction itself, including the sending address and its exposure to illicit funds. A compliance programme needs both, because a verified customer can still receive tainted deposits.

Does KYT screening cover every blockchain and token?

No. CoinGet's KYT risk screening covers a defined set of mainnets and tokens, and that set does not include every chain. Deposits on an unsupported network return a code saying the network is not supported. Confirm current coverage against your own deposit mix before relying on it.

What happens when a sending address returns a high risk?

With Collection Restriction enabled, CoinGet automatically disables the collection function for the corresponding receiving address, so the funds are not swept. Callback Restriction marks the received notice callback as failed at the same thresholds. Both can be re-enabled or re-initiated manually after review.

Can KYT screening replace a dedicated transaction monitoring vendor?

Not in every case. Screening inside the deposit engine handles the pre-movement decision well. A separate vendor still earns its place when you need case management, cross-venue graph analysis, regulator-facing investigation tooling, or coverage of chains outside the supported list.

How do we turn address risk auto check on?

Turning the feature on or off requires the account Google authentication code. Once enabled, the system assesses the risk level of the sending address on each receiving record, returning none, low, medium, high or severe, and reports the result in the callback.

Does the Travel Rule require transaction screening?

The Travel Rule governs originator and beneficiary information travelling with a transfer, a separate obligation from screening the risk of the funds. Supervisors expect both. A bank partner reviewing your programme will ask about Travel Rule coverage and about what happens when a deposit comes back high risk.