Crypto AML Transaction Monitoring: Rules, Red Flags, and Scenarios with Examples

A $20,000 crypto deposit. Is that a reason to trigger an AML alert? Or just another perfectly ordinary transaction?

Now add a few details. The funds came through two intermediary wallets. Their origin is linked to a known hack. The customer has never received anything close to this amount before. 

Suddenly, the same $20,000 tells a very different story.

Global Ledger's analysis of 99 centralized exchanges found that average hack-related deposits reached $20,137 in 2025, while sanctions-related deposits averaged just $5,772. The differences went beyond transaction values: sanctions exposure averaged 3.06 blockchain hops, compared with 1.80 for hacks.

These findings show why a red flag, a monitoring rule, and a scenario serve different purposes. The same transaction can contain several risk signals, but deciding when they warrant an alert requires combining them into meaningful monitoring logic.

This article explains how AML transaction monitoring rules, scenarios, and red flags work in crypto, with practical examples and guidance on setting and calibrating them.

What Is the Difference Between an AML Monitoring Rule, Scenario, and Red Flag?

Consider that $20,000 crypto deposit example from above. Here's how the four concepts apply:

• Red flag: The deposit has indirect exposure to a known hack-related entity.

• Rule: Generate or prioritize an alert when hack-related exposure is identified within the monitoring scope, taking into account exposure depth, attribution confidence, transaction value, and customer context.

• Scenario: Detect potentially suspicious deposits involving indirect high-risk exposure, particularly when combined with unusual transaction amounts, new counterparties, or activity inconsistent with the customer's established behavior.

A single red flag does not necessarily warrant an alert. Monitoring rules determine when specific conditions should trigger a response, while scenarios bring related signals together to identify patterns requiring investigation.

From AML Monitoring Rules to Real-World Risk: What 99 Exchanges Reveal

The distinction between individual risk indicators and monitoring scenarios becomes particularly important when looking at actual transaction patterns.

Global Ledger's analysis of 99 centralized exchanges, covering BTC, ETH, and USDT on Tron between 2021 and 2025, found that deposits above $10,000 accounted for 84.4% of identified risky deposit value but only 3.6% of risky deposit transactions. This concentration shows why transaction value alone cannot determine how an AML monitoring rule should work.

FATF identifies transaction size and frequency, counterparty characteristics, source of funds, and unusual transaction patterns as potential red flags. In crypto monitoring, these indicators gain meaning when assessed alongside counterparty attribution, direct and indirect exposure, asset and network, customer behavior, and fund routing.

In Global Ledger's study, exposure was traced to identified high-risk sources and destinations within five blockchain hops. This measures proximity to attributed high-risk entities, without establishing that an exchange or customer knowingly participated in illicit activity.

AML Transaction Monitoring Red Flags

Common red flags in crypto transaction monitoring include:

• indirect exposure to identified high-risk sources or destinations;

• unusual transaction size relative to the customer’s established activity;

• rapid onward movement of recently received funds;

• new or changing counterparties inconsistent with previous behaviour;

• complex routing through multiple wallets or services;

• unexpected asset or network changes within the customer’s activity;

• new high-risk attribution affecting recent counterparties;

• source-of-funds inconsistencies that do not match the transaction pattern.

A red flag on its own is not evidence of money laundering. These indicators can strengthen or prioritize monitoring alerts when assessed alongside other transaction and customer-risk signals.

AML Transaction Monitoring Scenarios for Crypto

The following six scenarios show how attribution, exposure depth, transaction value, customer behavior, velocity, and routing can be incorporated into monitoring rules.

1. Indirect High-Risk Exposure

Rule: Generate or prioritize an alert when funds are traceable to an identified high-risk source or destination through intermediary wallets or services within the monitoring scope.

Illustrative example: A customer deposit can be traced through intermediary wallets to an address attributed to a hack-related entity.

Main tuning variables: Exposure depth, attribution confidence, risk category, intervening wallets or services, transaction value.

2. Counterparty Risk Reassessment

Rule: Reassess or reprioritize recent transactions when new attribution changes the risk classification of a counterparty involved in customer activity.

Illustrative example: A wallet involved in a recent customer transaction is subsequently attributed to a sanctioned entity.

Main tuning variables: Attribution date, transaction date, risk category, attribution confidence, transaction direction, transaction value.

3. Rapid Movement of Funds

Rule: Generate an alert when a customer moves funds onward within an unusually short period and the source, route, or destination adds further risk.

Illustrative example: A customer receives funds and shortly afterward sends most of them to an identified high-risk service.

Main tuning variables: Time window, share of funds moved, source and destination attribution, routing pattern, customer history.

4. Unusual Transaction Behavior

Rule: Generate an alert when transaction behavior changes materially from the customer's historical activity and another risk signal is present.

Illustrative example: A customer who normally makes small BTC transfers begins receiving much larger USDT transactions from new counterparties and moving the funds onward soon after receipt.

Main tuning variables: Transaction value, frequency, asset and network, counterparties, velocity, historical customer activity.

5. High-Value Transactions with Additional Risk Indicators

Rule: Prioritize a high-value transaction when the amount is unusual for the customer and is combined with direct or indirect high-risk exposure, risky counterparty attribution, or source-of-funds concerns.

Illustrative example: A deposit materially above the customer's normal range can be traced through an intermediary wallet to a fraud-related source.

Main tuning variables: Transaction value relative to customer history, direct or indirect exposure, risk category, source of funds, attribution confidence.

6. Complex Transaction Routing

Rule: Generate or strengthen an alert when funds pass through multiple wallets or services and the route is combined with high-risk attribution, unusual velocity, or source or destination risk indicators.

Illustrative example: Funds pass through several intermediary wallets before reaching a customer and are then sent onward to another service shortly after receipt.

Main tuning variables: Routing pattern, number and type of intermediaries, exposure depth, velocity, source and destination attribution.

Common Monitoring Gaps and the Risks They Can Leave Undetected

Even when individual monitoring rules cover the scenarios above, gaps in how signals are combined or evaluated can affect which transactions generate alerts.

How to Calibrate and Test AML Transaction Monitoring Rules

Before a rule goes live, backtesting can show how many alerts it would have generated, which known-risk transactions it would have captured and where false positives concentrate.

Rules should be reassessed when customer behaviour, supported assets or networks, products, counterparty attribution or observed risk patterns change. Industry benchmarks can provide context, but they should not replace testing against the institution’s own activity.

Putting It All Together: From Risk Signals to Monitoring Decisions

Every AML monitoring scenario starts with a question: what combination of transaction activity and risk indicators should prompt a closer look?

Start with the red flags: unusual amounts, indirect exposure, rapid movement, changing counterparties, or complex routing. Consider what those signals mean for the particular customer and transaction.  

Then use a scenario to describe the suspicious pattern you want to detect and a rule to define when that pattern should generate or prioritize an alert.

The final step is to test whether the rule works as intended. Backtest it against historical activity, examine what it catches and what it misses, and adjust its parameters for the relevant customer segments and risk categories.

This provides a practical way to move from individual red flags to monitoring decisions that can be explained, reviewed, and improved over time.

Building Crypto AML Rules Around Real Transaction Risk

Effective AML transaction monitoring rules and examples combine counterparty attribution, exposure depth, transaction value, behavioural context, asset and network, velocity and routing instead of relying on copied thresholds. Their parameters should be backtested against the institution’s own activity and reassessed as behaviour, attribution and risk patterns change.

Global Ledger KYT combines real-time risk scores, source and use of funds data, direct and indirect exposure, and customizable alerts for building and applying this monitoring logic. 

FAQ