Crypto AML Glossary — Terms Google & Exchanges Use

Exchanges, banks, and compliance vendors speak a shared vocabulary: KYT, SDN, hop distance, UTXO graphs, source of funds. This crypto AML glossary defines the terms you encounter when screening wallets, appealing deposit freezes, or reading regulator guidance — written for self-custody holders, P2P traders, and OTC participants, not only compliance officers.

Core compliance terms

AML (Anti-Money Laundering)

The legal and operational framework requiring financial institutions — including many virtual asset service providers (VASPs) — to detect, report, and prevent flows of criminal proceeds. In crypto, AML covers customer identity checks, transaction monitoring, sanctions screening, and suspicious activity reporting. Self-custody users are not VASPs, but they still face AML consequences when depositing to exchanges or receiving tainted funds.

KYC (Know Your Customer)

Identity verification of account holders: government ID, proof of address, liveness checks. Centralized exchanges require KYC before fiat on-ramps and higher withdrawal limits. KYC answers who holds the account; it does not replace transaction-level analysis.

KYT (Know Your Transaction)

Real-time or batch analysis of individual blockchain transfers against risk intelligence: sanctions lists, hack databases, scam clusters, and mixer graphs. KYT is the crypto-native complement to KYC. Tools like Chainalysis KYT, Elliptic, and TRM Labs power exchange deposit monitors. See our Chainalysis alternative guide for free local KYT on Windows.

CTF (Counter-Terrorist Financing)

Rules aimed at blocking funds destined for designated terrorist organizations. Often implemented alongside AML in a combined AML/CTF program. OFAC and UN consolidated lists include entities subject to CTF blocking rules.

CDD / EDD (Customer / Enhanced Due Diligence)

CDD is baseline identity and risk assessment for customers. EDD is deeper review triggered by high-risk jurisdictions, large volumes, PEP status, or elevated KYT scores. Exchange users asked for source of funds letters during deposit holds are undergoing EDD.

VASP (Virtual Asset Service Provider)

Any business that exchanges, transfers, safeguards, or brokers virtual assets for clients — including many exchanges, custodians, and OTC desks. FATF guidance recommends VASPs apply Travel Rule and AML programs.

Sanctions and law enforcement

OFAC (Office of Foreign Assets Control)

U.S. Treasury bureau administering economic sanctions programs. OFAC publishes lists of blocked persons, entities, and — increasingly — cryptocurrency wallet addresses associated with designated actors.

SDN (Specially Designated Nationals and Blocked Persons List)

OFAC's primary sanctions list. SDN entries include individuals, companies, vessels, and on-chain addresses. U.S. persons and many global banks must block property and transactions involving SDN targets. Direct receipt from an SDN-listed wallet is among the severest AML signals. Read the OFAC crypto wallet sanctions guide.

Sanctions screening

Automated comparison of wallet addresses and entity names against SDN, EU consolidated lists, UK OFSI lists, and UN sanctions. Screening runs at onboarding and on every deposit. False positives require documentation; true positives are hard stops.

Designated entity

A person or organization formally listed under a sanctions program. In crypto contexts, smart contracts — such as specific Tornado Cash pools — have been designated, making interaction a sanctions-compliance question for U.S. persons.

FATF (Financial Action Task Force)

Intergovernmental body setting AML standards adopted by many countries. FATF's Travel Rule recommendation requires VASPs to share originator and beneficiary information on transfers above thresholds.

On-chain analysis

Blockchain analytics

Clustering addresses, labeling entities, and tracing fund flows across transactions. Analytics firms maintain attribution databases mapping addresses to exchanges, darknet markets, ransomware crews, and DeFi protocols.

Address clustering

Heuristic grouping of addresses likely controlled by one actor. Common signals: shared spending of inputs (Bitcoin), co-funding from a parent wallet, synchronized nonces, and exchange deposit patterns.

Hop / hop distance

The minimum number of transfers between the address under review and a labeled high-risk cluster. Zero hops means direct interaction; three hops means three intermediary transactions separate the wallets. Exchanges weight risk partly by hop count. Full explanation: mixer exposure & hop analysis.

Mixer exposure / mixer hops

Risk inherited from proximity to cryptocurrency mixers (tumblers) — services or contracts designed to obscure fund origin. Mixer hops measures graph distance from such pools. Even without using a mixer yourself, counterparty mixer use can taint your wallet.

Inherited exposure / indirect exposure

Risk that arrives with incoming funds because of upstream transaction history, not because you interacted with a bad actor directly. Also called taint or provenance risk. Inherited exposure is the main reason self-custody users screen addresses they did not create.

Direct exposure

Funds sent to or received from a flagged address in a single transaction hop — the strongest attribution signal short of wallet ownership.

UTXO (Unspent Transaction Output)

Bitcoin's accounting unit: each output of a transaction becomes a spendable coin. AML tools trace individual UTXOs because two coins in the same wallet can have different histories. See Bitcoin address AML check and Electrum AML screening.

UTXO graph

The directed acyclic graph linking UTXOs through spending transactions backward to coinbase rewards. Full graph traversal enables per-coin hop analysis on Bitcoin, distinct from simple address-level labels.

Account model

Ledger design used by Ethereum, Tron, and Solana where balances attach to addresses rather than discrete UTXOs. Hop analysis still applies but follows account-to-account transfers and contract internal movements.

Peel chain

A laundering pattern where a large balance is split across many rapid outbound transfers, each leaving a small change output consolidated elsewhere. Common on Bitcoin and Tron OTC mule wallets.

Investigation and documentation

Source of funds (SoF)

Documentation explaining how the holder acquired the crypto: salary, mining, business revenue, investment sale, lawful gift. Exchanges request source of funds during EDD when KYT scores are elevated. See P2P & OTC address verification and CEX deposit AML guide.

Source of wealth (SoW)

Broader proof of how a person accumulated total net worth — tax returns, property records, inheritance documents. Required for private banking tier EDD, occasionally for large OTC clients.

SAR / STR (Suspicious Activity / Transaction Report)

Filings VASPs submit to financial intelligence units when activity appears indicative of money laundering or sanctions evasion. Users rarely see SARs filed about them, but deposit freezes sometimes precede such filings.

Transaction monitoring

Ongoing automated review of customer transfers against rules: velocity thresholds, sanctions hits, structuring patterns, and geographic risk. KYT engines are the transaction monitoring layer for crypto.

Risk score / risk tier

Numeric or categorical output from screening tools (low, medium, high, severe). Scores aggregate sanctions, hops, entity labels, and behavioral flags. Different venues set different auto-action thresholds.

Products and operations

CEX (Centralized Exchange)

Custodial trading platform (Binance, Coinbase, Kraken, OKX). CEX deposits trigger KYT. Guides: Binance, Kraken, OKX deposit screening.

OTC (Over-the-Counter) desk

Broker facilitating large trades off public order books. OTC flows often use USDT TRC-20 or wire settlement. Counterparty verification and address screening are critical because escrow is rare.

P2P (Peer-to-Peer) trading

Direct trades between individuals, often via platform escrow for fiat legs. Crypto leg remains irreversible; P2P OTC verification of wallet addresses prevents mule and triangulation scams.

Travel Rule

Requirement for VASPs to exchange originator and beneficiary identifying information on virtual asset transfers above jurisdictional thresholds. Implementation varies by country; affects exchange withdrawals and institutional OTC.

Chainalysis / Elliptic / TRM Labs

Leading blockchain analytics providers selling enterprise KYT, investigation, and government tracing tools. Their labels often appear in exchange freeze notices and law enforcement affidavits.

Address screening / wallet screening

Querying a blockchain address against sanctions and risk databases before sending or receiving funds. Address screening is the practical action behind KYT for self-custody users — paste an address, review hops and labels, decide whether to transact.

Pre-sign screening

Checking counterparty addresses and contracts before approving a wallet signature — common in MetaMask and Rabby workflows. Prevents irreversible mistakes and documents due diligence.

How these terms connect

A typical exchange deposit freeze involves: KYT detecting mixer hops within two steps of a hack cluster on a UTXO or account graph → risk tier escalates to high → compliance requests source of funds under EDD → user provides trade logs and address screening snapshots → analyst checks for SDN false positives before release.

Understanding the vocabulary helps you communicate with exchange support, prepare documentation proactively, and run local screening before problems compound.