Which rule answers which obligation
Every KYTGate control, the provisions it supports and the official source for each. The same mapping is signed into each Decision Receipt as its basis, so an auditor sees why a decision was taken and what it answers in one record.
Library gatecite-2026-10-07 · JSON · CSV control matrix
Start free sandboxTalk to us50 screenings a month free, no card.
On this page
Policy rules
The built-in rules of the baseline policy. A rule you write yourself is recorded on the receipt as unmapped, never given a borrowed article.
rule:sanctions-directA direct match on a sanctions list freezes the funds pending the MLRO's decision; nothing is returned automatically.
rule:engine-floor:adverse-signalNo policy, built-in or custom, can turn a direct designation or an issuer freeze into ALLOW.
rule:issuer-blacklistAn address the stablecoin issuer has frozen goes to the MLRO.
No provision requires checking issuer freezes. It is mapped to the risk monitoring it supports; issuers often freeze on law-enforcement request.
rule:processor-highA high-risk or rejected verdict from your crypto processor freezes the funds pending the MLRO.
Relying on the processor's screening does not move the responsibility; FATF Recommendation 17 keeps it with you.
rule:processor-mediumA medium-risk processor verdict sends the event to human review.
rule:tx-integrity-failureA claimed deposit that is not found, reverted or unconfirmed on chain goes to human review.
Mapped to the requirement that records reconstruct the real transaction; a deposit that is not on chain cannot be recorded as received.
rule:mandatory-coverage-gapWhen a mandatory check could not run, the decision is a technical hold, never ALLOW.
rule:engine-floor:mandatory-coverage-gapNo policy, built-in or custom, can turn a failed mandatory check into ALLOW.
rule:behaviour-reviewA behaviour signal (shared wallet, pass-through, structuring) goes to human review; behaviour never blocks alone.
rule:allow-with-processor-evidenceWith every mandatory check complete and processor evidence on file, the event is allowed and the evidence is recorded.
Coverage dimensions
What each column of the coverage matrix records, and the obligation it helps you evidence.
coverage:transactionIntegrityConfirms the claimed transfer exists, succeeded and paid the stated address.
coverage:sanctionsScreens the address against the official sanctions lists at decision time.
coverage:issuerFreezeReads the issuer's freeze state on chain at decision time.
Beyond what is required; mapped to the virtual asset risk assessment it feeds.
coverage:walletOwnershipRecords whether ownership of a self-hosted wallet was evidenced.
coverage:processorEvidenceRecords whether your processor supplied evidence for its verdict, not just a verdict.
coverage:actorAttributionNot available on the public baseline; filled only by a commercial provider you connect.
coverage:sourceOfFundsExposureNot available on the public baseline; filled only by a commercial provider you connect.
coverage:customerBehaviourApplies the behaviour rules to the customer's own funding history.
coverage:travelRuleRecords whether originator and beneficiary information was received with the transfer.
Decisions
The four outcomes every screening ends in.
decision:ALLOWThe event proceeds; the receipt records what was and was not checked.
decision:REVIEWA case opens for a human to look before funds move on.
decision:BLOCK_PENDING_MLROFunds are held for the MLRO, who decides whether to report; releasing them takes two people.
decision:TECHNICAL_HOLDChecks could not be completed, so the event does not proceed until they are.
The record
What is kept, and for what.
record:receiptEvery decision is kept as a signed, append-only record that can be replayed later.
Sources
International standard (FATF)
- FATF Recommendations, Recommendation 1: Identify and assess money laundering and terrorist financing risks and apply a risk-based approach to them. Checked 7 October 2026.
- FATF Recommendations, Recommendation 6: Targeted financial sanctions on terrorism and terrorist financing: freeze without delay, make no funds available. Checked 7 October 2026.
- FATF Recommendations, Recommendation 7: Targeted financial sanctions related to proliferation of weapons of mass destruction. Checked 7 October 2026.
- FATF Recommendations, Recommendation 10: Customer due diligence, including ongoing monitoring; where it cannot be completed, do not proceed. Checked 7 October 2026.
- FATF Recommendations, Recommendation 11: Keep transaction records for at least five years, sufficient to reconstruct individual transactions. Checked 7 October 2026.
- FATF Recommendations, Recommendation 15: New technologies: assess and mitigate virtual asset risks; virtual asset service providers apply the AML/CFT measures. Checked 7 October 2026.
- FATF Recommendations, Recommendation 16: Originator and beneficiary information travels with a transfer; applied to virtual assets through Recommendation 15. Checked 7 October 2026.
- FATF Recommendations, Recommendation 17: Reliance on third parties for due diligence leaves the ultimate responsibility with the relying institution. Checked 7 October 2026.
- FATF Recommendations, Recommendation 20: Report promptly to the financial intelligence unit when funds are suspected to be proceeds of crime or linked to terrorism. Checked 7 October 2026.
European Union
- Directive (EU) 2015/849 (AMLD), Article 13: Customer due diligence measures, including ongoing monitoring of the business relationship. Checked 7 October 2026.
- Directive (EU) 2015/849 (AMLD), Article 14: Timing of verification; an entity unable to complete due diligence must not carry out the transaction. Checked 7 October 2026.
- Directive (EU) 2015/849 (AMLD), Article 33: Report suspicious transactions to the financial intelligence unit. Checked 7 October 2026.
- Directive (EU) 2015/849 (AMLD), Article 40: Retain due diligence and transaction records for five years after the relationship or transaction ends. Checked 7 October 2026.
- Regulation (EU) 2024/1624 (AMLR), Article 20: Customer due diligence measures, including ongoing monitoring; replaces AMLD Article 13. Applies from 10 July 2027. Checked 7 October 2026.
- Regulation (EU) 2024/1624 (AMLR), Article 40: Measures to mitigate risks in relation to transactions with a self-hosted address. Applies from 10 July 2027. Checked 7 October 2026.
- Regulation (EU) 2024/1624 (AMLR), Article 69: Reporting of suspicions to the financial intelligence unit; replaces AMLD Article 33. Applies from 10 July 2027. Checked 7 October 2026.
- Regulation (EU) 2024/1624 (AMLR), Article 77: Record retention; replaces AMLD Article 40. Applies from 10 July 2027. Checked 7 October 2026.
- Regulation (EU) 2023/1113 (Transfer of Funds Regulation), Article 14: The originator's provider sends originator and beneficiary information with a crypto-asset transfer. Applies from 30 December 2024. Checked 7 October 2026.
- Regulation (EU) 2023/1113 (Transfer of Funds Regulation), Article 16: The beneficiary's provider detects missing originator or beneficiary information. Applies from 30 December 2024. Checked 7 October 2026.
- Regulation (EU) 2023/1113 (Transfer of Funds Regulation), Article 17: Risk-based handling of crypto-asset transfers that arrive with missing or incomplete information. Applies from 30 December 2024. Checked 7 October 2026.
- Regulation (EU) 2023/1113 (Transfer of Funds Regulation), Article 26: Retention of the information collected under the regulation. Applies from 30 December 2024. Checked 7 October 2026.
United States (OFAC)
- 31 CFR Part 501 (OFAC Reporting, Procedures and Penalties), § 501.603: Report blocked property to OFAC within 10 business days of blocking. Checked 7 October 2026.
- 31 CFR Part 501 (OFAC Reporting, Procedures and Penalties), § 501.604: Report rejected transactions to OFAC within 10 business days of the rejection. Checked 7 October 2026.
How the map is kept
An article is cited only when its number has been read in the official text; otherwise the instrument is cited and the summary says what it covers. Summaries are paraphrases for orientation, not quotations. A provision that is not yet in force says when it applies. A control that goes beyond what any rule requires, such as reading stablecoin issuer freezes, says so instead of borrowing an article.
Each receipt records the library version it was mapped with, so a later correction here never changes what an earlier receipt said. If you find an error, write to hello@kytgate.com and we will correct it within one working day.