For exchanges that already have a screening vendor — and still cannot reproduce last year's decision.
Your vendor gives you a score today. Your supervisor asks what it was based on, on a day eighteen months ago, under the policy you had then.
What a second screening vendor is not for
KYTGate is not going to out-label Chainalysis, Elliptic or TRM, and says so on its pricing page. Naming the owner of an address is a fifteen-year data business with law-enforcement sources behind it; a label we invented would read exactly like one we verified, which is the reason there are none. If attribution is what you need, you already buy it.
What that purchase does not give you is the thing an examiner asks for, which is not a score but a reconstruction: these inputs, that list version, this policy, that decision, on that date. Vendor scores move — an address labelled medium risk in March can be high risk in September because the vendor learned something — and a monitoring record that shows today's score against last year's decision reads, to a reviewer, like the decision was never really made.
Bring your own vendor key
Connect your existing Chainalysis or Elliptic licence with your own API key, sealed with AES-256-GCM and never readable back out. KYTGate calls it at decision time, records the finding with the vendor named as its source in every sentence it prints, and files it alongside the public-source checks in the same case, the same receipt and the same replay. The commercial answer stops being a screenshot in a folder and becomes part of a record that can be verified without trusting either vendor.
Nothing about your customers is pooled or shared across tenants, and the database has no column for a name or a document. Your identity file stays where it is.
The part that is ours, not anyone's
Every decision is captured with the inputs that produced it and the policy version that judged them, then signed with Ed25519 and anchored in a daily Merkle attestation. Replay re-runs the stored inputs against the stored policy: no provider is re-queried, so the answer cannot drift. An evidence pack exports as self-contained JSON that a reviewer can verify with a published key, without trusting you and without trusting us.
Alongside that, the public layer runs whether or not a commercial vendor answers: OFAC, UK and EU sanctions data re-synced every six hours, live USDT and USDC freeze status read from the issuers' own contracts, and on-chain verification that the transaction you were told about exists with the amount you were told.
Three situations, handled
Your vendor changes an address's label
The original decision keeps the finding as it stood, with the vendor named and the timestamp attached. The new label opens a fresh question rather than rewriting an answered one.
An OTC settlement agreed on a call
Screen the counterparty address before the transfer and attach the decision to the ticket. The receipt is what makes 'we checked' into something a counterparty's bank can read.
An examiner asks about a decision from March
Replay reproduces it from stored inputs and the March policy version, deterministically. What changed since is visible as change, not as a contradiction.
Best fit: exchanges, brokers and OTC desks that already pay for attribution data and need the decision record, the policy versioning and the replay that their vendor does not sell.
Still working out which obligations apply to you? Who must screen crypto payments sets out the two layers — sanctions, which bind every EU business today, and due diligence, which binds a defined list of sectors from 2027 — with the source next to each row.
Decision-support software, not legal advice. Which obligations apply to you depends on your licence and structure — confirm with counsel.