VASPs need ongoing transaction monitoring because risk can change after onboarding, and a previously acceptable counterparty or wallet may later be linked to sanctioned activity or other illicit behaviour. Monitoring supports real-time alerts, source-of-funds analysis, and escalation when risk shifts. Without it, firms may miss evolving exposure, weaken compliance evidence, and accept transfers that should be reviewed or blocked.
Why Ongoing Monitoring Is Non-Negotiable for VASPs
Virtual Asset Service Providers cannot treat travel rule screening as a one-time onboarding check. Counterparty risk can change after the first transfer, and a wallet that looked ordinary yesterday may later be associated with sanctions exposure, mixers, stolen funds, or fraud. Current guidance from the FATF Recommendations — AML and KYC Framework expects risk-based controls that continue throughout the relationship, not just at account creation.
That matters because blockchain activity is fast, pseudonymous, and often fragmented across addresses, hosted wallets, and intermediaries. Ongoing monitoring helps firms reconcile Travel Rule data with transaction behaviour, detect changes in source of funds, and escalate activity that no longer fits the original customer profile. It also supports auditability under broader control expectations in the NIST Cybersecurity Framework 2.0, where continuous risk management is central. NHIMG research on Ultimate Guide to NHIs — Key Challenges and Risks shows how often hidden dependencies and weak visibility undermine control reliability in dynamic environments.
Practically, many VASPs discover exposure only after a suspicious transfer has already cleared, rather than through deliberate monitoring of shifting risk signals.
How Travel Rule Monitoring Works in Practice
Effective monitoring combines transaction screening, wallet risk intelligence, sanctions checks, and case management. The goal is not simply to flag a transfer, but to decide whether the counterparties, jurisdiction, asset, and payment pattern remain consistent with the customer’s expected behaviour. Teams typically apply continuous rules to incoming and outgoing transactions, then enrich alerts with Travel Rule payloads, blockchain analytics, and internal customer records.
A useful operating model is to treat each transfer as a new risk decision. That means checking whether the counterparty VASP is known and verified, whether required originator and beneficiary information is complete, and whether the transaction context has changed since onboarding. When the risk signal changes, the workflow should support review, enhanced due diligence, temporary holds, or rejection depending on policy and applicable law.
- Screen transactions against sanctions and illicit-finance indicators in near real time.
- Compare transaction size, velocity, destination, and asset type with expected customer behaviour.
- Validate Travel Rule messages for completeness and consistency before settlement.
- Escalate when wallet attribution changes, especially for hosted services and shared infrastructure.
- Retain evidence that shows what was known, when it was known, and what action followed.
This is one reason NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives is useful to compliance teams: it frames visibility and lifecycle control as evidence problems, not just technical ones. For implementation, the control baseline should align with NIST SP 800-53 Rev 5 Security and Privacy Controls and documented, repeatable monitoring procedures.
These controls tend to break down when transaction volumes spike across multiple chains and the monitoring stack cannot reliably correlate identity, wallet, and jurisdiction data in time.
Common Variations and Edge Cases
Tighter monitoring often increases false positives, review backlog, and customer friction, so VASPs must balance screening depth against settlement speed and operational capacity. Best practice is evolving, and there is no universal standard for exactly how much behavioural change should trigger escalation.
Grey areas often include self-hosted wallets, cross-border transfers involving multiple intermediaries, and customers whose activity is inherently high velocity, such as market makers or payment processors. In those cases, static thresholds are rarely sufficient. Firms generally need layered rules, analyst review, and documented exceptions so that legitimate activity is not repeatedly blocked while suspicious activity still surfaces quickly.
NHIMG’s Top 10 NHI Issues is relevant here because monitoring failures are often visibility failures first. The same pattern appears in AML programs: if data is incomplete, stale, or disconnected across systems, risk scoring can drift faster than controls can adapt. For governance, organisations should map monitoring obligations to ISO/IEC 27001:2022 Information Security Management and maintain a clear escalation path for sanctions, fraud, and source-of-funds exceptions.
In practice, monitoring programs fail when policy is written for a stable customer profile but the business is operating in a fast-changing, multi-venue crypto environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Ongoing monitoring depends on detecting credential and identity misuse over time. |
| CSA MAESTRO | MAESTRO covers governance for dynamic, multi-step agent and workflow behaviour. | |
| NIST AI RMF | AI RMF addresses ongoing risk monitoring and post-deployment governance. | |
| NIST CSF 2.0 | DE.CM-01 | Continuous monitoring is central to detecting suspicious crypto transaction behaviour. |
| NIST SP 800-63 | Identity assurance supports reliable customer and counterparty verification. |
Continuously review identity and credential activity and revoke access when behaviour no longer matches the approved profile.
Related resources from NHI Mgmt Group
- How should VASPs embed Travel Rule compliance into transaction workflows?
- Why do crypto firms need to prioritise Travel Rule compliance before scaling user growth?
- Who is accountable when crypto platforms fail to comply with the Travel Rule?
- Who is accountable when bank account verification is used for PSD2 and AML CTF compliance?
