Cutting Transaction Monitoring False Positives by 91% with KYT

The Challenge

The firm was generating close to 2,000 alerts per week through their Chainalysis rules-based monitoring stack. Roughly 40% of those alerts were false positives — real transactions flagged by pattern rules that lacked the entity-level context to distinguish noise from genuine risk. Analysts were spending the majority of their working hours triaging alerts they already knew would be closed without action.

The downstream effect on SAR workflow was severe. With queues backed up by false-positive volume, the time from initial alert to SAR filing averaged fourteen hours per case. High-confidence escalations were getting buried in the same queue as trivial noise. Analyst burnout was measurable in turnover and in the informal triage shortcuts that had developed to manage the volume — shortcuts that created their own compliance risk.

Replacing Chainalysis was not an option. The firm's clients depended on Chainalysis coverage, and the historical data it held had operational value that couldn't be migrated quickly. They needed something that would make their existing stack smarter, not something that would replace it.

The Solution

Infinihash KYT was integrated as a secondary enrichment layer immediately downstream of Chainalysis alerting. When Chainalysis generated an alert, KYT received the transaction context and ran it against a 25,000-entity label set, a 685-entity OFAC SDN index updated within 24 hours of sanctions list changes, and a behavioral clustering model that scored transaction patterns against known typologies.

Alerts that scored below the firm's configured risk threshold — and that carried no direct-entity match against the SDN index or high-confidence cluster assignment — were automatically closed with a structured audit trail. The closure reason, the entity labels consulted, and the scoring rationale were all logged at closure time, preserving the full documentation chain without any analyst involvement.

Alerts that scored above threshold were pre-populated with entity context, label provenance, and a behavioral cluster summary before reaching the analyst queue. When a case crossed the SAR filing threshold, a draft was automatically generated and routed for review. The Chainalysis workflow — rules, coverage, historical data — remained untouched throughout.

The Results

False positives dropped from 40% of total alert volume to 4% — a 91% reduction — within sixty days of full integration. The alert queue fell by 68% in absolute terms, because fewer alerts were being generated and fewer of the remaining alerts required analyst review before disposition.

SAR filing time fell from fourteen hours to four hours, driven primarily by pre-population of case context. Analysts were no longer reconstructing the transaction history and entity relationships from scratch at filing time — that work was done at alert time by the enrichment layer. High-confidence events triggered real-time SAR draft generation, compressing the most time-sensitive cases to under ninety minutes from detection to draft-ready.

Analyst capacity effectively doubled without headcount change. The team that had been spending most of its time on false-positive triage was now spending that time on elevated-risk cases with pre-loaded context. Zero disruption occurred to the Chainalysis workflow — the integration was additive throughout.

Key Takeaways

• A secondary enrichment layer integrated downstream of an existing stack consistently outperforms a full replacement — it adds intelligence without disrupting coverage or historical data.
• Behavioral clustering reduces noise without reducing coverage: alerts that don't match known patterns are closed with audit trail, not silently discarded.
• Auto-close with structured audit logging is as compliance-critical as auto-escalation — it documents why a case was closed, not just that it was.
• SAR pre-population — entity context, label provenance, narrative framework — cuts filing time more than any other single workflow change, because it eliminates reconstruction work at the moment of highest time pressure.