View source for Know-Your-Transaction (KYT) Canister

== Overview ==
Since all transactions on the Bitcoin blockchain are publicly accessible, it is possible to trace individual outputs and investigate the activities of Bitcoin addresses. Exchanges make use of so-called know-your-transaction (KYT) services that analyze Bitcoin transaction to identify outputs and addresses potentially associated with illicit activities so that they can take appropriate actions.

The KYT canister on the Internet Computer makes it possible for canisters to perform the same kind of checks. The KYT canister is used by the [https://github.com/dfinity/ic/tree/master/rs/bitcoin/ckbtc/minter ckBTC minter] to make sure that [[Chain-key Bitcoin|ckBTC tokens]] are only minted for KYT-checked outputs and bitcoins are only transferred out to KYT-checked Bitcoin addresses.

The following figure provides an overview of the process. After the user has transferred bitcoins to the ckBTC minter and requests the minting of ckBTC tokens (using the <code>update_balance</code> endpoint) or the user has sent a request to retrieve bitcoins, the ckBTC minter issues a KYT check request to the KYT canister whose response contains alerts, if any, for the provided output or address. The response also indicates the KYT provider whose key was used for the KYT check (see below for more details.
[[File:CkBTC minter & KYT Canister - Overview.png|none|thumb|600x600px|The ckBTC minter interacts with the KYT canister to perform KYT checks.]]


The canister ID of the KYT canister (used by the ckBTC minter) is <code>pjihx-aaaaa-aaaar-qaaka-cai</code>.

== Technical Details ==
The KYT canister cannot analyze the Bitcoin blockchain itself. Instead, it uses [[HTTPS outcalls]] to query external KYT service providers.

Since these services have a subscription-based model, an access key must be acquired. The KYT canister addresses this challenge as follows. External parties with a subscription can be registered as ''maintainers'' through an NNS upgrade proposal that adds the principal ID of the maintainer to the KYT canister. As soon as the maintainer is registered, a secret API key can be set inside the KYT canister using the <code>set_api_key</code> endpoint.

As mentioned above, the response for each KYT check contains the principal ID of the maintainer whose access key was used to query the external KYT service provider. The ckBTC minter uses this information to determine how much of the collected KYT fees it owes to each of the registered maintainers.

The candid file of the KYT canister is available [https://github.com/dfinity/ic/blob/master/rs/bitcoin/ckbtc/kyt/kyt.did here].

=== KYT Check for UTXOs ===
The KYT canister exposes the endpoint <code>fetch_utxo_alerts</code> to enable KYT checks for unspent transaction outputs. The request must specify the output, that is, the transaction ID and index (<code>vout</code>) of the output, and also the principal ID of the caller.

The response contains an external ID for the request provided by the external KYT service provider, a list of alerts, and the principal of the maintainer whose key was used for the request.