I think I missed your question.

*they* monitor individual tractions in real time. once a whale selling Bitcoin get a big influx in their account, they simply suspend the flow for the "security" reasons.