Why Accounts Get Blocked and How to Avoid it

AML Block on a Crypto Exchange: Why Accounts Get Blocked and How to Avoid it

Ivan Pavlovskyy
Choose us on Google

• What is AML, and why is this kind of control needed?

• Which transactions are subject to AML checks

• How AML checks work on a crypto exchange: a real-world example

• How to check a wallet’s AML rating

• What to do if your funds are subject to an AML block

• Can you complete the AML procedure on your own

Article brief
Share
🔐 Let’s break down what an AML freeze is, why a crypto exchange can lock funds even for a good-faith user, which transactions raise red flags, and what you can do to reduce the risk of an account freeze in 2026. 👇

According to Chainalysis, in 2025, addresses linked to illicit activity received at least $154 billion in cryptocurrency. Despite the relatively small share of such transactions in the market’s overall volume, their scale requires crypto exchanges to apply AML tools systematically to detect suspicious activity and reduce related risks.

Typically, an “AML freeze” refers to various measures a crypto exchange imposes as part of checking a user or their transactions. This can include holding a deposit, suspending withdrawals, requesting additional documents, or temporarily restricting an account. And even a good-faith user can run into these measures. For example, if the exchange detects a link between a transaction and a high-risk address, or flags activity that differs from the customer’s usual behavior.

The Incrypted editorial team looked into how AML checks work on crypto exchanges, which operations may be monitored, and what to do if a platform restricts access to funds.

• Crypto exchanges analyze addresses, transaction history, account behavior, and the source of funds.
• A single risk indicator does not prove wrongdoing, but it can trigger additional checks.
• After a freeze, it is important to identify the reason for the restriction and prepare a response to the platform’s official request.
• Pre-checking an address helps identify known risky transactions, although there is no single AML rating for wallets.

What Is AML and Why This Kind of Control Is Needed

AML (anti-money laundering) is a set of measures designed to combat money laundering. Using these tools, crypto exchanges check clients and transactions, identify suspicious activity, and, when necessary, share information with authorized authorities.

As a rule, AML works alongside other regulatory compliance mechanisms. These include KYC/KYB procedures, counter-terrorist financing (CFT), sanctions screening, and transaction monitoring.

A typical crypto exchange AML system includes:

• user verification
• transaction monitoring and address screening
• risk assessment of wallets and counterparties
• identifying suspicious activity
• compliance with the Travel Rule
• storing the required transaction data
• imposing restrictions when elevated risk is detected
• cooperating with regulators and law enforcement agencies.

Specific requirements depend on the country and the platform’s operating model. For example, in the European Union, the activities of crypto-asset service providers are regulated by the Markets in Crypto-Assets Regulation (MiCA), while the transfer of information for digital asset transfers is governed by Regulation (EU) 2023/1113.

In the United States, the Bank Secrecy Act, FinCEN requirements, and the sanctions regimes of the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) play a major role.

At the international level, baseline standards for the crypto industry are set by the FATF. In particular, Recommendation 15 extends AML/CFT requirements to virtual assets and virtual asset service providers (VASPs). Their transfers are also subject to the Travel Rule, based on Recommendation 16.

As a result, due to differences in legislation and internal procedures, the same transaction may be assessed differently across different platforms.

How AML differs from CFT and KYC

AML, CFT, and KYC are closely related, but they refer to different elements of the regulatory compliance framework. Specifically:

• KYC — the process of identifying and verifying a customer. A platform may request an ID document, proof of address, and other information depending on legal requirements and the risk level
• AML focuses on detecting and preventing money laundering. To do this, exchanges analyze transactions, the origin of assets, counterparties, and wallet history
• CFT focuses on countering the financing of terrorism. Similar tools are used here, including transaction monitoring, sanctions screening, and analysis of related addresses.

In other words, KYC is a foundational element of a broader control framework, and successful account verification does not mean an exchange will stop analyzing subsequent activity. In the future, the platform may request additional information about the

Before using a crypto exchange, it’s worth reviewing not only the KYC terms, but also the AML/CFT policy and the applicable sanctions restrictions.

As a rule, crypto exchanges use a risk-based approach. This means the system does not assess a single attribute of a transfer, but a combination of factors. The key ones are:

The platform cross-checks the sender’s and recipient’s addresses against available on-chain data, sanctions lists, and customer information. A link to a known high-risk address increases scrutiny of the transaction, although it does not, by itself, determine the outcome of the review.

Analytics systems can identify direct and indirect links to known risk categories. However, the depth of analysis and the weight given to such contacts vary between providers, so you cannot assume a rule that interacting with a certain address through several hops will automatically lead to a freeze.

The system may flag a sharp increase in volumes or the number of transactions, inflows from many unrelated addresses, rapid withdrawals after a deposit, and other de

Based on this data, a risk score is generated. If it exceeds the platform’s internal threshold, the transaction may be routed for additional review, temporarily paused, or rejected. At the same time, each exchange uses its own model and may

Which transactions are considered high risk

Despite differences between platforms, there are several common factors that can cause a transaction to be flagged as higher risk:

• interaction with mixers. The FATF treats services that increase transaction anonymity as potential risk indicators, especially if the transaction has no clear economic rationale
• links to darknet marketplaces and ransomware. Direct or indirect contact with addresses in these categories, or other known criminal wallets, can increase the risk score
• sanctioned addresses. Here, the consequences depend on the specific legal regime. For example, for platforms subject to OFAC requirements, assets in which a blocked person has an interest must be frozen
• P2P and OTC counterparties with a problematic history. In a direct deal, the user does not always know the origin of the other party’s assets. As a result, receiving funds from a counterparty linked to high-risk addresses can raise questions even for a good-faith recipient
• atypical movement of funds. This category includes rapid movement of a received deposit, repeated transactions in round amounts with no obvious purpose, and a mismatch between the stated source of funds and the actual onchain history.

The main principle of assessment — comprehensiveness. A single marker on its own does not prove the address owner’s wrongdoing and is not always sufficient grounds to freeze or block a transaction. It is also worth considering that monitoring does not end after funds are credited. The exchange may later receive new information about this wallet and start reviewing a transaction that has already been completed. 

An automated monitoring system can see transaction characteristics and links between addresses, but it does not know the circumstances of each operation. For example, a user may receive assets from a P2P counterparty who previously interacted with a high-risk address. For the analytics system, that link exists regardless of whether the recipient knew about it.

Therefore, automated scoring can be used to select transactions that require additional analysis. During such a review, the transaction may be temporarily suspended.

Such a restriction does not mean the platform has deemed the assets illegal. However, to have it lifted, a good-faith user needs to explain the details and substantiate their claims.

How an AML Check Works on a Crypto Exchange: a Specific Example

Given the specifics outlined above, the AML procedure on a crypto exchange typically combines automated tools and manual work by the compliance team.

To better understand how AML works in practice, let’s look at the WhiteBIT crypto exchange system. According to the current AML/CFT policy, the platform’s AML/CFT system includes the following key elements:

Responsible for implementing AML/CFT procedures, analyzing suspicious activity, conducting internal investigations, and submitting legally required reports to the competent authorities. They may also liaise with law enforcement and regulatory bodies as part of these procedures.

Includes KYC, Customer Due Diligence (CDD), and, where risk is elevated, Enhanced Due Diligence (EDD). The exchange verifies the user’s identity or the company’s beneficial owners, assesses the purpose and nature of the business relationship, and evaluates geographic and other risk factors. Enhanced checks may be applied, for example, to PEPs or higher-risk clients and transactions.

Continues throughout the entire period of using the platform. WhiteBIT states that it uses automated and manual tools with predefined criteria, parameters, and threshold values, as well as its own automated fraud prevention and risk management systems. Sanctions screening is carried out separately.

Users are assigned a risk profile, which may be reviewed if new factors emerge. Transactions are also compared against the customer’s normal activity — an atypical transaction or a material de additional checks

In particular, WhiteBIT may restrict incoming or outgoing suspicious and sanctions-related transactions, freeze the associated funds, suspend access to services, or conduct enhanced due diligence. In addition, the exchange may request documents confirming the transaction, proof of the movement of funds, and other information

At the same time, exchanges do not publish all internal scoring algorithms and trigger thresholds. As a result, a user cannot reproduce the platform’s AML checks with complete accuracy in advance.

If you have encountered frozen funds, account restrictions, or additional AML checks on a crypto exchange, you can contact Reclaim Capital and submit a request for a case review. Specialists will assess the circumstances of your case, help determine which documents and explanations will be required, and propose next steps based on the requirements of the specific platform.

Doing your own AML screening lets you check an address’s history and see known links to specific risk categories. But it’s important to understand that different services use their own databases, algorithms, and category weightings. In addition, an exchange has access to additional information — the user’s KYC profile, account activity data, and internal policies.

On the retail market, for example, AMLBot is available, allowing you to check addresses and transactions and receive a report on the identified risk categories. Safe3 offers a similar tool in the form of a non-custodial mobile wallet, and WhiteBIT clients can use the built-in Address Checker.

Comprehensive platforms like Chainalysis, Elliptic, and Crystal more often act as service providers and are primarily geared toward professional market participants, including exchanges and government agencies.

For users, what matters is not so much the name of the service as the correct interpretation of the result. If the check indicates a high-risk counterparty, it’s worth pausing the transaction and requesting additional information.

What to Do If Your Funds Are Hit With an AML Freeze

A temporary freeze or transaction restriction is not proof of illegal activity. If a platform applies such measures, the user should:

1. Review the exchange’s request

First, determine what exactly happened — whether a specific deposit was held, withdrawals were restricted, account features were suspended, or other measures were applied. Carefully read the official request and answer only the questions being asked.

Also make sure the message really came from the exchange. Use your account dashboard or the official website, and do not click suspicious links in emails or messengers.

Never share your password, two-factor authentication codes, seed phrase, or private keys with anyone. A request to move funds to a third-party wallet or pay a separate “AML unfreezing fee” is a sign of fraud.

1. Confirm the source of funds

The platform may request or. The former explains the origin of the specific funds involved in the transaction, while the latter describes how the client’s overall capital was built

There is no universal set of supporting documents. Depending on the situation, you may need bank statements, tax reports or returns, proof of deposits and withdrawals, contracts, and other documents explaining the origin of the funds.

1. Check the related addresses

Before responding, it is useful to independently check the addresses involved in the disputed transaction using one of the services listed above. This can help you spot a known risk and understand which part of the transaction may have raised questions. This is especially relevant with a long chain of transfers or when dealing with P2P counterparties.

1. Prepare a clear explanation

Your response to the platform’s request should make it easy to quickly match your version of events with documents and blockchain data. That’s why it is important to include:

• direct answers to the questions asked
• a timeline of related transactions
• a list of the attached documents
• an explanation of the source of funds
• the nature of your interaction with the counterparty, if they were the reason for the review

During a review, you should not try to bypass restrictions by splitting transactions, using new linked wallets, or using mixers. Structuring transactions to avoid control thresholds can itself be treated as a risk indicator and will only complicate the review.

However, not every AML review is limited to a standard set of documents. With a complex transaction history or a large number of P2P operations, an exchange may request additional proof of the

If it is difficult to handle such a request on your own, you can bring in specialized professionals. For example, Reclaim Capital works on cases related to frozen funds on centralized crypto exchanges, restoring access, verification, and legal support.

The team helps analyze the situation, prepare a document package, and structure communication with the platform. For certain cases, more comprehensive procedures are also available, including KYT analysis of transactions and drafting a legal opinion on the

In many cases, users complete an AML check on their own. This is possible if the exchange’s request is clear and you can confirm the circumstances of the transaction and thexity of the process depends on why it was triggered and how deeply the platform needs to analyze your transaction history

Several signs may indicate that you need outside help:

• the exchange repeatedly expands its initial request
• you need to reconstruct a long chain of transfers across multiple wallets and platforms
• the review involves a large number of P2P or OTC counterparties
• the request references sanctions lists, legal restrictions, or requirements from government authorities

In standard cases, it is enough to answer the platform’s questions step by step and provide only the information relevant to them. It is important that any new explanations do not contradict the data you previously submitted and make it possible to match documents to specific transactions.

If the review goes beyond a standard request and requires complex analysis, as well as additional financial or legal supporting documents, you can bring in specialists from Reclaim Capital. 

Conclusions

AML checks are a standard part of how crypto exchanges operate, and they are not applied only when violations are detected. An additional request, a temporary restriction, or a transaction review may be related to the specifics of a particular operation, the history of the addresses involved, or the platform’s internal rules.

It is impossible to fully eliminate the risk of such restrictions even for good-faith users, as exchanges use different assessment models and rely on their own data about the account and its activity. However, a transparent transaction history, counterparty checks, and keeping supporting documents can make the process easier.

If the situation goes beyond a standard request and requires complex transaction tracing, additional legal explanations, or analysis of a large number of related operations, you may need help from specialized professionals.

AML (anti-money laundering) is a set of measures designed to combat money laundering. On crypto exchanges, it includes customer verification, transaction monitoring, address analysis, Travel Rule compliance, and cooperation with government authorities.
The exchange uses a risk-based approach and cross-checks customer data, transaction history, linked addresses, sanctions list matches, and changes in account behavior. A single risk indicator does not prove a violation, but it may lead to additional screening or a request for documents.
For self-screening, you can use AMLBot, Safe3, or WhiteBIT Address Checker. These services help identify known risk categories, but their results are not universal and may differ from an exchange’s internal assessment.
First, you need to determine who exactly imposed the restriction. If the funds are being held by the exchange as part of an internal review, you should respond to its official request and confirm the origin of the assets. If it is enforced at the token level or is related to a sanctions or law enforcement decision, then you need to contact the issuer.
Yes, if it’s a standard KYC check or another straightforward request. If there’s a complex transaction history, sanctions risk, or an official legal restriction, you may need professional assistance.
Published:07.09.2026

Source: incrypted.com