TL;DR - When an exchange asks for a selfie or proof of where your crypto came from, it has triggered an enhanced due diligence check, usually because of a deposit's size, source, or pattern.
You sent a routine deposit, and instead of a confirmation the exchange asked for a fresh photo of your face and a paper trail proving where the money came from. Nothing was wrong with the transfer, so the request feels random. It is not. A specific signal moved your account from light checks into a deeper review called enhanced due diligence. Most guides explain what documents to send but skip the part people actually want to know: what set this off, and whether you could have seen it coming.
Why did my exchange suddenly ask for a selfie or source of funds?
Every regulated exchange runs two layers of identity work. The first is standard onboarding: your name, an ID, and a one-time liveness selfie. The second is enhanced due diligence, or EDD, a stricter review that kicks in when something about your activity scores as higher risk. A repeat selfie request is the exchange confirming that the person behind the account is still you. A source-of-funds request is the exchange asking you to account for money it cannot explain on its own.
The trigger is rarely about you as a person. It is about a transaction. An automated system watches deposits and withdrawals, scores each one, and escalates anything that crosses a threshold to a human analyst. That analyst then pauses the account and asks for more. The pause is procedural, not an accusation, but it does put the burden of explanation on you.
What triggers an enhanced due diligence check?
EDD fires on patterns, not hunches. A handful of signals account for most of the holds people run into.
Deposit size - a transfer that is large for your account, or that pushes your monthly volume past a tier the exchange set for your verification level.
Source of the funds - the wallet that paid you has exposure to a mixer, a sanctioned address, a known scam, or stolen funds a few hops back.
Pattern of movement - money that arrives and leaves quickly, round-number transfers, or many small deposits that add up to a large one.
Profile mismatch - activity that does not fit what you told the exchange at signup about your job, income, or expected use.
Jurisdiction - a deposit linked to a high-risk country, or a login pattern that suggests you are in one.
Compliance vendors such as Chainalysis, TRM Labs, and Elliptic supply the address-risk scores that drive the source-of-funds signal. When the wallet that paid you scores high, your clean deposit inherits that score, and the analyst sees the exposure rather than your intent.
An EDD review is set off by transaction signals, not by who you are. Source exposure is the one you can check before you deposit.
What documents count as proof of source of funds?
Source of funds means the immediate origin of the specific money you deposited. Source of wealth, a related request, means how you built your assets overall. For a single deposit, the exchange usually wants one clear document that ties the money to a lawful origin.
Salary or freelance income - a payslip, an invoice, or a bank statement showing the payment.
Trading or investment gains - statements from another exchange or broker showing the sale.
Sale of an asset - a contract or receipt for a car, property, or business.
Gift or inheritance - a letter from the giver, or a will and an executor's note.
For crypto deposits specifically, the analyst also cares about the on-chain trail. You can rebuild part of that yourself: open a block explorer such as Etherscan, find the address that paid you, and trace its incoming transactions backward, hop by hop, looking for any wallet tied to a hack, a scam, or a sanctioned entity. The catch is that one address can hold thousands of transactions, and the risk labels that decide the outcome never show up on the explorer itself. Rather than walking that trail by hand, screen the address with Plastron to see sanctions, mixer, and stolen-funds exposure across Ethereum and six other chains at once, with no wallet connection needed. Checking the source of an incoming payment before you deposit it is the cheapest way to avoid a hold you cannot explain later.
A flagged deposit moves from automated scoring to a human analyst, who decides whether your documents clear the hold.
Can you avoid the request, or at least clear it faster?
You cannot opt out of EDD on a regulated exchange, but you can shape the odds. Screen the source of a payment before you accept it, so a tainted wallet never reaches your deposit address in the first place. Keep records as you go: invoices, statements, and a short note of who paid you and why. If you know a large or unusual deposit is coming, expect the question and gather the proof in advance.
When the request does land, answer it directly and once. Send exactly what was asked, in a clear file, with names and dates that match your account. Vague or partial answers extend the hold, and bouncing the funds through extra wallets to look clean only adds hops that read as laundering. A frozen balance during this review is normal; for how long these holds usually run, see how long a crypto exchange AML review takes, and for the document itself, see how to write a source-of-funds letter.
FAQ
Does a source-of-funds request mean I am under investigation?
No. It is a routine compliance step triggered by a transaction signal, not a finding against you. The exchange has to document the origin of funds it cannot explain, and you are simply being asked to fill that gap.
Why does the exchange want a new selfie if I already verified?
A repeat liveness selfie confirms the live person controlling the account is the same person who onboarded. It is common after a higher-risk deposit, a login from a new device or country, or a long gap since your last check.
Can I get my deposit back instead of providing documents?
Sometimes, but not always. Some exchanges will return funds to the originating wallet if you decline EDD, while others hold the balance until the review is satisfied. Check the terms before you refuse, because a forced return can itself be slow.
How can I tell in advance if a deposit will be flagged?
You cannot see the exchange's internal thresholds, but you can check the part that drives most source-of-funds holds: the risk exposure of the wallet paying you. Screening that address before you deposit shows whether it has links to sanctions, a mixer, or stolen funds.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.
About Plastron
Plastron is a free, non-custodial wallet screening tool. It checks Ethereum and six EVM chains for AML and KYT risk — sanctions exposure, mixer contact, and stolen-funds proximity — and returns a risk report in seconds. It reads public on-chain data only: it never takes custody of funds and never asks for private keys.