TL;DR — Exchanges hold crypto when a deposit, withdrawal or pattern trips an AML rule — screening exposure, an unexplained source of funds, or a destination they will not send to. Most holds clear with documentation.
An exchange holding your funds is not an accusation. It is a regulated business hitting a threshold in a rulebook it did not write and cannot ignore, and the person reading your ticket usually has less discretion than you would hope.
That distinction matters because it changes what actually works. Arguing does not. Understanding which rule fired, and producing the specific evidence that rule wants, does. This guide covers every stage where a hold can happen, what triggers each one, how long they last, and what to send.
Why do exchanges screen at all?
Because they are money-services businesses in most jurisdictions, and that carries anti-money-laundering obligations with real penalties attached. An exchange that processes tainted value without controls risks its licence, its banking relationships and, in the worst cases, its executives.
So they build layers. Identity checks at onboarding. Address screening on every deposit and withdrawal. Behavioural monitoring across accounts. Each layer catches a different thing, and each one can hold your funds independently of the others — which is why passing KYC perfectly does not protect a deposit that arrives from a flagged address.
Two obligations sit behind most of what you experience. Sanctions compliance is strict and absolute: a designated address cannot be served, full stop. AML is risk-based, meaning the exchange sets thresholds and must justify them to a regulator — which is why two exchanges treat the same wallet differently, and why "but the other one let me through" is never a useful argument.
What actually triggers a hold?
In rough order of how often it happens to ordinary users:
Notice how many of these are about history rather than intent. Nothing in that list requires you to have done anything wrong — which is exactly why the check is worth running on your own wallet before the exchange runs it for you.
Deposits and withdrawals are held for different reasons
People treat these as one problem. They are not.
A held deposit is about where the value came from. The exchange screened the sending address, found exposure, and will not credit the balance until it understands it. Your funds are on their side of the wall, and the leverage is theirs. This is the expensive one.
A blocked withdrawal is about where the value is going, or about the account itself. Sometimes the destination is the problem. Sometimes the withdrawal is what finally triggered a review of activity that had been accumulating quietly. We went through the specific triggers in detail below, because this is the case most people arrive here for.
The practical difference: a blocked withdrawal leaves your funds where they are and your account usable. A held deposit does neither. If you only screen at one moment, screen before you deposit.
What triggers an AML hold on a withdrawal specifically?
Four things, in descending order of frequency.
The destination address screens badly. The exchange applies the same logic outbound as inbound, and it is not obliged to tell you which counterparty in that address's history caused it.
The amount or timing breaks your own pattern. Risk models are largely comparative: what matters is not that you withdrew ten thousand, but that you have never withdrawn more than five hundred before.
Your account has an open question. An unresolved source-of-funds request, a document that expired, a jurisdiction mismatch. The withdrawal did not cause the review; it surfaced one already pending.
A counterparty relationship trips a rule — sending to a service the exchange considers high risk, or to an address associated with one it has already declined to serve.
How long does a hold last?
Days for an automated check that clears itself. One to three weeks for a manual review with documentation. Considerably longer where a Suspicious Activity Report is involved, and in that case the exchange is often legally barred from telling you what is happening or why — the silence is a legal requirement, not indifference.
Two things genuinely shorten it: sending complete documentation the first time, and sending exactly what was asked for rather than everything you have. A reviewer working a queue will park an incomplete submission and move on. We collected realistic timelines in how long an AML review actually takes.
What should you send them?
Source of funds and proof of funds are different requests, and sending the wrong one restarts the clock. Proof of funds shows you have the value; source of funds shows where it came from. Compliance almost always wants the second, and the proof-of-funds page sets out what each looks like.
What actually satisfies a reviewer:
- A plain-language timeline. Two paragraphs. Where the value originated, how it reached this wallet, why it moved when it did. Write this first — it frames everything else.
- Primary documents. Exchange statements, payslips, a sale contract, an invoice, a tax return. Documents from a third party beat anything you generated yourself.
- The transaction hashes. Specific ones, tying your story to the chain. This is the part most people omit and the part a reviewer can actually verify.
- An explanation of the flag itself, if you know what it was. If the exposure came from a counterparty rather than from you, say so plainly and show the hop.
Where the funds bought something outside crypto, expect the bar to rise: property purchases pull in a second set of checks entirely. And in some jurisdictions the request escalates formally into enhanced due diligence, which is a defined regime rather than a mood.
The rules behind the behaviour
Three regimes explain most of what exchanges do, and knowing which one you have hit tells you how much room there is to argue.
The Travel Rule requires originator and beneficiary information to accompany transfers above a threshold. It is why an exchange sometimes asks who owns the receiving wallet. It works badly in practice because adoption is uneven — the sunrise problem — and it interacts awkwardly with self-custody, as the EU's thousand-euro threshold shows. It is also not the same thing as transaction monitoring, though the two get conflated constantly.
Ownership verification. Some exchanges will ask you to prove you control the other wallet, typically with a signed message — the Satoshi test. This is usually good news: it is a solvable request with a definite answer.
Regional regimes. MiCA in the EU has its own screening obligations, and an exchange serving several markets applies the strictest one it is bound by.
How do you stop it happening?
You cannot control an exchange's thresholds. You can control what arrives at them.
- Screen the wallet before you deposit. A pre-deposit check takes seconds and answers the question the exchange is about to ask.
- Screen incoming counterparties. The exposure that gets you held usually arrived from someone else. Check an address before you accept payment, not after.
- Keep records as you go. The evidence is easy to assemble while you still have account access and hard to reconstruct afterwards.
- Do not split deposits to stay under thresholds. It is detected, and it converts a documentation question into a conduct one.
- Do not move flagged funds to a fresh wallet. The chain of custody is permanent; a new hop reads as obfuscation.
If you want the exchange's side of it, how exchanges trace a deposit's origin explains what they see when your transfer lands — which is more than most people assume and less than most people fear.
Working backwards from a hold to its cause
Most people respond to a hold by writing to support and waiting. A better first move is to find out what the exchange saw, because you can do that yourself in a couple of minutes and it changes what you write.
Screen the wallet involved. The result tells you which category fired and how direct the exposure is, and those two facts sort every hold into one of three shapes:
- Nothing found. If the address screens clean on the categories a venue cares about, the hold is probably not about the address at all — it is about the account, the amount, or an open document request. That reframes your ticket from "my wallet is fine, prove otherwise" to "what do you need from me", which is the version that gets answered.
- Indirect, low-value exposure. Something tainted sits several hops back, carrying little value. This is the most common real finding and the most winnable: name the hop, show the transaction, explain that you never transacted with the source. Materiality is a legitimate argument and compliance teams are used to hearing it.
- Direct or substantial exposure. You transacted with a flagged address, or a large share of the balance traces to one. Here the honest advice is to stop writing tickets and get advice appropriate to the category — a sanctions finding is a different problem from a scam-cluster one, and only one of them is a legal matter.
The value of doing this first is not that it releases the funds. It is that you stop guessing. A ticket that says "I understand the deposit came via an address with mixer exposure two hops back; here is the transaction and here is where the funds originated" is a different document from "why is my money held", and it lands in a different part of the reviewer's day.
One caveat worth stating plainly: a free check covers direct counterparties, while an exchange runs deeper graph analysis across many intermediate hops. A clean result on your side and a clean result on theirs are not the same statement. If yours comes back clean and theirs did not, the gap is almost always depth — which is useful information too, because it tells you the exposure is distant rather than absent.
When the exchange is the one that got it wrong
It happens. Screening false positives cluster around heavily-used infrastructure contracts, and a label from a single unverified report carries the same colour on a dashboard as a Treasury designation. Contesting a false positive is a real process with a real success rate.
Issuers get it wrong too, and their mistakes bite harder because a stablecoin freeze is enforced on-chain rather than at a venue. Circle has frozen addresses in error with no warning and no appeal path, and Tether has frozen tens of millions without a warrant. Worth knowing before you assume a centralised stablecoin is neutral infrastructure.
FAQ
Can an exchange keep my crypto permanently?
Not arbitrarily, but it can hold funds while a review runs, and where law enforcement is involved the hold can outlast any commercial relationship. Most holds end in release. The ones that do not usually involve a legal instrument rather than a policy decision.
Will they tell me why my deposit was held?
Often only in general terms. Detailed disclosure can amount to tipping off, which is itself an offence in several jurisdictions, so a vague answer is frequently a legal constraint rather than evasion.
Does screening my own wallet make me look suspicious?
No. A read-only check against public ledger data is not visible to any exchange and is not a reportable event. The only thing it changes is what you know before you press send.
My deposit cleared last month and the same wallet is held now. What changed?
Usually the data, not the wallet. A counterparty in your history got designated or labelled in the interim, and exposure appears retroactively in wallets that did nothing new. Occasionally the exchange changed its own thresholds.
Should I just use a different exchange?
If the first one is holding funds, moving does not release them, and the second one screens the same wallet. Where it does help is forward-looking: risk appetite genuinely varies, and an exchange whose thresholds suit your activity is worth finding before you need one.
Can I get funds back that were sent to a blocked destination?
If the withdrawal was rejected before broadcast, the funds never left and will return to your balance. If it was broadcast and the destination is frozen at the issuer level, recovery depends entirely on that issuer's process, which is typically slow and discretionary.
Is a held withdrawal worse than a held deposit?
Usually better. A blocked withdrawal leaves your funds where they are and your account working, so the question is about one transaction. A held deposit means the exchange controls value you have already parted with, and the conversation starts from a weaker position.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.