TL;DR - An exchange flags a crypto withdrawal for review when its automated checks see something that needs a human to sign off: a destination address tied to sanctions, mixers, scams, or stolen funds, or a transaction that breaks your normal pattern. It is a pause, not a verdict. Most holds clear within hours to a few business days once you confirm your identity and the source of funds. You can avoid almost all of them by screening the wallet and counterparty before you withdraw.
You hit "withdraw", expected the coins to land, and instead got a message that your transaction is "under review", "pending compliance", or simply stuck. It is one of the most stressful moments in crypto - it feels like your money has been taken. In almost every case it has not. A flag is the exchange doing the job regulators require of it: checking that a payout is not part of money laundering, sanctions evasion, or theft before it lets the funds leave. This guide explains what triggers that check, how long it lasts, and what to actually do.
Why do crypto exchanges flag withdrawals for review?
Regulated exchanges operate under anti-money-laundering (AML) and know-your-transaction (KYT) obligations. Every withdrawal runs through an automated monitoring system before it is released. When the system sees a pattern or a counterparty that crosses a risk threshold, it raises an alert and routes the transaction to a human compliance analyst instead of paying it out straight away.
As one exchange glossary puts it, a flagged transaction is one "marked by banking institutions or regulatory bodies for further review" because it looks "unusual or potentially violating legal or policy standards." The flag is the alert; the review is what decides whether the money moves. Most flags are false alarms that an analyst clears quickly - but the exchange is legally obliged to look before it releases the funds.
What actually triggers an AML hold on a withdrawal?
Holds fall into two broad buckets: who you are sending to and how you are behaving. The most common triggers are:
- The destination address is high-risk. If the wallet you are withdrawing to is tied to sanctions (an OFAC-listed entity), a mixer like Tornado Cash, a darknet market, or a known scam or stolen-funds cluster, the payout stops cold.
- Your funds have risky history. Even if your destination is clean, coins that reached your exchange balance after passing through a mixer or a flagged address can trigger a review on the way out.
- An unusual amount or pattern. A "sudden large transfer of funds from a low-activity account may be flagged for review to rule out unauthorized access or money laundering," in one exchange's words. Rapid in-and-out movement, round-number sweeps, or many small withdrawals in a row (structuring) all draw attention.
- An unverified or new withdrawal address. Many platforms hold or reject payouts to addresses you have not previously confirmed, especially for larger amounts, until you verify ownership.
- Account or KYC gaps. Incomplete identity verification, a login from a new device or country, or a recent password or 2FA change can all add risk weight to an otherwise normal withdrawal.
You can inspect a destination address yourself on a block explorer such as Etherscan, but the explorer shows raw transactions - it will not tell you whether that address is already tied to sanctions, a mixer, or a theft cluster. Screen any address with Plastron first and you see the full risk picture in seconds - sanctions exposure, mixer contact, and proximity to stolen-funds and scam clusters across Ethereum and six other chains, with no wallet connection needed. Checking before you withdraw is how you avoid a hold instead of explaining one.
How long does a flagged withdrawal stay on hold?
There is no fixed legal clock, and it varies by exchange and by how serious the flag is. In practice:
- Routine reviews - an unverified address, a first large withdrawal, a minor pattern anomaly - usually clear within a few hours to two or three business days once any requested information is provided.
- Source-of-funds reviews can take a week or longer, because a human has to read what you submit and make a judgement.
- Confirmed hits - a real sanctions match or a direct link to stolen funds - can lead to an indefinite freeze and a Suspicious Activity Report (SAR) filed with regulators. At that point the timeline is out of the exchange's hands.
The single biggest factor in your control is responsiveness: holds drag on mostly when the exchange asks for documents and the user goes quiet.
What should you do if your withdrawal is flagged?
Work through it calmly and in order:
- Do not retry or restructure. Cancelling and re-sending, or splitting the amount into smaller withdrawals, reads as evasion and can deepen the review.
- Read what the exchange is asking for. Check your email and support tickets. Often the hold lifts the moment you verify the withdrawal address or complete an outstanding KYC step.
- Gather proof of source of funds. Be ready with on-chain transaction history, records from where you bought the crypto, and - if asked - a short source-of-funds letter explaining where the money came from.
- Respond promptly and honestly. Give the analyst what they need in one clear reply. Vague or incomplete answers extend the hold.
- Escalate if it becomes a freeze. If funds are held long-term with no resolution, use the exchange's formal complaint process, your regulator's dispute channel, or - for large sums - legal advice.
How do you stop your withdrawals from getting flagged?
Most holds are avoidable. The goal is to keep your funds and counterparties clean and your behaviour predictable:
- Screen the destination before you send. Knowing an address is clean - or catching that it is not - before you withdraw removes the single most common trigger.
- Know the history of incoming funds. Before you accept a payment or deposit, check that it did not come through a mixer or a flagged wallet, so it cannot taint your balance later.
- Complete KYC fully and verify withdrawal addresses in advance, especially for large amounts.
- Avoid mixers and unhosted high-risk services if you ever intend to move funds back to a regulated exchange.
- Keep records. A simple paper trail of where your crypto came from turns a stressful review into a two-minute formality.
A flag is not an accusation - it is a checkpoint. Understanding what the checkpoint looks for, and screening your wallet and counterparties before you transact, is the difference between a withdrawal that lands and one that sits "under review" while you wait.
Frequently asked questions
Does a flagged withdrawal mean I did something illegal?
No. A flag means an automated system saw something it could not clear on its own and sent the transaction to a human to check. Most flags are false alarms - an unverified address, a larger-than-usual amount, or coins with distant risky history. It only becomes serious if the review confirms a real link to sanctions, theft, or laundering.
Why was my withdrawal flagged when the amount was small?
Amount is only one trigger. A small withdrawal can still be flagged if the destination address is high-risk, if your funds passed through a mixer or flagged wallet earlier, if the address is new or unverified, or if you made several small withdrawals in a row in a way that looks like structuring.
How long does an exchange hold a flagged crypto withdrawal?
Routine reviews usually clear within a few hours to two or three business days, especially once you provide any requested information. Source-of-funds reviews can take a week or more. A confirmed sanctions or stolen-funds match can lead to an indefinite freeze and a regulatory report, which is no longer on a fixed timeline.
Can I avoid getting my withdrawals flagged?
Largely, yes. Screen the destination address and the history of your funds before you transact, complete your identity verification, verify withdrawal addresses ahead of time, keep records of where your crypto came from, and avoid mixers if you plan to use regulated exchanges. Predictable behaviour and clean counterparties prevent most holds.