Crypto AML Review: What Happens When an Account Is Under Review?

Identify the Review You Actually Have

“Under review” is not a single status. A withdrawal hold, KYC refresh and detailed transaction enquiry can require different answers.

Do not assume a security hold or an ordinary pending transfer is an AML case. Kraken’s explanation of account restrictions describes several protective and transaction review measures. Its particular review periods are Kraken policies, not EU-wide deadlines. For an account restriction guide, see Crypto Exchange Account Frozen or Restricted: What to Do and follow the provider-specific notice before escalating.

Why a Review May Begin

EU crypto-asset service providers are expected to apply risk-based anti-money-laundering controls. The EBA’s crypto risk-factor guidance describes factors relevant to a provider’s assessment of money-laundering and terrorist-financing risk. A review can also reflect security, sanctions, transfer information, a periodic information refresh or the provider’s own policy. A support message rarely identifies the complete internal reason.

Possible practical triggers include a transaction unlike prior activity, repeated deposits from external wallets, P2P purchases, a third-party bank payment, a complex cross-chain route or discrepancies between declared income and volume. These are examples, not a finding that any transaction is unlawful. The platform may ask questions even when the assets are legitimate.

The EU Transfer of Funds Regulation also addresses information accompanying certain crypto-asset transfers involving service providers. A request for originator or beneficiary information should be answered as asked; it is not the same as proving the lawful origin of all your wealth.

What Normally Happens During the Review

1. The platform flags an issue or schedules a periodic check. You may see a banner, email or a disabled function.

2. It requests information. The message may name a transaction, ask for current ID, or request Source of Funds and Source of Wealth records.

3. You submit evidence in a secure channel. Compliance checks whether names, dates, amounts and explanations reconcile.

4. It may ask a follow-up question. A second request does not necessarily mean that the first packet was rejected; it may target one unresolved gap.

5. It makes an operational decision. The provider may restore access, maintain a restriction pending further checks, refuse a particular transfer or close the relationship under its terms and law.

The provider may not share all internal monitoring or third-party information with you. Do not infer from limited detail that it has no basis to review. Ask what you can usefully answer, what remains outstanding and what procedure applies to your assets.

Respond Without Making the File Harder to Assess

Preserve the Current Position

Save the full notice, ticket number, screenshots of affected functions, balances, deposit or withdrawal IDs, transaction hashes and every submission receipt. Export account statements while access is available. Do not delete chats or change the transaction history you rely on. If there is an active compromise, secure the account at once rather than waiting to preserve a perfect screenshot.

Clarify the Scope

Read whether the request concerns one payment, all deposits over a period, a wallet you control, or your total wealth. Ask for the specific asset, amount and date if it is unclear. If the platform requests an identity document, follow that route; do not send a tax return instead.

A failed KYC process requires different troubleshooting. See Crypto KYC Verification Failed or Rejected: What to Do.

Build a Coherent Answer

Use a short chronology and an attachment index. For a particular deposit, identify the original source, actual receipt, crypto purchase and route into the reviewed account. For a third-party payment, name the relationship and include the legitimate underlying transaction. State plainly when a record is missing and what alternative evidence exists.

The Source of Funds proof guide explains how to connect a bank credit, purchase, wallet transfer and deposit. Do not upload unrelated years of records in the hope that the reviewer will locate that chain for you.

Submit and Track the Response

Reply in the same compliance ticket or secure portal. For example:

“Your request dated [date] concerns the [asset/amount] deposit on [date]. Files 1–4 show the source, purchase and route to my account. File 5 explains the transfer from [third party]. Please confirm receipt, identify any missing item and advise which account functions remain restricted during review.”

Keep the acknowledgement and any stated deadline.

Get a Free AML Review Assessment

Documents That Can Answer Common Questions

The platform’s own list controls accepted dates, formats and redactions. Never disclose a seed phrase, private key, password, live 2FA code or unrestricted remote access. Verify the request in the genuine app before sending financial documents.

Timing, Escalation and Realistic Outcomes

There is no single AML review duration applicable to every exchange or case. Ask for an update through the existing ticket at a reasonable interval, referring to the full submission date and case number. Do not open a new ticket for every follow-up; fragmented correspondence can obscure the record. If there is a stated deadline, record it and respond or request an extension before it passes.

If an in-scope EU CASP fails to handle a complaint properly, MiCA Article 71 requires an effective, transparent and free client complaint procedure, with a fair investigation and outcome communicated within a reasonable period. This is a route for a formal complaint; it is not an automatic order to restore withdrawals. A regulator complaint, police report and civil claim serve different purposes.

Possible outcomes include a further document request, removal of a hold, permission to withdraw remaining assets after closure, refusal of a transfer, continuing restrictions or a disputed final decision.

If the account remains blocked after one or two complete and coherent submissions, the amount is significant, or several jurisdictions or entities are involved, legal review may be useful. See When Do You Need a Crypto Recovery Lawyer?.

Common Mistakes

• Treating a review as proof of a criminal allegation. Respond to the actual request rather than arguing against an assumed accusation.
• Sending the same documents repeatedly without mapping them to the question. Add a one-page index and explain the missing link.
• Changing the origin story between submissions. Correct an earlier error explicitly with evidence.
• Sending forged, altered or misleading records. Preserve originals and label any explanatory reconstruction.
• Expecting support to disclose another customer’s details or internal risk logic. Ask what information you can provide and what happens next.
• Paying a third party who promises to “clear AML” for a fee. Use the provider’s genuine channel; no outsider can guarantee its decision.

Get a Case Assessment

If a complete response has not resolved a substantial restriction, Get a Free Case Assessment from P&P Crypto Asset Recovery. Send the platform’s notices, submission dates, the affected transaction schedule and its replies through a verified channel. We can assess the gaps and next step without guaranteeing approval or release.