Why Do Crypto Exchanges Freeze Accounts? AML Explained (2026)

Crypto exchanges freeze accounts because anti-money-laundering law punishes them severely for missing a criminal and almost never for blocking an innocent customer. After more than $5 billion in compliance fines since late 2023, every major exchange freezes first and investigates later. Most holds trace to security events, risk-scored deposits, sanctions screening, source-of-funds reviews, or law-enforcement orders — and most are temporary.

If your account is locked right now, that paragraph is the honest summary: you are probably not in trouble, but you are stuck inside a compliance machine that was built to protect the exchange, not you. The Consumer Financial Protection Bureau's complaint data backs this up — "trouble accessing funds" is consistently among the most common issues reported against crypto platforms, alongside fraud and poor customer service. Kraken alone had 492 complaints in the CFPB database as of February 2026.

LeoDex is not affiliated with any exchange named in this article. This is independent educational content, not financial or legal advice. For account-specific help, always use your exchange's official in-app support or help center.

Why do exchanges freeze first and ask questions later?

Because the penalty math is one-sided. Regulators can fine an exchange billions of dollars for letting a money launderer through, while wrongly freezing a legitimate customer costs the exchange roughly one support ticket. A rational compliance department therefore treats every ambiguous account as guilty until verified.

The fine history explains the paranoia better than any policy document:

Company	Penalty	Year	Core failure
Binance	$4.3 billion	2023	Willful Bank Secrecy Act violations; failed to report over 100,000 suspicious transactions (DOJ)
KuCoin	$297 million	2025	Operated for years with no KYC program; barred from the US market for two years (DOJ SDNY)
Block (Cash App)	$295 million combined	2025	$80M to 48 state regulators, $40M to NYDFS, $175M CFPB order; a backlog of roughly 170,000 unreviewed transaction alerts (The Block)
BitMEX	$100 million	2021	FinCEN and CFTC action for operating without an AML program

Notice what is missing from that table: there has never been a comparable fine for freezing too many innocent people. Binance's settlement also installed a multi-year independent compliance monitor, which means a human being now audits how aggressively the exchange flags accounts. Under that incentive structure, over-freezing is not a bug. It is the cheapest insurance policy the exchange can buy, and you are the premium.

What is KYC and AML in crypto — and why does my exchange need my ID?

KYC (know your customer) means verifying who you are; AML (anti-money-laundering) means monitoring what your money does. US exchanges are money services businesses under the Bank Secrecy Act of 1970: they must register with FinCEN, verify customer identity, screen transactions, and report suspicious activity. Your ID upload is them executing a legal duty, not a preference.

Three layers of rules drive most document requests:

• The Bank Secrecy Act (US). Money services businesses must file a suspicious activity report (SAR) for transactions of $2,000 or more that look irregular, generally within 30 days of detection. Filing too few SARs is exactly what cost Binance $4.3 billion and left Cash App with a 170,000-alert backlog.
• The FATF Travel Rule (global). Since June 2019, the Financial Action Task Force has required virtual asset service providers to pass originator and beneficiary information alongside crypto transfers — the same rule banks follow for wires. The EU's implementation, in force since December 30, 2024, applies with no minimum threshold.
• MiCA (EU). The Markets in Crypto-Assets Regulation, fully applicable to crypto service providers since December 30, 2024, ties an exchange's license to its ability to demonstrate exactly these controls.

Here is the uncomfortable proportion underneath it all: Chainalysis estimated roughly $40.9 billion flowed to illicit addresses in 2024 — about 0.14% of on-chain volume. To catch that 0.14%, exchanges must screen 100% of customers. You are reading this article because you are part of the 99.86% that got caught in the net anyway.

What actually triggers a crypto exchange account freeze?

Nearly every freeze falls into one of five trigger families: an automated security hold, AML risk scoring of incoming coins, a sanctions-screening match, a source-of-funds review, or a law-enforcement order. A sixth category — business "de-risking," where the exchange simply closes your account — is becoming more common in 2025-2026.

1. Security holds. Change your password and Binance automatically suspends withdrawals for 24-48 hours; Binance.US locks withdrawals for 120 hours after an email change. A login from a new device or country does the same. These are the most common and the most harmless freezes.

2. Risk-scored deposits. Exchanges run every incoming deposit through chain-analytics tools (Chainalysis, Elliptic, TRM Labs) that score where the coins have been. If your deposit passed within a few hops of a mixer, a darknet market, or a hacked wallet — even if you received it innocently from a P2P trade — the score can quarantine your whole account.

3. Sanctions screening. Exchanges match customers and counterparty addresses against the OFAC sanctions list. False positives on common names happen constantly. Address-based matches can be dramatic: when Tornado Cash was sanctioned in August 2022, accounts that had ever touched it were frozen industry-wide; OFAC delisted it in March 2025 after losing in court.

4. Source-of-funds reviews. The exchange asks you to prove where your money came from — payslips, bank statements, tax returns, trading history. Kraken is the best-known practitioner; our guide to Kraken source-of-funds requests covers what evidence actually satisfies them.

5. Law-enforcement orders. A subpoena, seizure warrant, or formal freeze request obliges the exchange to hold your assets and, usually, to say nothing about why. These are rare but open-ended.

6. De-risking closures. Sometimes nothing triggered at all — the exchange exited your customer segment or country. Crypto.com and Cash App both close accounts this way with a withdrawal window rather than a freeze.

How do freezes differ across the major exchanges?

Each large exchange has a recognizable freeze fingerprint. Knowing yours tells you which documents to prepare and how long to expect to wait. We maintain a dedicated, regularly updated guide for each pattern:

Exchange	Typical freeze pattern	Our deep-dive guide
Coinbase	"Account restricted" banner; buying and selling disabled while withdrawals often still work; ID re-verification loops	Coinbase account restricted
Binance	Automatic 24-48 hour withdrawal suspensions after security changes; longer compliance reviews on flagged accounts	Binance withdrawal suspended
MEXC	"Risk control" freezes lasting 30-180 days, frequently after profitable trading; a wave of user reports in May 2026	MEXC account frozen
Kraken	Withdrawals gated behind source-of-funds and source-of-wealth questionnaires	Kraken source of funds
Crypto.com	Outright account closure with a deadline to withdraw, often without a stated reason	Crypto.com account closed
Cash App	Bitcoin account closed while the fiat side keeps working; BTC becomes withdraw-only	Cash App bitcoin account closed

Why won't support tell you why your account is frozen?

Often because telling you would be a federal crime. If the exchange filed a suspicious activity report about your account, US law (31 U.S.C. 5318(g)(2)) prohibits revealing that fact to you — disclosure is called "tipping off" and carries criminal liability. Support agents read from scripts precisely because specifics could expose the company.

This is why frozen-account tickets get answers like "your account is under review by the relevant team and we cannot provide further details or a timeline." It is infuriating, but it is frequently the only legal sentence the agent is allowed to type. The practical decoder: if support says security review, expect hours to days; compliance review or enhanced due diligence, expect document requests and weeks; total silence with withdrawals blocked, consider a SAR or law-enforcement hold and start documenting everything. The other unglamorous explanation is volume — compliance teams are drowning. Of Kraken's 492 CFPB complaints through February 2026, every single one was closed with an explanation and zero resulted in monetary relief, which tells you how these reviews usually end: eventually, and in the exchange's favor on process.

How long do crypto exchange freezes last?

Security holds clear in 24-72 hours. Deposit risk reviews and sanctions false positives typically take a few days to three weeks. Source-of-funds reviews run two to six weeks once you submit documents — longer if you submit prose instead of records. Law-enforcement holds last until the order is lifted, which can be months or years.

Two duration rules of thumb hold across exchanges. First, freezes that the system created automatically (security events) end automatically; freezes that a human created (compliance escalations) end only when a human signs off, so your response speed matters more than your anger. Second, an exchange that intends to keep your assets long-term is rare — the common worst case is a forced exit: your account is closed and you get a 14-90 day window to withdraw everything. That is disruptive, but it is not confiscation. If your exchange has stopped responding entirely for more than 30 days while holding your funds, move to the escalation steps below rather than opening ticket number eleven.

What should you do if your exchange froze your account?

Work the process before you fight it. Most freezes end fastest when you give the compliance system exactly what it is looking for, in its preferred format, on the first try.

1. Complete every pending verification immediately. Open the app, check for a re-verify banner, and re-submit your ID with a fresh photo in good lighting — most "restricted" states clear automatically once verification passes.
2. Answer source-of-funds requests with documents, not explanations. Upload bank statements, payslips, a tax return, or trade history that shows the money's origin — a paragraph of backstory satisfies no checklist.
3. Preserve evidence as you go. Screenshot your balances, save every ticket number and email, and note dates — you will need this record if you escalate to a regulator or arbitration.
4. Test every exit. Try a small crypto withdrawal, a fiat withdrawal, and different assets — freezes are often partial, and many users discover one rail still works.
5. Do not open a second account. Device fingerprinting and shared KYC data link it to the frozen one within days, and ban evasion converts a temporary review into a permanent closure.
6. Escalate in writing after 30 days of deadlock. Send a formal complaint through the exchange's official complaints channel stating the amount held, the dates, and what you have submitted — this creates the paper trail every later step requires.

How do you escalate beyond customer support?

In the US, file a CFPB complaint — it takes about ten minutes, and the company must respond within 15 days, which routes your case past front-line support to the legal team. A complaint to your state attorney general adds parallel pressure. If real money is at stake, most US exchange user agreements (Coinbase and Binance.US included) provide for arbitration, where the exchange typically pays most arbitrator fees, or small-claims court for amounts under your state's limit. In the UK and EU, complain first in writing, then escalate to the national regulator that licensed the exchange (FCA, BaFin, AMF) or the relevant ombudsman where e-money balances are involved — and under MiCA, every authorized provider must operate a formal complaints procedure with response deadlines.

Which scams target people with frozen accounts?

A frozen account makes you a perfect mark: you are stressed, you have money on the line, and you are actively searching for help. Three scams dominate. None of them end with you getting your money back; all of them end with you losing more.

• Fake support numbers. Scammers buy ads and seed forums so that searching "Coinbase support phone number" surfaces their number, then "verify" you by walking you into sending crypto or revealing codes. Major exchanges handle frozen accounts through in-app support and email — never call a phone number you found through a search result, and never trust an inbound call.
• Recovery agents. Anyone who DMs you on X, Telegram, or Reddit claiming they can "unfreeze" or "recover" your funds for an upfront fee is lying — no third party can reach into an exchange's compliance queue.
• Phishing "compliance" emails. Mails that mimic the exchange and ask you to "verify your wallet" or enter a seed phrase to lift the restriction. No exchange will ever ask for a seed phrase; theirs hold your coins, not yours.

Can you opt out of the freeze game entirely?

Structurally, yes. Freezes are only possible because a custodian sits between you and your coins. Self-custody removes the custodian, and account-free swapping removes the need to ever re-onboard to one. An account that doesn't exist can't be frozen.

The play has two steps. First, while your account is healthy, move your coins to a wallet you control — our guide on how to get crypto off an exchange walks through the withdrawal procedure, network traps, and per-exchange quirks. Second, when you need to trade across chains, you no longer need an exchange account at all: LeoDex is a non-custodial, no-KYC swap aggregator that compares routes across THORChain, Chainflip, MAYAChain, NEAR Intents and more — 40+ chains, native BTC with no wrapped assets, and your keys never leave your wallet. To be clear about the legal frame: using non-KYC swaps is lawful for users in most jurisdictions (the compliance duties in this article sit on regulated businesses, not on you — see is no-KYC swapping legal?), crypto-to-crypto swaps remain taxable events in the US and most countries, and these are transparent public blockchains — this is about removing a custodian, not hiding from anyone. Try it at leodex.io: no account, no email, nothing to freeze.