“Your account is under review.” “Withdrawal frozen.” “Please provide ID, proof of address, and source of funds.” Those notices have become common on regulated crypto platforms, and they reflect how anti-money laundering controls now reach far beyond sign-up. For users, AML affects account opening, deposits, withdrawals, transfer limits, and whether access stays uninterrupted.
What AML is trying to control on crypto platforms
At its core, AML is meant to stop illegally obtained funds from being moved, split, disguised, and introduced into the legitimate financial system through digital assets. The source material notes that blockchain transfers can move across borders instantly and often with fewer intermediaries, making detection harder for traditional compliance systems. Regulators have responded by focusing on the business layer rather than the blockchain itself.
In most jurisdictions, AML duties fall on intermediaries such as exchanges, custodians, brokers, custodial wallet providers, and crypto payment processors. The Financial Action Task Force, or FATF, places these businesses within the Virtual Asset Service Provider, or VASP, framework and expects them to follow AML/CFT standards similar to those imposed on banks. Regular users are usually not the regulated party, but they feel the effect directly through platform controls.
KYC is only the starting point
AML on crypto platforms is not limited to collecting an ID at onboarding. KYC, or Know Your Customer, verifies identity and helps build a risk profile at sign-up. Customer due diligence and enhanced due diligence go deeper, especially where a platform sees elevated risk. The article makes the point plainly: AML is an ongoing system, not a box-ticking exercise.
That explains why some users are asked for more documents even after completing basic verification. A platform may review account history, risk level, and explanations about source of funds before allowing a withdrawal or a larger transfer. If the response is not satisfactory, temporary restrictions can follow, affecting both deposits and withdrawals.
How transaction monitoring leads to restrictions
Platforms monitor a wide range of signals in real time. The source lists transaction velocity, structuring patterns, exposure to risky counterparties, mixer usage, sanctions hits, and geographic outliers among the main indicators. Those signals are fed into monitoring systems and blockchain analytics tools such as Chainalysis, Elliptic, and TRM Labs, which score wallets and trace activity across addresses.
When a transaction crosses a policy threshold, an alert is raised for compliance review. The platform may request more information from the user, or it may freeze or restrict account activity under company rules and applicable law. The stated goal is to catch suspicious flows before they move through fiat off-ramps unnoticed.
Why the Travel Rule adds extra withdrawal fields
Users increasingly encounter additional fields during withdrawals: beneficiary name, receiving platform details, and at times a declaration of wallet ownership. This comes from the Travel Rule. Under FATF Recommendation 16, virtual asset service providers must collect and transmit information about the sender and recipient for transfers above a certain threshold.
The material says many regulators use a threshold of roughly USD 1,000 or EUR 1,000. In the European Union, though, the rule has been written into law through EU Regulation 2023/1113, creating a single framework for digital asset transfers, and the source notes that within the EU framework it applies regardless of the amount transferred. For users, that makes crypto withdrawals look more and more like bank wires.
What happens when a platform suspects laundering
If an exchange detects suspicious activity, it begins an internal review covering account history, risk profile, and submitted documentation. Users may be asked for source-of-funds evidence while withdrawals or deposits are temporarily restricted. If suspicion remains, the platform submits a report under local rules.
In the United States, that report goes to FinCEN as a Suspicious Activity Report, or SAR. In other jurisdictions, a Suspicious Transaction Report, or STR, is more common. The source also highlights a key point: in many countries, telling a user that such a report has been filed can itself be illegal. If funds are confirmed illicit, or if no adequate explanation is provided, the platform can impose permanent limits, close the account, or respond to law enforcement requests. The article cites Binance, which paid more than $4.3 billion in US penalties in 2023 over AML and sanctions failures.
Who writes the rules and how the US differs from the EU
Crypto AML standards are shaped by both international and local bodies. FATF sets global standards and defines terms such as virtual asset and VASP. In the US, FinCEN enforces expectations under the Bank Secrecy Act, or BSA. In the EU, the European Banking Authority and the new Anti-Money Laundering Authority are part of the enforcement structure, while national financial intelligence units receive and analyze SARs or STRs.
The source distinguishes the US and EU by structure rather than objective. The US BSA, enacted in 1970, requires recordkeeping, Currency Transaction Reports for large cash activity, and SAR filings where money laundering is suspected. FinCEN’s consolidated guidance in 2019 clarified how those rules apply across crypto business models, including miners, wallets, and decentralized exchanges.
Many US exchanges must also register with FinCEN as Money Services Businesses, usually as money transmitters, because they accept and transfer value on behalf of customers. That status triggers full BSA duties: AML programs, SAR filing, recordkeeping, and regular review. The source adds that miners, validators, and non-custodial wallet providers generally fall outside the MSB definition. The deciding factor is custody or control over customer funds.
Blockchain analytics has become part of compliance infrastructure
Public blockchains are not fully anonymous. The source stresses that while wallet addresses are pseudonymous, every transfer remains public and permanent, allowing analytics firms and law enforcement to trace illicit funds across wallets and exchanges, sometimes long after the original movement took place.
Blockchain analytics firms cluster wallets, assign risk scores, trace exposure hops, and flag patterns such as structuring or mixer usage. Exchanges integrate these tools into screening workflows before processing transfers. For users, that means a transfer is no longer judged only by whether the address is correct. The risk profile of the counterparty and the history of the funds now matter just as much.