An exchange freeze: a step-by-step protocol
One day you log in to your exchange account and see that withdrawals are unavailable and your funds are "blocked pending review." This is neither a verdict nor always a loss of money — it is a standard compliance procedure. In this lesson we examine why exchanges freeze funds, what a Source of Funds request is, and give a step-by-step protocol of actions with a ready-made template reply to support. The speed and quality of your reaction in the first hours directly affect the outcome.
Why exchanges freeze funds in the first place
A centralized exchange (Binance, Bybit, OKX, Kraken, and others) is required by law to run an AML program. The core of this program is a KYT (Know Your Transaction) system, automated transaction monitoring. Every incoming and outgoing transfer is run through an analysis engine (Chainalysis, Elliptic, TRM Labs), which assesses the origin of the funds and assigns them a risk score.
When a deposit or a flow tied to your account crosses an internal risk threshold, an automatic flag is triggered. Then a compliance officer steps in, and the funds are temporarily frozen. It is important to understand: in most cases this is not an accusation against you personally, but the system's reaction to the history of the coins that reached you.
- An incoming deposit with a labelYou received USDT/BTC that had previously passed through a mixer, a sanctioned address, a darknet market, or a hacked exchange. The system sees the trail and "pulls" it to your deposit.
- A pattern resembling launderingA fast "deposit → instant withdrawal" cycle, fragmentation of amounts, transit behavior (funds do not linger but pass through onward).
- An external requestLaw enforcement or another exchange sent a request about specific funds that reached you (for example, a fraud victim traced their money to your deposit).
- Sanctions exposureThe harshest case: part of the funds traces back to an address on the OFAC list. Here a freeze almost always turns into a demand for full disclosure.
The general logic of the process: KYT flag → freeze → Source of Funds request → provision of documents → compliance decision.
What a Source of Funds (SoF) request is
After a freeze the exchange almost always sends a Source of Funds request (the source of the funds) or a broader Source of Wealth request (the source of the wealth). This is a formal demand to prove where exactly these coins came from. The task of compliance is not to "punish" but to close their own liability: they must document to the regulator that they checked the origin and satisfied themselves of its legitimacy.
Typical wordings of the request: "Please provide the source of the funds deposited on DD.MM," "Provide documentary evidence of the origin of the assets," "Explain the nature of transaction with TXID …". Behind the dry phrases lies a concrete need: to tie the received coins to a legitimate event in your life (salary, sale of property, trading profit, mining, previously purchased crypto).
A step-by-step protocol of actions during a freeze
- Keep calm and record the fact. Take screenshots: the account status, the text of the notification, the ticket ID, the date and time. Do not write emotional messages to support — every word of yours goes into the case file.Panic and aggression in correspondence read to compliance as a red flag. Behave like someone with nothing to hide — calmly and by the facts.
- Read the request literally. Determine precisely which deposit/transaction is being asked about (TXID, date, amount) and what document format is required. Answer exactly the question asked, without dumping extras.If the request is unclear, in your first message politely clarify which specific transaction and which period are meant.
- Reconstruct the chain of the funds' origin. Trace where these coins came from: from which exchange/wallet, and what you received them for. Build a clear story: "bought on exchange X → transferred to wallet Y → sent to you."Here your own AML report on the sending address helps — it shows that you checked the counterparty in advance.
- Assemble the documents (see the checklist below). Build the package around the specific origin story. The more documentary — the better: statements, contracts, exchange receipts.One coherent set of 3–5 documents is stronger than 20 scattered screenshots.
- Compose a written explanation (a covering letter). A short coherent text of one screen: who you are, where the funds came from, what confirms this, the attached documents as a list. A neutral business tone, no emotion.Write in the exchange's language (usually English). Bad English is better than silence, but reread it for contradictions.
- Send the package in a single message and record it. Attach all files at once, indicate the ticket number. Keep a copy of what you sent.Do not send documents piecemeal over the course of a week — that looks like "making it up as you go."
- Wait for the decision, answer follow-ups quickly. Review takes from a few days to a few weeks. Answer additional questions within 24–48 hours — dragging it out works against you.If there is silence for more than 2 weeks — a polite reminder in the same ticket, without opening new tickets.
- On refusal — escalate. If the funds are not unblocked, request the official reason in writing, cite the clauses of the user agreement, and for large sums bring in a lawyer and a complaint to the regulator of the exchange's jurisdiction.An official written refusal is a document you can already work with in the legal field.
Which documents to gather
The package depends on the story of the funds' origin. Pick what really confirms your particular story.
- Salary / incomeAn income certificate, a statement from your salary account, an employment contract. Shows financial standing.
- Purchase of crypto on another exchangeA statement/trade history from the exchange where you bought the coins, with the TXID of the withdrawal to you. This is the most direct bridge "fiat → crypto → your deposit."
- Sale of property/businessA sale-and-purchase contract, a statement of the incoming funds. For large sums — the key document.
- Trading profit / P2PTrade history, a register of operations, screenshots of closed P2P orders with counterparties.
- MiningReceipts for equipment, pool statistics, electricity bills.
- Your AML report on the addressA document showing that you checked the origin of the coins before you accepted them. Demonstrates good faith.
Timelines and realistic expectations
Simple cases (a single transaction with a clear source) close in 3–10 business days. Complex ones (indirect sanctions exposure, a law-enforcement request) — weeks and months. If the funds trace back to a direct SDN address, unblocking may never come: the exchange has no legal right to return sanctioned assets. So the best freeze is the one prevented: check the origin of the coins before the deposit, not after.
Template reply to support (adapt to your case)
Subject: Source of Funds — Ticket #_____
"Hello. In response to your request regarding transaction [TXID] of [date] for the amount of [amount], I am providing information on the source of the funds. These coins were purchased by me on the exchange [name] on [purchase date] and withdrawn to my wallet [address], after which they funded my account on your platform. Attached: (1) a trade-history statement from [exchange]; (2) confirmation of the withdrawal with the TXID; (3) [additional document]. I am ready to provide further information on your request. Sincerely, [name, account ID]."
freeze
In the next lesson we will examine another type of freeze — a far more hopeless one. Whereas an exchange can be persuaded with documents, a freeze by the stablecoin issuer itself (Tether, Circle) is almost impossible to reverse. We will learn how it works and how to check whether an address has been "poisoned" at the contract level.
This material is for educational purposes and is not legal advice.