"Source of Funds." "Source of Wealth." "Enhanced Due Diligence." "Customer Due Diligence." "Politically Exposed Person." "Suspicious Activity Report." If your crypto exchange has sent you a compliance notification, you are now drowning in acronyms and legal terms that no one ever explained to you. This guide defines every term in plain English — and explains what each one means for your frozen account.
Understanding these terms is not academic. It is practical: the specific term the exchange uses in its notification determines what documentation you need, how long the review will take, and what your rights are. This guide is also available as a standalone AML glossary for quick reference.
Source of Funds (SoF)
Definition: Documentation proving where a specific deposit or transfer of funds came from.
What it means for you: The exchange is asking you to prove where the money you deposited came from. This is the most common compliance request. You need to trace the funds from their origin to the deposit — with documentation at each step.
Example: You deposited €50,000 into Binance. The exchange asks for SoF. You provide: pay slips showing your salary, bank statements showing salary deposits, and bank statements showing the transfer from your account to Binance. The chain is complete.
Key distinction: SoF is about a specific transaction. It is not about your overall financial history. Focus on the specific deposit the exchange is asking about.
For a complete guide on preparing SoF documentation, see our How to Prove Source of Funds guide.
Source of Wealth (SoW)
Definition: Documentation proving how you accumulated your overall net worth.
What it means for you: The exchange is asking about your broader financial situation, not just a specific deposit. This is more invasive than SoF. They want to understand your career, your income history, your investments, and how you came to hold the assets you hold.
Example: You hold €500,000 in crypto. The exchange asks for SoW. You provide: your employment history (CV or LinkedIn), salary progression over 10 years, tax returns, and a summary of your investment activity.
Customer Due Diligence (CDD)
Definition: The baseline level of identity verification and risk assessment applied to all customers.
What it means for you: CDD is the standard KYC process you went through when you registered your account. If the exchange is requesting CDD, they may simply need you to update your identity documents or re-verify your address.
Documentation typically required: Government-issued ID (not expired), proof of address (utility bill or bank statement, not older than 3 months), and a selfie for liveness verification.
Enhanced Due Diligence (EDD)
Definition: A higher level of scrutiny applied to customers deemed higher risk.
What it means for you: The exchange has classified you as a higher-risk customer. This is not an accusation — it is a risk classification based on factors like your transaction volume, nationality, or occupation. EDD requires more documentation than CDD.
What triggers EDD: Large transactions (varies by exchange, typically €10,000+), transactions with high-risk jurisdictions, PEP status, or unusual transaction patterns.
Documentation typically required: Everything required for CDD, plus: source of funds documentation, source of wealth documentation, explanation of the purpose of transactions, and potentially additional financial records.
Politically Exposed Person (PEP)
Definition: An individual who holds or has held a prominent public position, or a family member/close associate of such a person.
What it means for you: If you are classified as a PEP, your account will be subject to EDD. This does not mean you have done anything wrong — it means the exchange must verify that your funds are not the proceeds of corruption.
Who qualifies as a PEP: Heads of state, government ministers, senior politicians, senior judicial officials, senior military officials, senior executives of state-owned enterprises, and important political party officials. Family members (spouses, children, parents) and close associates are also included.
Common false positive: Your name matches a PEP in a screening database. This is especially common with common names. If you are flagged as a PEP incorrectly, we can help demonstrate that you are not the flagged individual. See our complex cases page.
Suspicious Activity Report (SAR)
Definition: A confidential report filed by a financial institution with the Financial Intelligence Unit when they detect potentially suspicious activity.
What it means for you: If the exchange files a SAR about your account, you will not be informed. Your account will likely be frozen while the FIU reviews the report. SARs are not criminal charges — they are reports of activity that might be suspicious.
Can a SAR be withdrawn? Not by the customer. The SAR is filed between the exchange and the FIU. However, if we provide comprehensive documentation demonstrating the legitimacy of your activity, the exchange may file a follow-up report ("no further action") that effectively neutralizes the original SAR.
Travel Rule
Definition: The FATF requirement for VASPs to collect and share sender and recipient information for crypto transactions above a threshold (typically USD/EUR 1,000).
What it means for you: If you receive crypto from another exchange and the sender information is missing, your exchange may freeze the incoming funds until the counterparty's exchange provides the required data.
Money Laundering — the three stages
Exchanges screen for the three classic stages of money laundering:
- Placement: Introducing illicit funds into the financial system. In crypto, this means depositing funds from illegal activity into an exchange.
- Layering: Moving funds through multiple transactions to obscure their origin. In crypto, this means transferring between wallets, using mixers, or converting between cryptocurrencies.
- Integration: Reintroducing the "cleaned" funds into the legitimate economy. In crypto, this means withdrawing to fiat through an exchange.
If your transaction pattern resembles any of these stages — even if your funds are completely legitimate — the exchange's automated systems may flag you. Understanding why your pattern looks suspicious helps you prepare documentation that addresses the concern.
Other key terms
- VASP (Virtual Asset Service Provider): The FATF term for crypto businesses. Exchanges, custody providers, and wallet services are all VASPs.
- MiCA (Markets in Crypto-Assets Regulation): The EU's comprehensive crypto regulatory framework. See our AML laws by country guide.
- OFAC (Office of Foreign Assets Control): The US Treasury department that enforces sanctions. If your address is on an OFAC list, exchanges worldwide will freeze your account.
- Chain analytics: Blockchain analysis tools (Chainalysis, TRM Labs) that exchanges use to screen incoming funds for risk.
- Risk score: A numerical assessment of your wallet or transaction's risk level, assigned by chain analytics tools.
- Tainted coins: Cryptocurrency that has passed through addresses associated with illicit activity.
- Mixer / Tumbler: A service that obscures the trail of crypto ownership. Using one will significantly raise your risk score.
How to use this guide
When your exchange sends a compliance notification, identify which terms it uses. This tells you what kind of review you are dealing with and what documentation to prepare. If the notification is vague ("Your account is under compliance review"), ask the exchange to specify what type of review and what documentation they need.
If you are unsure what the exchange is asking for — or if the request seems unreasonable — contact us. We can interpret the notification, prepare the appropriate documentation, and communicate with the exchange on your behalf.
For the full glossary in a reference format, see our Crypto AML Glossary.
SoF vs SOW: understanding the critical difference
One of the most common sources of confusion in crypto compliance is the difference between Source of Funds (SoF) and Source of Wealth (SOW). These terms are often used interchangeably by customers — and sometimes even by exchange support staff — but they mean different things in AML regulation, and the documentation required for each is different.
Source of Funds (SoF) refers to the origin of the specific funds used in a particular transaction. When an exchange asks for SoF, they want to know: "Where did the money for this specific crypto purchase come from?" The answer is typically narrow and transactional: "This €50,000 came from the sale of my apartment at [address], completed on [date], with the proceeds transferred to my bank account on [date]." SoF documentation covers the immediate origin of the funds — one or two steps back in the chain.
Source of Wealth (SOW) refers to the origin of your overall financial situation — how you accumulated your total assets over time. When an exchange asks for SOW (typically during Enhanced Due Diligence), they want to know: "How did you acquire the wealth that enables you to have €500,000 in crypto assets?" The answer is broader and more narrative: "I worked as a software engineer for 15 years, earning €80,000-€120,000 per year, saved approximately 30% of my income, and invested in crypto starting in 2017." SOW documentation covers your entire financial history — employment records, tax returns, business ownership, inheritance, investments.
The distinction matters because exchanges may ask for SoF when they mean SOW, or vice versa, and the documentation you provide for one will not satisfy a request for the other. If the exchange asks for SoF and you provide your tax returns (which demonstrate SOW), the compliance team will reject the submission because it does not trace the specific funds used in the flagged transaction. If the exchange asks for SOW and you provide a single bank statement, they will reject it because it does not explain your overall financial position.
The FATF Recommendations — the international standard for AML/CFT — require financial institutions to understand both SoF and SOW for high-risk customers. Under FATF Recommendation 10, financial institutions must apply Enhanced Due Diligence (EDD) for high-risk customers, which includes understanding the customer's source of wealth and source of funds. Crypto exchanges, as VASPs (Virtual Asset Service Providers), are subject to these requirements and implement them through their KYC/AML procedures.
In practice, most exchange freeze responses request SoF (specific transaction tracing), but as the case escalates — particularly if the amounts are large or the transaction patterns are unusual — the request may expand to include SOW (overall financial profile). Preparing both types of documentation upfront, even if only SoF is initially requested, can save time if the case escalates to EDD.
FATF guidance and how it affects your exchange account
The Financial Action Task Force (FATF) is the intergovernmental body that sets global AML/CFT standards. Its Recommendations are not legally binding directly, but they are implemented through national legislation in over 200 jurisdictions — meaning that every crypto exchange operating under a VASP license is, indirectly, following FATF guidance. Understanding FATF's framework helps explain why exchanges ask what they ask and why the documentation requirements are so specific.
FATF Recommendation 15 is the key provision for virtual assets. Updated in 2019 and revised subsequently, it requires VASPs to: (1) identify and verify customers (KYC); (2) conduct ongoing monitoring of transactions; (3) report suspicious transactions; (4) maintain records for at least five years; and (5) implement sanctions screening. The "Travel Rule" (Recommendation 16), which applies to crypto transactions, requires VASPs to share sender and recipient information for transactions above €1,000 (the threshold varies by jurisdiction).
The Travel Rule has a direct impact on exchange freezes. When you send crypto from one exchange to another, the sending exchange is required to transmit your personal information (name, account number, physical address) to the receiving exchange. If the receiving exchange's screening of this information generates a flag — for example, if your name partially matches a sanctions list entry — the receiving exchange may freeze the incoming funds while they conduct further review. This is why transfers between exchanges can trigger freezes that seem unrelated to the source of the funds.
FATF's 2021 Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers introduced the concept of "UBO" (Ultimate Beneficial Owner) verification for VASPs. For individual customers, this means the exchange must verify that you are the actual owner of the funds — not acting as a money mule or front for someone else. This is why exchanges sometimes ask for documentation that seems excessive: they are not just verifying your identity, they are verifying that the funds are truly yours.
The Risk-Based Approach (RBA) is central to FATF's framework. Under RBA, exchanges are expected to calibrate their compliance measures to the risk level of each customer. A customer who trades small amounts on an occasional basis is considered low-risk and subject to Standard Due Diligence (SDD) — basic KYC verification. A customer who transfers large amounts, transacts with high-risk jurisdictions, or shows unusual transaction patterns is considered high-risk and subject to Enhanced Due Diligence (EDD) — more extensive verification, including source of wealth and source of funds. If your account has been escalated to EDD, the documentation requirements increase significantly.
For the customer, understanding RBA helps explain why the same exchange that processed your transactions smoothly for years suddenly requests extensive documentation: something about your transaction pattern has crossed a threshold that triggered the EDD protocol. It could be the size of a single transaction, a new counterparty, a change in jurisdiction, or a flag from the exchange's blockchain analytics provider. Knowing that the request is driven by a risk-scoring algorithm — not a personal accusation — can help you approach the documentation process with the right mindset: provide what they need to lower your risk score, and the account will be unfrozen.
SoF requests by exchange: a comparison
Different exchanges have different approaches to source-of-funds requests. While they all operate under similar AML/CFT frameworks (FATF, national AML laws), their implementation varies based on their licensing jurisdiction, internal risk policies, and the compliance tools they use. Here is a practical comparison based on our experience handling cases across 21+ platforms:
Binance: The most structured SoF process. Binance's compliance team uses a standardized request template that specifies the exact documentation needed: source of funds proof (bank statements, employment records, sale contracts), proof of address, and a transaction explanation. Binance typically sets a 14-day deadline for SoF responses. If you miss the deadline, the account is flagged for closure. Binance's compliance team is responsive to legal correspondence and generally unfreezes accounts within 5-7 days of receiving a well-documented SoF package.
Coinbase: Coinbase's SoF process is more automated. Their compliance system generates SoF requests based on risk-scoring algorithms, and the initial request is sent through the app (not email). Coinbase asks for bank statements showing the source of funds and the transfer to Coinbase, plus a brief explanation of the source. Coinbase's compliance team is generally faster than Binance — 3-5 business days from submission of complete documentation. However, Coinbase is more likely to close accounts permanently if the SoF is deemed insufficient, without offering a second chance.
Kraken: Kraken has a more personal approach. Their compliance team communicates directly with the customer (not just through automated messages) and is willing to discuss the situation before requesting specific documents. Kraken's SoF requests are tailored to the individual case rather than following a standard template. This makes the process feel less adversarial, but it also means there is no "checklist" you can prepare in advance. Response time: 5-10 business days from complete submission.
Bybit and OKX: These exchanges have similar SoF processes — both use Chainalysis for transaction monitoring and both request standard SoF documentation (bank statements, source documentation, transaction explanations). Response time: 7-10 business days. Both exchanges are more likely to escalate to EDD if the initial SoF does not fully explain the transaction pattern.
Swap services (Changelly, ChangeNOW, FixedFloat): Swap services have a different compliance model. They typically do not hold customer funds (the swap is atomic or near-instant), so their SoF requests are less about account freezes and more about transaction holds. If a swap service flags your transaction, they may hold the funds and request source-of-funds documentation before completing the swap. The documentation requirements are similar to exchanges but the process is faster — typically 1-3 business days — because the transaction is smaller in scope and the service does not have ongoing customer relationships to evaluate.
Tether and Circle: The most rigorous SoF processes. Both stablecoin issuers require comprehensive documentation, including notarized identity verification and bank-level source-of-funds documentation. The process is slower (2-4 weeks) and more formal because the freeze operates at the blockchain level, not the account level — unfreezing a USDT or USDC address is a more significant decision than unfreezing an exchange account.
Understanding these differences helps you prepare the right documentation for the specific exchange you are dealing with. If you have accounts on multiple exchanges and one freezes your account, the others may follow — not because they share information directly (that would violate GDPR in the EU), but because the same blockchain analytics that triggered the first freeze may be visible to other exchanges' compliance teams. Addressing the first freeze quickly and comprehensively reduces the risk of cascading freezes across platforms.