A client logged into her Binance account and found a red banner: "Your account is under review. Withdrawals are temporarily suspended." She had been a Binance user for three years, had completed KYC verification, and had never had a problem. She had not received any suspicious funds, had not interacted with any flagged addresses, and had no idea why her account was frozen. After weeks of unresponsive customer support, she contacted us. The investigation revealed that her account had been frozen because she had received a small USDT transfer from a wallet that was three transactions removed from an address flagged by Chainalysis as connected to a sanctioned entity. She had no knowledge of the connection — the transfer was a legitimate payment for freelance work. But the AML scoring system had flagged her account, and the freeze was automatic.

This scenario plays out thousands of times every day across cryptocurrency exchanges worldwide. Accounts are frozen not by human decision but by automated AML scoring systems that analyze every transaction in real time. These systems are designed to catch money laundering, terrorist financing, and sanctions evasion — but they also catch innocent users who happen to receive funds from addresses that are distantly connected to illicit activity. Understanding how AML scoring works is essential for anyone whose account has been frozen, and for anyone who uses cryptocurrency exchanges.

In this article, I explain how AML scoring works, what triggers a freeze, the different risk models used by major exchanges, and what you can do if your account is frozen due to a false positive. This article is based on my experience as a former FIU investigator and current crypto compliance counsel — I have seen the AML scoring systems from both the exchange's side and the user's side.

What is AML scoring?

AML scoring (Anti-Money Laundering scoring) is the process by which a cryptocurrency exchange evaluates the risk of each transaction and each account. The score is calculated by blockchain analytics software — typically Chainalysis KYT (Know Your Transaction), TRM Labs Transaction Monitoring, or Elliptic Lens — which analyzes the transaction history of the addresses involved and assigns a risk score.

The risk score is a number (or a category, like "low," "medium," "high") that reflects the likelihood that the transaction is connected to illicit activity. The score is based on several factors:

The AML score is calculated in real time — every incoming and outgoing transaction is screened before it is processed. If the score exceeds the exchange's threshold, the transaction is flagged for manual review or the account is frozen automatically.

How the risk models differ between exchanges

Each exchange configures its AML scoring system differently. The configuration includes the risk thresholds (what score triggers a freeze), the transaction radius (how many hops of indirect exposure to check), and the categories of illicit activity to screen for. Based on my experience with cases across all major exchanges, here is how the risk models compare:

Coinbase

Coinbase uses Chainalysis KYT and has one of the most conservative risk models in the industry. Coinbase's threshold is low — even moderate indirect exposure can trigger a freeze. Coinbase screens up to 5 hops of indirect exposure, which means that an address that is 5 transactions removed from a sanctioned address can still be flagged. This wide radius results in a high rate of false positives — Coinbase freezes more legitimate accounts than any other major exchange. However, Coinbase also has a well-structured appeal process, and accounts that are frozen due to false positives are typically unfrozen within 2-4 weeks.

Binance

Binance uses both Chainalysis and TRM Labs (for different purposes — Chainalysis for address attribution, TRM for transaction monitoring). Binance's risk model is less conservative than Coinbase's, with a higher threshold and a shorter transaction radius (typically 3 hops). However, Binance's compliance team is larger and more active than most exchanges, and Binance is quick to freeze accounts that are flagged for any reason. Binance's appeal process is slower than Coinbase's (typically 3-6 weeks) but the success rate for legitimate appeals is reasonable.

Kraken

Kraken uses TRM Labs and has a moderate risk model — between Coinbase and Binance in terms of conservatism. Kraken screens 3-4 hops of indirect exposure and has a moderate threshold. Kraken's compliance team is known for being thorough but fair — they take the time to review each flagged account individually rather than relying solely on the automated score. Kraken's appeal process is typically 2-4 weeks.

OKX

OKX uses Chainalysis KYT and has a moderate-to-conservative risk model. OKX screens 3-4 hops of indirect exposure and has a moderate threshold. OKX's compliance team is based primarily in Hong Kong and Dubai, and communication is typically in English. OKX's appeal process is 3-5 weeks.

Bybit

Bybit uses TRM Labs and has a moderate risk model. Bybit screens 3 hops of indirect exposure and has a moderate threshold. Bybit's compliance team is responsive but smaller than Binance's or Coinbase's. Bybit's appeal process is typically 2-4 weeks.

Gate.io and MEXC

Gate.io and MEXC have less conservative risk models, with higher thresholds and shorter transaction radii. This means fewer false positives — but it also means that scammers prefer these exchanges because their funds are less likely to be flagged. Both exchanges' appeal processes are slower (4-8 weeks for Gate.io, 3-6 weeks for MEXC) and less structured.

What triggers a freeze: the most common scenarios

Based on the cases I have handled, the most common scenarios that trigger an account freeze are:

1. Receiving funds from a tainted source

The most common freeze scenario. You receive cryptocurrency from someone (a buyer, a client, a friend) and the funds turn out to be connected to an illicit address. You had no knowledge of the connection — you simply received a payment. But the analytics tool flagged the source address, and because you received funds from it, your address was flagged too.

Example: You sell a laptop for 0.05 BTC. The buyer sends the BTC from their wallet. A week later, your exchange account is frozen. The buyer's wallet had previously received funds from an address that was connected to a darknet market. You had no way of knowing this — but the analytics tool flagged the entire chain of addresses.

2. Sending funds to a flagged address

If you send cryptocurrency to an address that is already flagged by the analytics tool, your account may be frozen. The exchange's reasoning is that if you are sending funds to a known illicit address, you may be involved in the illicit activity. This is less common than the receiving scenario, but it does happen — particularly if the destination address is on a sanctions list.

3. Mixer interaction

If your address has sent funds to or received funds from a mixer (Tornado Cash, ChipMixer, Blender.io), your account will almost certainly be frozen. Mixers are treated as high-risk by all exchanges, and any interaction with a mixer triggers an immediate freeze. This is particularly relevant after the OFAC sanctioning of Tornado Cash in 2022 — any address that interacts with Tornado Cash is tainted and will be flagged by all major exchanges.

4. Sanctioned address interaction

If your address has transacted with an address on the OFAC SDN list, your account will be frozen immediately and reported to the relevant authorities. This is non-negotiable — exchanges are legally required to freeze sanctioned addresses and report the interaction. Unfreezing an account that has interacted with a sanctioned address is extremely difficult and requires proving that the interaction was unintentional and that you had no knowledge of the sanctioned status.

5. Unusual transaction patterns

If your account suddenly starts making unusual transactions — large withdrawals to new addresses, rapid in-and-out transfers, transactions to high-risk jurisdictions — the analytics tool may flag the account for review. This is a behavioral trigger, not a source-of-funds trigger. The exchange's reasoning is that the change in behavior may indicate that the account has been compromised or is being used for money laundering.

6. Incomplete or expired KYC

If your KYC documentation is incomplete, has expired, or cannot be verified, the exchange may freeze your account until you provide updated documentation. This is not an AML trigger per se, but it is often confused with one. The solution is straightforward: update your KYC documentation and the account will be unfrozen.

The false positive problem

The fundamental problem with AML scoring is false positives — legitimate accounts that are frozen because they happen to have a connection (often distant and unknowable) to an illicit address. The false positive rate varies by exchange and configuration, but it is estimated that 70-90% of all AML alerts are false positives. This means that the vast majority of accounts that are frozen are frozen incorrectly.

The false positive problem is a direct result of the wide transaction radius used by analytics tools. If the tool checks 5 hops of indirect exposure (as Coinbase does), then any address that is within 5 transactions of a known illicit address is flagged. Given the interconnectedness of the blockchain — where most addresses are within a few hops of most other addresses — this means that a very large number of addresses receive elevated risk scores. The wider the radius, the more false positives.

Exchanges are aware of the false positive problem, but they err on the side of caution. The cost of a false negative (failing to freeze a money launderer's account) is much higher than the cost of a false positive (freezing an innocent user's account). A false negative can result in regulatory fines, reputational damage, and legal liability. A false positive just results in a frustrated user — and the exchange's view is that frustrated users are an acceptable cost of compliance.

This is cold comfort for the innocent user whose account is frozen. But understanding the exchange's perspective helps in crafting an effective appeal — if you can demonstrate that the freeze was a false positive, and that you have no connection to the illicit activity that triggered the flag, the exchange has a process for unfreezing your account.

How to check your address's risk score

Before sending cryptocurrency to an exchange, you can check the risk score of your address using publicly available tools:

If you discover that your address has an elevated risk score, do not panic. An elevated score does not mean your funds will be frozen — it means there is a risk that they will be. If you are planning to send funds to an exchange, consider sending a small test transaction first. If the test transaction is accepted without issue, the full amount is likely to be accepted as well.

What to do if your account is frozen

If your account is frozen due to an AML flag, take these steps:

Case study: the freelance payment false positive

The client I described at the beginning of this article was a freelance graphic designer who received a 2,000 USDT payment from a client for design work. The client's wallet had previously received funds from an address that was connected to a sanctioned entity — three hops removed from the client's wallet. The client had no knowledge of this connection.

We filed an appeal with Binance that included: (1) the freelance contract and invoice for the design work, (2) correspondence with the client (emails and Slack messages discussing the project), (3) an independent blockchain analytics report (from TRM Labs, which Binance also uses, but the report was prepared by our forensic team rather than Binance's compliance team) showing that the client's address had no direct connection to any illicit activity, and (4) a legal analysis demonstrating that the client was a legitimate service provider who received payment for legitimate work.

Binance reviewed the appeal and unfroze the account within 12 business days. The key to the successful appeal was the documentation — the freelance contract and correspondence proved that the USDT was a legitimate payment for services, not a money laundering transaction. The independent analytics report confirmed that the client's address had no direct illicit connections.

This case illustrates that AML false positives are resolvable — but they require documentation, patience, and often legal representation. The exchange's compliance team is not trying to steal your funds — they are trying to comply with regulatory requirements. If you can demonstrate that the AML flag was a false positive, the exchange has a process for unfreezing your account.

How to prevent AML freezes

While you cannot eliminate the risk of an AML freeze entirely (because you cannot control who sends you funds or what their transaction history is), you can reduce the risk:

The bottom line

AML scoring is the automated system that decides whether your exchange account is frozen. It is based on blockchain analytics tools (Chainalysis, TRM Labs, Elliptic) that analyze the transaction history of the addresses involved and assign a risk score. The system is designed to catch money laundering and sanctions evasion, but it also catches innocent users through false positives — particularly when the analytics tool uses a wide transaction radius. If your account is frozen, do not panic. Contact the exchange's compliance team, provide source of funds documentation, and consider engaging legal counsel if the appeal is not resolved.

If your exchange account has been frozen and you need help with the appeal, contact us. We can prepare the appeal documentation, obtain an independent analytics report, and escalate to the regulator if necessary. We have successfully resolved hundreds of AML freeze cases across all major exchanges.

N. Silinevics
Nils Silinevics Crypto Compliance Counsel · Former FIU Investigator · Valken Legal AG