What to Do When Crypto or Bank Funds Are Frozen: AML Reviews, Evidence and Legal Escalation

A blocked bank account or frozen crypto balance can stop an otherwise healthy business within hours. Payroll may fail, suppliers may remain unpaid, customer withdrawals may be delayed, and management may receive only a generic notice referring to compliance, security or an internal review. The absence of a detailed explanation often makes the situation feel arbitrary. In reality, most restrictions arise from a combination of contractual rights, anti-money laundering controls, sanctions screening, fraud prevention, transaction monitoring and regulatory reporting duties.

Businesses frequently make the problem worse by responding emotionally, sending inconsistent explanations or flooding support teams with incomplete files. A freeze should instead be treated as a structured legal and evidentiary process. The immediate objective is not merely to demand access to the money. It is to identify the likely trigger, preserve evidence, demonstrate a lawful source and purpose of funds, and create a written record that can support escalation if the institution does not act proportionately.

When the restriction affects working capital, client assets or a substantial crypto balance, obtaining legal support for frozen funds early can help the company coordinate its AML response, avoid contradictory statements and determine whether the next step should be an internal complaint, regulatory submission, court action or negotiated release.

Why banks and crypto platforms freeze funds

Financial institutions and virtual asset service providers operate transaction-monitoring systems designed to identify patterns that may indicate money laundering, sanctions exposure, fraud, account takeover or prohibited activity. FATF guidance on virtual assets highlights red flags such as unusual transaction size or frequency, rapid movement through multiple wallets, exposure to high-risk services, inconsistent customer profiles and attempts to obscure the origin or destination of assets. A single red flag does not prove wrongdoing, but it can trigger enhanced review.

Bank restrictions may also result from a mismatch between the activity described during onboarding and the activity later observed. A company registered as a software consultancy may begin receiving large payments from crypto exchanges. A holding company may suddenly process third-party transfers. An individual account may be used for commercial settlements. Even where every transaction is lawful, the institution may regard the changed profile as unexplained risk.

Other common triggers include incoming fraud reports, chargebacks, law-enforcement requests, court orders, sanctions alerts, adverse-media matches, expired corporate documents, unclear beneficial ownership or transfers involving jurisdictions classified as high risk. Crypto platforms may additionally react to blockchain analytics showing links to hacks, scams, mixers, darknet markets or sanctioned addresses. False positives remain possible, particularly where assets passed through many wallets before reaching the current holder.

The first 24 to 72 hours: control the response

The first step is to determine exactly what has been restricted. An account may be fully blocked, limited only for outgoing transactions, placed under enhanced monitoring or suspended pending identity verification. A platform may freeze a specific deposit while leaving the rest of the account operational. The legal and practical response depends on the scope of the measure.

Management should appoint one person to coordinate communications and create a chronology. Record the date and time of the restriction, transaction references, account numbers, wallet addresses, support tickets, notices and every conversation with the institution. Preserve screenshots and export statements before access becomes more limited. Employees should be instructed not to contact the institution independently or provide speculative explanations.

At the same time, the business should protect operations. This may involve notifying key counterparties, pausing new deposits to the affected account, separating client and corporate funds, reviewing contractual payment deadlines and arranging lawful alternative payment channels. Moving funds to evade a review, using nominees or splitting transactions can create additional red flags and should be avoided.

Build an evidence package, not a document dump

Compliance teams need a coherent explanation supported by verifiable documents. Sending hundreds of unlabelled files can delay the review because the reviewer must reconstruct the transaction independently. A stronger submission begins with a concise cover letter describing the business, the relevant transaction, the parties, the commercial purpose and the source and destination of funds.

The supporting package may include incorporation records, beneficial-owner documents, contracts, invoices, bank statements, tax filings, audited accounts, payroll records, proof of delivery, correspondence with counterparties and explanations of the economic rationale. For investment or loan transactions, provide the subscription agreement, loan agreement, board approvals and evidence of the investor’s source of wealth or source of funds where available.

For crypto assets, the evidence should connect the on-chain history with the real-world transaction. Useful materials include exchange statements, wallet ownership evidence, transaction hashes, purchase records, OTC agreements, screenshots from custodial platforms and a wallet-flow analysis. The explanation should identify intermediary wallets and address any exposure that blockchain analytics may have flagged. Where funds originated years earlier, reconstructing the history may require multiple exchange records and archived communications.

How to explain source of funds and source of wealth

Source of funds refers to the immediate origin of the money or crypto involved in a transaction. Source of wealth explains how the person accumulated their overall assets. Institutions often ask for both because a bank statement showing an incoming transfer does not establish how the sender obtained the money.

A credible explanation is specific and internally consistent. Saying that funds came from “business activity” is weaker than identifying the customer, contract, invoice, service delivered, payment date and tax treatment. For crypto, saying that assets came from “trading” is insufficient without exchange records, deposit history and transaction links. Where documents are unavailable, the company should explain why and provide alternative evidence rather than ignoring the gap.

Discrepancies should be addressed openly. If a contract amount differs from the transfer because of fees, partial payments or currency conversion, explain the reconciliation. If a beneficial owner used a personal wallet before transferring assets to the company, describe the ownership chain and corporate authorisation. Attempting to conceal an awkward but lawful fact is usually more damaging than explaining it.

Communicating with the institution

Every submission should be accurate, measured and tailored to the questions asked. The company should request confirmation that the documents were received, ask whether additional information is required and seek a reasonable review timeline. However, institutions may be legally restricted from disclosing whether a suspicious transaction report has been filed. Repeated demands for confidential AML information are unlikely to help.

The communication should distinguish between cooperation and acceptance of an indefinite freeze. The customer can acknowledge the institution’s compliance duties while asking for the contractual and legal basis of the restriction, the categories of information still outstanding and whether less restrictive measures are possible. The European Banking Authority has emphasised risk-based measures and the need to consider alternatives before rejecting or terminating relationships, particularly where risk can be managed through enhanced monitoring or product limitations.

Internal complaint and regulatory escalation

When ordinary compliance communication stalls, the next step is usually a formal complaint under the institution’s published procedure. The complaint should contain the chronology, evidence already supplied, the operational harm caused, the requested remedy and a deadline for response. It should avoid accusations that cannot be proved.

Depending on the jurisdiction and type of institution, escalation may be available to a financial ombudsman, banking regulator, consumer authority, data-protection authority or virtual-asset regulator. Regulators generally do not replace the institution’s transaction review or order immediate payment in every case. Nevertheless, a well-documented complaint can prompt supervisory attention where the institution fails to communicate, applies restrictions inconsistently or maintains them without a clear review process.

Cross-border cases require careful forum analysis. The platform’s brand, operating company, licensed entity, contractual governing law and location of the account may all differ. Filing with the wrong regulator wastes time and can reveal that the claimant has not reviewed the terms of service.

When court action may be necessary

Litigation becomes relevant where a freeze is prolonged, the institution refuses to return uninvested funds after terminating the relationship, the restriction breaches a clear contractual duty or urgent harm cannot be managed through complaints. Potential remedies vary by jurisdiction and may include a payment claim, injunction, disclosure application, judicial review or challenge to an administrative or court order.

Before filing, counsel should assess whether the institution is acting under a binding law-enforcement request or court order. A bank cannot voluntarily release funds that are legally restrained. In such cases, the strategy may need to focus on the authority or order rather than the bank. The claimant must also consider whether proceedings could expose confidential business information or trigger broader scrutiny.

Interim relief is exceptional and normally requires evidence of urgency, a strong legal basis and risk of irreparable harm. A company that waited months before acting may find it harder to prove urgency.

Conclusion

A frozen account is not resolved by one perfect email. It requires a coordinated process that combines operational control, AML analysis, evidence reconstruction and proportionate escalation. The strongest cases present a clear commercial narrative, connect every material transaction to reliable documents and show that the customer understands and can mitigate the relevant risks.

Early legal involvement is particularly valuable when the freeze affects client assets, multiple jurisdictions, significant crypto history or an ongoing law-enforcement process. A structured response cannot guarantee immediate release, but it substantially improves the business’s ability to obtain meaningful answers, challenge disproportionate restrictions and protect its position if a formal dispute becomes unavoidable.

Sources

• FATF, Virtual Assets Red Flag Indicators of Money Laundering and Terrorist Financing

• FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs

• European Banking Authority, Guidelines and materials on unwarranted de-risking

• European Banking Authority, Guidelines on ML/TF risk factors