Exchanger Hold for a High-Risk Transaction: What It Means
If Onix or another fiat/crypto exchanger labels a transfer high risk and pauses it, that is usually automated screening of the address history, not a court finding. An exchanger's process is often thinner than AML / KYC / SoF on a large exchange — and you cannot invent that process from someone else's screenshot. See exchange account unfreezing for the practical route.
What a high-risk label usually means at an exchanger
Onix is used here as an example of a class: a fiat/crypto exchanger, not a large centralized-exchange account. Statuses such as "under review," "high risk," or "suspicious transaction" usually mean automated screening saw a link in the address history that the venue treats as elevated — a mixer, a scam cluster, a sanctions list, a tainted chain. That is not a description of one exchanger's internal policy: the analytics vendor, threshold, and timeline are specific to the venue.
Separate three scenes. A pause on one exchanger trade is not the same as a full-account freeze on a large exchange. It is also not the same as a cash desk disappearing after a "review." While the venue answers through an official channel and asks for documents, the situation is closer to a manual risk review. If the channel goes silent and someone asks for an extra payment to "unfreeze" to a personal card, that is a different scenario. The broader hold checklist is in frozen crypto: what to do.
The label does not mean your coins are a different type of asset. The venue is usually looking at the route: who sent them, which addresses they passed through, and whether those paths touch known clusters. The logic is similar to a Dangerous transaction tag in an exchange ticket, except the entry point is an exchanger cash desk rather than a withdrawal from a KYC account.
First steps after the hold
- Save the TxID, network, amount, time, in-app status, and a screenshot of the label as one package, not ten forwards in a chat.
- Open one coherent ticket through the venue's official channel; parallel duplicates usually confuse the review rather than speed it up.
- Ask for a written reason if you do not have one: which side of the transfer and which type of review.
- Prepare SoF calmly: where the asset came from, through which exchange or P2P, without extra passports "just in case."
- Do not pay a person in direct messages for "acceleration," even if they claim to be support.
- Do not send a second transfer "to test" while the first is on hold.
Documents matter when the venue actually asked for them, or when you are assembling a typical SoF package in advance. The contents are close to an exchange file: a statement, purchase history, a contract if the transfer was a payment. There is no universal list of "what works at Onix." If you need to review the address itself before the next transfer, see checking a wallet for AML risk.
Exchanger, large exchange, and a silent cash desk
At a large exchange, manual review is usually formal: a ticket, a document list, a separate risk team. At an exchanger the channel may be shorter: chat, email, a status in the cabinet. That does not make the pause unlawful, and it does not make it a scam by itself. FATF describes a risk-based approach to virtual assets as an obligation of the provider to assess risk, not as your personal SLA.
| Scenario | What it resembles |
|---|---|
| Trade pause plus an official document request | Manual risk review at an exchanger |
| Full-account freeze at a large exchange | A separate AML/KYC/SoF track |
| Silence, new payment details, a "withdrawal tax" | More likely a scheme than compliance |
If the cash desk stops answering, changes payment details, or asks for a new deposit "to close the review," preserve the correspondence and TxID and do not send more funds. That is no longer an argument with risk control; it is a question of whether the venue still exists. While the dialogue stays on an official channel, keep one package and one ticket — the restriction route is exchange account unfreezing. Examples without promised outcomes are in case studies.
What not to do
- Do not invent Onix's rulebook from other people's reviews, and do not cite legal articles the venue never sent you.
- Do not open a second account on the same venue to "bypass" the pause.
- Do not change your apparent login location with a VPN mid-review unless you were asked to.
- Do not confuse an exchanger pause with a USDT issuer freeze.
Do not feed a follow-on scam: after a pause, supposed staff often write offering to clear the flag for crypto. A legitimate risk review does not take a side commission in direct messages. The outcome is not guaranteed: the venue may credit the trade, return funds to the sender, ask for more documents, or refuse.
Risks and limitations
- The venue may refuse, request more documents, or never credit the transfer; the outcome is not guaranteed.
- An exchanger's process is often less formal than a large exchange's; the venue sets the timeline.
- Paying for "acceleration" in direct messages almost always increases the loss.
- Silence after a pause may be a disappearing venue rather than AML.
- A second transfer "to test" creates a second disputed amount.
Sources used
- FATF — Virtual assets
- FATF — Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (2021)
- Chainalysis — Wallet screening (glossary)
- Kraken — Source of wealth or source of funds documents
- DefCrypt exchange-unfreeze practices for fiat/crypto exchanger holds (anonymized)