Crypto Gateway AML Holds 2026: Nobody Says How Long

A merchant emails support because a settlement has not arrived, and the reply asks where the money came from. That is the moment a crypto payment gateway AML hold stops being a clause nobody reads and becomes working capital you cannot reach. We read the published terms and AML policies of ten gateways on 8 October 2026 to answer the three questions a merchant in that position has: can they do this, for how long, and do I get it back?

The first answer is yes, in seven of ten cases, in writing. The second is the one worth the article: not one of the ten publishes a maximum hold period. The third is worse than vague — only one of the ten says what happens to a balance once it has suspended you. We read the terms rather than the marketing pages, and where a document is silent we counted the words, because "their terms don't mention it" is a finding only if you looked.

This is not a claim that compliance holds are illegitimate — a regulated processor that spots a problem is supposed to stop and look, and some holds are a legal obligation rather than a choice. The complaint is narrower: the clauses granting the power are specific, and nothing tells you how to get out.

Which gateways publish a power to hold your money on an AML hold

Here is the whole set, with the clause each power lives in. "Hold" means withholding value that has already arrived — suspending a withdrawal, locking a balance, blocking a transaction after the funds moved — not declining to onboard you.

Across the seven, the trigger is drafted generously and the remedy not at all. CoinGate's clause 27.5 spends hundreds of words on grounds, among them failing to evidence "the source (origin) of funds". BitPay reaches the same place in one sentence, using "sole discretion" fourteen times across its Terms of Use. Both are enforceable; neither says what happens next.

How long an AML hold can last, according to the terms

This is the question every merchant asks first and the one no document in the set answers. We looked for a number, a business-day count, a review window — anything bounded. There is nothing in any of the ten.

CoinGate's is worth reading twice, because it closes the loop in one breath. Clause 15.7 allows it to suspend a withdrawal for that unspecified period, then continues: "In that case, we shall not be liable to you for any default on any contractual obligations and/or for any damages or losses sustained by you." An open-ended hold plus a disclaimer for the consequences of its length answers the legal question completely and the commercial one not at all.

Fiat processors are the only place this intent is served today. The strongest page on frozen payment-gateway accounts is Razorpay's, not about crypto at all — yet it separates a freeze from a funds hold from a rolling reserve and names a 24-to-48-hour response target. None of the ten offers a taxonomy or a target. The incumbents are not better behaved, just further along in documenting themselves.

Who tells you, and who does not have to

A hold you learn about from a missing settlement costs more than one announced by email, because what you lose first is the chance to send documents while the reviewer still has the file open. Three of the ten publish a notice commitment; the rest reserve the right to act first.

CoinGate's split is easy to misread in your favour. A merchant who finds the ten-day notice clause and relaxes has read the wrong one: ten days applies when CoinGate ends the relationship for no particular reason, the case where you were never at risk. The compliance grounds sit two clauses later and carry the word "immediately". In these documents, notice periods attach to the benign exits.

That document also carries a drafting error worth knowing if you ever cite it. Clause 10.8 sends a reader to "section 28 of the General Terms" for the suspension power. Section 28 is FINAL PROVISIONS — governing law, Vilnius jurisdiction, severability. The power is in section 27, and 10.8 is the clause a merchant would be pointed at first.

The only hold with its own payment status

When we mapped the payment status vocabularies of nine gateways, one value described a compliance event rather than a blockchain one. Cryptomus publishes locked alongside its thirteen other statuses, and this is the definition in full:

Seven words. No sequence showing what locked can become, no terminal marker, no documented action, no sign whether a human or a rule set it. It is still the most honest treatment in the set, because it alone admits the state exists where an integrator meets it: in the webhook payload, in production. Six other gateways can do the same and give your handler no way to tell it from an ordinary delay.

Noted without inference: the same documentation also sells AML screening as a product, with endpoints for buying check packages and pulling reports.

What the terms say about getting the balance back

Suppose the review ends and nothing is wrong, or the account closes with a balance on it. Which of the ten has written down that you can withdraw it?

One provider in ten has written the sentence a merchant in trouble most needs, and it is Plisio. It is not a guarantee — it is carved out for legal and court-ordered holds, the cases where money is least likely to move — but it is a published default, and that is something you can point at in a support ticket. The distinction running through this table is between a closure you chose and a suspension you did not: several providers document the first carefully and leave the second blank.

On BitPay, "freeze" means something else entirely

Search BitPay's Terms of Use for the word a worried merchant would search for and you find it five times, meaning something else. All five occurrences of freeze and frozen describe locking the fiat conversion rate of a ledger balance, not withholding the balance:

That is a currency-risk mechanism, and it cuts both ways: if the asset doubles, you are settled on the frozen figure anyway. The power that actually withholds money sits two sections away under a heading without the word in it — "Our Right to Decline, Suspend, or Close Your Account". Diligence by keyword search finds the harmless clause and misses the operative one, which is why the suspension and termination sections are the ones to read in full.

Two AML policies that never mention your money

A published AML policy reads like a commitment, and most of what these documents contain genuinely is one. But two of the ten describe how a merchant will be screened and never say what happens to their funds if the screening flags something.

We counted rather than skimmed, because an absence is evidence only if you measured it. Across the whole of NOWPayments' policy, the words suspend, suspension, freeze, block, withhold, terminate and release do not appear once. The single "frozen" sits in a definition about criminal proceedings against a politically exposed person, and every "hold" match is holder, shareholder or "holding personal assets". It is a careful account of how the company will assess you, including clauses on determining "the source and origin of the funds used in a transaction", and it ends there.

That silence is not a promise not to hold funds and should not be read as one. Both take custody, both run the checks their regulators require, and in PassimPay's case the suspension power is in the Terms of Service instead. The lesson is where to look: an AML policy tells you what will be screened; only the terms say what the company may do to your balance as a result.

The two designs where a hold cannot happen

Seven of ten can hold your money because they hold it already. Two have chosen architectures where the question does not arise, and they arrive there from opposite directions.

trybit screens before crediting. Its documentation says the AML and KYT check "runs automatically as a payment arrives, before it's credited to your balance", and that if a transaction shows signs of a suspicious origin, "it isn't credited — the funds are returned to the sender". Screening is on by default with no toggle to disable it, so there is no hold because the money never becomes your balance. Price the trade: a false positive is bounced rather than reviewed, landing on your buyer as a refund and on you as a lost sale, and the page describes no appeal.

BTCPay Server removes the custodian. Its FAQ calls it "a non-custodial invoicing system which eliminates the involvement of a third-party" and "an open-source self-hosted software stack, not a company"; payments "go directly to your wallet", and "the BTCPay Server community does not hold or have access to any funds of a store". Nobody freezes a balance that was never pooled. You take on what the custodian was doing instead: a node, backups, keys, your own compliance posture, and no support queue at midnight.

Neither is free. A custodial processor absorbs operational work and regulatory exposure, and these hold powers are part of what that costs. The question is not custodial versus not, but whether the volume you run through a provider is a sum you could survive being unreachable for an unspecified period — because that is the term you agreed to. Our guide to gateways without merchant KYC covers the adjacent decision at onboarding.

What to do before a hold, and during one

Before routing volume through any custodial gateway, do these four things once:

1. Read the suspension and termination sections, not the AML policy. That is where power over your balance lives. Search for suspend and restrict, not freeze.
2. Check whether a post-suspension withdrawal right is published. In our set, one provider published one. If there is none, assume the balance is unreachable for the duration and size your float accordingly.
3. Settle often and keep the balance small. Every power in this article attaches to money the provider holds. Frequent settlement to your own wallet is the only lever that cuts the amount at risk without switching providers.
4. Run a second gateway before you need one. A suspension stops new transactions as well as settlements, and a dormant integration you can switch on in an hour turns an existential event into a bad week.

1. Ask in writing for the clause, the documents and a timeline. Name the clause number; it changes the register of the reply. You probably will not get a timeline, since none of these providers publishes one, but asking records when you asked.
2. Send the source-of-funds evidence in one package. Per affected payment: transaction hash, paying address, the invoice it settles, and anything linking payer to sale. Several of these terms make failure to evidence the origin of funds an independent ground for termination, so a partial answer can turn a review into a closure.
3. Do not close the account to force the issue. The balance-return language that exists applies to closures you initiate in good standing, and at least one set of terms says you may not use closure to evade an investigation.
4. If it stalls, escalate to the regulator named in the terms. These documents name an operating entity and licence, and that entity — not always the brand on the dashboard — is where a complaint goes.
5. Keep the raw webhook payloads. If your provider signals the hold in the status field, the payload is your only proof of when the state changed.

None of that ends a hold sooner than the reviewer decides. It does mean the decision is made against a complete file rather than a silence, and that you are not rebuilding a timeline from memory three weeks in.

FAQ

How long can a crypto payment gateway hold my funds for an AML check?

For as long as it decides. None of the ten gateways we read on 8 October 2026 publishes a maximum. CoinGate permits suspending a withdrawal "for a certain period of time", adding that where law sets no period, "a relevant period shall be determined at our own discretion". Plisio's regulator-driven freeze runs "until further clarification of the circumstances". The other five attach no duration language at all.

Can a crypto payment gateway legally freeze a merchant's funds?

Seven of the ten reserve that power in writing, and you agreed to it when you opened the account. BitPay's clause 4.8.2 allows it to "immediately suspend or close your Account, without notice, in our sole discretion", and CoinGate may refuse, block or reverse a transaction "even when funds are already debited". Some holds are a legal obligation rather than a commercial choice, which is why a provider may be unable to explain one even when it wants to.

What does the locked status mean on Cryptomus?

Cryptomus defines locked as "Funds are locked due to the AML program", and that sentence is the whole published definition. It is the only gateway in our set that gives a compliance hold its own payment status, so it is the only one whose webhook tells your code that this is a compliance event rather than an ordinary delay. The docs do not say what the status can become, how long it lasts, or what you should do.

Will I get my money back after a crypto gateway suspends my account?

Only one of the ten publishes a commitment. Plisio's terms say that if cryptocurrency remains on a suspended or closed account, "you can access this cryptocurrency and bring it to the external address of the wallet", unless a law or court order prevents it. BitPay and PassimPay describe balance return only for a closure you initiate. The other four providers with a published hold power — CoinGate, Cryptomus, BlockBee and B2BinPay — say nothing about the balance at all.

Which crypto payment gateway has the best terms on compliance holds?

Plisio, narrowly, as the only one publishing a post-suspension withdrawal right — though it can still freeze an account on a regulator's request without notice. BlockBee has the clearest notice language, promising an email and an explanation on termination. BTCPay Server sidesteps the comparison by never holding your funds, at the cost of running the infrastructure yourself. No provider publishes a hold duration, so none can be recommended on that basis.

Why did my crypto gateway ask for source of funds when I am the merchant, not the payer?

Because the obligation attaches to the account holder, not to whoever sent the transaction. NOWPayments' published policy gives its processing provider the right to "identify the source and origin of the funds used in a transaction", and CoinGate makes a merchant's failure to evidence "the source (origin) of funds" an independent ground for termination. In practice you are being asked to document your customer's payment, so keep the transaction hash, the paying address and the order it settles for every invoice.

Does a non-custodial crypto payment gateway avoid AML holds?

It removes the party who could impose one. BTCPay Server's FAQ describes it as non-custodial and "not a company", with payments going straight to your wallet and the community holding no funds. That does not exempt you from your own legal obligations, and it moves screening, custody and key management onto you. trybit gets there differently, screening before crediting and returning suspicious funds to the sender — so there is no balance to hold, and no review to appeal.

Affiliate disclosure: Payyd earns a commission if you sign up to some providers linked on this page. That changes none of the clauses, definitions or word counts reported here, all of which come from the providers' own documents and can be checked at the links below.

Sources

Primary documents read on 8 October 2026:

• CoinGate: Merchant Terms of Services — clauses 10.8, 15.4–15.12, 16.2, 27.2–27.9
• BitPay: Terms of Use — clause 4.8.2, and the settlement-value freeze provisions
• Cryptomus: payment statuses — the locked definition
• Plisio: Terms of Use (PDF) — Suspension and Account Closure
• BlockBee: Terms and Conditions
• BlockBee: AML Policy
• PassimPay: Terms of Service (last updated 1 November 2024)
• B2BinPay: AML & KYC policy
• trybit: AML/KYT screening of incoming payments
• NOWPayments: AML and KYC/KYB policy of FD Transfers LLC (PDF), last updated 15 December 2025
• BTCPay Server: general FAQ — non-custodial design
• Razorpay: what to do when your payment gateway account is frozen — cited for the fiat comparison only

Cryptomus' own terms and AML pages return 403 to automated requests, so its locked definition was read from its developer documentation. OxaPay and Blockonomics serve their legal pages as client-rendered applications with no readable text, so neither is counted above rather than guessed at.