AML screening of incoming crypto payments: what a merchant sees and does

CryptoLike screens the sender of an incoming crypto payment before the money becomes available on your balance, whenever the sender can be determined, and the destination of a payout before it is sent. Most payments pass without you noticing. When a transfer comes from a sanctioned source or scores above the risk threshold, the funds are held instead of credited, your server receives a deposit.on_hold webhook, and CryptoLike's compliance review decides what happens next. This article explains when screening runs, what you see at each step and how to handle a held payment in your shop or product.

This article describes how screening works in CryptoLike. It is not legal advice: your own obligations depend on your business and your jurisdiction.

#What is screened, and when

CryptoLike runs two kinds of screening: of the address money comes from, and of the address money goes to. Both use the same risk assessment, cover every network CryptoLike supports — Bitcoin, Litecoin, Ethereum with its ERC20 tokens, TRON with its TRC20 tokens — and apply to payments, static addresses, single payouts and payout files alike.

Checked against CryptoLike on 2026-09-24. On Bitcoin and Litecoin the sender is derived from the transaction's inputs; on Ethereum and TRON it is the account that sent the transaction. If the sender cannot be determined, the transfer is not screened: depending on your account's setting, it is credited with a mark or held for review. The platform sets the screening thresholds for each account.

Screening runs after confirmations, not before: a transfer that is still waiting for blocks can still disappear in a reorganisation, and checking it early would only be repeated later.

#What happens to an incoming payment

The screening result puts each screened incoming transfer into one of four levels. The level decides whether the money becomes available now or waits for a person. You never see the score, the categories behind it or who produced it — only whether the funds were credited or held.

While funds are held, they are not in your available balance and the payment is not marked paid: paid_amount of the invoice does not change, and a CMS order keeps waiting for payment. The deposit.on_hold webhook carries the transaction — amount, txid, address, status and, for a payment, the invoice ID — and no compliance details.

#What the compliance review decides

Each held transfer becomes a compliance case at CryptoLike, decided with a fresh 2FA code and a written reason. There are three possible decisions, and only the first moves money onto your balance.

1. Credit. The funds move to your available balance, the platform fee is taken as for any payment, and the usual events follow — the same deposit.confirmed or invoice events you would have received without the hold.
2. Freeze. The funds stay held. A frozen transfer can be credited or returned later.
3. Return. The transaction status becomes returned, and the funds are sent back through a manual procedure; they never reach your balance.

Freeze and return send no webhook; the transaction's status in the cabinet and in GET /v1/transactions shows where it stands. If a block reorganisation removes a held transfer from the chain, the hold is reversed like any other credit and the case closes.

#What happens when screening is unavailable

CryptoLike fails closed when the screening service is down. If the service cannot answer, a transfer whose sender is known is not credited until the check succeeds: its confirmation waits and is retried in order, and operators are alerted. The payment stays in pending a little longer, and nothing is lost.

For payouts the effect is similar. A payout cannot be created while its destination cannot be screened — the API answers 503 unavailable, and you retry later. A payout already created stays pending until the check before signing succeeds. Results are cached per address for a limited time, so a destination you pay regularly is not screened from scratch on every payout.

#How payout destinations are screened

A payout destination is checked twice because hours can pass between creating a payout and signing it — in a second approval, a review or a queue. A sanctioned address is refused immediately; a high-risk one goes to review.

A payout in review keeps its amount on hold, and you can cancel it while it waits. Screening sits on top of your own controls — 2FA, the address whitelist and the second approval — described in protect crypto payouts.

#How to handle deposit.on_hold in your integration

A held payment needs no action from your code except not treating it as paid. Subscribe to deposit.on_hold, record it next to the order or the user's top-up, and wait for the outcome. Payment and deposit webhooks are delivered at least once, so deduplicate them by event_id, as with every event — see verifying webhooks.

• Do not ship and do not credit a user balance on deposit.on_hold. Credit only on invoice.paid or deposit.confirmed.
• Tell the customer the payment is being checked, without details: the customer sees their transfer on the blockchain and will ask. The screening details are not shared with you or with them.
• Keep the txid. If you need to ask CryptoLike support about a held payment, the transaction ID is what identifies it.
• Expect a late outcome. If the review ends after the payment's deadline, the credit arrives as it would for any late transfer; decide on the order then — see underpaid, overpaid and late payments.

CMS plugins need no change: they follow the invoice, which is not paid while the funds are held.

#Screening and the rest of compliance

Screening of transfers is one part of what CryptoLike checks. An account is verified before its payouts start (KYB), payouts above the limits of an account go to a manual review, and every balance change is an append-only ledger posting that can be traced to a transaction ID. The controls are listed in one place on the security page. Which documents verification needs and what each status means: KYB for crypto merchants.

What screening does not do: it does not check your customers' identity, and it does not decide what your business may sell. Screening is not a separate line in the fee schedule on the pricing page.

#FAQ

#What does on_hold mean for a crypto payment?

The transfer arrived and reached its confirmations, but screening of the sender found a sanctioned source or a risk above the threshold, so the funds are held for a compliance review instead of being credited. Your server received deposit.on_hold. Do not ship until the payment is credited.

#Can I see why a payment was held?

No. CryptoLike does not share the risk score, the categories behind it or the source of the assessment with merchants; the transaction shows only on_hold and the outcome. If you need to discuss a held payment, contact support with its transaction ID.

#How long does a compliance review take?

It depends on the case. CryptoLike reviews each held transfer and decides to credit, freeze or return it. Until then the funds stay out of your available balance; when they are credited, you receive the usual payment events.

#Is every incoming payment screened?

Not always. A transfer to a payment or a static address is screened after its confirmations, before it is credited, when its sender can be determined. If it cannot, the transfer is credited with a mark or held for review, depending on your account's setting. The platform also sets the screening thresholds for each account.

#What happens if I try to pay out to a sanctioned address?

The payout is refused when you create it, with 422 address_refused. In a payout CSV such a row rejects the whole file, so nothing is sent. If an address becomes sanctioned after the payout was created, the check before signing rejects the payout and returns the hold to your balance.