Changelly Review: KYC, AML and Real Risks

Verdict: Changelly KYC and Risk Level

KYC type: conditional. For standard crypto-to-crypto exchanges, the service allows an anonymous start without an account, but its Terms explicitly reserve the right to apply AML/KYC checks to specific users, addresses, and transactions. API partners are additionally required to warn that a transaction may be placed on hold and sent to KYC after funds have already been transferred. For fiat purchases, the situation is stricter: verification is often required by partner providers rather than the Changelly interface itself.

Risk level: high. For privacy/NON-KYC scenarios, the main risk is that KYC may be triggered retroactively, after funds have been sent, and the official FAQ explicitly allows checks that can last weeks or even months. This risk does not appear theoretical: there are recurring public complaints about long holds and template responses, and the UK Financial Conduct Authority has added Changelly to its warning list as an unauthorized firm for the UK market.

Key insights: The service supports XMR and allows an anonymous start, but its AML policy simultaneously classifies exchanges involving “untraceable cryptocurrencies” as high risk. In other words, “privacy coin support” does not imply privacy-friendly behavior: privacy-oriented flows may actually increase the likelihood of AML/KYC checks.

Last updated: May 4, 2026.

Quick summary: How Changelly Works

What it is. Changelly is an ecosystem of exchange products, including crypto-to-crypto swaps, buying and selling crypto for fiat, and the Changelly PRO exchange. The service states that it does not hold user balances, but generates a deposit address for each transaction through which the incoming asset is processed.

How it works. The user selects a pair, chooses a fixed or floating rate, and provides a receiving address. They can then proceed either via email/Google account or anonymously without registration. After that, the exact amount must be sent to the generated address; the service sources liquidity through external trading platforms and partners.

Who it is for. Suitable only for users who accept that “no registration” does not mean “no KYC,” and who perform standard, traceable, non-urgent swaps with small to medium amounts. Not suitable for privacy-sensitive users, large all-in transfers, urgent payments, or those who require a predictable policy without post-transaction KYC.

KYC Behavior and AML Triggers

The most important thing to understand about Changelly is that the absence of KYC at the entry point does not mean the absence of KYC at the exit. This is a classic case of post-transaction KYC.

Official triggers are described vaguely. The FAQ mentions the activation of a risk-scoring algorithm in cases such as disposable emails, attempts to deceive during KYC, and detection of mixers or black market wallet addresses. The AML policy additionally classifies as higher risk: “untraceable cryptocurrencies,” transactions from higher-risk countries, transfers above thresholds associated with Travel Rule/AML approaches, and PEP-related risks. The service does not disclose specific numerical thresholds, score cut-offs, or public statistics on trigger frequency.

If a transaction is placed on hold, the required documentation can be extensive. The official KYC flow includes name, email, ID document photo, selfie/video for liveness check, and proof of source of funds—such as bank statements, exchange history, receipts from sellers, mining proofs, and similar documents. ID verification is described as typically taking up to 24 hours, but the FAQ simultaneously warns that transaction reviews may take several weeks or even months.

It is important to distinguish who requires KYC. For standard crypto swaps, it may be handled by Changelly or its compliance team; for fiat purchases (Direct Buy), verification is usually requested by a partner such as Switchere. The FAQ also notes that some providers, including Wert, allow purchases without verification only up to certain limits, after which – or based on internal rules – documents may still be required. Through API and wallet integrations, the risk remains: Changelly documentation explicitly requires partners to warn users about the possibility of a KYC hold.

Risks of Freezes and Blocks on Changelly

Freezing of funds is possible. The Terms include broad disclaimers of liability for losses caused by exchange delays. The service also uses a one-time deposit address: the user first sends the incoming asset, and only then either receives the output or enters a dispute/KYC flow.

For a privacy-focused user, the typical risk scenario is as follows: an anonymous swap is initiated without an account, the user sends funds to the generated address, after which the transaction receives a “hold” status and a request for ID and source of funds begins. Since the AML policy explicitly classifies mixers, black-market addresses, and “untraceable cryptocurrencies” as higher risk, users dealing with privacy coins or assets with questionable traceability may fall into a higher-risk category even without initial KYC requirements.

Public cases suggest this is not a rare edge case. On Reddit, there is a complaint about approximately $600-650k being held for over 11 months after completing KYC. Another case describes 20,000 USDT being held after KYC and proof of funds, followed by requests for additional historical transactions. On Trustpilot, a review dated April 16, 2026, states that funds remain blocked despite full compliance and an expired review timeframe. These are user claims rather than independent audits, but similar patterns appear across multiple public sources.

It is also notable that, at the time of review, the Trustpilot page shows 4,523 reviews, of which 20% are 1-star. Recent negative feedback primarily concerns slow support, AML reviews without clear timelines, and template responses. This does not prove fault in every individual dispute, but it indicates that freeze/KYC friction is a noticeable part of real user experience.

Refunds and Disputes with Changelly

Officially, a refund is only possible if funds were sent to a Changelly address and the transaction has not yet been completed. The refund policy divides cases into refundable with ETA, refundable without ETA, and non-refundable, emphasizing that the process is not automated and is handled manually by the support team.

Timelines are inconsistent. Simple fixed-rate refund cases may take around an hour, medium cases up to 7 business days, and hard cases up to 20 business days. If partners or widgets are involved, there may be no ETA at all. The Terms also allow Changelly to retain operating costs and network fees during refunds, and to charge supplementary fees for certain technical recoveries.

A critical nuance: official documentation does not provide a clear universal rule that, in case of an AML trigger, funds are automatically returned to the original address without completing KYC. In practice, public cases often describe that refunds – or any progress – occur only after KYC/AML cooperation, and sometimes only after public pressure or legal escalation. On Bitcointalk, there is a report of a full refund of $1M USDT within 72 hours following a court-stamped legal threat.

Outcomes are mixed rather than consistently favorable. There are recent public reports of holds lasting 16 days, over 6 months, and even around 2 years without a clear timeline, as well as cases where users report silence or template replies after submitting documents. Refunds do occur, but predictability is low, and outcomes often depend on the specific case, partners involved, and the level of escalation.

Changelly’s Privacy level

Rating: low. While the service allows users to start a crypto swap without an account, the privacy model breaks once an AML trigger occurs. At that point, requirements may include ID submission, selfie, liveness video, and source-of-funds verification. For a privacy-oriented user, this means that “no registration” is not equivalent to anonymity or protection from de-anonymization.

The level of privacy is further reduced by the volume of collected data and its storage. The KYC infrastructure operates through Sumsub; the AML policy states that identification records may be stored for up to five years and can be shared with competent authorities upon request. Additionally, the classification of “untraceable cryptocurrencies” as higher risk makes the use of privacy coins more likely to trigger additional scrutiny rather than provide enhanced privacy.

The service does not disclose a single global “min/max” limit applicable to all pairs; there is also no available data on exact AML score thresholds.

Real use cases of Changelly: When to Use / When Not to Use

When to use. For standard crypto-to-crypto swaps with small to moderate amounts, a clean/traceable on-chain history, and non-urgent transfers, where you are prepared to provide KYC and source of funds if required. For small fiat purchases, friction may be lower with certain providers, but even there the service explicitly states that verification may still be requested under provider guidelines.

When NOT to use. If anonymity and a predictable “no KYC” flow are critical; if you deal with privacy coins, mixer-adjacent history, or otherwise hard-to-explain provenance; if the amount is large; if the payment is time-sensitive; if you require a clear consumer-protection framework; or if you are located in a jurisdiction listed as restricted in the Terms. For UK users, an additional drawback is that the FCA warning explicitly states there is no Ombudsman/FSCS protection if something goes wrong.

KYC after sending funds. Yes, this is one of the central risks of the service. Official documentation confirms hold-for-KYC after a transaction has started, and public cases on Reddit and Trustpilot show that many users encounter compliance flow in exactly this way.

Delays and freezes. The official FAQ allows for holds lasting weeks or months; the Terms disclaim liability for damages caused by exchange delays; public cases indicate that disputed funds can indeed remain frozen for extended periods. This makes the service unsuitable for time-sensitive transfers.

Other risks. Refunds may be manual and include retention of fees/costs; if partners are involved, there may be no ETA; some technical issues may be non-refundable; transfers below the required network fee are not refunded.

Summary from a NON-KYC perspective. Changelly is not a “pure no-KYC service,” but rather a service with anonymous entry and potentially strict KYC/AML at the exit. For privacy-focused use cases, this represents a significant mismatch.