You’re about to send more crypto than usual, and one question matters more than the rate: What are the odds this transaction stops halfway and someone asks for your passport? The answer is published. It sits in a crypto exchange AML policy linked from the footer, and almost nobody opens it including people who spend twenty minutes comparing quotes to the third decimal.
That document is the only disclosure a provider makes before you commit. Everything else — the rate, the estimated arrival time, the support promise — is a projection. But reading the AML page alone will mislead you, because on both services examined here the operative conditions live partly in the Terms of Use. This piece sets out six questions worth answering before a large transfer, applied identically to ChangeNOW and Changelly.
“No Registration” and “No Verification” Are Different Claims
A service can truthfully require no account and still verify you. ChangeNOW’s AML/KYC policy states that it does not require registration or continuous identity checks, and its Terms name nine jurisdictions whose residents must satisfy mandatory KYC before using the service at all: the EU, the United States, Japan, South Korea, Singapore, Hong Kong, the UAE, Australia, and Canada.
A separate section of the same Terms lists the UK and the US among prohibited jurisdictions, directing US users to a separate account-based product, so the two sections have to be read together.
Changelly takes the opposite structure: no mandatory KYC list, but a Restricted Locations clause naming around twenty jurisdictions, including Germany, Austria, India, Japan, Turkey, Hong Kong, the UK, and the US, where the service may be denied outright.
Neither fact appears on a landing page. Both determine whether the rest of the policy is even relevant to you.
The Same Six Questions, Applied to Both
| ChangeNOW | Changelly | |
|---|---|---|
| Where the rules live / last updated | AML/KYC policy, 17 Jul 2026; Terms, 28 Jul 2026 | AML/KYC policy, Feb 2022; Terms, Dec 2024 |
| Are trigger conditions named? | Four named, plus “unusual or suspicious” | Undisclosed risk score; separate named list for enhanced due diligence |
| Geographic conditions named? | Nine mandatory-KYC jurisdictions | ~20 restricted locations |
| Who verifies | Sumsub | Sum & Substance Ltd (Sumsub) |
| Stated retention | No fixed period; deletion requests within two weeks | Five years after account closure |
| Liability cap | EUR 500 | Fees you paid in the prior three months |
Both are governed by the law of Saint Vincent and the Grenadines.
Named Triggers Versus an Undisclosed Score
A policy that lists its trigger conditions can be assessed in advance; one resting on an unpublished score cannot. ChangeNOW names four situations in which verification may begin for users outside the mandatory group: fraud or stolen-fund reports, AML/CFT compliance obligations, requests from third-party fiat providers, and transactions that look unusual. Three are concrete. The fourth is open-ended, which is honest but unassessable.
Changelly works the other way round. Its identification procedure applies to transactions its scoring system flags as suspicious, and flagged transactions are put on hold. The criteria are not published, and the policy notes that sudden large swaps can be scored low, medium, or high risk, so an amount-based mental threshold isn’t reliable.
The same document does publish an indicative higher-risk list for enhanced due diligence: requests to exchange untraceable cryptocurrencies, activity appearing to come from higher-risk countries, transfers above the FATF threshold, and politically exposed persons.
The date gap is its own signal. A 2022 document may describe current practice exactly; the point is that you can’t tell from the page.
Where Your Documents Go, and for How Long
Once verification starts, the verifier’s terms matter more than the provider’s goodwill and both delegate to the same company. Changelly names Sum & Substance Ltd and states that submitted data sits on GDPR-compliant servers in the EU, retained for five years after account closure and available to competent authorities on request. ChangeNOW names Sumsub and commits to no fixed retention period, saying only that data is kept as long as necessary and that deletion requests are handled within two weeks.
ChangeNOW’s two documents also disagree on Sumsub’s legal role: the AML policy calls it an independent data processor, the privacy policy an independent data controller. Under GDPR that distinction determines who decides how your ID is used, so it isn’t a drafting nicety.
What Refusing a Check Actually Costs
This is where the published answers diverge most and where the older document simply goes quiet. ChangeNOW’s terms state that a user given a verification link has three days and may refuse, in which case a refund is provided. That is a rare thing to find in writing.
The same section carves out suspected illegal activity, where the transaction may be frozen for any period necessary and moved to cold storage, with a refund only on request from an authorized body; elsewhere, the terms cap how long funds are held at one calendar year, after which safekeeping isn’t guaranteed.
Changelly publishes no equivalent outcome. Its Terms acknowledge that an exchange may be delayed where AML/KYC procedures are necessary and ask users to indemnify the company against damages arising from delay. Its AML policy states that verification failure leads to blacklisting the account and that false or incomplete information may lead to blacklisting and termination.
Two caveats belong here. These are published policies, not predictions: what happens in your case depends on the facts, the jurisdiction, and the provider’s discretion. And crypto transfers are irreversible once sent, which is exactly why the pre-commitment document is worth five minutes.
A Four-Question Method for Any Provider
Open both the AML page and the Terms, then answer:
When was each document last updated?
Divergent dates usually mean the newer one governs.
Which triggers are named, and which rest on discretion?
Named conditions let you estimate exposure; a score does not, at any size.
Who verifies, and on what retention terms?
Look for the verifier, the storage jurisdiction, and the retention period.
What is published about refusal, holds, and liability?
The liability cap tells you what recourse is worth.
Where a provider’s own document is thin or undated, a third-party listing is the fallback: Swapzone’s Changelly exchange review carries a KYC-frequency label and user reviews tagged with swap pair and date, though it lists Changelly as a commercial partner, and its label is coarse Changelly and ChangeNOW currently sit at the same “Rare” rating despite documents that disclose very different amounts. Treat that as a prompt to open the policy, not a substitute for it.
None of this predicts whether your transaction completes cleanly. It tells you what the provider has committed to in writing, which is the only thing available before the funds leave your wallet.
