No-KYC Swap Asked for ID? When Review Really Starts
Both pools' terms, verbatim: what triggers a source-of-funds request, why a suspension looks like a stuck order, and what a refund really costs.
Three layers, and only one of them ever asks for paper
A swap on veilswap.io is a POST with seven fields: fromAsset, toAsset, fromAmount, toAddress, toExtraId, refundAddress and refundExtraId. There is no field for a name, a birth date or a document, and the handler ignores anything else you send, so the form itself cannot ask you for papers. Any request you do get therefore comes from one of two other layers: the pool that actually executes the exchange, or the fiat leg at either end - the card issuer, the bank, or the regulated exchange you bought from. Keeping those three apart is the useful part. A pool asking for the source of funds is a different event from your bank asking where you live, and neither is the same as a site that collects an ID at signup.
What the pools' own documents actually say
FixedFloat's Terms of Service, updated 2 October 2026, are the most explicit text in this corridor. Section 7.1: an order 'may be suspended in order to request details about the origin of the funds sent', and you must write to [email protected] from the email shown on the order page. Section 4.12.1 makes that email obligatory at order creation and 4.12.2 says it cannot be changed afterwards. Section 7.8 lets the service freeze funds for return to victims if you refuse or provide false data. Section 7.9 adds identity verification as an exception and states refunds happen only after verification, and only to the address the funds came from. Note the ordering: verification first, money second.
ChangeNOW's FAQ describes the same layer differently: an automated risk-management system flags an exchange, the order is put on hold, the page grows a Verify button that opens Sumsub, and the customer is asked for an ID scan plus information on where the funds came from. It says plainly that the criteria 'can't be made public'. Refusing means a refund to the deposit address minus network fees within 24 hours, after which the address may be blacklisted; false documents mean a refund only 'in specific cases', plus the same blacklist. Documents stay with Sumsub under GDPR, not with the exchange. I fetched both documents today and neither contains the words 'proof of address' or 'utility bill': at this layer the surface is identity and source of funds, not residence. (how Monero fees work)
Why a suspension looks like a stuck order, not an upload form
Our local status map collapses twenty upstream strings into seven states - waiting_deposit, confirming, settling, paid, expired, refunded, failed - and none of them means 'under review'. So when a pool freezes an order, your page does not grow an upload form; it sits in confirming or settling, and the raw providerStatus value is the only honest signal. FixedFloat's EMERGENCY is mapped to failed precisely because it means a human at the pool has to step in. The no-account design has a second consequence worth stating: we store no email, so nobody can email you a request. The order link is the channel, and it is a capability token - lose it, and a review can run without you ever hearing about it.
Six moments when review actually starts
1) The deposit address traces directly to a known-bad entity; 7.2 names partners, public sources, victim complaints and law-enforcement requests as its inputs. 2) The amount crosses an internal line the pool does not publish - our ceiling on USDT-TRC20 to XMR this morning was 169,650.08 USDT, but that is liquidity, not the review threshold. 3) One address or one IP produces several orders in a short window; our hard stop is six orders per hour per IP plus a 90-second duplicate window, and that is rate limiting, not risk scoring. 4) The refund address is an exchange deposit address, an ownership conflict the pool cannot resolve without you. 5) Behaviour that reads as abuse under 6.5 - simulated swaps, refund farming. 6) You decline to answer, which turns a review into a refund decision. (recovering misdirected funds)
What the wait costs, in fees and in clocks (how Monero fees work)
A refund is a new on-chain transaction and the fee is yours. At 10:04 UTC with XMR at 589.83, BTC at 77,573 and TRX at 0.334377, the same refund costs about 0.00003068 XMR (1.8 cents) on Monero at 1,534 bytes and 20,000 piconero per byte, 141 satoshis (11 cents) on Bitcoin at 1 sat/vB for a 141-vB payment, and 6.7735 TRX (2.27 dollars) for a TRC20 transfer, because a USDT transfer to an address whose balance slot is already funded burns 64,285 energy at 100 sun. Two clocks matter more than the fee. The 30-minute expiry only fires while the pool still reports the order as waiting, so a suspended order is never cancelled by it, and the six-hour lookback exists for late deposits, not for reviews. Only when the pool cannot find the order at all does the 24-hour fallback close it locally. (XMR to USDT exit)
If you are asked, hand over exactly one document
Ask three questions in writing before you send anything: which document exactly, what it must show, and what happens if you decline. Then send one document, as a PDF rather than a phone photo, because JPEG carries EXIF and often GPS. On a utility bill the pool needs a name, an address, an issue date and the issuer - black out the account number, the consumption history and the barcode. On a bank statement, send the pages with the two transactions that explain the money, not twelve months. For source of funds, a signed sale contract, an employer letter or an exchange export covering the deposit is normally enough. Reply from the address on the order, because 4.12.3 explicitly allows a refusal when the sender cannot make contact from that mailbox.
Five moves that turn a review into a loss
Five moves convert a review into a loss. Submitting an edited document - 7.8 and ChangeNOW's false-document clause both allow freezing, and a blacklist outlives the order. Borrowing someone else's bill, which fails the name match and now implicates two people. Photographing the whole passport when only the data page was requested. Sending a second deposit to 'speed things up', which creates a second order and a second review. And pasting a seed phrase or private key into support chat, which no legitimate review ever needs. (seed backup guide)
Who actually gets stopped, by the numbers
The arithmetic explains why paperwork is rare and pattern matching is common. This morning 100 USDT-TRC20 bought 0.14902139 XMR, 1,000 bought 1.6511699, 10,000 bought 16.67073915 and 100,000 bought 166.59892792 - 671.05, 605.63, 599.86 and 600.24 USDT per XMR against a spot of 589.83, the gap being the fixed per-order deduction, not a risk premium. The floor was 19.451908 USDT and the ceiling 169,650.08. Selling 1 XMR returned 570.201686 USDT, 3.3% under spot. A 20-dollar order cannot attract a compliance review worth a human's time; a 40,000-dollar order that arrived in six tranches from an address with mixer history can, whatever the site's front page says. (privacy coins vs mixers)
The short version
Seven fields, zero identity fields, and three layers that can still ask: the pool with its terms, the fiat leg with its bank rules, and law enforcement behind both. Expect a request to arrive as a stuck order rather than a form, answer one document at a time, and remember that the refund clock starts when the pool decides, not when you reply.