Counterparty risk
Last updated 16 October 2026
The question most “AML check” tools answer is whether your coins are dirty. That is not the question most people actually have, and answering it means paying a blockchain-analytics firm and sending them the address you were asking about.
This page answers the other question: will you get your money. Nothing here involves a third party, and no address is sent anywhere — the whole of it is measured on this site or quoted from a provider’s own terms.
Does it turn up
Every time anyone prices a transfer here, every eligible provider is asked at the same moment and the answer is kept. This is how often each one produced a price when asked. A provider below 30 observations shows no rate rather than a number that would not survive one more sample.
| Provider | Answered | Asked | Rate | Grade |
|---|---|---|---|---|
| PegasusSwap | 1166 | 3148 | 37.0% | A |
| Exolix | 986 | 1967 | 50.1% | D |
| SideShift | 1601 | 3148 | 50.9% | D |
| ETZ-Swap | 915 | 1731 | 52.9% | A |
| ChangeHero | 1130 | 2034 | 55.6% | D |
| Mistex | 179 | 268 | 66.8% | unrated |
| Swapuz | 1937 | 2718 | 71.3% | unrated |
| CCECash | 626 | 845 | 74.1% | unrated |
| Changelly | 2358 | 3148 | 74.9% | D |
| GhostSwap | 2431 | 3148 | 77.2% | D |
| SimpleSwap | 2666 | 3149 | 84.7% | D |
| BitcoinVN | 264 | 311 | 84.9% | unrated |
| StealthEX | 2697 | 3148 | 85.7% | D |
| SageSwap | 208 | 216 | 96.3% | unrated |
| ChangeNOW | 3049 | 3149 | 96.8% | D |
| FixedFloat | 3147 | 3153 | 99.8% | D |
Grades are kycnot.me’s, mapped to letters. An unrated provider is not a clean one — it is one with no listing, which is a gap in somebody else’s directory rather than a verdict. The full table, with scores and review dates, is on providers.
What it is permitted to do with your money
Quoted exactly rather than characterised, with the date each was read. A terms page changes without announcement, so an undated quotation is a claim about a company rather than a record of one.
Exolix
“If you refuse to provide such information, we are not responsible for ensuring the refund or completion.”
Exolix terms of service, read 1 October 2026
May 2026. An unresolved breach exposed about $39.5M of swap history across roughly 355,000 transactions — deposit and withdrawal addresses, transaction hashes, amounts and timestamps — through unscoped API keys. That is the exact source-to-destination pairing this site exists to break, published by the provider rather than inferred by an observer.
ChangeHero
“In case the User does not wish to disclose their identity for certain reasons and refuses to undergo the KYC/AML procedure, ChangeHero has the right to terminate the exchange and the deposited funds are then transferred back to the initial address the deposit was made from, subtracting the network fee and ChangeHero operational fee in amount of 10% from transferred assets but not less than 100 USD equivalent.”
ChangeHero terms of use, paragraph 3.7, read 16 October 2026
Waived for visitors from this site
“The 10% fee for declining the KYC/AML procedure applies to users referred to us via an affiliate link/widget. For direct API integrations, we're ready to waive this clause, so users coming through Crypto Train via the API won't be charged this.”
ChangeHero partners desk, by email, 17 October 2026. The clause above is what their published terms say and is the document with legal force; this is an undertaking not to apply it. Both are printed because they are different kinds of thing.
September 2026. Multiple reports of withheld user funds, open since September 2026, including a documented case of $94,000 released only after the sender completed extensive identity checks and raised it publicly. kycnot.me scores the service 5 of 10 with a privacy rating of 38 out of 100 — the lowest of any provider compared here.
SideShift
“Monero and Zcash delisted; Tor access refused.”
kycnot.me listing, condensed from their policy, read 6 September 2026
A provider absent from this list has nothing recorded here, which is not the same as having nothing to record — the rest have terms nobody here has yet read closely enough to quote. An entry marked not yet connected is one decided on but without a working integration: the disclosure does not wait for the code.
Evaluated and refused
A list of who is carried says nothing about the standard applied. The refusals are where a standard actually shows, so these are published too.
Quickex
A deposit that trips an automated risk flag is frozen, and releasing it requires government ID, a selfie and proof of source — plus a 5% fee on a refund of an exchange they declined to perform. Complaints on record include funds held five months. The entire EU and EEA is excluded from the service.
Read 1 October 2026
Godex
Rated 4 of 10 with a privacy score of 38, and listed as able to block funds part-way through a transfer. The listing is community-contributed and unverified. Their API works — the rating is what rules them out.
Read 1 October 2026
Majestic Bank
Shut down in July 2025 with funds in flight; the operator disappeared and support stopped answering. Refunds were reportedly offered at a premium and largely not delivered. It had held a privacy score of 96 and a stated promise never to request identity — and none of that predicted whether it would still exist the following month.
Read 1 October 2026
BitSwitch
Terms reserve the right to require identity verification “when detect suspicious activities or for any other reason” — discretion with no limit in it — and to notify law enforcement without telling the customer. No company or jurisdiction is named anywhere on the site.
Read 1 October 2026
Who owns a service is part of its threat model
Everything above is about what a provider does. This is about what a provider is obliged to do, which can change without anything on their site changing.
In October 2026 SOL Strategies, a publicly listed company, closed its acquisition of Houdini Swap — a privacy swap service that routes transfers through a randomised intermediary chain, and the nearest thing to a competitor this site has. Their own announcement describes it as adding transactional revenue to a Solana infrastructure platform, and the infrastructure is described as carrying AML and sanctions controls, geo-blocking, and real-time transaction monitoring.
None of that is wrongdoing, and this site is not in a position to be sniffy about it: it screens for sanctions as well, and says so on the AML page. Real-time monitoring is a reasonable thing for a regulated parent to require, and they publish it rather than hiding it.
It is published here because it is the kind of fact a comparison is supposed to surface and nobody else will. A listed parent has reporting duties, auditors and shareholders; those are commitments to parties other than you, and they outlast any individual promise made on a product page. The service is the same software it was the week before. What has changed is who it answers to.
Apply it here too. This site holds no accounts, so there is nothing to hand over that it has not already published on the privacy page — and that is a property of how it is built rather than a promise about who owns it. Ownership can change; what a service never collected cannot be produced later. That is the only version of this guarantee worth anything, and it is the one to hold every provider to, including this one.
What this page does not tell you
It says nothing about the history of your coins. It cannot tell you whether funds passed through a mixer, how many hops they are from a hacked exchange, or whether a provider’s own analytics vendor will flag them. That requires clustering across whole chain histories, which is a product sold by the surveillance firms this site exists to work around — and buying it would mean sending them every address you asked us about, along with your address and the time you asked.
For Monero it would tell you even less, because there is no public ledger to read. That is the point of the Monero hop, and it cuts both ways: nobody can reassure you about an XMR address either.