Centralised and decentralised exchanges
Withdrawal flow, KYC / KYT, and where the freeze risk actually differs.
Centralised and decentralised exchanges get framed as an either/or, but they are solving different problems. Working out what each one handles—and what it leaves you with—is more useful than picking a side.
Centralised: matching happens in a database
Orders are matched inside the platform’s own system, and assets sit in the platform’s wallet. The upside of that architecture is real: deep books, fast fills, fiat rails, and someone to contact when something goes wrong.
The cost is custody risk plus risk-control freezes. Because they hold the money, they are answerable for where it came from and where it is going—so they must have the right to review, and the right to pause.
Decentralised: matching and settlement both on-chain
Assets leave your wallet and go straight to the counterparty or a liquidity pool, with nobody holding them along the way. There is no account, so there is no such thing as your account being frozen.
The cost moves somewhere else: no built-in fiat rail, slippage and MEV, front ends that may geoblock you, and mistakes that are effectively irreversible—a wrong address is a wrong address, and nobody can claw it back.
Side by side
| Centralised / decentralised | |
|---|---|
| Custody | The platform’s wallet / your own wallet |
| Account freeze risk | Yes, at account level / no account to freeze |
| Fiat rail | Usually built in / needs a third party |
| Withdrawal review | KYC + KYT, possibly an RFI / none on-chain, but the fiat leg still needs KYC |
| Reversibility of mistakes | Support may be able to help / effectively none |
| Transaction record | Internal ledger; only withdrawals hit the chain / everything on-chain |
The most common misreading
“Use a DEX and you will not get frozen” is only true for the on-chain leg. The moment you want fiat, you are back at a regulated provider, and the KYC and KYT are waiting there.
Decentralisation removes custody risk, not compliance risk. Those two get talked about as one thing, but they are separate—you can drop the first, and the second is still there for anything touching fiat.
How risk controls actually get triggered
- KYC (Know Your Customer): identity verification at sign-up. A one-time gate.
- KYT (Know Your Transaction): ongoing chain analysis of your counterparties and the source of funds. Continuous monitoring, not a one-off.
- RFI (Request for Information): when something is flagged, you are asked to explain and provide documents. This is the step that stalls people, because what is asked for can go back years.
- Dust attacks: someone sends tiny amounts of tainted assets to your address so that analytics tools downgrade its score. You did nothing—but what risk control sees is “has dealt with a sanctioned address”.
That last one is not theoretical. In August 2026 Kraken saw a flood of dust deposits from wallets that chain analytics had labelled as HTX-linked and that were under UK and EU sanctions. Compliance review kicked in and temporarily locked the accounts of users who had done nothing. HTX denies involvement and says its own review found no official accounts were used.
The practical combination
If what you need is “take USDT as everyday payment, cash out now and then”, the practical answer is not either/or. Keep the on-chain leg self-custodial, use a provider when you need fiat, and check that a failed review returns the funds to your own wallet rather than parking them in someone else’s account.