On Friday night, a user who joined your platform eight months ago logs in from a new phone. The password is right, and the two-factor code checks out. They ask to withdraw their full balance to a wallet address you have never seen before. Their KYC was approved the day they signed up.

Do you release the funds? Once a transfer is confirmed on the blockchain, you generally cannot pull it back, so the answer has to come before the money moves.

Many crypto platforms in Africa verify users well at sign-up. The gap is at withdrawal, when value leaves the platform. This guide covers the withdrawal moments that deserve extra verification, which checks fit each one, and how to add them without frustrating good customers.

Why Withdrawals Need Their Own Check

KYC answers one question: who opened this account? It answers once, at a single point in time. A withdrawal raises a different question: is the person asking right now the same person? Account takeovers, stolen credentials and SIM swaps all happen after onboarding, which is why a clean KYC record does not protect a withdrawal.

The value at stake is growing. Chainalysis reports that Sub-Saharan Africa received over $205 billion in on-chain value between July 2024 and June 2025, up roughly 52% from the previous year. Nigeria alone received $92.1 billion, nearly triple what South Africa received.

Supervisors are paying attention too. In March 2026, the CBN began an AML/CFT/CPF supervision pilot for a first group of virtual asset service providers. Participants undergo reviews covering governance, customer onboarding, sanctions screening, transaction monitoring and cross-border activity. The pilot confers no licence or regulatory status, and the SEC keeps separate oversight of virtual assets that qualify as securities. Monitoring after onboarding is part of the scrutiny either way.

That makes it worth deciding in advance which withdrawals get extra attention.

Withdrawal Moments That Call for Step-Up Verification

Step-up verification means asking for an additional check only when an action carries higher risk. For withdrawals, these five moments make good starting triggers:

1. First withdrawal on a new or dormant account: A new account has no history to compare against, and a long-dormant one may have changed hands.
2. A wallet address the user has never used: A new destination is the most direct sign that something changed in how the account is being used.
3. A withdrawal soon after a credential or device change: A password reset, a new phone, or a swapped two-factor method followed quickly by a payout deserves a second look.
4. An amount far outside the user’s pattern: Compare against that user’s own history instead of a flat limit.
5. Several withdrawals in a short window: Splitting one large payout into smaller ones can be an attempt to stay under review thresholds. Dojah’s transaction monitoring can recognise transactions broken into smaller amounts to evade reporting thresholds.

Set your own thresholds from your data. The list shows where to look, and your volumes and customer mix decide where the lines sit.

Once you know the trigger, you can match the check to the risk.

Matching the Check to the Risk

Not every trigger needs the same response. A simple three-level approach keeps friction in proportion:

• Low risk: Let the withdrawal through and log it for monitoring.
• Medium risk: Ask for a face re-authentication. The user takes a short liveness check that is matched against the one they completed earlier, which confirms the person on the screen is the account holder without repeating full KYC.
• High risk: Hold the withdrawal for review. Look at the profile, device, and recent activity, and screen the user again against sanctions and PEP lists if the amount or destination raises AML questions.

The next question is how to build this so real customers barely notice it.

Keeping Friction Low and the Process Safe

A few habits make step-up checks easier on users and harder to game:

• Trigger on risk only: A check on every withdrawal teaches users to resent it.
• Say why: A short line such as “We are confirming this withdrawal to protect your account” removes confusion.
• Decide on your server: Dojah’s documentation warns against treating the widget callback as proof that the user passed. Confirm the status server-side from the webhook before you release a sensitive action.
• Protect the reference ID: It is the key to a user’s stored biometric record, and the same documentation notes that anyone who can supply a valid one can attempt authentication against that record. Store it on your server, never in the browser.

Each of these maps to something you can set up today.

How Dojah Supports Withdrawal Verification

Easy Authentication re-authenticates users before critical activities such as major transactions. It matches a live selfie against a liveness record captured at onboarding or through a liveness-only registration, and sends the result to your webhook.

Easy Detect monitors deposits, transfers, and withdrawals in real time. You define rules, including logic for transaction velocity, and each event gets an Allowed, Pending, or Blocked verdict. Pending events go to a Case Management tab for review.

For users whose risk changes over time, AML Watchlist offers ongoing monitoring that reports status changes in real time. Dojah’s crypto solutions bring sign-up verification, AML screening, and transaction monitoring together for exchanges and wallets.

Want to see step-up verification on your own withdrawal flow? Explore Dojah’s anti-fraud solutions for crypto today.

FAQs

What is step-up verification in crypto?
Step-up verification is an extra check that a platform asks for only when an action looks risky, such as a withdrawal to a new wallet address or a large payout soon after a device change.

When should a crypto platform ask for extra verification on a withdrawal?
Good starting triggers are a first withdrawal on a new or dormant account, a wallet address the user has never used, a payout soon after a credential or device change, an unusual amount, and several withdrawals in a short window.

Will extra verification slow down legitimate users?
It adds a step only for withdrawals that trip your rules, so the cost lands on a few risky moments instead of every transaction. Clear messaging and a mobile-friendly check keep that step short.