August 18 Electronic Evidence: What user data can investigators obtain from cryptocurrency exchanges

On August 18, 2026, an EU regulation will officially come into effect. In the past three years, the regulation has attracted almost only the attention of professional law firms.

European Regulation (EU) No 2023/1543 on Production and Preservation Orders for Electronic Evidence in Criminal Proceedings (referred to as the "Electronic Evidence Regulation") allows prosecutors to directly contact a service provider in another Member State. In some cases, judicial assistance channels between judicial authorities will be replaced. In reports related to German cryptocurrencies, the rule has recently appeared in a sharp form: starting from Tuesday, investigators can directly access cryptocurrency exchange accounts without having to detour. This statement cannot withstand the scrutiny of the original text of the regulations. Article 2 of the regulation contains an industry exemption clause that applies here, while the German Implementing Act contains another restriction related to the tax authority.

This assessment is based on the regulatory text on EUR-Lex and the German Implementing Act on gesetze-im-internet.de, both searched on August 16, 2026.

Electronic Evidence Regulation of August 18, 2026: What came into force on that day

This regulation was enacted on July 12, 2023 and was adopted simultaneously with Directive (EU) 2023/1544. The regulations themselves govern production and preservation orders; the directives ensure that each relevant service provider has a point of contact that can be reached in a single market. The three-year transition period ends on August 18, 2026.

For service providers who are already active in the EU on February 18, 2026, the deadline for appointing at least one recipient also expires on the same day: that is, establishing an agency or appointing a legal representative within the EU to serve orders on it. Those who do not designate will face a fine process.

Here, the difference between approach and authority is crucial. What investigators can essentially do remains in accordance with the criminal procedure laws of the issuing country. The new change lies in the approach: French prosecutors no longer need to go through German courts to obtain data held by German-based service providers.

Production orders and preservation orders: Two tools of the regulation

The regulation stipulates two orders, which are often mentioned together, but implement different functions. The European Production Order requires the recipient to transfer specified stored data to the issuing authority. The European Preservation Order has lower requirements and is often used as a first step in practice: service providers must retain existing data to prevent it from being deleted in order to make subsequent requests based on other legal grounds. During this process, the customer's account is not affected.

Both orders are issued in specific criminal proceedings. Authorities conduct speculative large-scale screening of the entire customer base and are not covered by the regulation.

Why abolishing mutual legal assistance is the real core

Mutual legal assistance between two member states usually takes several months. Given that data can be deleted within a few weeks of the service provider's retention period, investigations can be in trouble. The price of shortcuts: In some cases, judicial control in the country where the data is located is removed.

Article 2 (3): Financial Services Industry Exemption

For everyone holding cryptocurrency through a service provider, key terms appear in the definition. Article 2 (3) defines a service provider as anyone who provides a specific class of services and clearly states that "does not include financial services referred to in point (b) of Article 2 (2) of Directive 2006/123/EC."

This exemption excludes the entire industry from application. Among the provisions referred to, Services Directive 2006/123/EC excludes banking, credit, insurance, securities and payment services, while the Electronic Evidence Regulation follows the list.

For a cryptocurrency exchange authorized by MiCA, the impact cannot be generalized. The quote points to a 2006 list that naturally does not include crypto asset services. Therefore, whether a service provider falls within the scope of exemption needs to be judged based on specific circumstances; Winheller Law Firm, which specializes in cryptocurrency legal matters, also believes in its analysis that it is necessary to conduct a case-by-case evaluation.

In practice, this means two things. Transactions, custody and payment processing tend to apply exemptions because they are closest to classic financial services. Assistive features that are not related to financial business may be covered, such as integrated Chat features, user forums or document storage. Waivers are for specific services rather than company logos. Therefore, regulated service providers authorized by Europe are not automatically excluded from the regulations.

This regulation implements hierarchical filtering: the more sensitive the data category, the more detailed the conditions are set.

User data, traffic data and content data: Three types of data, triple thresholds

If the service provider falls within the scope of application, the data category determines the threshold. User data is the main data of the account: name, address, registration information and other information needed to identify the user. These data can be requested for any criminal offence regardless of the severity of the offence. For service providers with anti-money laundering obligations, this is the data generated when opening an account. Traffic data describes who communicated with whom and when, but does not disclose the content. Content data is the content itself. For both types of data, the regulation requires that in the issuing country, the offence is legally punishable by imprisonment for a maximum of three years, or falls within a specific category of crimes listed in the regulation.

Therefore, the identity behind the account is the easiest information to obtain. Information beyond this scope requires a certain degree of severity of a crime.

Ten days and eight hours: Deadline for recipient

According to the production order, the recipient shall transmit the requested data directly to the issuing authority within ten days at the latest after receiving the order. In confirmed emergencies, the deadline is shortened to eight hours. Preservation orders should be executed immediately.

Eight hours means service providers need to be on call 24/7. As a customer, you need to pay attention to the following key points: It may only take a few hours from the issuance of an order to the transmission of data. Regulations do not provide for advance notice, and notification to parties may be delayed while the investigation is in progress.

EBewMG and the Federal Office of Justice: How Germany implements the regulation

Germany implements the directive through its European Electronic Evidence Production and Preservation Orders Act (EBewMG) promulgated in March 2026. The second part on designated recipients will apply from March 13, 2026; the remaining provisions will take effect on August 18, 2026.

The novelty of this legal status is reflected in one detail in the full text. When searched on gesetze-im-internet.de on August 16, 2026, Articles 7 to 17 (i.e., containing the entire third part of the procedure) and Article 19 still had the note "coming into effect in the future." The procedural law, which applies from Tuesday, had not been officially designated as effective law on the previous Sunday.

The competent agency is the Federal Office of Justice. As a central authority, it supervises the obligations of service providers and can punish violations as administrative violations; Article 18 of the EBewMG contains a list of fines. Article 2 (2) of the EBewMG clearly states that the authority of the German investigative authority over domestic service providers will not be affected. As a result, purely domestic matters have changed little; the purpose is cross-border cases.

Taxation authorities and tax criminal litigation: Why ordinary tax procedures are excluded

The second common confusion involves tax administration. EBewMG did introduce tax authorities, but limited it to a very narrow role: when they independently conduct tax criminal litigation. In this case, the tax bureau plays the role of prosecuting authority, and the Criminal Procedure Law has long stipulated its own authority for this purpose.

In ordinary tax procedures (i.e., review of your tax returns), no new general investigative powers will arise. Anyone who is worried that your tax commissioner will be able to retrieve transaction history on the Irish or Malta exchange from Tuesday is confusing the two procedures. Preliminary suspicion of criminal offence still needs to exist.

An industry exemption clause completely excludes a certain part from the scope of application, rather than just treating it differently.

DAC8 and electronic evidence: Two often confused paths

Effective January 1, 2026, crypto asset service providers have assumed new reporting and due diligence obligations under DAC8 and the German Crypto Asset Tax Transparency Act. Both involve cryptocurrencies, data and regulatory agencies; however, the mechanisms work in the opposite direction.

DAC8 is an automated reporting path : service providers report proactively, regularly, without triggering conditions, and without suspicion, and tax authorities exchange data with each other. Electronic evidence is a trigger-based search path : As long as no agency makes a request in a specific criminal proceeding, nothing will happen.

For your own records, this means that your recording obligations will not change on August 18. Anyone who uses common tax and portfolio tools to organize receipts and payments will not be more directly affected by the regulation than before.

Self-hosting and software wallets: Why there are no recipients

This regulation is for service providers and assumes that someone stores data for you and can serve orders to it. For a wallet where you own a private key, this recipient is missing: there is no company account data, no registration information, and no history that the service provider can transfer.

This observation can sometimes be over-interpreted. Self-custody does not exempt assets from investigation. Transactions on public blockchains are visible to everyone, and the connection between addresses and individuals often occurs precisely where the service provider is involved: for example, when buying or selling euros. What changes is the number of locations in which your data is stored. Technical differences are detailed in software wallet comparisons.

Limitations of this assessment: What cannot be recorded in text

There are still three issues that remain unclear. First, it is impossible to determine which specific cryptocurrency service providers rely on industry exemptions and which have designated recipients. During the research, a public list of recipients could not be found; it was impossible to answer each service provider's questions one by one from the outside.

Secondly, as far as we know, there is no jurisprudence as to whether cryptographic asset services are financial services within the meaning of the Service Directive. This assessment is based on regulatory wording and expert literature that may change in the future.

Third, this article deliberately does not mention possible fines: Article 18 of the EBewMG contains a list of fines, but it is not possible to determine reliable amounts from primary sources.

Putting electronic evidence regulations in context: Points to remember

An administrative route was shortened on August 18, 2026. It does not create new rights to access your account, nor does it turn the tax office into an investigative authority. The following three steps can help you clarify your assets.

Check what services your service provider operates outside of financial business. Trade, custody and payment processing tend to apply to industry exemptions under Article 2 (3); integrated Chat features or document storage do not apply. A list of service providers authorized in Europe can be found in the Regulated Cryptocurrency Exchange Comparison.

Distinguish reporting routes. Information automatically submitted to tax authorities without triggering is governed by DAC8. If you have maintained a transaction history, August 18 will not change this; suitable tools can be found in the Cryptocurrency Tax Tool Comparison.

Decide how to host based on your security needs. For self-managed assets, there is no recipient of the order, but you bear the key risk alone. Device overview: Comparison of hardware wallets.

Which service provider deadlines are currently creating real action pressure, see an overview of cryptocurrency exchange deadlines. The main sources for further reading: regulatory texts on EUR-Lex and EBewMG on gesetze-im-internet.de.