E-Evidence From August 18: Which User Data Investigators Can Request From Crypto Exchanges

On August 18, 2026 an EU regulation becomes applicable that for three years has occupied almost nobody outside specialist law firms. Regulation (EU) 2023/1543 on European Production and Preservation Orders for electronic evidence in criminal proceedings, E-Evidence for short, allows a public prosecutor to approach a service provider in another member state directly. For a share of cases, the route through mutual legal assistance between judicial authorities falls away.

In German-language crypto coverage the rule has recently arrived mostly in a sharpened form: from Tuesday, investigators could reach accounts at crypto exchanges without a detour. That does not survive a reading of the regulation. Article 2 contains a sector exemption that bites precisely here, and the German implementing act contains a second restriction that concerns the tax office.

This assessment rests on the text of the regulation at EUR-Lex and the German implementing act at gesetze-im-internet.de.

The E-Evidence Regulation from August 18, 2026: what takes effect that day

The regulation dates from July 12, 2023 and was adopted together with Directive (EU) 2023/1544. The regulation governs the orders themselves; the directive ensures that every service provider concerned has a reachable point of contact in the single market. The three-year transition period ends on August 18, 2026.

For providers already active in the EU on February 18, 2026, the deadline to name at least one addressee expires on the same day: an establishment or a legal representative in the EU on whom an order can be served. Anyone failing to name one risks fine proceedings.

The distinction between route and power matters here. What investigators may do in substance continues to follow the criminal procedure law of the issuing state. What is new is the route to it: a French prosecutor no longer has to go through a German court to reach data held by a provider based in Germany.

Production order and preservation order: the regulation’s two instruments

The regulation knows two orders that are often named in one breath although they achieve different things. The European Production Order requires the addressee to transmit specified stored data to the issuing authority. The European Preservation Order demands less and still often stands at the beginning in practice: the provider must keep existing data from deletion so that it can later be requested on a separate legal basis. Nothing changes on the customer’s account in the process.

Both orders are issued within a concrete criminal proceeding. A speculative bulk enquiry, in which an authority has an entire customer base screened, is not covered by the regulation.

Why dropping the mutual legal assistance route is the actual core

Mutual legal assistance between two member states frequently took months. With data deleted after weeks under a provider’s retention periods, an investigation therefore ran into the void. The price of the shortcut: judicial control by the state where the data sits falls away in part.

Article 2(3): the sector exemption for financial services

The decisive sentence for everyone holding crypto through a provider sits in the definitions. Article 2(3) defines a service provider as any person offering certain categories of service, and does so with the express words “excluding financial services as referred to in Article 2(2), point (b), of Directive 2006/123/EC”.

That exemption cuts an entire sector out of the scope. At the point referred to, the Services Directive 2006/123/EC excludes banking, credit, insurance, securities and payment services, and the E-Evidence Regulation takes over that catalogue.

What follows for a MiCA-authorised crypto exchange cannot be answered across the board. The reference points to a catalogue from 2006 in which crypto-asset services naturally do not appear. Whether a provider falls under the exemption is therefore a question of the individual case; the law firm Winheller, which specialises in crypto law, likewise considers a case-by-case assessment necessary in its analysis.

In practice that means two things. Trading, custody and payment processing point towards the exemption, because they stand closest to classic financial services. Ancillary functions with no connection to the financial business can be caught, such as an integrated chat, a user forum or a document store. The exemption attaches to the individual service rather than to the company sign. A regulated provider with European authorisation therefore does not stand outside the regulation automatically.

Subscriber data, traffic data and content data: three categories with three hurdles

Where a provider does fall within the scope, the data category determines the height of the hurdle.

Subscriber data are the master data of an account: name, address, registration details and whatever else is needed to identify the user. They can be requested for any criminal offence, regardless of its gravity. At a provider with anti-money-laundering duties, those are precisely the data from account opening.

Traffic data describe who communicated with whom and when, without revealing the content. Content data are the content itself. For these two categories the regulation requires that the offence be punishable in the issuing state by a custodial sentence of a maximum of at least three years, or that it belong to certain groups of offences listed in the regulation.

The identity behind an account is thus the most easily reachable information. Anything beyond it requires an offence of some weight.

Ten days and eight hours: the deadlines for the addressee

Under a production order the addressee transmits the requested data directly to the issuing authority within ten days of receipt at the latest. In justified emergencies the deadline shortens to eight hours. A preservation order is to be implemented without delay.

Eight hours means round-the-clock availability for providers. For you as a customer, what counts above all is this: a few hours can lie between an order arriving and your data being transmitted. No advance warning is provided for, and while investigations are ongoing, notification of the person concerned can be deferred.

EBewMG and the Federal Office of Justice: how Germany implements the regulation

Germany implemented the directive with its act on European production and preservation orders for electronic evidence, EBewMG for short, promulgated in March 2026. Part 2, covering the naming of addressees, has applied since March 13, 2026; the remaining provisions enter into force on August 18, 2026.

How fresh this legal position is shows in a detail from the full text. On retrieval at gesetze-im-internet.de on August 16, 2026, sections 7 to 17, meaning the whole of Part 3 with the procedure, along with section 19, still carried the note “entering into force in future”. The procedural law to be applied from Tuesday was not yet officially designated as law in force on the Sunday beforehand.

The competent body is the Federal Office of Justice. As the central authority it supervises the duties of service providers and can penalise breaches as a regulatory offence; section 18 EBewMG contains the schedule of fines. Section 2(2) EBewMG makes clear that the powers of German investigating authorities in relation to domestic providers remain unaffected. For purely domestic matters little changes, then; the purpose is the cross-border case.

Tax office and criminal tax proceedings: why ordinary taxation stays outside

The second frequent confusion concerns the tax administration. The EBewMG does bring in the tax authorities, but only in a narrowly drawn role: where they conduct criminal tax proceedings independently. There the tax office acts as a prosecuting authority, and for that the Code of Criminal Procedure has long provided powers of its own.

In ordinary taxation procedure, meaning the review of your tax return, no new general investigative power arises. Anyone fearing that their case officer could call up trading history at an exchange in Ireland or Malta from Tuesday is confusing two types of procedure. The requirement remains an initial suspicion of a criminal offence.

DAC8 and E-Evidence: two routes that are regularly confused

Since January 1, 2026 crypto-asset service providers have been subject to new reporting and due diligence duties under DAC8 and the German crypto-asset tax transparency act. Both concern crypto, data and authorities; the mechanism, however, runs in opposite directions.

DAC8 is an automatic reporting route: the provider reports of its own motion, regularly, without any trigger and without suspicion, and the tax administrations exchange the data among themselves. E-Evidence is a trigger-based retrieval route: nothing happens as long as no authority requests something in a concrete criminal proceeding.

For your own records it follows that August 18 changes nothing about the duty to document. Anyone keeping their inflows and outflows in order anyway, for instance with one of the common tax and portfolio tools, is no more affected by the regulation than before.

Self-custody and software wallets: why there is no addressee there

The regulation addresses service providers and presupposes that somebody stores data for you and can be served with an order. With a wallet whose keys you hold yourself, that addressee is missing: no account data at a company, no registration details, no history a provider could hand over.

This observation is occasionally pushed too far. Self-custody does not withdraw holdings from investigation. Transactions on a public blockchain are visible to anyone, and the link between an address and a person arises as a rule exactly where a provider was involved after all: on buying or selling against euros. What changes is the number of places where your data sit bundled together. The technical differences are set out in the comparison of software wallets.

Limits of this assessment: what the text cannot document

Three points remain open. First, it cannot be said which specific crypto providers rely on the sector exemption and which have named an addressee. A public list of addressees was not findable at the time of research; from the outside the question cannot be answered provider by provider.

Second, on the question whether crypto-asset services are financial services within the meaning of the Services Directive there is, as far as can be seen, no case law yet. The assessment rests on the wording and on specialist literature and may change.

Third, this text deliberately names no figure for the level of possible fines: section 18 EBewMG contains the schedule, but a reliable amount could not be established from the primary source.

Putting the E-Evidence Regulation in context: what to take away

August 18, 2026 shortens an administrative route. It creates no new power of access to your account and does not turn the tax office into an investigating authority. Three steps put that in order for your own holdings.

1. Check which services your provider runs alongside the financial business. Trading, custody and payment processing point towards the sector exemption under Article 2(3); an integrated chat or a document store does not. The providers with European authorisation are listed in the comparison of regulated crypto exchanges.
2. Keep the reporting routes apart. What goes to the tax administration without any trigger is governed by DAC8. If you maintain your transaction history anyway, August 18 changes nothing about that; the suitable tools are listed in the comparison of crypto tax tools.
3. Decide on custody according to your security needs. With self-custodied holdings there is no addressee for an order, but you carry the key risk alone. An overview of the devices: hardware wallet comparison.

Which provider deadlines are currently creating real pressure to act is set out in the overview of crypto exchange deadlines. The primary sources for further reading: the text of the regulation at EUR-Lex and the EBewMG at gesetze-im-internet.de.

(As of August 16, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)