How and Why Crypto Exchanges Share User Data: Lawyers Explain

Legal Nature of Cooperation

The key factor in how an exchange responds to a request from a given authority is its jurisdiction, experts say. 

If an exchange is registered, licensed, or listed as a service provider in a particular country, or is effectively providing services in that market, it falls under that state’s regulators and is required to respond to their requests, Juscutum senior lawyer Daniil Voloshchuk told Incrypted: 

“This obligation is direct and does not require any international procedures, as it follows from the licensing terms and national legislation, and failure to comply entails fines, supervisory measures, suspension or revocation of the license, and in some cases personal liability for officials (including the compliance officer).”

Depending on the jurisdiction, a request may come from investigators, prosecutors, courts, financial investigation bodies, tax authorities, and other competent agencies, Hanna Voievodina said.

What does this process look like legally? 

1. Documentation: the investigative body opens a case and identifies the exchange, account, wallet addresses, transaction hashes, the suspect’s contact details, and other identifiers that can be used to establish their link to crypto assets. 
2. Request preparation: investigators then draft the request themselves or obtain court or prosecutorial authorization. The request typically includes the name of the requesting authority, the responsible official and their contacts, the case number, factual background, legal qualification, specific data, the time period, and the purpose for using the requested data. 
3. Submitting the request: the request is submitted via the communication channel provided by the exchange. This may include dedicated request portals or official email.  
4. Exchange review: the crypto platform’s legal team verifies the applicant’s authenticity, jurisdiction, legal basis, and territorial scope of the request. 
5. Clarification: if needed, the exchange may ask to narrow the scope of the request, clarify certain points, or object. In addition, it may preserve the requested data until a more substantiated document is received — for example, a court order. 
6. Data transfer: if the request is approved, the exchange provides the requested information to investigators.