E-Evidence From August 18: What Changes for Crypto Exchange Users

On August 18, 2026 an EU regulation becomes applicable that for three years has occupied almost nobody outside specialist law firms. Regulation (EU) 2023/1543 on European Production and Preservation Orders for electronic evidence in criminal proceedings, E-Evidence for short, allows a public prosecutor to approach a service provider in another member state directly. For a share of cases, the route through mutual legal assistance between judicial authorities falls away.

In German-language crypto coverage the rule has recently arrived mostly in a sharpened form: from Tuesday, investigators could reach accounts at crypto exchanges without a detour. That does not survive a reading of the regulation. Article 2 contains a sector exemption that bites precisely here, and the German implementing act contains a second restriction that concerns the tax office.

This assessment rests on the text of the regulation at EUR-Lex and the German implementing act at gesetze-im-internet.de, both retrieved on August 16, 2026.

The regulation dates from July 12, 2023 and was adopted together with Directive (EU) 2023/1544. The regulation governs the orders themselves; the directive ensures that every service provider concerned has a reachable point of contact in the single market. The three-year transition period ends on August 18, 2026.

For providers already active in the EU on February 18, 2026, the deadline to name at least one addressee expires on the same day: an establishment or a legal representative in the EU on whom an order can be served. Anyone failing to name one risks fine proceedings.

The distinction between route and power matters here. What investigators may do in substance continues to follow the criminal procedure law of the issuing state. What is new is the route to it: a French prosecutor no longer has to go through a German court to reach data held by a provider based in Germany.

The regulation knows two orders that are often named in one breath although they achieve different things. The European Production Order requires the addressee to transmit specified stored data to the issuing authority. The European Preservation Order demands less and still often stands at the beginning in practice: the provider must keep existing data from deletion so that it can later be requested on a separate legal basis. Nothing changes on the customer's account in the process.

Both orders are issued within a concrete criminal proceeding. A speculative bulk enquiry, in which an authority has an entire customer base screened, is not covered by the regulation.

Mutual legal assistance between two member states frequently took months. With data deleted after weeks under a provider's retention periods, an investigation therefore ran into the void. The price of the shortcut: judicial control by the state where the data sits falls away in part.

The decisive sentence for everyone holding crypto through a provider sits in the definitions. Article 2(3) defines a service provider as any person offering certain categories of service, and does so with the express words "excluding financial services as referred to in Article 2(2), point (b), of Directive 2006/123/EC".

That exemption cuts an entire sector out of the scope. At the point referred to, the Services Directive 2006/123/EC excludes banking, credit, insurance, securities and payment services, and the E-Evidence Regulation takes over that catalogue.

What follows for a MiCA-authorised crypto exchange cannot be answered across the board. The reference points to a catalogue from 2006 in which crypto-asset services naturally do not appear. Whether a provider falls under the exemption is therefore a question of the individual case; the law firm Winheller, which specialises in crypto law, likewise considers a case-by-case assessment necessary in its analysis.

In practice that means two things. Trading, custody and payment processing point towards the exemption, because they stand closest to classic financial services. Ancillary functions with no connection to the financial business can be caught, such as an integrated chat, a user forum or a document store. The exemption attaches to the individual service rather than to the company sign. A regulated provider with European authorisation therefore does not stand outside the regulation automatically.

Where a provider does fall within the scope, the data category determines the height of the hurdle.

Subscriber data are the master data of an account: name, address, registration details and whatever else is needed to identify the user. They can be requested for any criminal offence, regardless of its gravity. At a provider with anti-money-laundering duties, those are precisely the data from account opening.

Traffic data describe who communicated with whom and when, without revealing the content. Content data are the content itself. For these two categories the regulation requires that the offence be punishable in the issuing state by a custodial sentence of a maximum of at least three years, or that it belong to certain groups of offences listed in the regulation.

The identity behind an account is thus the most easily reachable information. Anything beyond it requires an offence of some weight.