On August 18, 2026 an EU regulation becomes applicable that for three years has occupied almost nobody outside specialist law firms. Regulation (EU) 2023/1543 on European Production and Preservation Orders for electronic evidence in criminal proceedings, E-Evidence for short, allows a public prosecutor to approach a service provider in another member state directly. For a share of cases, the route through mutual legal assistance between judicial authorities falls away.
In German-language crypto coverage the rule has recently arrived mostly in a sharpened form: from Tuesday, investigators could reach accounts at crypto exchanges without a detour. That does not survive a reading of the regulation. Article 2 contains a sector exemption that bites precisely here, and the German implementing act contains a second restriction that concerns the tax office.
This assessment rests on the text of the regulation at EUR-Lex and the German implementing act at gesetze-im-internet.de, both retrieved on August 16, 2026.
The regulation dates from July 12, 2023 and was adopted together with Directive (EU) 2023/1544. The regulation governs the orders themselves; the directive ensures that every service provider concerned has a reachable point of contact in the single market. The three-year transition period ends on August 18, 2026.
For providers already active in the EU on February 18, 2026, the deadline to name at least one addressee expires on the same day: an establishment or a legal representative in the EU on whom an order can be served. Anyone failing to name one risks fine proceedings.
The distinction between route and power matters here. What investigators may do in substance continues to follow the criminal procedure law of the issuing state. What is new is the route to it: a French prosecutor no longer has to go through a German court to reach data held by a provider based in Germany.
The regulation knows two orders that are often named in one breath although they achieve different things. The European Production Order requires the addressee to transmit specified stored data to the issuing authority. The European Preservation Order demands less and still often stands at the beginning in practice: the provider must keep existing data from deletion so that it can later be requested on a separate legal basis. Nothing changes on the customer’s account in the process.
Both orders are issued within a concrete criminal proceeding. A speculative bulk enquiry, in which an authority has an entire customer base screened, is not covered by the regulation.
Mutual legal assistance between two member states frequently took months. With data deleted after weeks under a provider’s retention periods, an investigation therefore ran into the void. The price of the shortcut: judicial control by the state where the data sits falls away in part.
The decisive sentence for everyone holding crypto through a provider sits in the definitions. Article 2(3) defines a service provider as any person offering certain categories of service, and does so with the express words “excluding financial services as referred to in Article 2(2), point (b), of Directive 2006/123/EC”.
That exemption cuts an entire sector out of the scope. At the point referred to, the Services Directive 2006/123/EC excludes banking, credit, insurance, securities and payment services, and the E-Evidence Regulation takes over that catalogue.
What follows for a MiCA-authorised crypto exchange cannot be answered across the board. The reference points to a catalogue from 2006 in which crypto-asset services naturally do not appear. Whether a provider falls under the exemption is therefore a question of the individual case; the law firm Winheller, which specialises in crypto law, likewise considers a case-by-case assessment necessary in its analysis.
In practice that means two things. Trading, custody and payment processing point towards the exemption, because they stand closest to classic financial services. Ancillary functions with no connection to the financial business can be caught, such as an integrated chat, a user forum or a document store. The exemption attaches to the individual service rather than to the company sign. A regulated provider with European authorisation therefore does not stand outside the regulation automatically.
Where a provider does fall within the scope, the data category determines the height of the hurdle.
Subscriber data are the master data of an account: name, address, registration details and whatever else is needed to identify the user. They can be requested for any criminal offence, regardless of its gravity. At a provider with anti-money-laundering duties, those are precisely the data from account opening.
Traffic data describe who communicated with whom and when, without revealing the content. Content data are the content itself. For these two categories the regulation requires that the offence be punishable in the issuing state by a custodial sentence of a maximum of at least three years, or that it belong to certain groups of offences listed in the regulation.
The identity behind an account is thus the most easily reachable information. Anything beyond it requires an offence of some weight.
Under a production order the addressee transmits the requested data directly to the issuing authority within ten days of receipt at the latest. In justified emergencies the deadline shortens to eight hours. A preservation order is to be implemented without delay.
Eight hours means round-the-clock availability for providers. For you as a customer, what counts above all is this: a few hours can lie between an order arriving and your data being transmitted. No advance warning is provided for, and while investigations are ongoing, notification of the person concerned can be deferred.
Germany implemented the directive with its act on European production and preservation orders for electronic evidence, EBewMG for short, promulgated in March 2026. Part 2, covering the naming of addressees, has applied since March 13, 2026; the remaining provisions enter into force on August 18, 2026.
How fresh this legal position is shows in a detail from the full text. On retrieval at gesetze-im-internet.de on August 16, 2026, sections 7 to 17, meaning the whole of Part 3 with the procedure, along with section 19, still carried the note “entering into force in future”. The procedural law to be applied from Tuesday was not yet officially designated as law in force on the Sunday beforehand.
The competent body is the Federal Office of Justice. As the central authority it supervises the duties of service providers and can penalise breaches as a regulatory offence; section 18 EBewMG contains the schedule of fines. Section 2(2) EBewMG makes clear that the powers of German investigating authorities in relation to domestic providers remain unaffected. For purely domestic matters little changes, then; the purpose is the cross-border case.
The second frequent confusion concerns the tax administration. The EBewMG does bring in the tax authorities, but only in a narrowly drawn role: where they conduct criminal tax proceedings independently. There the tax office acts as a prosecuting authority, and for that the Code of Criminal Procedure has long provided powers of its own.
In ordinary taxation procedure, meaning the review of your tax return, no new general investigative power arises. Anyone fearing that their case officer could call up trading history at an exchange in Ireland or Malta from Tuesday is confusing two types of procedure. The requirement remains an initial suspicion of a criminal offence.
Since January 1, 2026 crypto-asset service providers have been subject to new reporting and due diligence duties under DAC8 and the German crypto-asset tax transparency act. Both concern crypto, data and authorities; the mechanism, however, runs in opposite directions.
DAC8 is an automatic reporting route: the provider reports of its own motion, regularly, without any trigger and without suspicion, and the tax administrations exchange the data among themselves. E-Evidence is a trigger-based retrieval route: nothing happens as long as no authority requests something in a concrete criminal proceeding.
For your own records it follows that August 18 changes nothing about the duty to document. Anyone keeping their inflows and outflows in order anyway, for instance with one of the common tax and portfolio tools, is no more affected by the regulation than before.
The regulation addresses service providers and presupposes that somebody stores data for you and can be served with an order. With a wallet whose keys you hold yourself, that addressee is missing: no account data at a company, no registration details, no history a provider could hand over.
This observation is occasionally pushed too far. Self-custody does not withdraw holdings from investigation. Transactions on a public blockchain are visible to anyone, and the link between an address and a person arises as a rule exactly where a provider was involved after all: on buying or selling against euros. What changes is the number of places where your data sit bundled together. The technical differences are set out in the comparison of software wallets.
Three points remain open. First, it cannot be said which specific crypto providers rely on the sector exemption and which have named an addressee. A public list of addressees was not findable at the time of research; from the outside the question cannot be answered provider by provider.
Second, on the question whether crypto-asset services are financial services within the meaning of the Services Directive there is, as far as can be seen, no case law yet. The assessment rests on the wording and on specialist literature and may change.
Third, this text deliberately names no figure for the level of possible fines: section 18 EBewMG contains the schedule, but a reliable amount could not be established from the primary source.
August 18, 2026 shortens an administrative route. It creates no new power of access to your account and does not turn the tax office into an investigating authority. Three steps put that in order for your own holdings.
Which provider deadlines are currently creating real pressure to act is set out in the overview of crypto exchange deadlines. The primary sources for further reading: the text of the regulation at EUR-Lex and the EBewMG at gesetze-im-internet.de.
(As of August 16, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
