Recovery windows for misappropriated digital assets are measured in hours, not weeks. When funds leave a wallet under MiCA (the EU's Markets in Crypto-Assets Regulation), a business has a narrow window to compel an exchange to disclose account-holder identity and transaction records before withdrawal, conversion, or transfer renders recovery impractical. An exchange disclosure order – a court-compelled direction requiring a CASP (crypto-asset service provider) to produce subscriber and transaction data – is the instrument that opens that window.
This guide sets out the legal basis for such orders in the EU-MiCA environment, the step-by-step process a business must follow, the cross-border complications that arise when the exchange or the stolen assets span multiple jurisdictions, and the decision points at which engaging specialist counsel changes outcomes. Every step assumes the recovery clock is already running.
Why Disclosure Orders Matter Under MiCA
A disclosure order is the first operational step in any EU crypto-asset recovery action, because without the identity of the person controlling the receiving address, no freezing application can name a defendant. Under the MiCA regime, CASPs authorised in an EU member state are regulated entities subject to record-keeping, AML, and data-retention obligations. That regulatory status creates a documented paper trail – subscriber onboarding records, transaction logs, wallet addresses – that a court order can reach.
Prior to MiCA, the legal position varied sharply across member states. A VASP registered in Lithuania operated under rules materially different from one licensed by the MFSA in Malta. MiCA harmonises the authorisation layer across the EU and EEA. The practical consequence for recovery is significant: a CASP authorised under MiCA in any member state now holds regulated records in a standardised form. The disclosure target is more predictable.
In our cross-border practice, we have seen cases stall not because the exchange refused to cooperate, but because the applicant did not establish which forum had jurisdiction over a CASP authorised in a different member state than either the victim or the perpetrator. Getting the forum right is as important as drafting the order.
Which Forum Issues the Order?
The forum question is the critical structural decision in any EU disclosure application, and the answer turns on where the CASP is authorised, where the claimant is domiciled, and where the cause of action arose – in that order of practical importance. MiCA does not create a unified EU court system. Disclosure orders remain a matter of national civil procedure.
For a CASP authorised in Lithuania under the Bank of Lithuania's transitional CASP authorisation, a Lithuanian court is the natural forum for compelled disclosure. For a CASP authorised by the MFSA in Malta, Maltese civil proceedings apply. The result is that a fraud victim may need to pursue parallel proceedings – a disclosure order in the exchange's home member state, and a freezing order in the jurisdiction where assets are held or where the defendant has attachable property.
England and Wales is not an EU member state, but it remains a dominant forum for crypto-asset disclosure. The English High Court has developed a mature practice of granting Norwich Pharmacal and Bankers Trust disclosure orders against exchanges, including those operating outside England, where there is a jurisdictional hook. English courts have confirmed that crypto assets are property capable of being traced and frozen – a principle established in AA v Persons Unknown [2019] and reinforced in subsequent decisions. Many EU-domiciled claimants use English proceedings alongside EU domestic steps precisely because of this developed jurisprudence.
The DIFC Courts in Dubai have also demonstrated a willingness to issue freezing and disclosure relief in support of foreign proceedings, as illustrated by recent matters in that forum. Where assets have moved offshore during the EU recovery process, a multi-forum strategy is often necessary.
For a scoped assessment of which forum best anchors your disclosure application, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the CASP's home member state, your domicile, the location of the assets – change the analysis considerably. Map your options.
Step by Step: How to Obtain an Exchange Disclosure Order
The process moves in five discrete stages, each with its own evidence requirement and its own failure risk. Missing or misordering a stage is the most common reason applications are delayed or denied.
Stage 1 – Preserve the on-chain record. Before filing anything, secure a forensic blockchain trace from a qualified provider. The trace must identify the receiving wallet addresses, the transaction hashes, the timestamps, and the flow of funds across any intermediary addresses. This report is the evidential foundation for every subsequent step. Without it, a court cannot satisfy itself that the target exchange holds relevant records. In our practice, we initiate this engagement in parallel with the legal assessment, not after it.
Stage 2 – Identify the CASP and its regulatory home. ESMA maintains the MiCA register of authorised CASPs. Check whether the receiving exchange holds a MiCA CASP authorisation, and if so in which member state. That entry determines the primary forum. If the exchange is not MiCA-authorised – because it is based outside the EU or operates without licence – the disclosure strategy shifts to international cooperation or to a third-country court with jurisdiction over the exchange's operations.
Stage 3 – Issue proceedings and apply for the disclosure order. In most EU member states, the application is made on notice to the respondent CASP unless there is a risk of tipping off or asset dissipation. The application must demonstrate: (a) a good arguable case of fraud or misappropriation; (b) that the CASP likely holds identifying or transaction records; and (c) that disclosure is necessary and proportionate. The applicant typically also files a data-protection justification, because GDPR applies across the EU and a court order is the standard legal basis for overriding the exchange's data-protection obligations to its customer.
Stage 4 – Obtain and serve the order; request compliance. Once granted, the order is served on the CASP. The CASP's response timeline varies by member state and by the specificity of the order. Where the CASP is cooperative – as authorised entities generally are when presented with a valid court order – records arrive within days. Where the CASP contests the order, enforcement proceedings follow.
Stage 5 – Use the disclosed information to apply for freezing relief. The identity and account data obtained under the disclosure order enables a named defendant application for a worldwide freezing order (an injunction preventing a defendant from disposing of assets globally) or a domestic asset freeze. In the EU context, the European Account Preservation Order (EAPO) regime may also be available to freeze bank accounts across member states. Where assets remain on the exchange, a parallel application for an account freeze is made simultaneously with or immediately after the disclosure application.
What Evidence Does the Court Require?
Courts issuing disclosure orders against exchanges require more than a narrative of loss. The evidence bundle typically includes a witness statement from the claimant setting out the facts of the misappropriation, the professional forensic trace report linking the stolen assets to addresses associated with the target exchange, any available communications evidencing the fraud, and a statement of the claimant's legal interest in the assets. The forensic report is the critical document. A court will not make an order requiring a regulated entity to breach its customer confidentiality obligations on the basis of an unverified account.
The GDPR intersection is a live issue in every EU application. A court order is a lawful basis for processing under GDPR, and a well-drafted application will address this explicitly. Some practitioners overlook it. An exchange's legal team will raise it. Addressing it in the application itself avoids delay.
A common mistake at this stage is submitting a forensic report that traces funds only to the deposit address, without demonstrating that the deposit address is associated with a specific CASP's on-chain infrastructure. Exchanges use clustering and proprietary deposit-address assignment. The forensic report must close that gap explicitly, or the court cannot satisfy itself that the respondent CASP holds the relevant records.
How Does MiCA Change the Disclosure Calculus?
MiCA changes the disclosure environment in three concrete ways. First, CASPs authorised under MiCA are subject to AML and record-keeping obligations that make the records a disclosure order seeks more likely to exist and more likely to be retained. A pre-MiCA VASP with minimal AML controls might genuinely lack subscriber KYC records. A MiCA-authorised CASP operating under ESMA oversight does not have that defence.
Second, MiCA's passporting mechanism means a CASP authorised in one member state may serve customers across the entire EU. That increases the probability that a fraud victim in, say, France was victimised through a CASP authorised in Lithuania or Malta. The victim's local court may not be the exchange's home court. A misalignment between the victim's jurisdiction and the exchange's regulatory home is now the norm, not the exception.
Third, MiCA imposes conduct and market-integrity obligations on CASPs. A CASP that knowingly or negligently facilitates fraud by failing to perform adequate KYC may face regulatory exposure in addition to the civil proceedings. That regulatory lever – the ability to alert the CASP's home regulator (ESMA or the relevant NCA) to a pattern of behaviour – is a negotiating tool in disclosure negotiations that did not exist under the prior regime.
In a recent matter, we acted for a payments company that traced misappropriated stablecoins through two CASPs authorised in different EU member states. We filed parallel disclosure applications in both home member states and coordinated with allied counsel in the relevant jurisdictions to synchronise the filing timeline. The disclosed records identified a single controlling party. Freezing relief was sought in a leading common-law forum, and the balance was preserved before the defendant could consolidate the assets offshore.
Cross-Border Complications: When Assets Move Outside the EU
Misappropriated crypto assets rarely stay within the EU. Perpetrators route funds through chains of wallets, bridge to different networks, convert stablecoins into privacy coins, or withdraw to exchanges in jurisdictions outside MiCA's reach. Each of these moves creates a fork in the recovery strategy.
Where assets move to a VASP in the United Kingdom, the FCA's registration regime means the receiving VASP is a regulated entity susceptible to English court disclosure orders. The English High Court's experience with Norwich Pharmacal and Bankers Trust orders against crypto exchanges is the most developed in the world. For EU claimants, this means that even if assets leave the EU, the English forum remains accessible and is often faster and more reliable than the equivalent domestic procedure in many EU member states.
Where assets move to a VASP in Dubai, the DIFC Courts have shown willingness to issue freezing and disclosure relief, and VARA-licensed entities are subject to Dubai's regulatory oversight. Where assets reach Singapore, MAS-licensed digital payment token service providers are regulated entities. In each case, allied counsel in the relevant jurisdiction must be engaged. OBOLUS coordinates these multi-forum strategies from a single point of instruction.
The Travel Rule – the FATF obligation requiring originator and beneficiary information to accompany a virtual asset transfer – creates a parallel data trail. Under MiCA, CASPs must comply with the Travel Rule. That means transfer data exists at both the sending and receiving CASP. A disclosure order addressed to the sending CASP may therefore yield beneficiary data even before the receiving CASP is identified. We use this two-sided data architecture in every EU recovery matter.
If a recovery clock is running and assets may already have left the EU, reach our disputes desk now at info@oboluslaw.com or via t.me/oboluslaw. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Map your options.
Decision Matrix: Which Profile Fits Which Approach?
Not every victim of crypto fraud is in the same legal position. The right approach depends on the claimant's domicile, the receiving CASP's location and authorisation status, the size of the loss, and how much time has elapsed since the misappropriation.
Profile A – EU-domiciled claimant, MiCA-authorised CASP, recent loss. This is the clearest case for a domestic EU disclosure application. File in the CASP's home member state. The regulatory record is recent and complete. The GDPR basis is an order of the court. Parallel stablecoin freeze requests to Tether or Circle (which hold contract-level blacklist authority over USDT and USDC respectively) should be filed simultaneously if the stolen assets include those tokens. Timeline from instruction to order: typically a matter of days to a few weeks, depending on the member state's court practice.
Profile B – EU-domiciled claimant, CASP not MiCA-authorised (offshore or unlicensed). The domestic EU route does not reach an unlicensed CASP operating offshore. The strategy shifts to the exchange's actual jurisdiction of operation (which may be different from its stated jurisdiction of incorporation), to an English Norwich Pharmacal order against the exchange's payment-processing bank, or to a US subpoena where the exchange has US users. This profile requires multi-forum analysis before any application is filed.
Profile C – Non-EU claimant, assets passed through a MiCA-authorised CASP. A claimant domiciled outside the EU can still apply to a member-state court for a disclosure order against an EU-authorised CASP, provided the claimant can establish the court's jurisdiction. Jurisdictional hooks include the CASP's home member state, the place of performance of any contract, and – in some member states – the place where damage was suffered. Allied counsel in the relevant member state is essential. English proceedings run in parallel are often the more efficient route for non-EU claimants.
Profile D – Large institutional loss, multiple CASPs, cross-chain movement. This profile requires a coordinated multi-forum strategy from day one. An on-chain forensic team, a lead forum for the primary freezing order, and parallel disclosure applications in each CASP's home jurisdiction are running simultaneously. The cost is higher, but so is the proportion of assets that can be preserved. A seven-figure or eight-figure balance justifies the investment. Timeline is compressed by the complexity; expect the first freezing relief within days of instruction if the forensic trace is already complete.
A Common Assumption: "Once Funds Leave the Wallet, Nothing Can Be Done"
This is the most damaging myth in digital-asset recovery, and it costs victims real money. The assumption is wrong for several reasons.
First, blockchain is an immutable ledger. Every transfer is permanently recorded. Unlike a wire transfer that flows through correspondent banks and is then obfuscated, an on-chain transfer leaves a forensically recoverable trace that does not degrade over time. The evidence gets harder to act on quickly, but it does not disappear.
Second, MiCA-authorised CASPs are regulated entities with mandatory AML and record-keeping obligations. They cannot simply delete records because a court proceeding is commenced. A CASP that does so faces regulatory consequences from its home NCA or from ESMA.
Third, stablecoin issuers retain blacklist authority over tokens. Tether (USDT) and Circle (USDC) can freeze specific token balances at the contract level, and they act on law-enforcement requests and court orders. Where stolen assets include stablecoins, a parallel freeze request to the issuer – made at the same time as the court application – can freeze the balance even before a court order is served.
The myth persists because victims who act too slowly genuinely do lose the window. But the lesson is speed, not resignation.
Related at OBOLUS
- Disputes & Asset Recovery for Digital-Asset Businesses – how OBOLUS structures cross-border recovery mandates from instruction to enforcement
- Smart Contract Dispute Resolution in Panama – when on-chain obligations are enforced in a civil-law jurisdiction outside the EU
- Tokenised Fund Structuring: the Disputes Angle – how fund structure decisions affect recovery options when token assets are misappropriated
FAQ
Can stolen crypto actually be recovered?
Recovery is possible and happens regularly, but it is not automatic. Success depends on how quickly legal action is initiated, the quality of the forensic trace, the jurisdiction where the receiving exchange is regulated, and whether stablecoin issuers can act on freeze requests. Acting within hours of discovery – rather than days – materially improves the probability of preserving assets before they are moved further or converted into harder-to-trace instruments.
How fast must I act after a digital-asset theft?
Immediately. Recovery windows close in hours. The on-chain forensic trace should be commissioned on the same day as the misappropriation is discovered. Legal proceedings – including an application to a stablecoin issuer for a contract-level freeze – can be initiated in parallel. Waiting for a police report or an insurance notification before engaging counsel is the single most common reason recoveries fail. Regulators and courts understand the urgency; the process is designed for speed when counsel is instructed promptly.
Can a court freeze assets held on an exchange?
Yes. Courts in leading common-law forums – including England and Wales, Singapore, and Hong Kong – have granted freezing injunctions over assets held in exchange accounts, directing the exchange not to release funds pending resolution. Under the EU regime, domestic courts can issue equivalent interim relief. The EAPO (European Account Preservation Order) also provides a mechanism to freeze bank accounts across EU member states. Where assets are on a MiCA-authorised CASP, the exchange's regulated status makes court-ordered compliance more reliable.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums, and we move for disclosure and freezing relief while the trail is live. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Glen Sorensen, Disputes & Recovery Analyst – cross-border crypto-asset recovery and exchange disclosure strategy under MiCA and in common-law forums.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.