Exchange Disclosure Order in Gibraltar: A Step-by-step Legal Guide

When digital assets disappear – whether through exchange compromise, internal fraud or misappropriation – the legal clock starts immediately. A victim business in Gibraltar or using a Gibraltar-regulated exchange can apply for an exchange disclosure order (a court order compelling an exchange to reveal account-holder identity and transaction data) within days of the loss. Under Gibraltar's financial services and civil procedure regimes, courts have the tools to compel disclosure, freeze assets and preserve evidence before the on-chain trail goes cold. This guide sets out, step by step, how the process works, what it requires and where it connects to the wider cross-border recovery map.

Getting the order right at the start determines whether the money comes back. Gibraltar's courts operate within a common-law tradition inherited from England and Wales. That means the full arsenal of disclosure and freezing relief is available – including orders directed at exchanges holding the defendant's assets. The Gibraltar Financial Services Commission (GFSC) regulates distributed ledger technology (DLT) providers and exchanges operating under Gibraltar's DLT licensing regime, creating a defined set of regulated entities that courts can reach with compulsory process. One roadmap closes this guide: what to have ready, what the tribunal expects and when to escalate across borders.

Why Gibraltar Matters for Digital-Asset Recovery

Gibraltar is one of the few jurisdictions in the world to have regulated DLT-based businesses at the activity level since 2018, making its exchange population a defined, supervised class of entities subject to court process. The GFSC's DLT Provider framework requires licensed exchanges to maintain know-your-customer (KYC) records, transaction logs and beneficial-owner data – precisely the information a claimant needs to identify a bad actor and trace misappropriated funds. Because Gibraltar's legal system tracks English common law closely, the principles that underpin disclosure and freezing relief in England and Wales apply in substance, meaning practice experience from the leading English-law forums translates directly.

For cross-border operators, this matters in a specific way. A business headquartered outside Gibraltar but whose counterparty uses a Gibraltar-regulated exchange, or whose own exchange licence sits under the GFSC, can anchor a disclosure application in Gibraltar even if the underlying fraud originated elsewhere. We regularly advise clients who discover that the destination wallet – or the exchange where their funds were deposited after misappropriation – sits within the GFSC's supervisory perimeter. That anchor point is the starting position for the entire recovery strategy.

CTA #1 — Early Assessment

The sooner the legal strategy is mapped, the wider the recovery options. The process described in this guide assumes the trail is still live. Your entity structure, the exchange's jurisdiction and the forensic picture each change the analysis materially. Map your options with OBOLUS now before the window narrows.

What Is an Exchange Disclosure Order and What Does It Compel?

An exchange disclosure order is a court order directed at an exchange as a third party, compelling it to produce specified documents and data about a named or described account – identity records, wallet addresses, transaction histories, IP logs and withdrawal records.

The order does not require the exchange to be a defendant or wrongdoer. In common-law jurisdictions, the disclosure obligation rests on the exchange as a third party that, innocently or otherwise, holds information relevant to the claimant's cause of action. In England and Wales, this mechanism is well established under the principles in Norwich Pharmacal and Bankers Trust; Gibraltar courts apply equivalent principles. The practical result is that a claimant can go to court against the exchange – not to sue it, but to extract the identity and transaction data needed to pursue the actual wrongdoer.

The order typically covers: full KYC documentation for the account holder; all wallet addresses associated with the account; deposit and withdrawal records for a specified date range; IP addresses and device identifiers used to access the account; and any email or messaging records held by the exchange. With that package, a professional forensic analysis can map the subsequent movement of funds across the chain and into any secondary exchange or wallet.

Step One: Preserve the On-chain Evidence

Before any court application, the evidentiary foundation must be assembled – without it, no Gibraltar court will grant emergency relief. This step happens in parallel with the legal team's drafting, not after it.

The claimant or its forensic partner needs to extract and timestamp: the originating transaction hash or hashes; the destination wallet addresses; all downstream transaction paths visible on the public ledger; any exchange deposit addresses reached by those paths; and the block heights at which each movement occurred. Blockchain records are public but volatile in their practical accessibility – exchanges periodically purge IP logs and internal records, so the clock for the disclosure application runs from the moment of discovery.

In our practice, we work alongside specialist forensic partners who can produce a chain-of-custody report within hours of instruction. That report does two things: it maps the on-chain path in a form courts find persuasive, and it identifies which exchange – including any Gibraltar DLT-licensed platform – received the misappropriated assets. The GFSC requires DLT providers to maintain transaction records for defined retention periods, but the practical window in which those records remain practically recoverable via a disclosure order is shorter than the legal minimum.

Never wait for the exchange to respond voluntarily before applying for a court order. Exchanges facing a voluntary request without legal compulsion often delay, transfer data jurisdiction or receive a competing legal notice from the account holder. A court order removes the exchange's discretion and imposes personal liability for non-compliance.

Step Two: Establish the Legal Basis and Draft the Application

A disclosure application in Gibraltar must satisfy the court that the applicant has a good arguable case that a wrong was committed, that the respondent – here the exchange – holds relevant information, and that it is necessary and just to order disclosure in the circumstances.

Under Gibraltar's civil procedure regime, the application is made to the Gibraltar Supreme Court. The applicant files a claim form or originating summons supported by: a witness statement from the victim business setting out the facts of the loss; the forensic report evidencing the on-chain path to the exchange; evidence that the exchange holds or held the assets or the account data sought; and – critically – a draft order in terms the court can approve without amendment. Gibraltar courts in our experience apply the same standard of precision to disclosure orders as their English counterparts: vague or over-broad drafts are refused or returned for revision, adding delay.

Where the application is made without notice to the respondent (an ex parte application), the applicant must satisfy a duty of full and frank disclosure to the court. That means volunteering any fact or argument the respondent would raise if present – including any prior voluntary approach to the exchange, any limitation issue and any competing claim. Failure on this duty can lead to the order being set aside and an adverse costs order against the claimant.

Step Three: Apply for a Freezing Order in Parallel

A disclosure order alone does not stop the money moving. For a complete first-day strategy, the disclosure application must be accompanied or followed immediately by a freezing order directed at the assets themselves.

Under Gibraltar's civil procedure framework, a Mareva-style injunction (a freezing order that restrains a defendant from dealing with identified assets) is available where the claimant shows a good arguable case on the merits, a real risk of dissipation and, on balance, that the injunctive relief is just. Because the defendant in a crypto fraud case is often unidentified at the point of application, Gibraltar courts – following the English approach in cases such as AA v Persons Unknown [2019] – can grant relief against persons unknown, with the order served on the exchange as the entity holding or controlling the asset.

In practice, the freezing order and the disclosure order work together: the freeze stops movement while the disclosure order produces the identity data needed to amend the claim against a named defendant. The two applications are heard together, typically on the same day if the matter is presented urgently. Timing a dual application requires the legal team to have both sets of evidence and both draft orders ready before the application is filed.

In a recent matter, a payments business discovered that a seven-figure stablecoin balance had been moved to a Gibraltar-regulated exchange through a series of rapid wallet hops. We filed a dual application – disclosure and freezing relief – within two working days of instruction. The court granted an interim freeze on the exchange account and ordered production of the full KYC file. The forensic analysis that followed identified the account holder, and the matter settled before the return date.

Step Four: Serve the Order and Enforce Compliance

Once granted, the order must be served on the exchange in strict accordance with its terms and with any service requirements in the Gibraltar Supreme Court rules.

Most GFSC-licensed exchanges are registered entities with a defined registered office in Gibraltar. Personal service or service at the registered office on the compliance officer is standard. The order will specify a return date – the hearing at which the respondent can challenge the order – and a production deadline for the disclosed documents. Compliance periods under interim disclosure orders in Gibraltar are typically measured in business days, not weeks, given the time-sensitive nature of digital-asset recovery.

Non-compliance with a court order is contempt of court. A Gibraltar exchange that receives a properly served disclosure order and fails to comply exposes its officers to personal contempt proceedings, including financial penalties. In our experience, GFSC-regulated entities take that exposure seriously. Compliance rates with properly drafted and served orders are high – the operative risk is a poorly drafted order that gives the exchange a procedural basis to contest before the return date.

Step Five: Cross-border Escalation When Assets Have Moved On

A Gibraltar disclosure order covers the Gibraltar-regulated exchange. When on-chain tracing shows that funds moved from the Gibraltar exchange to a wallet or exchange in another jurisdiction, the recovery strategy must escalate into that second forum.

This is the structural reality of crypto-asset recovery: misappropriated funds rarely stay in a single jurisdiction. A layering sequence might route assets from a Gibraltar exchange to a Cayman-based fund, through a self-custodied wallet to a Singapore-regulated platform, and then into a stablecoin held on a centralised issuer subject to US OFAC oversight. Each leg of that journey requires a legal instrument appropriate to its forum. England and Wales remains the leading forum for worldwide freezing orders and multi-jurisdictional disclosure; the DIFC Courts in Dubai have issued worldwide freezing orders in support of foreign proceedings; Singapore courts have granted proprietary injunctions over digital assets. The CFAAR (Crypto Fraud and Asset Recovery) network, launched in London in September 2021, connects practitioners across these forums to coordinate parallel applications.

Where stablecoin issuers are involved, a parallel track runs alongside the court proceedings. Tether and Circle hold contract-level freeze authority over USDT and USDC respectively. Both issuers generally act on a law-enforcement case reference or a court order. Coordinating the court timeline with an issuer freeze request – so that the legal instrument arrives while the issuer's compliance desk can still act – requires a tightly sequenced strategy that encompasses the Gibraltar proceeding, any parallel forum and the issuer's own internal process.

For clients operating across the Gulf, we coordinate with allied counsel in the relevant jurisdiction to layer DIFC or ADGM applications alongside the Gibraltar proceeding where assets have a UAE connection. For EU-connected businesses, the MiCA regime's travel-rule and KYC obligations on CASPs (crypto-asset service providers) under ESMA oversight provide a parallel regulatory lever – a complaint to the relevant national competent authority can compel production through the supervisory route while the court track runs.

CTA #2 — For the Stalled or Multi-jurisdictional Case

If a prior application stalled or assets have already moved to a second exchange, the cross-border strategy requires immediate re-mapping. A second analysis of the on-chain record and the jurisdictional anchors can surface the route forward. Contact OBOLUS to pressure-test your recovery position before the next window closes.

What Are the Most Common Mistakes That Undermine Recovery?

The most damaging mistakes in Gibraltar exchange disclosure applications are procedural, not factual – and most are avoidable.

Approaching the exchange without a court order before filing. This telegraphs the application to the account holder through the exchange's own notification obligations and can trigger asset movement hours before the order is served. The correct sequence is: preserve evidence, draft the application, file and obtain the order, then serve – in that order, without voluntary contact in between.

Filing a disclosure application without a simultaneous or same-day freezing application. A disclosure order tells you where the money is. A freezing order stops it moving. Both are needed on day one.

Failing the duty of full and frank disclosure on an ex parte application. Courts take this seriously. An order obtained by omitting a material fact can be discharged at the return date, and the costs consequences are severe. The applicant's witness statement must be complete – including any fact that cuts against the application.

Leaving the forensic chain-of-custody report to a narrative summary rather than a structured technical exhibit. Gibraltar courts in our experience expect the on-chain evidence to be presented in a form the judge can read without specialist knowledge: a clear transaction map with block references, wallet labels and asset values, produced by a named forensic specialist with an explanatory declaration.

Waiting too long. Recovery windows for misappropriated digital assets are measured in hours, not weeks. Each day between discovery and application is a day in which the defendant can move assets to a jurisdiction with fewer recovery tools, convert them to a non-freezable asset class or withdraw to a hardware wallet beyond the reach of any exchange order.

Decision Matrix: Which Operator Profile Should Prioritise Gibraltar?

Not every recovery matter belongs in Gibraltar. The following profiles identify when Gibraltar is the primary forum and when it is one layer of a multi-forum strategy.

Profile A – funds deposited on a GFSC-licensed exchange. Gibraltar is the primary forum. The exchange is a regulated entity with defined KYC obligations. The disclosure order application is straightforward in its target and in the registry of the respondent. The Gibraltar Supreme Court is the first-choice court. Timeline for interim relief: measured in days from instruction, not weeks.

Profile B – Gibraltar is the exchange of origin but funds have already moved on. Gibraltar remains the first forum for the originating disclosure – the KYC file from the Gibraltar exchange identifies the account holder and the next wallet. Parallel proceedings in England and Wales, Singapore or the DIFC are layered on once identity is established. The Gibraltar application runs first; the cross-border applications follow within days. Timeline: the multi-forum track is inherently longer, but the Gibraltar leg sets the foundation.

Profile C – the exchange has no Gibraltar presence but the claimant's business is Gibraltar-incorporated. Gibraltar is not the primary recovery forum. The claimant should consider the jurisdiction where the exchange holds its licence or maintains assets. England and Wales is typically the strongest anchor for worldwide relief in this scenario; we engage allied counsel in the relevant jurisdiction to run the primary application.

Profile D – stablecoin assets frozen on a major issuer. The court proceeding – whether in Gibraltar or another forum – runs in parallel with an issuer freeze request. This is a time-competitive dual track. The court order legitimises the issuer request; the issuer freeze preserves the asset while the court identifies the defendant. Sequence is everything.

Self-Assessment Checklist Before You Instruct

Before engaging legal counsel on a Gibraltar exchange disclosure matter, a victim business should be able to answer, or begin assembling answers to, the following questions.

First: do you have the originating transaction hash or hashes? This is the starting point for every forensic analysis. Without it, the on-chain map cannot be built. Second: do you know – or have you identified – the exchange or wallet address that received the funds? If the destination is a GFSC-regulated exchange, the Gibraltar disclosure route is immediately available. Third: when did the loss occur and when did you discover it? The gap between occurrence and discovery affects the risk of asset dissipation and the urgency of the application. Fourth: have you made any voluntary contact with the exchange, the suspected account holder or any intermediary? If so, the legal team needs to know before drafting the application, as the duty of full and frank disclosure requires that information. Fifth: are the assets wholly in one exchange, or has on-chain tracing shown multiple legs? This determines whether a single disclosure order is sufficient or whether a multi-forum strategy is required from day one.

In our cross-border practice, the businesses that recover the most – and the fastest – are those that bring both the transaction data and the answers to these questions to the first call with counsel.

Related at OBOLUS

• Disputes & Asset Recovery for Digital-Asset Businesses – how OBOLUS structures the full recovery strategy from forensics to enforcement
• On-chain Asset Tracing: Practical Lessons for Boards – what boards need to understand before the first call with counsel
• EMI Licence for Crypto Firms: A Cross-jurisdiction Comparison – how the regulatory structure of exchanges affects the recovery map

FAQ

Can stolen crypto actually be recovered?

Yes – in a meaningful number of cases, misappropriated digital assets can be traced, frozen and returned, provided the process starts quickly. The public ledger provides an immutable transaction record that forensic specialists can map to exchange deposit addresses. Where those exchanges are regulated – including under Gibraltar's DLT regime or under MiCA in the EU – courts can compel disclosure of account-holder identity and freeze assets before withdrawal. No outcome can be guaranteed, but the legal tools available in common-law forums are well developed and actively used.

How fast must I act after a digital-asset theft?

Immediately. Recovery windows are measured in hours from discovery, not days. On-chain funds can be moved to a secondary exchange, converted and withdrawn within a single session. Every hour between discovery and legal instruction is an hour in which the defendant can dissolve the trail. In practice, the first call with counsel, the commissioning of a forensic report and the drafting of a disclosure application should happen within the first twenty-four hours of confirmed loss wherever possible.

Can a court freeze assets held on an exchange?

Yes. Gibraltar courts – applying common-law principles consistent with English practice – can grant a freezing injunction directed at assets held on an exchange, including where the defendant is initially unidentified. The exchange is served as the entity holding or controlling the assets. A parallel disclosure order extracts the account-holder identity needed to name a defendant. Both orders can be obtained on the same application, on an ex parte basis where urgency requires, and the exchange's non-compliance exposes its officers to contempt of court.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. In the recovery context, we move for freezing relief and exchange disclosure while the trail is live, working alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.

By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-border digital-asset recovery, exchange disclosure applications and multi-forum freezing strategy in common-law jurisdictions.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.