Exchange disclosure order in Liechtenstein

A business discovers that digital assets have been misappropriated and traces the funds to an exchange operating under Liechtenstein's Token and Trusted Technology Service Provider Act – the TVTG, the principal statute governing crypto-asset service providers in the Principality. The immediate legal question is whether a court can compel that exchange to disclose subscriber and transaction data before the assets move again. In Liechtenstein, the answer is yes – but the mechanism, the timing and the cross-border architecture matter enormously. This guide sets out each step, the applicable legal regime and the decision points that determine whether a disclosure order translates into frozen funds or a dead end.

An exchange disclosure order is a court directive compelling a regulated token service provider (TSP) or exchange to produce account-holder identity, wallet addresses and transaction records relating to a defined set of assets. Liechtenstein's courts have jurisdiction to grant such relief over TSPs authorised under the TVTG, and they apply the Principality's civil procedural rules alongside well-developed evidence-preservation principles. The practical effect is that a victim creditor can obtain subscriber data and freeze an outbound path – but only if the application is made before the assets are moved off-platform.

The sections below walk through the legal basis, the procedural steps, the cross-border considerations and the common errors that destroy a recovery case at its first hour.

Why does Liechtenstein matter for digital-asset recovery?

Liechtenstein is one of the few jurisdictions worldwide that enacted a comprehensive token-economy statute before the major EU regulatory cycle caught up. The TVTG created a supervised class of TSPs – exchanges, custodians, token issuers and transfer agents – all of which are registered with the Financial Market Authority Liechtenstein (FMA). That supervision record is directly useful in recovery: a TSP registered with the FMA has a legal address, a compliance officer, AML obligations and an obligation to respond to judicial process. Contrast that with a deregistered or unregulated offshore exchange, where a disclosure application has no domestic defendant to serve.

Liechtenstein is an EEA member, not an EU member, but it adopts significant EU financial-services and AML legislation by agreement. The country's AML regime follows FATF Recommendation 15 on virtual assets, meaning TSPs carry customer-identification obligations that generate the very records a claimant seeks to compel. When an exchange holds KYC files, those files exist because the law required them. A disclosure order does not demand the impossible – it demands delivery of records the exchange is already obliged to hold.

The Principality's small but professional court system has experience with commercial disputes, including cross-border asset-tracing matters. Liechtenstein courts apply civil-law procedure with influences from Swiss and Austrian practice. Applications for urgent evidence-preservation – analogous to a pre-trial disclosure or interim relief measure – are available under Liechtenstein's civil procedural regime. For inbound claimants, this means there is a functioning legal pathway, provided the application is properly framed and executed quickly.

What is the legal basis for an exchange disclosure order in Liechtenstein?

A disclosure order compelling a Liechtenstein TSP to produce subscriber and transaction data rests on two overlapping pillars: the general civil-law right to evidence preservation in pending or prospective proceedings, and the specific AML/KYC record-keeping obligations imposed on TSPs by the TVTG and the applicable AML regime. Together, these create a situation where the exchange is simultaneously a potential defendant to an ancillary order and a repository of evidence it was legally required to create.

Under Liechtenstein civil procedure, a claimant may apply for the preservation of evidence or for interim production of documents where there is a prima facie claim, a risk of evidence loss and proportionality between the relief sought and the disruption caused. In the digital-asset context, the risk of evidence loss is inherent: wallets are pseudonymous, withdrawals are irreversible and exchanges can delist accounts or purge logs. Courts in Liechtenstein assess these factors pragmatically. In our cross-border practice, we have seen that a well-documented application – combining on-chain transaction analysis, a clear chain of custody from victim wallet to exchange deposit address and a concise statement of the claim – is the application that moves fastest.

The TVTG overlay matters here. A TSP authorised under the TVTG is not a third party in the abstract: it is a regulated entity that accepted supervisory obligations as a condition of operating in the Principality. Those obligations include maintaining records of beneficial owners of accounts, transaction histories and the source-of-funds files generated at onboarding. A disclosure application can therefore point the court to concrete categories of documents that exist, are required to exist and are held by a named, addressable entity.

Where the claimant is a foreign business, the application is typically filed in the Liechtenstein court with territorial jurisdiction over the TSP's registered seat. If parallel proceedings are running in another forum – England and Wales, the DIFC Courts, Singapore or another common-law jurisdiction – the Liechtenstein application can be structured as ancillary relief in support of those proceedings, which strengthens both the urgency argument and the proportionality analysis.

To scope a disclosure application before assets move further, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking, the jurisdictional spread of the theft – change the analysis in material ways.

How does the disclosure order process work, step by step?

The process from discovery of misappropriation to service of a disclosure order on a Liechtenstein TSP typically moves through six sequential steps, each of which has its own legal requirement and its own failure mode.

Step 1 – On-chain tracing. Before any application is filed, the victim must produce a professional transaction-tracing report mapping the flow of misappropriated assets from the originating wallet through intermediate addresses to the deposit address at the target exchange. Liechtenstein courts – like most civil-law courts in commercial matters – expect documentary evidence to support a prima facie claim. A bare allegation that funds went to "an exchange" is insufficient. The report must identify specific transaction hashes, amounts and the exchange's deposit wallet. Forensic firms operating in the digital-asset space – including several that OBOLUS coordinates with on a project basis – produce court-ready reports to this standard. Time is the operative constraint: the report must be obtained in hours, not days.

Step 2 – Assessment of jurisdiction and the applicable TSP. The claimant's counsel confirms that the target exchange is in fact a TSP authorised under the TVTG and registered with the FMA. The FMA maintains a public register of authorised entities. If the exchange is not on the FMA register, the TVTG framework does not apply and the application must be redirected to wherever the entity is actually regulated – which may require a parallel multi-forum strategy.

Step 3 – Parallel forum assessment. In virtually every meaningful crypto-theft case, assets do not stay in one jurisdiction. A Liechtenstein-facing disclosure application should be designed alongside any applications in other forums where assets may have been routed or where the perpetrator may have connections. In our practice, we advise clients to map the full asset path before filing anything, because filing in one jurisdiction can accelerate asset movement in another if the perpetrator is monitoring proceedings.

Step 4 – Drafting and filing the application. The application for evidence preservation or interim document production is filed with the competent Liechtenstein court. It sets out: the factual basis (theft, tracing, exchange deposit); the legal basis (civil procedural rules on evidence preservation; TSP record-keeping obligations under the TVTG and AML regime); the documents sought (specifically: account-holder identity, KYC file, transaction records for the identified wallets and any withdrawal addresses registered to the account); and the urgency argument. Where the application is filed ex parte – without notice to the exchange – the urgency and prejudice arguments must be strong enough to justify that approach.

Step 5 – Service and compliance. Once granted, the order is served on the TSP's registered address in Liechtenstein. The TSP's compliance function typically processes a court order within a defined operational window. The exchange is not the adversary at this stage; it is a regulated entity with an obligation to comply. Delays arise when the order is technically deficient, when the exchange requests clarification of scope or when the wallet addresses identified in the order do not match the exchange's internal records. Precision in the order's terms is therefore not a formality – it is the difference between disclosure and a contested compliance dispute.

Step 6 – Transition to freezing relief. The disclosed identity and account data feed the next stage: a freezing order over the assets still held on the exchange, or onward tracing if the assets have already been withdrawn. If the exchange holds assets, a freezing application can be made immediately after disclosure – sometimes on the same day. The goal is to prevent withdrawal before the victim has obtained proprietary or enforcement relief in the substantive proceedings.

How does a Liechtenstein disclosure order interact with proceedings in other jurisdictions?

Cross-border coordination is not optional in digital-asset recovery. A Liechtenstein TSP may hold the most recent identifiable deposit, but the perpetrator likely operates through entities, wallets and exchanges across multiple jurisdictions. The Liechtenstein disclosure order is a single piece of a multi-part structure, not a standalone solution.

The most common pattern in our cross-border practice is a coordinated application architecture: a worldwide freezing order (WFO) obtained in a primary common-law forum – typically England and Wales, the DIFC Courts or Singapore – combined with jurisdiction-specific disclosure applications wherever the assets are held. England and Wales in particular have well-developed case law on crypto-asset proprietary claims and disclosure orders against exchanges, including the recognized ability to grant Norwich Pharmacal orders (a disclosure mechanism compelling a third party that has become mixed up in wrongdoing to reveal the wrongdoer's identity) and Bankers Trust orders over financial records. The CFAAR (Crypto Fraud and Asset Recovery) network, launched in London in September 2021, has built practitioner coordination capacity across these forums.

Liechtenstein fits into this structure as the jurisdiction of the exchange. The EEA membership and the Principality's treaty relationships facilitate judicial cooperation. Foreign judgments and orders can be recognized and enforced in Liechtenstein through established private international law routes, and Liechtenstein courts will consider the existence of parallel proceedings when assessing the urgency and proportionality of an application filed domestically. A claimant who has obtained a WFO in England and Wales and can present that order to the Liechtenstein court significantly strengthens the domestic application – it demonstrates that a serious forum has already assessed the prima facie claim.

Banking is a further dimension. Liechtenstein's financial sector includes private banks and payment institutions that may hold fiat proceeds linked to a crypto theft – conversion of stolen assets into fiat currency through the exchange, followed by withdrawal to a bank account. A coordinated strategy must address both the on-chain layer (exchange disclosure and crypto freeze) and the off-chain layer (bank account disclosure and fiat freeze). These applications run in parallel, not in sequence.

What are the most common mistakes that destroy a crypto recovery case in Liechtenstein?

Speed failure is the most common and most fatal error. Recovery windows for misappropriated digital assets are measured in hours, not weeks. An exchange holds stolen funds only until the perpetrator decides to withdraw, swap or bridge them onward. Every procedural delay – drafting the application over several days, waiting for the forensic report to be formatted, failing to file ex parte when urgency demands it – narrows the window and, at some point, closes it entirely. We have seen cases where a technically meritorious application arrived after the exchange balance had been emptied; the disclosure still yielded identity information, but the assets were gone.

Precision failure is the second category. A disclosure order that is vague about the wallets, the time window or the categories of documents sought invites a compliance dispute with the exchange. TSPs have compliance teams, not adversarial litigation lawyers; they will comply with a clear order. They will seek clarification – or their own legal advice – on an ambiguous one. That clarification process costs days. Write the order to be unambiguous.

Forum failure is the third category. Filing only in Liechtenstein when assets have already been partly withdrawn to a second exchange in a different jurisdiction is a structural mistake. The Liechtenstein disclosure may identify the perpetrator, but if no contemporaneous application is made in the forum holding the next wallet, the information arrives too late to freeze anything. A full asset path mapping – conducted before the first application is filed – is not an optional preliminary; it is the foundation of the strategy.

A fourth error is underestimating the AML angle. If the stolen assets passed through the TSP and the perpetrator submitted false KYC, there may be an AML regulatory complaint to be filed with the FMA in parallel. This does not replace the civil proceedings, but it creates a supervisory pressure on the exchange that can accelerate compliance with a disclosure order and, in some cases, triggers the exchange's own internal freeze pending regulatory review.

A coordinated disclosure and freeze in practice

In a recent matter, a digital-asset fund discovered that a counterparty had transferred a significant portfolio of tokens – a mid-seven-figure balance – to a Liechtenstein-registered TSP shortly after entering a disputed settlement agreement. The fund engaged us within twenty-four hours of the discovery. We coordinated a forensic tracing exercise overnight, confirmed the TSP's FMA registration, filed for evidence preservation in the Liechtenstein court and simultaneously applied to a leading common-law forum for a worldwide freezing order in support of arbitral proceedings. The Liechtenstein court granted the disclosure order within the initial application period; the TSP complied promptly, confirming the account-holder identity and the full transaction history. The WFO was served on the TSP before the account holder attempted withdrawal. Assets remain subject to the order pending resolution of the underlying claim. The matter illustrates the operational reality: speed, precision and cross-forum coordination are the determinants of outcome, not the strength of the underlying claim alone.

Which profile of claimant should pursue a Liechtenstein disclosure order?

Not every victim of crypto misappropriation should lead with a Liechtenstein application. The decision turns on where the assets are, who the regulated entity is and what the recovery goal requires.

Profile A – Theft traced directly to a TVTG-registered TSP. If the on-chain trace ends at an exchange that is identifiable on the FMA register, a Liechtenstein disclosure application is the primary instrument. File immediately, with a forensic report in hand. Timeline: the evidence-preservation application can be filed within one to two business days of obtaining the trace; court response is a matter of days in urgent cases. Primary risk: assets move before the order is served.

Profile B – Funds passed through Liechtenstein but have moved onward. Here the Liechtenstein disclosure is still valuable – it identifies the account holder and may reveal the next destination wallet or bank account – but it is no longer a freezing tool on its own. File in Liechtenstein for identity disclosure, simultaneously file in the next jurisdiction where assets appear to be held. Timeline is extended because two or more forum applications run in parallel. Primary risk: the perpetrator monitors proceedings and accelerates asset dispersal.

Profile C – Assets are on a Liechtenstein TSP but the primary proceedings are offshore. Obtain the primary WFO or equivalent order in the main forum first, then present that order to the Liechtenstein court to support the domestic application. The presence of a foreign order materially strengthens the proportionality and urgency arguments. Timeline: dependent on the primary forum's speed; Liechtenstein then operates on a compressed ancillary basis. Primary risk: delay in the primary forum bleeds time before the domestic application can be made.

Profile D – Claimant is uncertain whether the exchange is TVTG-registered. Verify the FMA register first. If the entity is not registered, the TVTG mechanism does not apply and a different route – potentially a police referral, an Interpol notice or a claim in the entity's actual jurisdiction of registration – is required. Filing in Liechtenstein against an unregistered entity wastes critical time.

If a recovery clock is running, reach our disputes desk now at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back to effective relief.

Is it true that nothing can be done once funds leave a wallet?

A common assumption among victims – and even among some corporate counsel who have not worked in this area – is that the pseudonymous nature of blockchain transactions makes post-theft recovery structurally impossible. That assumption is wrong, and acting on it is one of the most expensive decisions a victim can make.

The blockchain is a permanent, public ledger. Every transaction is recorded and traceable. Professional forensic analysis can follow a stolen asset through dozens of intermediate wallets, cross-chain bridges and exchange deposits with a level of granularity that traditional financial forensics cannot match. The pseudonymous layer – the wallet address – dissolves the moment the asset reaches a regulated exchange that has KYC obligations, because that exchange holds the identity behind the address. A disclosure order is precisely the tool that converts a pseudonymous transaction record into a named defendant.

The caveat is timing. Traceability does not expire, but the ability to freeze an asset does. Once an exchange balance is withdrawn, the forensic trail continues – but the next step requires a new disclosure application in a new forum. Each step adds time; each step gives the perpetrator more opportunity to further dissipate the assets. The practical implication is not that recovery is impossible after early movement, but that each hour of delay increases the cost, the complexity and the uncertainty of the outcome. "Nothing can be done" is not a legal analysis. It is the conclusion that follows from waiting too long to act.

In our cross-border practice, we regularly advise clients who come to us after a delay – sometimes significant – and have successfully traced and frozen assets in cases where the initial belief was that the trail had gone cold. The trail rarely goes cold permanently; it goes cold for a claimant who lacks the tools or the forum coverage to follow it.

Related at OBOLUS

• Disputes & Asset Recovery for Digital-Asset Businesses – Full-scope recovery services across 25+ forums, from tracing to enforcement.
• Crypto Fraud and Asset Recovery: Practical Lessons for Boards – Board-level analysis of recovery strategy, sequencing and common failure points.
• Token Sale Agreement Drafting: Practical Lessons for Boards – Structuring and risk-allocation guidance for token transactions before disputes arise.

FAQ

Can stolen crypto actually be recovered?

Yes – recovery is possible and, in our cross-border practice, we have secured it across multiple forums. The blockchain's permanent public record means the asset trail persists. Once stolen funds reach a regulated exchange with KYC obligations, a disclosure order can convert a pseudonymous wallet address into a named account holder. Subsequent freezing relief can prevent withdrawal while the substantive claim proceeds. Success depends on acting quickly and coordinating applications across every jurisdiction where assets appear.

How fast must I act after a digital-asset theft?

Act within hours, not days. Exchange balances can be withdrawn at any moment; once cleared, the assets move to a new wallet and a new jurisdiction and the freeze opportunity is lost. The critical path is: secure a professional on-chain tracing report, confirm the exchange's regulatory status, instruct counsel and file for evidence preservation and, where applicable, freezing relief simultaneously. Every hour of delay narrows the window. Waiting for internal approval processes to complete before engaging external counsel is a common and costly error.

Can a court freeze assets held on an exchange?

Yes. Courts in Liechtenstein and in leading common-law forums – including England and Wales, the DIFC Courts and Singapore – have granted freezing orders over assets held on regulated exchanges. A worldwide freezing order obtained in a primary forum can be served on a Liechtenstein TSP as an ancillary measure. Domestically, Liechtenstein civil procedure permits interim relief measures over identifiable assets pending the outcome of substantive proceedings, provided the prima facie claim and urgency threshold are met.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums – and, increasingly, across civil-law jurisdictions with active crypto-asset registrations such as Liechtenstein. We move for freezing relief and exchange disclosure while the trail is live. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.

By Glen Sorensen, Disputes & Recovery Analyst – specialising in on-chain asset tracing, exchange disclosure applications and multi-forum freezing relief for corporate victims of digital-asset fraud.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.