Key takeaways

• Since 1 July 2026, providing crypto-asset services from Cyprus without MiCA authorisation is unauthorised activity; the transitional period is over.
• CySEC is the competent authority. New applications remain open; the February 2026 deadline applied to firms relying on the transitional regime.
• Minimum capital depends on your service class: EUR 50,000, 125,000 or 150,000, and own funds must also cover a quarter of last year's fixed overheads if that is higher.
• The hardest parts of the file are evidence, not paperwork: safeguarding of client assets, management body suitability, and shareholder source of wealth.
• One Cyprus authorisation passports the services across the entire EU on notification.

MiCA, the EU Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), replaced the patchwork of national crypto registrations with a single authorisation that works across the Union. For Cyprus that transition is complete: the Article 143(3) transitional period ended on 1 July 2026, and a firm providing crypto-asset services from Cyprus today either holds a CASP authorisation, has an application under assessment after applying in time, or is operating unlawfully.

This guide walks through the authorisation as it actually runs in Cyprus: who needs it, what it costs in capital, what goes in the file, how long it takes, and what changes after the licence arrives. It is written for founders and compliance officers planning an application, and it is deliberately blunt about the parts applicants underestimate. It is not legal advice, and a real application should be prepared with counsel; our role in these projects is the evidence layer, which we describe at the end.

Who Needs CASP Authorisation

Authorisation is required for providing any of the ten crypto-asset services in MiCA Article 3 to clients in the EU as a business: custody and administration of crypto-assets; operating a trading platform; exchanging crypto for funds or for other crypto-assets; executing orders; placing crypto-assets; reception and transmission of orders; advice; portfolio management; and transfer services. If your revenue model touches client crypto in any of those ways, assume you are in scope and work backwards from there.

Two groups regularly get this wrong. Pure software providers whose users self-custody generally fall outside the services list, but the analysis turns on facts, not on what the marketing page says. And non-EU firms serving EU clients cannot rely on reverse solicitation beyond its genuinely narrow meaning: a client who found you through your own promotion was solicited.

Capital: What Each Class Requires

MiCA Article 67 sets prudential safeguards as the higher of a permanent minimum and a quarter of the preceding year's fixed overheads. The permanent minimum depends on the class of services (Annex IV):

Treat the minimum as a floor, not a plan. The fixed-overheads test binds as soon as the business has any real cost base, and CySEC expects the programme of operations to show capital adequacy on projected, not just current, numbers.

What Goes in the Application

The Article 62 application is a business file, not a form. In practice the Cyprus file breaks into five blocks:

• The business: programme of operations, service classes, target clients, three-year financials, and the fee model.
• The people: management body suitability under Article 68 against the joint EBA and ESMA guidelines, covering competence, reputation, time commitment and collective knowledge, plus identity and source-of-wealth evidence for every qualifying shareholder (10% or more).
• The controls: governance arrangements, AML/CFT framework, complaints handling, conflicts, outsourcing, and ICT risk management aligned with DORA.
• The assets: custody policy and proof that clients' crypto-assets and funds are segregated from the firm's own, the single area where supervisors most want evidence rather than narrative.
• The exit: a wind-down plan showing client assets can be returned in an orderly failure.

The blocks that stall applications are the evidence-heavy ones: suitability, source of wealth, and safeguarding. A policy saying client assets are segregated is an assertion; wallet architecture plus on-chain proof that client and proprietary assets never commingle is evidence. That distinction is most of the difference between a smooth review and a long one, and it is the core of our MiCA readiness service.

Process and Timeline in Cyprus

Applications go to CySEC as the Cyprus competent authority. MiCA gives the authority 25 working days to confirm the file is complete and then 40 working days to assess it, but the clock stops whenever questions go back to the applicant, and questions always go back. Realistic planning for a well-prepared file is measured in months, with the applicant's own response speed the biggest variable. Incomplete safeguarding evidence and unresolved suitability questions are the classic clock-stoppers.

Firms that applied by CySEC's 27 February 2026 cut-off under the transitional regime and are still under assessment should treat supervisory correspondence as the priority queue it is. Everyone else applying fresh should assume full scrutiny with no transitional goodwill.

Passporting: Cyprus as the EU Entry Point

A Cyprus CASP authorisation is an EU authorisation. Under Article 65, expanding into other member states is a notification, not a new licence: the firm informs CySEC of the states and services, the information is transmitted to the host authorities, and the firm can provide services cross-border shortly after. For groups choosing a base, that makes the real comparison between member states one of supervisory quality, ecosystem and tax, and Cyprus scores on all three for digital-asset businesses, including the 15% corporate rate and the professional infrastructure that has grown around CySEC-regulated firms. Greece, notably, becomes a notification away.

After Authorisation: The Part Everyone Underestimates

The licence starts obligations rather than ending them: ongoing own-funds coverage, safeguarding that holds every day rather than on application day, incident and complaints records, and supervisory reporting to CySEC. Cyprus has already shown enforcement appetite across the EU's new framework, and the first MiCA fines elsewhere in Europe landed in 2026. The firms that find supervision easy are the ones whose evidence cycle runs continuously: reconciliation, reserve attestation, and segregation proof produced on a cadence rather than reconstructed on demand. That ongoing cycle, not the application, is where most of our MiCA work happens.

MiCA Readiness Checklist

Run this before engaging anyone, including us. It maps the file blocks above to yes/no questions:

• Have you fixed the exact service classes you need, and sized capital against both the Annex IV minimum and a quarter of fixed overheads?
• Can every management body member evidence competence, reputation and time commitment against the EBA/ESMA suitability guidelines?
• Can every 10%+ shareholder document source of wealth, including any crypto-origin wealth with an on-chain trail?
• Does your wallet architecture separate client from proprietary assets, and can you prove it on-chain today?
• Do your books reconcile to the chain at month-end without manual heroics?
• Is there a written wind-down plan that returns client assets in an orderly failure?
• Are AML/CFT, complaints, outsourcing and ICT (DORA) frameworks written AND operating, with records to show it?
• Do you have counsel for the legal drafting and an evidence partner for the on-chain proof?

Anything answered "no" is application work. Anything answered "yes, but we could not show it quickly" is also application work.

How Ondology Labs can help: We are the evidence layer of a MiCA application, working alongside your legal counsel: gap assessments against the CASP obligations, cryptographic wallet-control verification, on-chain proof of client asset segregation, reserve attestations, Article 68 suitability assessments and shareholder source-of-wealth evidence, plus the ongoing supervisory evidence cycle after authorisation. We are not a law firm and this guide is not legal advice.

Related reading: MiCA's transition window is closing · Crypto reporting obligations in Cyprus · Crypto audit requirements in Cyprus.

Key takeaways

• Cyprus companies file audited financial statements under the Companies Law; holding crypto does not exempt you, it just makes the audit harder.
• The evidence problem is specific: auditors must verify existence, ownership, valuation and completeness of assets no bank can confirm.
• CASPs face a second layer: CySEC supervisory expectations under MiCA on safeguarding and own funds.
• Since 1 January 2026, crypto activity has direct tax consequences in Cyprus: 15% corporate income tax and a flat 8% on crypto disposals under Article 20E.
• Preparation, above all reconciliation of the chain to the ledger, decides whether an audit takes weeks or quarters.

The question we hear most from crypto businesses in Cyprus is some version of "do we actually need an audit?" The short answer is that if you operate through a Cyprus company, you almost certainly do, because Cyprus requires it of companies generally. The longer answer, the one that matters for planning, is about which layer of requirements applies to you and what evidence your auditor will need that a traditional client never has to think about.

The Baseline: Every Cyprus Company Is Audited

Under the Cyprus Companies Law (Cap. 113), companies prepare financial statements under IFRS and have them audited by a licensed statutory auditor. Audited accounts also underpin the corporate tax return. There is a narrow carve-out introduced in recent years allowing the smallest companies (net turnover up to EUR 200,000 and total gross assets up to EUR 500,000) to obtain a review engagement instead of a full audit, but a crypto business that custodies assets, trades, or raises outside capital will rarely sit inside it, and banks, investors and regulators generally expect the audit regardless.

In Cyprus, a statutory audit opinion can only be issued by an audit office licensed by ICPAC, the Institute of Certified Public Accountants of Cyprus. That is why our own audit work is structured as a partnership: the statutory audits we deliver run with CYAUSE Audit Services Ltd, the ICPAC-licensed office that issues the opinion, while Ondology Labs produces the on-chain evidence the opinion rests on.

Why Crypto Makes the Audit Hard

Audit standards ask the same questions of every material asset: does it exist, does the company own and control it, is it valued correctly, and is the record complete? For a bank balance, one confirmation letter answers all four. For crypto there is no bank to write to, so each assertion needs its own evidence:

• Existence: balances read directly from the chain at the reporting date, not from a screenshot of a wallet interface or an exchange dashboard.
• Ownership and control: cryptographic proof that the company controls the claimed addresses, typically a signed message or a microtransaction from each wallet, covering the actual signing arrangements including multi-sig and custodial setups.
• Valuation: a defensible fair value at the reporting date from documented price sources, with an accounting policy that deals with the awkward fact that IFRS treats most crypto holdings as intangible assets (IAS 38) or, for broker-traders, inventory (IAS 2).
• Completeness: confidence that the wallets presented are all the wallets, which is where forensic techniques such as tracing flows out of known addresses earn their place in an audit file.

Most stalled crypto audits stall on the last point plus reconciliation: the on-chain activity does not agree with the accounting ledger, and nobody can explain the difference. That is a bookkeeping problem, not an audit problem, and it is fixable before the audit starts with transaction reconciliation.

Requirements by Entity Type

The Tax Layer Nobody Should Ignore

From 1 January 2026, Cyprus taxes gains on the disposal of crypto-assets at a flat 8% under Article 20E of the Income Tax Law, for companies and individuals alike, while the corporate income tax rate rose to 15%. Both changes make the quality of your crypto records a tax matter, not just an audit matter: the 8% applies per disposal, which includes crypto-to-crypto exchanges, so a complete acquisition and disposal history is now the foundation of the return. The full picture, including DAC8 reporting on your users, is in our reference guide to crypto reporting obligations in Cyprus.

What the Audit Actually Involves

A crypto audit engagement in Cyprus typically runs in four stages. Scoping agrees the wallets, exchange accounts, chains and ledgers in scope, and surfaces the accounting-policy questions early. Evidence collection reads balances from the chain at the reporting date and verifies control of each address cryptographically. Reconciliation matches on-chain and exchange activity to the ledger and resolves the breaks. Reporting turns all of it into working papers a statutory auditor can rely on, or, in the full statutory engagement, into the audited financial statements themselves.

Timelines depend almost entirely on the state of the records. A business that reconciles monthly can be audit-ready in weeks. A business handing over three years of unreconciled DeFi activity should expect the preparation to take longer than the audit. Fees follow the same logic, which is why we scope fixed fees only after seeing the wallet count, chains and volumes involved.

If You Already Have an Auditor

Keep them. The most common engagement we run is crypto audit support: your incumbent auditor keeps the engagement and the opinion, and we deliver the specialist digital-asset procedures inside it, from wallet-control verification to reconciliation working papers. Audit firms engage us directly on the same basis for their own crypto clients. Independence rules are respected in both directions: we do not audit records we prepared, and we say so up front when a scoping conversation heads that way.

How to Prepare: The Short Checklist

• Inventory every wallet and exchange account, including dormant ones; completeness questions start here.
• Reconcile on-chain activity to your ledger monthly, not annually.
• Document who can sign for each wallet and how keys are controlled.
• Fix an accounting policy for classification and valuation before year-end, not during the audit.
• Keep acquisition records: dates, amounts and cost basis now drive the Article 20E computation too.

How Ondology Labs can help: We deliver statutory crypto audits with CYAUSE Audit Services, our ICPAC-licensed audit partner, provide crypto audit support to incumbent auditors and their clients, and get records audit-ready through transaction reconciliation. Exchanges and custodians can add proof of reserves attestations. This page is general information, not audit, tax or legal advice for any specific situation.

Related reading: Crypto audits in 2026: the new standard · How to read a proof of reserves report · Crypto reporting obligations in Cyprus.

We are asked some version of the same question every month. A crypto firm in Cyprus, often newly authorised or midway through an application, wants to know what it actually has to report. The honest answer is that the question needs splitting before it can be answered, because the word "reporting" is doing four separate jobs at once.

A tax report under DAC8 goes to the Cyprus Tax Department and describes your users. Regulatory reporting goes to CySEC and describes your firm. A suspicious transaction report goes to MOKAS and describes one customer's behaviour, urgently. Your own tax return describes your own income. Different data, different owners, different deadlines, and very different consequences for getting each one wrong.

All four moved in 2026, which is why so much of the guidance still circulating is wrong. Cyprus transposed DAC8 in March, backdated to January. The MiCA transitional window closed on 1 July. And a new Article 20E introduced a flat 8% tax on crypto disposals from 1 January, ending years of the island being described as a place where crypto gains are simply untaxed.

This is a map of all four as they stand in September 2026. It is written for compliance officers, finance leads and the boards that sign off on what they produce. It is not tax or legal advice, and where a position is genuinely unsettled we say so rather than presenting one reading as settled law.

The Four Regimes at a Glance

If you take one thing from this page, take this table. Most of the confusion we see resolves the moment someone sees the four obligations side by side and understands that they are not substitutes for one another.

Note what the table implies. Only the first regime is triggered by having users, only the second by being licensed, and only the third by seeing something suspicious. The fourth applies to you whether or not you run a crypto business at all. A firm can owe all four, and an individual investor with no business at all can still owe the fourth.

1. DAC8: Reporting Your Users to the Tax Department

DAC8 is the EU's crypto tax transparency regime, and it is the obligation Cyprus firms are least prepared for. Partly because it is new, and partly because its first filing deadline sits far enough away to feel unreal while the data collection behind it is already running.

What Cyprus Did, and When

Cyprus missed the original transposition deadline of 31 December 2025 and passed its implementing law on 27 March 2026, with retroactive effect from 1 January 2026. Retroactive is the word that matters. The late arrival of the law did not move the start of the first reporting year, so obligations run from January 2026 regardless of when the text landed. A firm that waited for the Cyprus law before starting to collect data is already behind, and the gap has to be closed by reconstruction rather than by going forward cleanly.

The law reaches entities licensed in Cyprus under MiCA and crypto-asset operators providing services without a MiCA registration requirement. That second category catches more businesses than firms expect, which is the subject of the trap below.

The Three Dates That Govern Your Year

Three deadlines drive everything else. Data collection has applied since 1 January 2026, so the first reporting year is already in progress. Self-certifications from pre-existing users, meaning accounts opened before 2026, are due by 1 January 2027. The first reports, covering the 2026 calendar year, fall due in 2027, and Cyprus has set 30 June 2027. Other member states set their own dates inside the EU window, so a group filing in more than one jurisdiction should confirm each one rather than assuming the Cyprus date travels.

The Trap: "We Are Not an Exchange, So This Is Not Us"

The most common misreading we encounter. DAC8 attaches to the provision of crypto-asset services to EU-resident users, not to whether you think of yourself as an exchange or whether you hold a MiCA licence. A firm executing transactions on behalf of clients, operating a trading platform, or providing transfer services can be a reporting crypto-asset operator without ever having applied for anything. Being outside the EU does not help either: a non-EU platform with EU-resident users is still in scope.

Scoping this properly is a one-off exercise that costs very little and settles the question with reasoning on the record. Assuming your way out of it is the expensive option, because the assumption is only tested when a reporting year has already closed.

2. MiCA and CySEC: Reporting Your Firm to Your Supervisor

The second regime is supervisory rather than fiscal. Crypto-asset service providers in Cyprus are supervised by the Cyprus Securities and Exchange Commission, and once you are authorised under MiCA, reporting is continuous rather than periodic in the way a tax filing is.

Cyprus used the transitional period that MiCA's Article 143(3) leaves to member states, and that window has now closed. Firms registered under the old national regime could continue until 1 July 2026, and CySEC required anyone intending to seek authorisation through Cyprus to have applied by 27 February 2026, with a wind-down plan expected from those who did not. The practical consequence for September 2026 is that providing crypto-asset services from Cyprus without MiCA authorisation is no longer a transitional position, it is an unauthorised one. Everything below follows from being a supervised firm.

What a CASP owes its supervisor falls into a few recognisable families. The exact content and frequency depend on which services you are permitted to provide, so treat the following as the shape of the obligation and confirm the specifics against your own authorisation conditions and the circulars in force.

The families are: periodic prudential and operational reporting, covering own funds, safeguarding of client assets and business volumes; notification of material changes, meaning shareholding, management, outsourcing and any change to the services you provide; complaints reporting; incident reporting, both operational and ICT-related, where DORA has raised expectations for firms in scope; and, for issuers of asset-referenced and e-money tokens, a separate reporting stream tied to reserves and redemption.

The failure we see here is rarely a missed return. It is that the numbers in the supervisory report cannot be reconciled to the chain or to the ledger when someone asks how they were produced. A report you cannot reproduce is a finding waiting to happen, which is why our transaction reconciliation and MiCA readiness work usually starts with the evidence trail rather than the form.

3. AML: Reporting Suspicion to MOKAS

The third regime is the one with no deadline, which is precisely what makes it hard to run. Suspicious transaction reports go to MOKAS, the Cyprus financial intelligence unit, under the Cyprus law implementing the EU anti-money laundering directives. The trigger is knowledge or suspicion, and the timing is "promptly", not "quarterly".

Two things about STRs are consistently misunderstood. First, there is no monetary threshold that switches the obligation on. A small transaction that makes no sense is reportable; a large transaction that makes complete sense is not. Firms that have quietly built a de facto threshold into their escalation process have built a defect. Second, filing is not the end of the matter. Tipping off is a separate offence, and the decision about whether to continue the customer relationship after filing is one you have to document rather than default.

The quality issue we find in reviews is not under-reporting so much as undifferentiated reporting. A firm that files everything is not demonstrating diligence, it is transferring its judgement to the FIU, and supervisors read high volume with thin narrative for what it is. We cover this and the related control gaps in more depth in our note on AML audit readiness for Cyprus crypto firms.

The Travel Rule Is a Reporting Obligation Too

The EU Transfer of Funds Regulation extends the travel rule to crypto-asset transfers, which means originator and beneficiary information has to accompany transfers between service providers. Firms tend to file this mentally under "AML tooling" rather than "reporting", and then discover at review time that the obligation has an evidential dimension: you have to be able to show what you sent, what you received, and what you did when the information was missing or incomplete.

Exception handling is where this breaks. Transfers to and from self-hosted wallets, counterparties who send incomplete data, and the question of what constitutes a reasonable delay before rejecting a transfer are all areas where firms have a policy and no evidence that the policy was followed. That is a reporting failure even when no report was due.

4. Your Own Tax Position

The fourth regime is the one people usually mean when they ask about "crypto tax in Cyprus", and it is separate from all three above. DAC8 concerns what you report about your users. This concerns what you and your own business report about yourselves. It is also the part of the Cyprus picture that changed most in 2026, and a great deal of the advice still circulating online describes the old position.

Cyprus Now Has a Dedicated Crypto Tax Article

Until the end of 2025, Cyprus had no provision written specifically for digital assets. Practitioners worked from general Income Tax Law principles, the "titles" exemption and the badges of trade, and outcomes turned on whether activity was characterised as investment or as trading. That ambiguity is what produced the widely repeated claim that crypto gains in Cyprus are simply untaxed.

That position no longer holds. The 2026 tax reform inserted Article 20E into the Income Tax Law, via the Income Tax (Amending) (No. 4) Law of 2025, and it applies from 1 January 2026. It taxes gains from the disposal of crypto-assets at a flat 8%, for individuals and companies alike. "Crypto-asset" takes the MiCA definition in Article 3(1)(5) of Regulation (EU) 2023/1114, which is a deliberate and useful piece of drafting: the tax definition and the regulatory definition are the same definition.

Four events count as a disposal, and the last two are the ones people miss: sale for fiat, exchange of one crypto-asset for another, gift or transfer without consideration, and payment for goods or services. A crypto-to-crypto swap is a taxable disposal even though no fiat moved and nothing reached a bank account. Simply holding is not taxed.

The Details That Change Behaviour

Three features of Article 20E matter more than the headline rate.

Losses are ring-fenced. A loss on a crypto disposal can be set only against crypto disposal gains realised in the same tax year. It cannot be carried forward, surrendered by group relief, or offset against other income. Unused losses are simply lost, which makes the timing of realisations matter far more than it does elsewhere in the Cyprus system.

Mining is carved out. Crypto-assets acquired through mining fall outside the 8% regime and are dealt with under the general provisions, meaning ordinary corporate or personal rates. Staking rewards and airdrops likewise sit outside Article 20E on receipt, though a later disposal of those assets comes back inside the 8%. A business with mixed activity therefore has to track how each holding was acquired, not just what it sold, and that is a data problem long before it is a tax problem.

Non-dom status does not exempt it. The non-domiciled regime exempts dividends and interest from the special defence contribution, and a number of people have assumed crypto gains travel with them. Under the 2026 law they do not. A non-dom Cyprus tax resident disposing of crypto-assets is within the 8%.

Around this sit the wider reform changes: corporate income tax moved from 12.5% to 15% from 1 January 2026, in line with the OECD global minimum, so the general rate that applies to mining income and to trading profits outside Article 20E moved with it.

This regime is new, and new regimes generate practice questions faster than guidance answers them. Cost basis on assets acquired long before 2026, valuation on crypto-to-crypto swaps, and the boundary between staking receipts and disposals are all areas where we would expect the detail to firm up. Take advice on your own facts. What we do is build and reconcile the underlying dataset, including acquisition method, cost basis and disposal history across chains and venues, which is almost always the part that is missing. The characterisation of that data is a matter for your tax advisor, and the two jobs should not be collapsed into one.

Where These Obligations Collide

The regimes are legally separate but they draw on overlapping data, and that overlap is where the real risk sits. Three collisions are worth planning for.

Consistency across filings. The transaction population behind a DAC8 report, the volumes in a CySEC return and the revenue in a tax computation are different views of the same underlying activity. When they are produced by different teams from different extracts, they disagree, and the disagreement is visible to anyone who looks at two of them together. Building the three from one reconciled source is the single highest-value structural fix available.

Self-certification and KYC are not the same record. DAC8 wants tax residency and taxpayer identification numbers. AML onboarding wants identity and source of funds. Firms frequently assume their KYC file already satisfies DAC8 and find at collection time that the tax fields were never captured, for exactly the users who are now hardest to reach.

An STR does not discharge a reporting obligation. Filing a suspicious transaction report about a user does not remove that user from your DAC8 population, and it does not change what you report to your supervisor. Obvious when stated, and not always obvious in the moment.

A Realistic Sequence

If all four apply to you and none of them are in good order, the sequence below reflects what we would actually do rather than what a maturity model would suggest.

First, scope DAC8 and write the conclusion down. It is cheap, it is time-critical because the reporting year is running, and the answer determines how much of the rest matters. Include the reasoning, not just the conclusion.

Second, find out what your 2026 data actually looks like. Not whether you have data, but whether you can produce, for a given user, a complete and valued transaction history reconciled to the chain. Do this before building anything. Most remediation plans we see are written before anyone has looked, and are wrong in consequence.

Third, close the self-certification gap for pre-existing users. This has a hard deadline of 1 January 2027 and it depends on customer responsiveness, which you do not control. It needs the most lead time and gets the least.

Fourth, reconcile once and reuse. Build the reconciled transaction source that the DAC8 dataset, the supervisory returns and the tax computation all draw from, rather than three parallel extracts that will drift.

Fifth, test the AML reporting chain end to end. Take a real alert and follow it to a filed report, or to a documented decision not to file. If the trail breaks anywhere, that is your finding, and you would rather have it than an inspector.

What This Page Cannot Tell You

Three honest limitations. The exact content and frequency of CySEC reporting depend on your permissions and on circulars that change, so verify against what is in force for your firm rather than against this summary. Article 20E is barely a year old, and the practice questions it raises, cost basis on assets acquired well before 2026, valuation on crypto-to-crypto swaps, and the treatment of staking receipts, will be settled by guidance and practice that does not fully exist yet. And parts of the EU AML framework are still bedding in as the AML package phases in, so where supervisory expectation has not settled, a documented interpretation with reasoning behind it is defensible and silence is not.

Dates and positions in this article were verified in September 2026. Regulatory timetables in this area have moved more than once, and Cyprus transposed DAC8 three months late, so confirm anything you are about to rely on before you rely on it.

How Ondology Labs can help: We work on the data underneath all four regimes rather than on the forms themselves. That means DAC8 reporting support, from applicability scoping to a reporting dataset reconciled to the chain and to your books, MiCA readiness and CASP compliance evidence, independent AML compliance audits covering the escalation and reporting chain end to end, and transaction reconciliation that gives your tax advisor an acquisition and disposal history they can actually work from. We are based in Nicosia and most of this work is done for firms supervised here.

Related reading: AML audit readiness for crypto firms in Cyprus · The DAC8 directive explained · MiCA's transition window.

In the wake of multiple high-profile crypto collapses, namely FTX and Zondacrypto, the digital asset industry has been forced to mature. It is abundantly clear that a traditional financial audit, designed for fiat bank accounts and physical inventory, is woefully inadequate for a crypto balance sheet. The unique nature of blockchain technology introduces financial assertions that require specialized scrutiny, pushing auditors to look beyond standard practices. Blockchain-based remittance companies, cryptocurrency exchanges, and stablecoin issuers are some of the immediate enterprises that will require crypto audits.

The Intricacies of Crypto Audits

When a standard auditor approaches a balance sheet, they test for existence, valuation, and rights and obligations. In traditional finance, verifying existence is often as simple as requesting a bank statement. In crypto, "existence" means proving control over the private keys that govern a wallet address, or validating the data integrity of the underlying blockchain records against the client's internal custodian records. But control does not inherently equal ownership, which complicates the "rights and obligations" assertion. Are the assets held in a custodial capacity for users, or do they belong to the exchange?

Furthermore, valuation remains a complex puzzle. While Bitcoin and Ethereum have deep liquidity, valuing thinly traded altcoins or complex derivative tokens requires sophisticated fair-value modeling that accommodates hyper-volatility. These valuations can also rely on assessments of the company status as well as a number of benchmarking sources such as credible indexes.

Why Auditors Need Technical Experts

Because of these complexities, standard CPAs often find themselves out of their depth. Under international auditing standards, auditors are increasingly relying on technical experts to provide assurance. Blockchain cybersecurity and data science specialists are needed to evaluate the architecture of cold and hot wallets, audit the underlying code of smart contracts, and assess the cryptographic proofs (such as Merkle trees) used by exchanges for proof of reserves on the assets they hold in an offchain environment.

Without this technical assurance, an auditor cannot confidently sign off on the financial statements, as a single, overlooked smart contract vulnerability could instantly wipe out a firm's reserves.

The Expanding Regulatory Net

The regulatory landscape has also shifted dramatically, forcing companies to adopt robust reporting systems. The European Union's DAC8 directive, which entered its implementation phase in January 2026, acts as a stringent crypto tax-reporting framework. It requires service providers to automatically gather and share transaction data and user tax residency information with authorities, closing the visibility gap between traditional finance and digital assets.

Coupled with the markets in crypto-assets (MiCA) regulation, which imposes strict rules on market conduct, compliance is no longer optional. A recent example underscores this strict environment: on August 14, 2026, Austria's financial market authority (FMA) issued Europe's first published MiCA penalty to Vienna-based exchange Bitpanda. The €70,000 fine penalized the firm for procedural misses regarding a crypto-asset white paper and its accompanying marketing disclosures.

Specifically, the FMA identified three technical breaches. First, Bitpanda submitted a required token white paper to the regulator fewer than the strictly mandated 20 working days prior to publication. Second, promotional material was distributed before the white paper was actually published, reversing the sequence MiCA demands. Finally, the marketing communication omitted mandatory disclaimers, such as a statement noting the document had not been reviewed by a competent authority, alongside required contact details.

Bitpanda swiftly addressed the intervention, characterizing the episode as a procedural misstep concerning timing and formal specifications rather than a deeper compliance failure. The firm opted for an accelerated, consensual conclusion to the proceedings with the FMA. The fine, while financially small for a major platform, especially given that Bitpanda secured a full MiCA license from Germany's BaFin earlier in the year, sends a powerful signal. It demonstrates a definitive shift from the mere issuance of licenses to active, rigid enforcement of disclosure standards across the European Economic Area.

Case Studies of Success

Despite the regulatory hurdles and technical challenges, industry leaders are proving that comprehensive audits are possible.

In mid-August 2026, Tether, the issuer of the world's largest stablecoin, announced the completion of its first full independent financial audit of its 2025 statements, conducted by Big Four firm KPMG US. For years, critics questioned whether Tether truly held the reserves it claimed. KPMG's audit went far beyond a standard digital check. To verify the "existence" and "valuation" assertions, auditors physically inspected and counted Tether's gold holdings in vault locations, rather than relying solely on custodian records. They also extensively audited the smart contracts and cryptographic proofs that bind the USDT tokens on various blockchains. The audit yielded a clean opinion, revealing that Tether held a staggering $6.814 billion in excess reserves above its liabilities, and generated over $10 billion in net profit for 2025. This granular level of physical and cryptographic verification represents a new gold standard for stablecoin issuers.

Meanwhile, Bitpanda has demonstrated that operational security is just as critical as financial assurance. In February 2026, the firm completed its first System and Organization Controls (SOC) 2 Type II attestation. Unlike a standard point-in-time financial audit, a SOC 2 Type II involves a months-long rigorous examination by independent auditors to ensure that a company's security controls, availability, and confidentiality are consistently and operationally enforced.

As the digital asset market continues to bridge the gap with traditional finance, the expectations placed on crypto balance sheets will only grow. The combined forces of DAC8, MiCA, and the demand for institutional-grade assurance dictate that a standard audit is merely the starting point. Today's successful crypto audits require a fusion of traditional accounting principles, deep cryptographic expertise, and an unwavering commitment to regulatory compliance.

How Ondology Labs can help: This fusion is exactly what we do. We deliver full crypto financial statement audits with our ICPAC-licensed audit partner, provide crypto audit support as the technical experts for audit firms and companies with their own auditors, and prepare DAC8 crypto reporting for CASPs in Cyprus and across Europe.

Related reading: How to read a proof of reserves report · The MiCA transition window closes in July 2026.

Crypto now appears in disputes that have nothing to do with crypto: civil fraud and asset tracing, insolvency, financial remedy proceedings, regulatory enforcement, prosecution and defence. In most of them the instructing lawyer must make a technical judgement they are not equipped to make, which expert to rely on, and whether the report in front of them will hold. This piece takes that judgement from both directions: how to test a prospective crypto expert witness before you instruct, and how to test an opposing expert's report once it lands.

Procedural requirements for expert evidence vary by forum: the form of any declaration, whether permission is needed, what must be disclosed about instructions, whether experts meet before the hearing. Confirm those locally. What follows is about substance, which travels.

What Actually Qualifies Someone as a Blockchain Expert Witness

The market is full of people who describe themselves as crypto experts. Few have produced analytical work that anyone adversarial has examined. Three things are commonly offered as credentials, and none of them is one on its own.

• "Years in crypto." Trading since 2013, running a node, or working at an exchange shows familiarity with an industry. It does not show the ability to reconstruct a transaction history, document the method used, and defend each inferential step under cross-examination.
• A vendor tool certification. It shows the candidate can operate the software. It says nothing about whether they understand what the software is inferring or where its heuristics fail. An expert whose opinion is whatever the tool displayed is an expert whose opinion collapses the moment someone asks how the tool reached it.
• Publications and conference appearances. Useful context, weak evidence. Ask about the analytical work instead.

What does qualify someone is demonstrable analytical work on chain and an articulable methodology. Can they explain, without the software in front of them, how they establish that a set of addresses is under common control, and what would falsify that conclusion? Have they worked the chains your matter involves? Bitcoin's UTXO model and account-based chains raise genuinely different analytical problems, and fluency in one does not transfer. Have they been cross-examined, and what happened? An expert whose method has never been tested is an unknown quantity, whatever the CV says. Accountancy or audit qualification adds a second layer, because valuation and reconciliation questions arrive alongside the tracing ones; our own work sits under ICPAC licensing for that reason.

Test Independence First

Test independence first, not last, because everything else is worthless without it. An expert instructed by one party still owes an overriding duty to the tribunal, above any duty to the party paying the fee. That is not a formality. It is the reason the evidence is weighed at all rather than treated as advocacy.

Ask how the expert has handled a case where the data did not support the instructing party's position. A candid answer describes telling the client early and privately, in time for the legal team to decide how to proceed. A candidate who says it has never happened has either not done much work or is not telling you the truth. Related tests: does any part of the fee depend on outcome or recovered assets, and is the same firm running conflicting work, a contingent recovery mandate, say, while also offering to opine on the same transfers?

What a Crypto Expert Report Must Contain

A report that holds up is one another competent expert could pick up and reproduce. The components are unglamorous and they are the whole game.

• Instructions and questions, reproduced, so the scope of the opinion is unambiguous and nothing has been answered that was not asked.
• Documented methodology. Chains, tools, data providers, block heights or snapshot dates, and each analytical step, in enough detail to be repeated. Transaction schedules exhibited, not summarised.
• Chain of custody. How each item was obtained, when, by whom, and how it has been preserved. On-chain data is verifiable at source; the report should record what a third party needs to verify it independently.
• Fact separated from opinion. "Address A sent 40 ETH to Address B at block 21,431,908" is observed fact. "Address B is controlled by the second defendant" is opinion resting on inference. A report that blurs the two will be taken apart line by line.
• Assumptions and limitations. Every point where the trail could not be resolved, where attribution rests on inference, and where an alternative explanation remains open, stated by the expert, before opposing counsel states it.
• Declaration of qualifications, independence, and the duty owed to the tribunal, in whatever form the forum requires.

The Four Soft Spots in Crypto Evidence

Overreaching in crypto reports concentrates in four places. Know them and you can read any report, yours or theirs, with the right scepticism.

Address clustering. Grouping addresses into a single controlled cluster relies on heuristics, most commonly common-input ownership and change-output identification. These are probabilistic inferences about behaviour, not proofs of control, and they are weakened by exchange batching, CoinJoin-style constructions, and unusual wallet software. A report should state which heuristics were applied and how confident each conclusion is. One that presents a cluster as a fact has skipped the step that matters.

Attribution to a named person or entity. The most common overreach in the field. On-chain data can show that an address behaves as part of a cluster and that value reached a named exchange. It cannot, by itself, show who held the keys when a transaction was signed. Attribution to a person almost always depends on off-chain corroboration: KYC records obtained through disclosure or a third-party order, device evidence, correspondence, an admission. Where a report attributes a wallet to a defendant, find the off-chain link. If it is a commercial dataset label, ask how and when that label was derived; vendor attribution databases are investigative leads, not evidence of identity.

Mixers and bridges. Different problems, often treated as one. A mixer or privacy protocol is designed to break the link between input and output; frequently no reliable path through exists, and the honest finding is that the trail ends there. Timing-and-amount correlation across a mixer can be legitimate analysis, but it is inference with a stated confidence, never a traced hop. Bridges are more tractable: a cross-chain transfer typically leaves a lock or burn event and a corresponding mint or release, but the correspondence must be evidenced transaction by transaction, not assumed because the amounts look similar.

Inference at unresolved hops. Some reports bridge a gap with language like "the funds were then transferred to" when what is meant is "an equivalent amount later appeared at." Watch the verbs. Each unresolved hop should be flagged, with the assumption used and its effect on the conclusion. A single unflagged hop can carry the entire chain of reasoning.

Questions to Put to a Prospective Expert

1. What is your duty when the on-chain evidence contradicts the case of the party instructing you, and when has that happened?
2. Describe a matter where your methodology was challenged. What was put to you, and what did you concede?
3. Which chains, protocols and asset types have you analysed in instructed work, and which are outside your expertise?
4. How do you establish common control over a set of addresses, and what would cause you to withdraw that conclusion?
5. What do you rely on for attribution beyond commercial dataset labels, and how do you express attribution confidence?
6. How do you handle a transfer into a mixer? When would you decline to trace through it?
7. Which tools and data sources do you use, and can you reach the same result through an independent source?
8. Could another competent expert reproduce your analysis from your report alone? Show me an anonymised example.
9. How do you record chain of custody over material we provide and over data you collect yourself?
10. What is your fee basis, and does any part of it depend on the outcome or on recovered assets?
11. Do you or your firm have any relationship with the parties, their advisers, or any platform involved? Run a conflict check before we go further.
12. Can you meet the timetable (report deadline, expert meeting, hearing window), and are you available to give oral evidence on those dates?

Questions to Probe an Opposing Report

Use these when reviewing the other side's report, preparing cross-examination, or briefing your own expert to respond. Most productive challenges to blockchain evidence come from the same short list.

1. Is the methodology set out in enough detail that an independent expert could reproduce the result? If not, the conclusions are assertions.
2. Are the transaction schedules exhibited, with hashes, timestamps and block heights, or only summarised in narrative?
3. Which statements are observed fact and which are opinion? Mark them up. The proportion is often revealing.
4. What clustering heuristics were applied, and are their known failure modes acknowledged?
5. On what basis is each wallet attributed to a person or entity: off-chain corroboration, or only a vendor label?
6. Where the report says funds "were transferred to" a destination, does the data show a traced path or a correlation of timing and value?
7. How were mixers and unresolved hops handled, and is each break in the chain disclosed?
8. For cross-chain movement, is each bridge transaction matched on both sides, or inferred from amount and timing?
9. Does the report treat off-chain movements inside an exchange as if they were on-chain transfers?
10. Are assumptions and limitations stated at all? A crypto report with no limitations section is not a careful report.
11. Do the conclusions exceed the questions the expert was instructed to answer?
12. Does the expert opine outside their expertise, on legal characterisation, intention, or a party's state of mind?
13. Are the data sources and date of analysis identified, and can the work be re-run today against the same chain state?
14. Is there an independence declaration, and does the fee arrangement or a prior relationship undermine it?

Practical Matters Before and After Instruction

Run the conflict check first, with the full party list including corporate vehicles and any exchange or custodian in the picture. Then write a letter of instruction that asks answerable questions. "Trace the stolen funds" is not answerable; "identify the destination of the 312 BTC transferred from the addresses at Schedule 2 between 3 and 9 March 2025, and state whether any part reached an identifiable service" is. Ambiguous instructions produce reports that miss the issue and hand the other side a line of attack about scope. Agree scope, fee basis and deadline in writing before analysis starts, and give the expert the full timetable, not only the report date. Urgent applications run to a different rhythm: a focused analysis for a freezing application, then a fuller report later.

Where each side has an expert, expect expert discussions and a joint statement. In crypto cases the technical gap narrows sharply at that stage, because both experts are reading the same public ledger; what remains in dispute is usually attribution and the confidence attached to inferences, which is exactly what should reach the hearing. By then the work that decides the outcome is months old. An expert with a documented method, stated assumptions and limitations disclosed on the face of the report is a hard target. One defending an undocumented method for the first time under questioning is not. Watch, too, for the expert who argues the client's case from the witness box. It reads as partiality and costs more than the point being defended.

How Ondology Labs Can Help

We are a blockchain forensics and auditing firm in Cyprus providing blockchain forensics and tracing, crypto asset recovery, and independent expert witness reports and court support for legal teams in Cyprus, Greece and across the EU. We accept single joint expert appointments, take part in expert meetings and joint statements, and attend to be cross-examined. Where a finding rests on inference rather than proof, we say so in the report, before opposing counsel does.

Related reading: Blockchain forensics in Cyprus and Greece.

We review AML frameworks at crypto exchanges, CASPs, custodians and payment firms, and the findings repeat. Not because compliance teams are careless. The people we meet are usually stretched, competent and aware of at least half of what we are about to write down. The gaps repeat because they are structural. They come from frameworks assembled quickly during authorisation, vendor tooling deployed with default settings, and a business that changed faster than its documentation.

This is a readiness checklist rather than a description of what an audit covers. If you want the latter, it is set out on our AML compliance audit page. What follows is the shortlist of things to go and look at yourself, this week, before someone external looks at them for you.

The Supervisory Backdrop, Briefly

Crypto-asset service providers in Cyprus are supervised by the Cyprus Securities and Exchange Commission and are obliged entities under Cyprus AML law implementing the EU directives. MiCA brought CASPs into a harmonised EU authorisation regime, which means your AML framework is now assessed as a component of a supervised firm rather than as a voluntary standard, a change of posture more than a change of rules. Our note on the MiCA transition window covers that shift in more detail.

Layered on top is the EU AML package: a directly applicable AML Regulation that narrows the national discretion firms have been reading around, and AMLA, the new EU-level authority that will push supervisory expectations toward a common standard. The Transfer of Funds Regulation extends the Travel Rule to crypto transfers. Suspicious transaction reports go to MOKAS, the Cyprus financial intelligence unit.

Parts of this are still bedding in. Where supervisory expectation has not settled, we say so rather than presenting one reading as settled law, and you should take the same approach in your own documentation. A stated interpretation with reasoning behind it is defensible. Silence is not.

Gap 1: A Risk Assessment About Crypto Businesses in General

The business-wide risk assessment is where most reviews start, and it is where the tone of the whole engagement gets set. The common failure is a document that describes a generic crypto business: the standard threat typologies, the standard geographic risk categories, the standard conclusion that residual risk is medium.

What good looks like: the assessment names your actual products, your actual customer segments, your real onboarding jurisdictions in volume order, and the specific chains and asset types you support. It explains why a risk is rated as it is, with reference to your own data. It is dated, approved at board level, and revisited when you launch something new, not annually by calendar reflex. If a reader who has never met you could not describe your business after reading it, it is not your risk assessment.

Gap 2: Monitoring Rules Nobody Tuned

Transaction monitoring is usually bought, deployed with the vendor's starter rule set, and left. Two years later the customer base has shifted, the product set has doubled, and the thresholds are still whatever the implementation consultant typed in.

What good looks like: a documented mapping from each risk identified in your risk assessment to the rule or rules intended to detect it, so coverage gaps become visible. Thresholds justified against your own distribution of customer behaviour, not against a market average. A record of every tuning decision: what changed, why, who approved it, what the before-and-after alert volumes were. Above-the-line and below-the-line testing when thresholds move. Crypto AML controls that were never calibrated to the book they monitor are, functionally, an expensive log.

Gap 3: Treating Alert Volume as Evidence of Diligence

This one is worth stating bluntly. A backlog of thousands of open alerts is not proof that you are monitoring carefully. It is proof that you are generating output nobody is consuming. We have seen firms present alert counts as a compliance metric while the average alert had been open for months and dispositions read, in full, "reviewed, no action".

What good looks like: alert volume that a team of your size can actually clear, with an ageing report the compliance officer sees weekly. Dispositions that record what was checked and what the reviewer concluded, in enough detail that a second person could reach the same conclusion from the file. Quality assurance sampling of closed alerts. A defined escalation path with named roles. If the backlog is genuinely unmanageable, the honest fix is tuning plus resourcing, documented as a decision, not quiet accumulation.

Gap 4: Sanctions Screening Nobody Has Tested

Almost every firm screens. Far fewer can tell us what their fuzzy-matching threshold is set to, who set it, or what it does with transliterated names, name order reversal, or common regional spelling variants. And a large number screen at onboarding only, so a customer who was clean in 2024 is still clean in your system today regardless of what has happened since.

What good looks like: documented list coverage and refresh frequency, including which lists and from what source. Match-threshold settings that have been tested with a deliberate set of known-difficult names, with the results kept. Rescreening of the entire existing book on list updates, on a schedule you can evidence. Screening that reaches counterparties and beneficial owners, not customers alone. A false-positive process that does not quietly train staff to clear everything. The European Banking Authority guidelines on internal policies and controls in this area are a useful reference point even where they are not directly binding on you.

Gap 5: Travel Rule Exception Handling

Travel Rule compliance for crypto is the gap that has moved fastest and is understood least evenly. Most firms have the happy path working: an in-scope transfer to a counterparty on the same messaging network, with complete originator and beneficiary data, goes through fine. That is not where the risk sits.

The risk sits in the exceptions, and there are three that come up constantly:

• The counterparty who does not respond. You sent the required information. Nothing came back. What is your policy: hold, release, release and flag? For how long? Who decides? Is the decision recorded per transfer or is it an unwritten desk convention?
• The self-hosted wallet transfer. There is no counterparty institution to exchange data with. What verification do you perform on the claimed ownership, at what value, and how is the outcome recorded? What blockchain analytics screening applies before release?
• The transfer arriving with information missing or obviously implausible. A beneficiary name of "customer" is missing information wearing a hat. What happens next, and does anything feed back into the customer's risk rating or into your view of that counterparty?

What good looks like: a written exception matrix covering each case, with a decision, an owner, a time limit, and a record. Counterparty due diligence performed before you start exchanging data with another provider, not after. Periodic sampling of failed and held transfers to check the policy is what actually happened. And a straightforward acknowledgement in your documentation where market practice is still consolidating. This is an area where interoperability between messaging solutions remains imperfect, and pretending otherwise reads worse than describing your workaround.

Gap 6: Analytics Scores With No Decision Attached

Blockchain analytics is now an expected control, and most firms have a provider. The gap is that the risk score arrives on a dashboard and stops there. There is no documented threshold at which a score changes an outcome, no escalation trigger, and no record of what the score was at the time a decision was made.

What good looks like: a written policy stating the score bands, what each band requires, and who can override, with overrides logged and reviewed. Scores captured and retained at the point of decision, because providers reclassify addresses over time and a screenshot from last year will not reconstruct itself. Periodic reassessment of exposure for existing customers, not just at deposit. And an independent check, at least occasionally, that what your tooling reports matches what the chain shows; that is a core part of what we do in blockchain auditing engagements, and it is the one control most firms have never had verified by anyone other than the vendor selling it.

Gap 7: Training That Trains Nobody in Particular

Annual e-learning with a multiple-choice quiz produces a completion certificate. It does not produce a support agent who recognises a structuring pattern, or an onboarding analyst who knows when source of wealth evidence is inadequate rather than merely absent.

What good looks like: role-specific content. Onboarding staff get due diligence and escalation. Monitoring analysts get typologies drawn from your own closed cases and your own chains. Senior management gets governance and personal exposure. Board members get enough to challenge what they are shown. Training records that log content and role, not just attendance. And at least one internal case study a year built from something that actually happened at your firm.

Gap 8: The Documentation Mismatch, in Both Directions

The last gap is the one that turns manageable findings into serious ones, and it runs two ways.

In one direction, the procedure describes a control nobody performs: a quarterly review that stopped happening in 2024, a second-line check that was dropped when someone left. That reads to a supervisor as a control failure plus a governance failure, because nobody noticed.

In the other, the control is performed diligently and never evidenced. The analyst genuinely checked three things; the file records none of them. Unevidenced work is, for review purposes, indistinguishable from work not done, and arguing otherwise during an inspection is a losing position.

What good looks like: a periodic walkthrough where the person who performs each control reads the procedure describing it and confirms line by line that this is what they do. Version-controlled documents with owners and review dates. Case file templates that capture the reasoning, not just the outcome. Where a control has lapsed, a dated record of the decision and the compensating measure. A documented, remediated gap is a far better finding than a live undisclosed one.

A Realistic Sequence

You cannot fix all eight at once, and firms that try tend to produce a lot of new documents and very little changed behaviour. In our experience the order that works is: risk assessment first, because everything else should trace back to it; then monitoring coverage and alert backlog, because those are the ones a supervisor can quantify in an afternoon; then Travel Rule exception handling and sanctions testing; then analytics thresholds, training and documentation, which are cheaper to close once the substance underneath is right.

Two honest caveats. First, an independent audit is not regulatory approval. We are not a regulator and cannot bind one. An audit is an opinion on the controls tested, on the evidence seen, at the time it was seen. CySEC, MOKAS and any other authority reach their own conclusions and may weigh things differently. Second, your obligations continue in full regardless, between reviews, after a clean report, and in every period outside the sample. Sampling means an unqualified report is evidence that a competent independent party tested the framework and set out what it found. It is not proof that nothing was missed.

The reason to do any of this early is unglamorous but real. A gap you find yourself is a remediation plan. The same gap found during supervision is a finding, with a timetable you did not set. The FATF standards on virtual assets that sit underneath the EU framework have not moved much in substance; what has moved is how closely anyone is checking.

How Ondology Labs can help: We run independent AML compliance audits for crypto exchanges, CASPs, custodians and payment firms in Cyprus and across the EU, testing the controls you actually operate, on real case files, with on-chain exposure verified independently. Findings come ranked and evidenced, with a remediation plan you can sequence.

Related reading: MiCA's closing transition window · The EU privacy token ban and what it signals for Cyprus.

Almost every large crypto platform now publishes something called proof of reserves. Very few of those publications prove what the name implies. The usual artefact is a dashboard showing wallet balances, a large percentage figure, and a logo. That is a statement about assets. Solvency is a comparison between two numbers, and the second number, what the platform owes its customers, is the one most commonly missing, unverified, or quietly supplied by the platform itself.

This guide is about reading rather than producing. If you want to know what a rigorous engagement involves on the inside, our proof of reserves attestation service sets out the methodology. What follows is the other half: how to evaluate a report that someone else has published, and how to tell assurance from marketing.

Assets Alone Prove Nothing

Start with the arithmetic, because everything else follows from it. A reserve ratio is reserves divided by liabilities. If a platform publishes only the numerator, it has published a number with no denominator and no meaning.

Consider a platform showing 100,000 BTC in verified cold storage. Impressive, until you ask what customers are owed. If the answer is 95,000 BTC, the platform is over-collateralised. If it is 130,000 BTC, the same wallets now describe a hole. The on-chain figure did not change. Only the half nobody published did.

So the first question is not "how much do they hold" but "against what". When you open any attestation, look for an explicit total customer liability, expressed per asset rather than as a single blended dollar figure. Blending matters: a platform can be 150% covered in stablecoins and 70% covered in a token it lent out, and the aggregate USD ratio will hide that. Reserves and liabilities should be compared asset by asset, or the comparison is cosmetic.

Proving Wallet Control Must Be Cryptographic

The asset side has its own failure mode. A list of addresses is not evidence of ownership. Anyone can point at a wallet on a block explorer and call it theirs, and blockchains have no concept of a name attached to an address.

Control has to be demonstrated, and there are only two credible ways to do it. The first is a signed challenge message: the verifier supplies a phrase, the platform signs it with the private keys controlling each reserve address, and the signature verifies against that address. The second is a nominal transfer executed on the verifier's instruction, at a moment and amount the verifier chooses. Both prove possession of keys. Neither can be produced by someone who has merely borrowed sight of a wallet.

When you read a report, look for language describing how control was established. "Management provided a list of wallet addresses" is an assertion the verifier accepted. "Control of each address was demonstrated by signature over a challenge message specified by us" is proof. If the report is silent on the point, treat the addresses as unproven, and ask whether any address was excluded because control could not be shown. A report that excludes nothing has often tested nothing.

Merkle Trees and How a Customer Verifies Inclusion

The liability side has a genuine problem: a platform cannot publish every customer balance without destroying customer privacy. The standard solution is a Merkle tree, and it is worth understanding because it is the one part of proof of reserves that individual users can check themselves.

The construction is simple. Every customer's account balance is hashed into a leaf. Pairs of leaves are hashed together into parent nodes, then pairs of parents into their parents, until a single hash remains at the top. That top value is the Merkle root, and the platform publishes it alongside the attestation. Change any single balance anywhere in the tree, and the root changes completely.

Here is how a customer performs the check in practice:

1. Retrieve your own proof. Log in and find the proof of reserves or verification section. The platform should give you a record ID, your balance as it was included at the snapshot, and a short list of sibling hashes, your Merkle path.
2. Recompute the leaf. Hash your own record using the algorithm the platform documents. If the result does not match the leaf they gave you, your balance was recorded as something other than what you hold.
3. Walk the path upward. Combine your leaf with each sibling hash in turn, in the specified order, hashing at each level. This takes about twenty steps even for a platform with a million customers.
4. Compare to the published root. If your final hash equals the root the auditor attested to, your balance was inside the total that was verified. If it does not, it was not.

Most platforms provide an in-browser tool for this. Prefer the ones that also publish an open-source verifier you can run yourself, since a check performed entirely by the party being checked is not much of a check. Reputable implementations publish the hashing scheme in enough detail that a third party can reimplement it.

Now the crucial limitation. A Merkle proof shows that your balance was included. It says nothing about whether everyone else's was. A platform can omit a class of accounts, or insert a leaf with a negative balance to shrink the total, and every individual proof will still verify. This is why the tree has to be built or independently tested by the verifier from the complete ledger, with controls testing around ledger completeness, rather than accepted as a finished output from the platform. If a report describes a Merkle root but says nothing about how the leaves were sourced and tested, the cryptography is decorating an unaudited number.

The Snapshot Problem

Every attestation describes a moment. That moment is the weakness anyone determined to game the process will attack.

If the snapshot time is known in advance, assets can be borrowed shortly before it and returned shortly after. The wallets are genuinely controlled, the signatures genuinely verify, and the report is genuinely accurate about a position that existed for a few hours. Related-party transfers between affiliated entities produce the same effect without any external lender at all.

Three things reduce this risk, and you can check for all of them:

• Unannounced or verifier-selected timing. The platform should not choose the block height it is measured at.
• Investigation of large inbound movements. A competent verifier looks at what arrived in the reserve wallets shortly before the snapshot and where it went afterwards. Large round-number inflows immediately before a snapshot are the signature to look for, and any credible report addresses them.
• An unbroken series. This is the single strongest signal available to a non-specialist reader. Window dressing one snapshot is feasible. Window dressing every snapshot, on a published schedule, for eight consecutive quarters, requires sustaining the deception continuously, which is a different order of difficulty.

So look at the archive before you look at the latest report. A platform with three years of quarterly attestations, including through bad quarters, is telling you something a first-time publisher cannot. Watch for gaps. A missed period, a change of verifier without explanation, or a quiet shift from monthly to annual publication is worth more attention than the current ratio.

Who Signed It

An attestation is only as good as the party standing behind it, and that party should be independent, professionally regulated, and named.

Check whether the signer is a licensed accounting firm subject to professional standards and disciplinary oversight (in Cyprus, that means licensed by ICPAC) or a consultancy with no such obligations. Check whether the firm is named at all, or whether the report is self-published with a vendor's dashboard embedded. Check the engagement letter description: an attestation performed under a recognised assurance standard carries obligations that a "report of factual findings" prepared to the client's specification does not.

Independence deserves a moment of thought too. A verifier who is also a large shareholder, a lender, or a commercial partner of the platform is not independent, however competent. Reports rarely volunteer this, so it is a fair question to ask directly.

Attestation Is Not an Audit

This distinction is routinely blurred in marketing and it matters enormously.

A proof of reserves attestation is narrow and deep: it addresses specified assets and specified customer liabilities at a point in time. A financial statement audit is broad: it covers the whole entity, including revenue, expenses, related-party transactions, off-balance-sheet obligations and going concern. The two answer different questions. Proof of reserves can be run quarterly or monthly; a full audit cannot.

The practical consequence is the honest limitation of the entire exercise. Proof of reserves is not a solvency guarantee. It cannot see debts that never touch the customer ledger: a loan from an affiliate, an undisclosed guarantee, a legal judgment, a commitment to a related entity. It says nothing about whether the business is profitable or whether its operating costs exceed its revenue. A platform can pass a reserves attestation cleanly on Monday and fail for reasons entirely outside its scope on Friday.

That is not an argument against proof of reserves. It is an argument for reading it as what it is: strong evidence about one specific and important question, published frequently, rather than a clean bill of health. Treat a report that claims more than that as a warning in itself. Any verifier worth trusting states the limitations plainly in the document.

The Checklist: Twelve Questions to Ask of Any Attestation

Take these to any published report, or send them to a platform that has not published one. The answers, or the absence of them, will tell you most of what you need to know.

1. Are liabilities stated at all? If the report shows only wallet balances, it is a balance disclosure, not proof of reserves. Stop here.
2. Are reserves and liabilities compared asset by asset? A single blended ratio can conceal a serious shortfall in one asset behind a surplus in another.
3. How was wallet control proven? Signed challenge message or verifier-instructed transfer. Not a list of addresses supplied by management.
4. Were any addresses excluded, and why? Exclusions are a sign the verifier actually tested something.
5. Where did the liability ledger come from, and was it tested for completeness? This is the question that separates real engagements from theatre.
6. Is a Merkle root published, and can you verify your own inclusion? Ideally with an open-source verifier you can run independently.
7. Who chose the snapshot time? Verifier-selected or unannounced timing is materially stronger than a date the platform announced weeks earlier.
8. Were large pre-snapshot inflows investigated? The report should say so explicitly.
9. Is there a series, and is it unbroken? Check the archive for gaps, cadence changes, and changes of verifier.
10. Who signed it, and are they licensed and independent? A named, regulated, independent firm, or not.
11. What is in scope, and what is out? Assets held with third-party custodians, staked, or lent out carry counterparty risk and should be identified separately rather than counted at face value.
12. What limitations does the report itself disclose? A report that names its own blind spots is more trustworthy than one that does not. Silence here is the loudest signal in the document.

A platform that can answer all twelve is doing serious work. A platform that answers three and calls the result proof of reserves is relying on the phrase rather than the practice.

Why This Is Becoming a Regulatory Question

Until recently, publishing reserves was voluntary and reputational. In the EU it is turning into evidence. The Markets in Crypto-Assets Regulation does not use the phrase "proof of reserves", but it requires crypto-asset service providers to segregate and safeguard client assets and imposes specific reserve and reporting obligations on token issuers. A recurring, independently signed reserves attestation is the practical way to evidence compliance with obligations of that shape, which is why the standard of what counts as credible is rising, and why the closing MiCA transition window has pushed a number of platforms to publish for the first time.

The reader's advantage in this environment is simple. The gap between platforms that can withstand the twelve questions above and platforms that cannot is wide, visible, and free to check.

How Ondology Labs can help: We perform independent proof of reserves attestations for exchanges, custodians, stablecoin issuers, and funds, verifying cryptographic wallet control, establishing customer liabilities, and publishing reports written to be read by the people above rather than filed. We also provide broader blockchain auditing for firms that need the full picture, and counterparty reviews for boards assessing someone else's attestation.

Related reading: MiCA's closing transition window · Inside the CoinDCX $44M hack.

Stolen crypto moves fast. In most incidents we see, the funds are split, swapped and pushed through bridges or exchanges within hours of the initial theft. That is the honest reason speed matters: not because panic helps, but because the window in which a transaction trail is clean, short and attributable is measured in hours, not weeks. What you do today shapes what is realistically possible later.

This guide is written for individuals and small businesses in Cyprus and the wider EU. If you already know you need a trace, you can go straight to crypto asset recovery and come back to the rest afterwards.

Step 1: Secure what is left (first 30 minutes)

Assume the compromised wallet is permanently compromised. If an attacker has your seed phrase, your private key, or a signature-approval you granted to a malicious contract, changing your password does nothing. There is no way to "clean" a wallet whose key is known to someone else. The only safe move is to abandon it.

1. Create a new wallet with a brand-new seed phrase. Ideally on a different device, and ideally a hardware wallet. Do not reuse the old seed, do not "derive a new account" from the same seed, and do not restore the old wallet anywhere.
2. Move remaining assets out. Transfer whatever is left in the compromised wallet to the new one. Send the native gas token last, and be aware that some drainers automatically sweep incoming funds. If a small test transfer disappears instantly, stop and get help rather than feeding the attacker gas.
3. Revoke token approvals. Many thefts do not involve a stolen key at all. They involve a token approval you signed, which lets a contract spend your tokens indefinitely. Revoke them using a reputable tool such as Revoke.cash or the Etherscan token approval checker. Do this for every chain you have used, not just the one where the loss occurred.
4. Lock down the surrounding accounts. Change the password on the email address tied to your exchange accounts, enable app-based two-factor authentication (not SMS), and remove any browser extension you do not recognise. If a support agent, "wallet validator" or remote-desktop session was involved, treat the whole device as untrusted and stop using it for crypto.
5. Freeze the account side. If the theft touched a centralised exchange account, log in and disable withdrawals, revoke API keys, and terminate all active sessions.

Do not skip the approvals step because "the wallet is empty anyway". Approvals persist across chains and across new deposits, and victims are frequently drained a second time weeks later by the same open permission.

Step 2: Preserve the evidence now, before it disappears

This is the step victims most often get wrong, and it is the one that determines whether anything can be done later. Scam websites go offline. Telegram and WhatsApp accounts get deleted. "Support agents" block you. Exchanges retain records, but you need to ask for them while your account is still open. Capture everything today, even the parts that feel embarrassing or irrelevant.

Collect and save, in one folder, with the date on each item:

• Transaction hashes. The full hash of every unauthorised transaction, copied as text, not just a screenshot. These are the backbone of any trace.
• Wallet addresses. Your address, the destination address the funds went to, and any intermediate address you can see on the block explorer.
• Amounts, tokens, chains and timestamps. Record the value in EUR at the time of the transaction as well as the token amount.
• Screenshots of the block explorer pages showing the transactions, taken while the pages are live.
• The platform URL. The exact domain of the website, app or "investment platform" involved, including any variant spelling. Screenshot the homepage, your account dashboard and your supposed balance before it is taken down.
• Full chat logs. Export, do not screenshot selectively: WhatsApp, Telegram, Signal, Instagram, LinkedIn, dating apps, Discord. Include usernames, phone numbers and profile photos.
• Emails with full headers. Headers contain routing information that screenshots destroy.
• Exchange statements. Download your full transaction and withdrawal history from every exchange involved, plus any deposit addresses you were given.
• Bank records. If you sent fiat by card or transfer, save the statements, the beneficiary name, IBAN and reference.
• A written timeline. Plain text, in order: when you were first contacted, what you were told, what you clicked or signed, when you noticed the loss. Write it today while your memory is accurate.

Do not contact the thief. Do not tell them you are investigating, do not threaten legal action, and do not send a "test" payment to see whether they respond. Every warning you give them accelerates the laundering and costs you leverage.

Step 3: Report it (same day)

A police report is not optional paperwork. Exchanges will generally only freeze funds or disclose account holder information on the instruction of law enforcement or a court. Without a case number, a compliance team has no legal basis to act on your request, however sympathetic they are.

• The Cyprus Police. File a report in person at your local station and ask that it be referred to the Office for Combating Cybercrime. Bring the evidence folder from Step 2 in printed and digital form, and ask for the case reference number in writing. Contact details are on the Cyprus Police website.
• MOKAS, the Cyprus FIU. The Unit for Combating Money Laundering is the financial intelligence unit that handles suspicious transaction reporting and international asset-freezing cooperation. It is normally engaged through the police or through your lawyer or a regulated entity rather than by a direct victim complaint, but where laundering through Cypriot or EU accounts is involved, its involvement is what makes cross-border freezing possible. Ask the investigating officer explicitly whether the matter has been referred.
• The exchange or platform. Open a support ticket immediately with the destination address, transaction hashes and your police reference. Use the words "unauthorised transaction" and "request for account freeze". Keep the ticket number.
• Your bank or card issuer. If fiat left your account in the last days, call the fraud line rather than emailing. Some card payments can be charged back, and some SEPA transfers can be recalled, but only within tight windows.
• CySEC, if the platform claimed to be a licensed Cyprus investment firm or crypto-asset service provider. You can check registers and file a complaint through the Cyprus Securities and Exchange Commission. A false claim of regulation is itself evidence.
• Report abroad where relevant. If you are resident elsewhere in the EU, report to your national police as well. Cross-border cases are routinely coordinated between member states.

If the scam followed a pattern you recognise (a fake trading platform, a romance-led investment, a fake support agent, a giveaway or an airdrop drainer), name that pattern explicitly in the report; investigators triage faster when the mechanism is clear.

Step 4: Start a trace while the trail is short

A police report on its own says "money was taken from me". A traced report says "the money moved through these seven addresses and 62% of it arrived at a named, regulated exchange at 04:11 on Tuesday". Those are very different documents. The second one gives an officer something to send, a specific counterparty to contact, and a legal target for a freezing request. This is the single biggest thing that changes the outcome of a case.

Blockchain forensics works because the ledger is public and permanent. The transactions cannot be deleted. What a trace does is turn that raw data into attribution: clustering the addresses that belong to the same actor, following funds through swaps, bridges and chain hops, and identifying the point at which stolen value touches a regulated service that knows its customer.

Be realistic about the odds

Nobody honest can promise you your money back. Recovery is a genuine possibility in some situations and close to impossible in others, and you deserve to know which one you are in before you spend anything.

Recovery is realistic when: the funds land at a regulated exchange with real KYC obligations; you act within hours or days rather than months; the amount is large enough to justify legal action; the destination sits in a jurisdiction whose authorities and service providers cooperate; or the platform that took your money still has identifiable corporate and banking infrastructure.

Recovery is unlikely when: the funds were passed through mixers or converted into privacy coins; the trail ends in a jurisdiction that does not respond to mutual legal assistance requests; the theft happened months or years ago and the funds have already been cashed out; or the sums involved are too small to support cross-border litigation. In those cases a trace still has value (for insurance, for a tax loss position, for a criminal complaint, or to rule out throwing good money after bad), but it is not a route to getting the coins back, and we will say so.

Warning: the second scam is aimed at you right now

Within days of a theft, sometimes within hours, victims are approached by "recovery agents", "blockchain investigators" and "cyber units" who claim they can retrieve the stolen funds. They find victims through public complaint forums, social media comments, leaked victim lists sold between fraud groups, and search ads placed against phrases like "recover stolen crypto". Being scammed a second time is common enough that regulators treat it as its own category of fraud; see the general guidance on cryptocurrency fraud from the U.S. Federal Trade Commission.

Treat all of the following as disqualifying:

• An upfront fee paid in cryptocurrency, gift cards or to a personal account.
• A guarantee of recovery, or a specific percentage promised before any analysis has been done.
• A request for your seed phrase, private key, or remote access to your device. No legitimate investigator ever needs any of these.
• Unsolicited contact: they messaged you, you did not go looking for them.
• Claims of being able to "hack the blockchain", reverse a transaction, or work through a private contact inside an exchange or a police force.
• "Release fees", "tax payments", "compliance deposits" or "unlocking costs" demanded after they claim to have found the money. This is the same structure as the original scam.
• No verifiable legal entity, registration number, physical address or named professionals.

A genuine firm will scope the work, quote for the analysis rather than for a promised outcome, tell you when the case is not worth pursuing, and produce a report you can hand to police or to a court.

What a professional trace actually involves

If you decide to take that route, this is what the work looks like at Ondology Labs, so you can judge it against anyone else you speak to.

1. Intake and triage. We take your addresses, hashes and timeline and give you an early, blunt read on whether the funds are still traceable and whether the case is worth pursuing. If it is not, you hear that first.
2. Tracing and clustering. We follow the funds across wallets, chains, swaps and bridges, and group addresses under common control to separate the thief's infrastructure from ordinary counterparties.
3. Attribution. We identify where value reaches services that hold customer identity data (exchanges, payment processors, custodians) and flag the specific points where a freeze or a disclosure request can bite.
4. Reporting. You get a written, court-ready report: methodology, evidence, exhibits and conclusions, structured so that police, a regulator, a bank compliance team or a lawyer can act on it without needing to redo the analysis.
5. Support afterwards. We work alongside your lawyer and the investigating officers, respond to follow-up questions from exchanges, and can give expert evidence where proceedings require it.

Ondology Labs is a blockchain forensics and auditing firm based in Cyprus, and our forensic work is built to the same evidentiary standard as our audit work, because a report that cannot survive scrutiny is worth nothing to you.

How Ondology Labs can help: If your crypto has been stolen, start with our crypto asset recovery service for an honest assessment of whether the funds can still be traced, backed by blockchain forensics and court-ready reporting across Cyprus, Greece and the EU. Secure your remaining wallets and file your police report first, then bring us the evidence.

Related reading: What blockchain forensics is and how it works.

The global digital asset ecosystem is undergoing its most significant structural shift to date, transitioning from a state of regulatory ambiguity and voluntary disclosure to a highly standardized, mandatory crypto-asset reporting framework. The GENIUS Act represents a significant milestone in federal cryptocurrency legislation in the United States. Introduced on July 18, 2025, by Senator Bill Hagerty, the bipartisan legislation established a comprehensive federal regulatory system for dollar-backed payment stablecoins.

The primary policy objective is to fortify the global reserve status of the U.S. dollar by driving demand for U.S. Treasury instruments, which serve as the mandated backing for regulated stablecoins, while integrating digital transaction rails directly into the traditional financial architecture.

Mechanically, the GENIUS Act establishes a dual-track oversight system, authorizing both FDIC-supervised banks and new limited-purpose stablecoin companies chartered by the Office of the Comptroller of the Currency (OCC) to mint payment stablecoins on public blockchains.

To address systemic liquidity risks, the legislation mandates that all permitted payment stablecoin issuers (PPSIs) maintain 1:1 reserves consisting exclusively of highly liquid, low-risk assets, specifically cash, Federal Reserve balances, or short-term Treasury bills with maturities of 90 days or fewer. Under the rules, which officially become effective on January 18, 2027, issuers are strictly prohibited from rehypothecating reserve assets to fund other investments or offering any form of yield or interest to stablecoin holders.

Additionally, issuers are treated as financial institutions under the Bank Secrecy Act, requiring them to implement comprehensive anti-money laundering (AML) programs, customer due diligence procedures, and the technical capability to seize, freeze, or burn tokens upon lawful order.

Market Regulation vs. Tax Enforcement: A Deliberate Divergence

The regulatory divergence between the classification of assets for market oversight versus tax enforcement remains a key point of interest for market participants. While the GENIUS Act excludes compliant stablecoins from the definitions of "securities" and "commodities" to bypass SEC and CFTC jurisdiction, the IRS maintains its property classification regardless of these designations. This is further highlighted by the CLARITY Bill, which passed the House and remains pending in the Senate; although the CLARITY Bill seeks to designate digital assets as either securities under the SEC or commodities under the CFTC based on their functional decentralization, it carries no direct tax impact, as the IRS does not recognize these regulatory classifications for capital gains purposes.

Furthermore, because cryptocurrencies are classified as property, they remain exempt from the wash sale rules under Section 1091 of the Internal Revenue Code. This allows spot traders to execute tax-loss harvesting strategies by selling tokens at a loss and immediately repurchasing them without disallowance. However, this exemption does not apply to tokenized securities, which are digital representations of traditional equities, bonds, or mutual funds registered with the SEC. Under the new IRS Form 1099-DA reporting requirements, U.S. brokers must perform due diligence on digital accounts, reporting gross proceeds starting in 2025 and cost basis information starting in 2026, with a dedicated reporting box (Box 1i) specifically tracking disallowed wash sale losses on tokenized securities. (For a deeper look at which tokens escape securities treatment, see our breakdown of which RWA tokens are not securities.)

This current framework stands in contrast to past legislative proposals, such as the crypto tax provisions within the Lummis-Gillibrand Responsible Financial Innovation Act (RIFA). The Lummis proposal aimed to make digital assets more practical for daily use by introducing a de minimis capital gains tax exemption for personal transactions, which would exempt capital gains of less than $300 from reporting, subject to an aggregate annual cap of $5,000. Additionally, the Lummis bill proposed deferring the taxation of mining and staking rewards until the tokens are sold or disposed of, preventing phantom tax liabilities caused by price volatility at the point of earning, while formally extending Section 1091 wash sale restrictions to all standard cryptocurrency transactions.

The IRS Position Is Unchanged: Digital Assets Remain Property

For tax purposes, the regulatory formalization of stablecoins under the GENIUS Act does not fundamentally alter the underlying tax classification of digital assets. The Internal Revenue Service continues to treat cryptocurrencies and stablecoins as intangible property under Notice 2014-21, meaning that general property tax principles apply to every digital transaction. Consequently, swapping a payment stablecoin such as USDC or USDT for another cryptocurrency, or using it to pay for goods and services, constitutes a taxable disposal, realizing a capital gain or loss based on the difference between the taxpayer's cost basis and the fair market value of the asset at the time of the transaction. Staking and lending yields remain taxable as ordinary income valued in U.S. dollars at the point of receipt.

Operational Directives for U.S. Market Participants

For U.S. digital asset market participants, financial institutions, and corporate treasurers, the following operational directives must be integrated immediately:

1. Maintain comprehensive fair market value (FMV) records. Continuously record the exact USD fair market value of all stablecoin balances and transactions on the precise date and time of purchase, swap, or disposal, as every transaction remains a taxable event under standard property guidelines.
2. Segregate spot crypto from tokenized securities. Formally separate spot cryptocurrencies and stablecoins (exempt from the Section 1091 wash sale rule) from tokenized securities, ensuring that disallowed losses on the latter are accurately tracked in accordance with Box 1i of the new IRS Form 1099-DA.
3. Classify stablecoins correctly on the balance sheet. Ensure corporate accounting policies classify stablecoins as cash or cash equivalents only if they are issued by an authorized "permitted payment stablecoin issuer" (PPSI) under the GENIUS Act, reporting other positions as distinct intangible assets under GAAP.
4. Track staking and yield allocations. Properly document all cryptocurrency staking rewards and stablecoin lending yields as ordinary income at their exact fair market value upon receipt of control, preparing for incoming Form 1099-DA reporting regimes once federal OCC chartering is operationalized.
5. Audit reserve disclosures. Establish internal risk-management pipelines to audit the monthly reserve disclosures and quarterly attestations mandated by the GENIUS Act to avoid illiquidity or sudden asset depegs.

Figure 1: Parallel regulatory drivers, the U.S. GENIUS Act and the EU's DAC8, converging into a global crypto transparency framework

The legislation intentionally avoids modifying the Internal Revenue Code, and market participants face a significant divergence between streamlined regulatory oversight and an unchanged, high-friction tax framework. Under IRS Notice 2014-21, stablecoins remain treated as property rather than currency, requiring traders and corporations to account for every single on-chain swap and conversion.

The synchronization of the GENIUS Act in the United States and the DAC8 directive in the European Union represents a fundamental change in the digital asset regulatory landscape. The historical assumption of informational opacity is no longer a viable operational strategy. Digital asset transactions are now fully visible to tax authorities, requiring investors, platform operators, and tax advisors to establish robust compliance processes to mitigate risk and adapt to this highly transparent environment.

How Ondology Labs Can Help

As reserve attestations, cost-basis reconstruction, and Form 1099-DA reporting become table stakes, verifiable on-chain records matter more than ever. Ondology Labs provides blockchain auditing (proof of reserves, transaction reconciliation, and AML audits) alongside blockchain forensics and tracing that reconstruct transactional histories with court-ready evidence. For issuers, treasurers, and funds preparing for this transparent, mandatory-reporting era, that combination turns compliance from a liability into a competitive advantage.

Continue with Part 2: The DAC8 Directive and the EU's crypto tax transparency dragnet.

Related reading: The DAC8 directive: the EU's crypto tax transparency dragnet · Crypto reporting obligations in Cyprus · DAC8 and CARF: a crypto tax guide for EU expats

In the European Union, the adoption of Council Directive (EU) 2023/2226, known as DAC8, marks the end of information asymmetry between crypto platforms and tax authorities. Formally adopted on October 17, 2023, and entering into effect across all 27 member states on January 1, 2026, DAC8 establishes a standardized framework for the automatic exchange of tax-relevant transaction data. The directive transposes the OECD's Crypto-Asset Reporting Framework (CARF) and the revised Common Reporting Standard (CRS 2.0) into binding EU law, targeting an estimated €1.4 billion in annual lost tax revenue from unreported crypto transactions.

Under DAC8, Reporting Crypto-Asset Service Providers (RCASPs), which include centralized exchanges, custodial wallet providers, brokers, and certain decentralized finance (DeFi) platforms that maintain functional control over user access, must identify their EU-resident users, verify their tax residencies, collect their Taxpayer Identification Numbers (TINs), and report their transactional data annually. The reporting scope is comprehensive, covering crypto-to-fiat exchanges, crypto-to-crypto swaps, transfers to unhosted wallets, and retail payment transactions. Crucially, DAC8 operates without any de minimis threshold, meaning that any transaction or account balance above zero is reported.

The enforcement mechanisms of DAC8 are particularly stringent. If a user fails to supply the required self-certification or a valid TIN, the platform is legally obligated to issue two formal reminders. If the user does not comply within 60 days of the second reminder, the platform must block their account from performing any reportable transactions, restricting usage strictly to withdrawals. Non-compliant platforms face administrative fines ranging from €20,000 to €500,000 and the potential revocation of their operating licenses. Data collection commenced on January 1, 2026, with the first reports due from platforms to national authorities by January 31, 2027, or June 30, 2027, depending on the member state's specific guidelines. The first automatic exchanges between EU tax administrations will take place on September 30, 2027, covering the entire 2026 calendar year.

This European transparency layer operates in tandem with a broader global rollout of the OECD's CARF, which utilizes the same XML reporting schema and database structures. Over 75 jurisdictions have committed to CARF, which is being implemented in distinct waves, ensuring that offshore tax havens are integrated into the global reporting network.

National Tax Policies and Non-Compliance Penalties Within the EU

While DAC8 standardizes the collection and exchange of data across the EU, it does not harmonize tax rates or domestic classifications of digital assets. Member states continue to apply highly heterogeneous tax regimes, and their respective tax administrations have established specific, severe penalties for taxpayers who fail to accurately declare their digital asset income.

• Germany: Germany does not treat cryptocurrencies as capital assets, classifying them instead as private money. Gains from the sale of digital assets are completely tax-free if the assets are held for longer than 12 months within private portfolios; if held for less than one year, gains are taxed at the taxpayer's progressive income tax rate. Under Germany's transposition of DAC8 via the Crypto-Asset Tax Transparency Act (KStTG), any failure to disclose taxable transactions will trigger retrospective income tax reassessments, an annual interest penalty of 1.8% on the unpaid tax liability, and potential criminal charges for deliberate tax evasion.
• Italy: Italy imposes a flat capital gains tax rate of 33% on crypto-asset profits exceeding a statutory threshold of €2,000 within a tax year. If an Italian resident fails to declare their crypto holdings or transactions, the authorities can impose administrative penalties ranging from 90% to 180% of the unpaid tax amount, in addition to interest charges.
• France: French tax residents are subject to a flat tax rate of 30% (a 12.8% income tax component and 17.2% in social levies) on private digital asset gains. French tax law requires the mandatory declaration of all foreign crypto exchange accounts via Form 3916-bis. Taxpayers who deliberately conceal accounts or transactions face a 40% surcharge plus interest, escalating to an 80% surcharge in cases of established fraud.
• Spain: Spain taxes digital asset capital gains under a progressive scale ranging from 19% to 28%. Spanish tax authorities use DAC8 data to automatically cross-reference transactions against individual personal income tax returns (IRPF), and the burden of proof is shifted to the taxpayer to reconcile discrepancies. Penalties reach 50% of the unpaid tax for negligent non-reporting, rising to 150% where Hacienda determines intentional concealment. Discrepancies exceeding €120,000 carry criminal prosecution for tax fraud.
• Cyprus: Under the 2026 tax reform package effective January 1, 2026, Cyprus introduced dedicated rules under Article 20E of the Income Tax Law. Eligible individual tax residents can elect to tax crypto disposal profits, including fiat sales, swaps, gifting, and retail payments, at a flat rate of 8%. Capital gains from crypto assets listed on recognized exchanges remain 100% exempt for casual private investors, while active staking and mining rewards fall under standard progressive bands (0–35%) or corporate income tax (raised from 12.5% to 15% in 2026). Under-declaration triggers audits, a 3.50% statutory late-payment interest rate, and administrative surcharges.
• Greece: Greece lacks a crypto-specific income-tax line, requiring taxpayers to declare digital assets as "securities" under general personal returns. Capital gains from crypto transfers are taxed at a flat 15%; systematic professional trading is taxed under progressive business income rates (9% up to 44%). Investors log activity in Form E1 under Code 743 (acquisitions), Code 781 (sales), and Code 865 (capital gains); losses (Code 871) offset gains and carry forward for 5 years. Late or inaccurate filings trigger fines of 10%–50% of the unreported tax, rising to a flat 50% for non-filing, plus 8.76% annual interest.
• The Netherlands: The Netherlands does not levy a standard capital gains tax on individual investors. Crypto is declared as a wealth asset in "Box 3" based on fair market value on January 1st. In 2026, Box 3 rules assume a fictitious 6.00% return on "investments and other assets," taxed at 36%, an effective rate of roughly 2.16% on total portfolio value above a €59,357 allowance. A Supreme Court-approved actual-return rebuttal scheme allows paying 36% only on actual gains where returns are lower. Professional trading, mining, or crypto wages shift the obligation to "Box 1" progressive bands (up to 49.5%). Intentional Box 3 errors carry an automatic 150% fine (75% for gross negligence).
• Malta: Under Malta's Blockchain Tax Guidelines, treatment relies on token classification. Casual private investors enjoy a 0% capital gains tax on standard "Coins" (like BTC and ETH) and utility tokens, as they are not deemed securities. Security tokens with profit-participating or dividend-like rights follow standard capital gains rules. Professional trading under the "badges of trade" analysis is taxed as trading income at up to 35%, though Malta's full imputation system can reduce the effective corporate rate on distributed dividends to between 5% and nil. Resident non-domiciled individuals are exempt from Maltese tax on foreign-sourced capital gains, even if remitted. Unpaid balances incur late interest of 0.6% per month (7.2% annually).

Operational Directives for Platforms and Taxpayers

• Verify and document tax residency status. Expatriates and international residents must establish their tax residency under local laws and bilateral Double Taxation Agreements (DTAs), documenting physical presence and economic ties using the OECD Article 4 tie-breaker cascade to support residency claims during audits.
• Conduct thorough account and data audits. Gather complete historical transaction data across all centralized exchanges, custodial wallets, and on-chain protocols. CARF-compliant software can help reconcile cost basis records and identify discrepancies before data is automatically exchanged in 2027.
• Address past discrepancies proactively. Taxpayers with undeclared income from prior years should consider domestic voluntary disclosure programs. Disclosing before host authorities receive the automated 2026 dataset can reduce surcharges and minimize criminal audit risk.
• Complete KYC and TIN verification. Users of EU-regulated platforms (or non-EU platforms serving EU residents) must confirm their correct TINs are on file to prevent mandatory account blocks.
• Update corporate balance-sheet accounting. Ensure the treatment of stablecoins aligns with the definitions under the GENIUS Act and GAAP. Stablecoins issued by non-permitted or unregulated entities cannot be classified as cash or cash equivalents.

How Ondology Labs Can Help

DAC8 makes on-chain activity permanently legible to tax administrations, and the same analytics regulators use to cross-reference returns can help firms and investors get ahead of it. Ondology Labs provides Cyprus-based DAC8 reporting support: applicability scoping, aggregation and valuation of reportable transactions, and a reporting dataset reconciled to the chain and the books before automatic exchange begins, backed by blockchain auditing and forensic transaction tracing. For CASPs navigating both DAC8 and the closing MiCA transition window, that is the difference between audit-ready and exposed.

Read Part 1: The GENIUS Act and the tax status of digital assets, or continue to Part 3: How DAC8 and CARF affect international expats in the EU.

Related reading: Crypto reporting obligations in Cyprus: DAC8, MiCA, AML and the 8% tax · DAC8 and CARF: a crypto tax guide for EU expats · Crypto audits in 2026: the new standard

For international tax residents residing in the EU, the operational launch of DAC8 and its global integration with CARF eliminate the geographic and informational insulation that previously characterized cross-border digital asset holdings, through the free exchange of information between crypto service providers. Following the OECD's endorsement of CARF, the European Union pledged to adopt the rules beginning January 1, 2026, for all EU Member States, and they are now in effect.

Tax residency in international law is determined by physical presence, center of vital interests, and treaty tie-breaker rules, subjecting individuals who reside in an EU member state to unlimited tax liability on their worldwide income, regardless of the physical location of the exchange or wallet.

Figure 1: How global tax reporting applies to U.S., Indian, UAE and Singaporean expatriates who are EU tax residents

1. United States Citizens Residing in the EU

U.S. citizens living within the European Union are subject to a complex, dual-layered tax reporting structure. Because the United States enforces citizenship-based taxation, U.S. citizens must report and pay taxes on their worldwide income to the IRS regardless of their actual country of physical residence. When residing in an EU member state, they are simultaneously classified as local tax residents, subjecting their worldwide digital transactions to the unlimited fiscal jurisdiction of their host European nation.

From a compliance perspective, these individuals are monitored through two distinct regulatory frameworks. Any European or offshore exchange used by a U.S. citizen will collect their host EU nation's TIN and report all transactions to the local European tax authority under DAC8. Simultaneously, under FATCA, foreign financial institutions must identify and flag U.S. persons, automatically reporting their account details and balances to the IRS. If these individuals use U.S.-based digital asset brokers, their transactions will be reported to the IRS on Form 1099-DA.

To avoid double taxation, U.S. citizens must claim the Foreign Tax Credit (FTC) on Form 1116, offsetting their U.S. federal tax liability by the amount of tax paid to their host EU country. However, because of differences in tax timing, such as Germany exempting gains after one year while the U.S. continues to tax long-term capital gains at rates up to 20%, taxpayers can face significant cash-flow and reporting mismatches.

Additionally, a U.S. citizen who attempts to expatriate to resolve this dual-reporting burden may be classified as a "covered expatriate" if their net worth exceeds $2 million or their average annual net income tax liability exceeds statutory thresholds. This classification triggers the U.S. Exit Tax, which treats all worldwide holdings, including all cryptocurrency and stablecoin positions, as if they were sold at fair market value on the day before expatriation, realizing immediate capital gains taxes on all unrealized paper profits.

2. Indian Citizens Residing in the EU

Indian nationals who relocate to the EU and meet local physical residency requirements (such as Slovakia's 183-day presence rule or Estonia's rolling 12-month domestic test) must report and pay taxes on their global income, including all digital asset transactions, within their host EU country.

This creates a significant mismatch with the domestic tax rules of their home country. In India, digital assets are subject to a flat 30% tax rate with no option to offset losses, alongside a 1% Tax Deducted at Source (TDS) on domestic transactions. Since India is classified as a non-committed jurisdiction under the OECD's CARF, Indian domestic exchanges are not currently participating in the automatic exchange of data with EU member states, creating a temporary informational gap.

However, this gap is narrow and carries high compliance risks. As EU tax residents, Indian nationals are legally required to self-report all foreign assets and worldwide transactions. If an EU tax authority detects undeclared transactions on Indian platforms (during an audit or through blockchain analytics tracking transfers to an EU custodial exchange), the taxpayer faces severe non-disclosure penalties. Administrations such as the Spanish Hacienda can apply indirect audit methods, assessing tax based on the unexplained accretion of wealth, resulting in administrative surcharges of up to 150% and potential criminal prosecution.

3. United Arab Emirates Residents Residing in the EU

The United Arab Emirates has become a prominent hub for digital assets due to its highly favorable domestic tax policy, which features a 0% personal income and capital gains tax on individual investors. While corporations are subject to a 9% federal corporate tax on profits exceeding AED 375,000, entities operating in free zones like the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM) can maintain a 0% corporate rate on qualifying activities, such as proprietary trading, by demonstrating physical substance.

However, if a UAE national or expatriate establishes physical residency in the EU, the UAE's tax-free status is nullified. The individual's worldwide transactions are immediately subject to the tax rates of their host EU country. Any assumption that transactions executed on UAE platforms will remain hidden is outdated. The UAE is a signatory to the CARF MCAA, with mandatory data collection commencing in 2027 and automatic cross-border exchanges with EU tax authorities starting in 2028.

Consequently, any digital asset activity conducted on UAE-regulated exchanges (such as those authorized by Dubai's Virtual Assets Regulatory Authority or Abu Dhabi's FSRA) by an EU tax resident will be automatically reported to their home EU tax authority by 2028. Failure to declare these transactions during 2026 and 2027 will lead to retrospective audits and significant non-compliance penalties once the CARF data exchange begins.

4. Singaporean and Asian Residents Residing in the EU

Singapore operates under a territorial tax framework and does not impose a general capital gains tax on personal investments. Gains from the disposal of digital payment tokens are tax-free for individual investors, provided the transactions are classified as private investment rather than an active trade or business. If the Inland Revenue Authority of Singapore (IRAS) determines that activity constitutes a business (evaluated using "badges of trade" such as holding periods, transaction frequency, and commercial intent), profits are taxed as ordinary income at progressive rates up to 24% for individuals, or a flat 17% corporate tax rate for companies.

For a Singaporean or Asian resident who relocates to the EU, Singapore's capital gains tax exemption does not carry over. As an EU tax resident, their worldwide income is taxable under the progressive or flat-tax structures of their host country, regardless of whether Singapore classifies the activity as private investment.

Operationally, Singapore signed the CARF MCAA in November 2024, with mandatory data collection starting in 2027 and automatic data exchanges scheduled for 2028. The IRAS is actively preparing its data pipelines to extract and format transaction-level details into the required OECD XML format. As a result, all transaction records, taxpayer identities, and year-end balances held by EU residents on Singaporean exchanges or custodial platforms will be transmitted directly to European tax authorities, exposing undeclared assets to tax audits and retrospective penalties.

Operational Directives for EU-Resident Expats

• Submit TIN and onboarding verifications proactively. Supply correct, up-to-date TINs and completed self-certification forms to every crypto-asset platform you use. Failure to comply within 60 days of a platform's second reminder legally mandates locking the account from any further transactions.
• Reconcile cost basis and consolidate activity early. Reconcile historical ledger entries across centralized exchanges, DeFi protocols, and unhosted wallets using CARF-compatible tax tools to preempt discrepancies before automatic exchanges on September 30, 2027.
• Evaluate and clear prior-year under-declarations. For undeclared gains from years preceding DAC8, coordinate with a qualified tax advisor to pursue a voluntary disclosure correction, which significantly reduces penalty multipliers compared to audits triggered after 2026 dataset transmissions.
• Establish genuine residency and track day counts. Meticulously document physical day counts, local lease agreements, family center of vital interests, and professional ties to establish a defensible primary tax residency under OECD tie-breaker criteria, using DTAs to mitigate double taxation.
• Prepare for Wave 2 cross-border transfers. Expatriates from the UAE and Singapore must prepare for automated CARF reporting starting in 2028, auditing foreign accounts to confirm all holdings have been fully declared in their home EU jurisdiction.

The implementation of DAC8, in alignment with the OECD's global CARF, marks the end of reporting opacity for European Union tax residents and expatriated international residents alike. By transposing transaction-level data collection directly into binding EU law, the EU has established an automated, cross-border database-matching framework that replicates standard banking transparency. While the first automatic exchange (covering 2026) occurs in 2027, the operational architecture went live on January 1, 2026, meaning all current on-chain and centralized activity is already generating a verifiable paper trail.

How Ondology Labs Can Help

For expats, the hardest part is proving a clean, coherent transaction history across years of cross-border, multi-exchange activity. Ondology Labs uses the same-grade blockchain forensics and transaction tracing that tax authorities rely on, reconstructing fund flows across chains, wallets, and jurisdictions, paired with DAC8 and tax reporting support to document cost basis and residency-relevant activity with court-ready rigor. If you are an EU tax resident preparing for automatic exchange, that evidence is what turns a potential audit into a straightforward reconciliation.

Catch up on Part 1: The GENIUS Act and the tax status of digital assets and Part 2: The DAC8 directive and the EU's transparency dragnet.

Related reading: The DAC8 directive: the EU's crypto tax transparency dragnet · Crypto reporting obligations in Cyprus · The GENIUS Act and the tax status of digital assets

While many tokenized assets (particularly those tied to equity, debt, or yield) clearly fall within securities frameworks, a growing subset of decentralized finance RWA tokens is being structured to sit outside those frameworks.

For founders, asset issuers, and platforms, understanding these distinctions is no longer optional. It is central to regulatory strategy, especially in tightly supervised jurisdictions such as Cyprus and Germany.

The Core Regulatory Principle

Across jurisdictions, regulators apply a consistent test. A token is likely to be a security if it involves:

• An investment of capital
• An expectation of profit
• Reliance on the efforts of a third party

In the United States, this is formalized through the Howey Test. In Europe, similar logic is embedded within MiFID II and national securities laws.

Common Triggers for Security Classification

Tokens are typically classified as securities when they include:

• Profit-sharing mechanisms (dividends, yield)
• Interest payments or revenue rights
• Pooled investment exposure
• Expectation of capital appreciation
• Active management by an issuer

If these elements are absent, a token may fall outside securities regulation, though never outside regulation entirely.

Five RWA Token Categories That May Avoid Securities Classification

1. Commodity-Backed Tokens

Commodity-backed tokens represent direct ownership or claim over a physical asset such as gold, oil, or agricultural goods.

These tokens function similarly to:

• Warehouse receipts
• Commodity certificates
• Digital bearer instruments

Holders typically have redemption rights or direct ownership claims, but no expectation of profit generated by an issuer.

Regulatory Outcome: Often classified as commodities or property rights, not securities.

2. Asset-Backed Payment or Settlement Tokens

These tokens are designed primarily for value transfer and settlement, not investment.

Examples include:

• Gold-backed settlement tokens
• Government bond-backed stable-value instruments

Key characteristics:

• Redeemable against underlying reserves
• Stable value orientation
• No yield, dividends, or profit-sharing

Regulatory Outcome: Typically treated under e-money, payment, or stablecoin frameworks (e.g., MiCA), rather than securities law.

3. Utility Tokens Linked to Physical Infrastructure

Some RWA tokens provide access to real-world services, rather than financial exposure.

Examples include:

• Energy grid access tokens
• Compute or storage capacity tokens
• Telecom or bandwidth tokens

The critical distinction lies in intent of use:

• If purchased for consumption → likely utility
• If marketed for profit → risk of being classified as a security

Regulatory Outcome: Potentially utility tokens, but classification is highly sensitive to marketing and user behavior.

4. Direct Property Ownership Tokens

In certain jurisdictions, tokens can represent direct ownership of real estate or physical assets, linked to official registries.

Unlike traditional real estate tokenization:

• No intermediary SPV (Special Purpose Vehicle)
• No shares or profit participation
• Direct legal ownership encoded digitally

Regulatory Outcome: May be treated as property ownership, not securities, provided legal recognition exists.

5. Digital Certificates of Ownership

These tokens function as digital registries, recording ownership of assets such as:

• Art and collectibles
• Inventory and goods
• Carbon credits

They do not pool capital or generate returns.

Regulatory Outcome: Typically classified as recordkeeping tools, not financial instruments.

What Is Considered a Security in Cyprus and Germany?

Cyprus (CySEC Framework)

In Cyprus, securities classification aligns with EU MiFID II standards, enforced by the Cyprus Securities and Exchange Commission (CySEC).

A token is likely a security if it qualifies as a transferable security, including:

• Shares or equity-like instruments
• Bonds or debt instruments
• Units in collective investment schemes

Additionally, Cyprus places strong emphasis on:

• Economic substance over form
• Whether investors expect returns
• Whether an issuer actively manages the asset

Implication: Even if a token is labeled as a "utility" or "RWA token," CySEC will assess actual economic function, not branding.

Germany (BaFin Approach)

Germany applies one of the strictest interpretations in Europe through BaFin.

BaFin may classify tokens as:

• Financial instruments
• Investment assets (Vermögensanlagen)
• Or securities under the German Securities Trading Act

Germany focuses heavily on:

• Transferability
• Tradability on secondary markets
• Investor expectations of return

Notably: Even non-traditional structures can fall under regulation if they resemble investment products in practice.

The Compliance Challenge: Design vs Reality

A recurring issue in RWA tokenization is the gap between token design and real-world usage.

A token may be structured as a utility or commodity. But if it is:

• Marketed as an investment
• Traded speculatively
• Associated with expected returns

It may still be classified as a security in practice.

This is particularly relevant in jurisdictions like Germany and Cyprus, where regulators prioritize economic reality over technical structure.

The Need for Regulatory Vigilance

As MiCA comes into force across the EU, the margin for misclassification is narrowing.

Crypto firms and tokenization platforms must adopt regulatory vigilance across three core areas:

1. Continuous Legal Monitoring

Regulatory interpretations are evolving rapidly. Staying up-to-date with guidance from CySEC, BaFin, and ESMA is essential.

2. Robust Compliance Frameworks

Firms must implement:

• Clear token classification methodologies
• Legal reviews aligned with MiCA and MiFID II
• Internal governance structures

3. Reporting and Transparency

Proper reporting frameworks must be established, including:

• Transaction monitoring
• Disclosure of token rights and risks
• Audit trails for asset backing and ownership

Without these controls, even well-designed token models risk regulatory intervention.

RWA tokenization does not eliminate regulatory obligations. It redefines them. While certain token structures can fall outside securities classification, the determining factor remains unchanged: the economic relationship between issuer and holder.

For firms operating in Europe, especially in regulated environments like Cyprus and Germany, the challenge is no longer just innovation, but precision in legal design and compliance execution.

As the market matures, those who align token architecture with regulatory expectations will gain a durable advantage in an increasingly institutionalized digital asset ecosystem.

How Ondology Labs can help: Token classification lives or dies on economic substance. We provide blockchain auditing and forensic transaction analysis to evidence how a token actually behaves.

Related reading: MiCA's closing transition window · The GENIUS Act and digital-asset tax.

Since December 2024, MiCA is now fully in force across the European Union, creating the first comprehensive regulatory framework for crypto-asset markets within a major economic bloc. However, this regulatory milestone came with a transition period intended to give existing firms time to adapt.

For many firms, the window is rapidly closing.

While several exchanges and custodians continue servicing EU clients under national registrations, this temporary privilege will expire across much of the Eurozone by July 1, 2026, marking the end of the transition period.

From Regulatory Arbitrage to a Unified Market

Prior to MiCA, the European crypto landscape resembled a patchwork of national regimes.

Germany imposed one of the strictest frameworks, requiring financial-grade custody licenses. France offered an optional PSAN registration regime, while Lithuania became known for a relatively light-touch approach.

This environment enabled firms to select jurisdictions based on regulatory flexibility rather than operational robustness. MiCA effectively eliminates that strategy.

Under the new framework, crypto firms must obtain authorization as Crypto-Asset Service Providers in one EU member state. Once approved, they can passport services across all 27 EU countries, creating a single, unified market.

However, the bar for authorization is significantly higher than most national frameworks. Firms must now demonstrate robust governance structures, capital adequacy, operational resilience, and custody safeguards.

For many startups that previously relied on lighter licensing regimes, this represents a profound structural shift.

The Misunderstood Deadline

The widely cited July 2026 deadline is often misunderstood.

MiCA does not impose a uniform transition timeline. Instead, Article 143(3) allows individual member states to determine the length of their transition periods.

As a result, Europe has entered a multi-speed compliance environment, divided into three regulatory zones.

• The Expired Zone: Countries including the Netherlands, Finland and Hungary opted for a short six-month transition period that ended in June 2025. In these jurisdictions, full MiCA authorization is already mandatory.
• The Mid-Transition Zone: Germany, Ireland and Lithuania allowed a 12-month transition period ending in December 2025.
• The Maximum Window: France, Italy, Luxembourg and the Czech Republic implemented the full 18-month grace period, which expires on July 1, 2026. Spain also extended its deadline to July 2026.

Crucially, grandfathering rights are national in scope. A platform registered in France may continue serving French clients until July 2026, but it cannot passport services into Germany if Germany's transition period has already ended.

This nuance has created operational complexity for exchanges attempting to scale across Europe.

Stablecoins and Hidden Compliance Risks

Another area where companies frequently miscalculate compliance risk is the intersection between MiCA and existing payment regulations.

MiCA introduces specific categories for stablecoins, namely Electronic Money Tokens (EMTs) and Asset-Referenced Tokens (ARTs). However, stablecoin issuance and payment flows can also fall under the Payment Services Directive (PSD2).

Failing to account for both regimes simultaneously can expose firms to regulatory gaps.

For example, a stablecoin platform may comply with MiCA's reserve requirements yet inadvertently trigger PSD2 licensing obligations if its services resemble payment processing.

This regulatory overlap remains one of the most complex compliance challenges facing crypto startups in Europe today.

What MiCA Means for Cyprus

For Cyprus, MiCA represents both a challenge and an opportunity.

The island has positioned itself as an emerging fintech hub within the EU, hosting a growing number of crypto firms. Under the new framework, oversight of crypto service providers will fall under the Cyprus Securities and Exchange Commission (CySEC).

CySEC will now supervise CASP licensing, operational compliance and market conduct in line with MiCA standards.

For firms operating from Cyprus, the regulation introduces several critical requirements:

• Establishing substantive operations within the EU, including real management and governance structures.
• Implementing segregated custody systems to protect client assets.
• Maintaining transparent reporting and risk management frameworks.

At the same time, companies that successfully obtain authorization through Cyprus gain access to passporting rights across the entire EU market, significantly expanding their potential client base.

As such, Cyprus may become an increasingly attractive jurisdiction for firms seeking long-term regulatory certainty within the European digital-asset ecosystem.

The Role of Forensic Vigilance

As MiCA transitions from policy to enforcement, forensic vigilance will become a cornerstone of regulatory compliance.

Regulators are expected to intensify monitoring of crypto-asset transactions, custody operations and suspicious activity reporting frameworks.

For crypto service providers, this means implementing:

• Continuous blockchain transaction monitoring
• Suspicious activity detection systems
• Clear reporting protocols aligned with CySEC and EU AML directives
• Transparent asset-segregation audit trails

The importance of forensic monitoring extends beyond regulatory compliance. It also strengthens market integrity by detecting fraud, insider manipulation and illicit financial flows.

Without robust monitoring frameworks, even fully licensed platforms risk regulatory scrutiny or operational disruptions.

A Structural Shift for the Crypto Industry

For investors and institutional participants, regulatory maturity is quickly becoming a primary risk metric.

Key indicators of readiness now include:

• Verified CASP authorization status in regulatory registers
• Demonstrated EU operational substance
• Transparent custody and asset segregation frameworks
• Robust monitoring and reporting systems

The closing of the MiCA transition window will likely trigger significant market consolidation.

Platforms that secure authorization will gain a powerful competitive advantage. Those that fail to meet the new regulatory threshold may quietly exit the European market.

The Road Ahead

MiCA marks the beginning of a new phase in the evolution of the crypto industry.

The European market is rapidly shifting away from lightly regulated offshore structures toward institutional-grade regulatory environments.

For crypto firms operating in the Eurozone, and particularly in emerging hubs like Cyprus, the months leading up to July 2026 will be decisive.

The companies that survive the transition will be those that successfully combine regulatory compliance, operational resilience, and forensic transparency in an increasingly scrutinized financial ecosystem.

How Ondology Labs can help: MiCA rewards firms that can prove compliance. We provide blockchain auditing (proof of reserves, reconciliation and AML audits) plus forensic monitoring for CASPs.

Related reading: The EU's DAC8 crypto tax directive · Which RWA tokens are not securities.

In its submission to Congress, the Treasury acknowledged that crypto mixers, services designed to anonymize and obscure blockchain transaction trails, can serve legitimate privacy needs for users operating within the law.

The development represents a subtle but important shift in tone from previous enforcement-first approaches that targeted mixers such as Tornado Cash. Instead of treating privacy technologies as inherently suspect, regulators are beginning to recognize a more nuanced reality.

Recognizing Lawful Uses of Crypto Mixers

The Treasury report highlights that mixers may lawfully be used to protect sensitive financial information on public blockchains. Individuals and organizations may rely on such tools to shield the visibility of their balances, counterparties, and transaction histories.

However, this recognition is conditional. According to the Treasury's guidance, mixers could be considered legitimate when paired with safeguards such as record-keeping requirements, compliance protocols, and the ability to support investigations when necessary.

This "conditional legitimacy" effectively establishes a regulatory exception: privacy tools themselves are not unlawful, but their design and operation must support accountability and traceability when required.

For blockchain developers and service providers, this implies that privacy features must be architected with compliance in mind, a paradigm often described as "privacy with auditability."

Congress Faces Pressure to Clarify DeFi AML Obligations

Alongside acknowledging legitimate uses for mixers, the Treasury urged Congress to address several regulatory gaps in the decentralized finance (DeFi) ecosystem.

One major recommendation is to clarify which DeFi participants (such as developers, validators, front-end operators, or governance bodies) should be subject to anti-money laundering (AML) obligations.

Current frameworks were largely designed for centralized financial intermediaries. As DeFi protocols operate through distributed software and autonomous smart contracts, determining regulatory responsibility becomes significantly more complex.

By clarifying AML expectations for DeFi actors, regulators aim to ensure that decentralized platforms do not become systemic blind spots in the global financial system.

Advancing Privacy-Preserving Digital Identity

Another key element in the Treasury's recommendations is the development of privacy-preserving digital identity tools. These technologies could allow users to prove compliance with regulatory requirements without exposing unnecessary personal data.

Zero-knowledge proofs and decentralized identity frameworks are frequently cited as potential solutions. Such systems allow users to verify attributes (e.g., being a verified customer or residing in a permitted jurisdiction) without revealing the underlying information.

For regulators, these tools may represent a path toward balancing financial surveillance concerns with civil liberties.

Considering New Powers to Freeze Suspicious Digital Assets

The Treasury report also proposed that lawmakers consider introducing a digital-asset "hold law."

This mechanism would allow financial institutions and service providers to temporarily freeze suspicious crypto transactions while investigations are conducted.

Such powers would mirror existing controls in traditional finance, where banks may halt transfers flagged by anti-money laundering systems.

However, implementing these capabilities in decentralized environments presents practical challenges. Unlike banks, DeFi protocols often lack centralized administrators capable of freezing funds.

This regulatory tension, between decentralized architecture and compliance enforcement, will likely remain a central policy debate in the coming years.

The Need for Forensic Vigilance in a Privacy-Enhanced Ecosystem

While regulators move toward acknowledging legitimate privacy tools, the risks associated with mixers remain substantial.

Blockchain analytics firms and law enforcement agencies have repeatedly observed illicit actors using mixers to launder proceeds from cyberattacks, ransomware campaigns, and cross-border sanctions evasion.

In this environment, forensic vigilance becomes critical. Effective oversight will require:

• Continuous blockchain transaction monitoring
• Cross-platform analytics capable of identifying obfuscation patterns
• Real-time alerting systems for suspicious activity
• Structured reporting frameworks aligned with AML compliance obligations

Monitoring must extend beyond centralized exchanges to include DeFi protocols, bridges, and privacy-enhancing services where illicit actors may attempt to obscure asset flows.

Without robust forensic capabilities, privacy-enhancing technologies could inadvertently create new blind spots for financial crime investigations.

Toward a Balanced Framework

The Treasury's evolving stance on mixers reflects a broader reality confronting regulators worldwide: blockchain transparency creates unprecedented visibility, yet it also raises legitimate concerns about financial privacy.

The policy path emerging in the United States suggests a balanced framework, one that neither bans privacy technologies outright nor allows them to operate without accountability.

Achieving that balance will depend on the strength of investigative infrastructure across the digital-asset ecosystem. In practice, this means deploying advanced blockchain analytics, establishing standardized compliance procedures, and ensuring that suspicious activity reporting mechanisms evolve alongside the technology.

The Treasury's recognition that crypto mixers can serve lawful purposes marks a notable shift in regulatory thinking. Yet the acknowledgment comes with clear expectations: privacy tools must coexist with accountability.

As policymakers work to define AML obligations for DeFi, advance privacy-preserving identity systems, and consider new powers to freeze suspicious assets, the role of forensic monitoring will only become more central.

In the emerging regulatory environment, privacy and transparency are no longer opposing forces. They are two pillars that must be engineered to coexist within a resilient and accountable blockchain ecosystem.

How Ondology Labs can help: Privacy-with-accountability depends on strong monitoring. We provide blockchain forensics and transaction monitoring plus independent blockchain auditing across chains and DeFi.

Related reading: The EU privacy-token ban · The GENIUS Act and digital-asset tax.

This sharp rise is not just a statistic. It signals a structural shift in how cybercriminals operate and how defenders must respond.

Against this backdrop, a new partnership between Ondology Labs and Cyberfraud Investigators reflects a broader industry evolution: the convergence of cyber intelligence and blockchain forensics to combat time-sensitive digital asset crimes.

The New Reality of Ransomware in Crypto

Ransomware has evolved from opportunistic attacks into highly coordinated, professionalized operations.

According to Chainalysis data, several key trends define the current threat landscape:

• Higher attack frequency: A 50% increase year-over-year reflects expanding attacker capabilities
• Crypto-native laundering: Funds are rapidly moved across wallets, bridges, and obfuscation tools
• Shorter response windows: The time between attack and asset dispersion continues to shrink
• Target diversification: Beyond enterprises, attackers increasingly target SMEs and individuals

The implication is clear: traditional investigative timelines are no longer sufficient.

Once funds are moved through mixers, cross-chain bridges, or layered wallets, recovery becomes exponentially more difficult.

The Critical Role of Crypto Forensics

As ransomware actors adopt more sophisticated laundering techniques, blockchain forensic capabilities have become central to incident response.

Effective crypto investigations now require:

• Real-time transaction tracing across multiple blockchains
• Attribution analysis linking wallets to known threat actors
• Pattern recognition for identifying obfuscation techniques
• Actionable intelligence for law enforcement and asset recovery

Speed is the defining factor. Delays of even a few hours can allow attackers to fragment funds across dozens of wallets or exit into fiat systems. This is where specialized forensic teams play a decisive role.

Partnership Announcement: Ondology Labs × Cyberfraud Investigators

In response to this growing threat landscape, Ondology Labs and Cyberfraud Investigators have entered into a strategic partnership aimed at accelerating crypto incident response and asset recovery efforts.

With over two years of focused experience in blockchain forensics, Ondology Labs has built a strong track record delivering:

• Detailed crypto forensic reports
• Wallet tracing and fund flow reconstruction
• Investigative support for legal and enforcement actions

As part of this collaboration, Ondology Labs will power Cyberfraud Investigators with advanced crypto forensic capabilities, enhancing their ability to respond to crypto-related fraud cases with precision and speed.

The partnership is designed to address a critical gap in the market: the need for integrated cyber and blockchain investigations under a unified response framework.

Cyberfraud Investigators: Capabilities and Milestones

Cyberfraud Investigators has established itself as a growing force in cybercrime response across Cyprus and Greece, focusing on fraud prevention, digital investigations, and victim support.

Core Offerings

• Cybercrime investigations: Handling cases involving fraud, scams, and digital financial crimes
• Incident response services: Rapid engagement following cyberattacks or unauthorized transactions
• Victim advisory and support: Assisting individuals and organizations in navigating recovery processes
• Collaboration with authorities: Supporting law enforcement efforts with structured intelligence

Regional Expertise

Operating in Cyprus and Greece, Cyberfraud Investigators brings:

• Strong understanding of local regulatory environments
• Experience working within cross-border investigation frameworks
• Established presence in high-risk fraud corridors in the region

Growth and Positioning

In a relatively short period, the firm has:

• Built a reputation for responsive case handling
• Expanded its footprint across multiple jurisdictions in Southern Europe
• Positioned itself as a bridge between victims, investigators, and enforcement bodies

However, like many cyber investigation firms, the increasing complexity of crypto-related cases has necessitated specialized blockchain expertise, a gap this partnership directly addresses.

A Combined Force: Speed as a Competitive Advantage

The collaboration between Ondology Labs and Cyberfraud Investigators is built around a single operational principle: time is the most critical variable in crypto asset recovery.

By combining Cyberfraud Investigators' frontline incident response and case management with Ondology Labs' deep blockchain forensic capabilities, the partnership enables:

• Faster identification of attacker wallets
• Immediate tracing of stolen funds
• Structured reporting for law enforcement and legal proceedings
• Improved chances of asset recovery before funds are irreversibly dispersed

This integrated approach significantly reduces the traditional lag between incident detection and forensic action.

The Broader Industry Signal

The rise in ransomware activity is not an isolated trend. It reflects the increasing financialization of cybercrime through crypto infrastructure.

As a result:

• Cybersecurity alone is no longer sufficient
• Compliance frameworks must incorporate forensic readiness
• Incident response must evolve into multi-disciplinary operations

Partnerships like Ondology Labs × Cyberfraud Investigators signal a shift toward specialized, collaborative defense models.

Conclusion

The 50% surge in ransomware attacks underscores a fundamental reality: crypto-enabled crime is accelerating, and response capabilities must evolve accordingly.

In this environment, the ability to act quickly, combining cyber intelligence with blockchain forensics, can determine whether stolen assets are traced and recovered or permanently lost.

By joining forces, Ondology Labs and Cyberfraud Investigators are positioning themselves at the forefront of this evolving battlefield, delivering faster, more precise, and more effective crypto investigation capabilities across Cyprus, Greece, and beyond.

How Ondology Labs can help: When funds move fast, forensics must move faster. We provide blockchain forensics, real-time tracing and crypto recovery for time-sensitive incident response.

Related reading: Inside the CoinDCX $44M hack · The U.S. Treasury's shift on crypto mixers.

CoinDCX described the incident as a "sophisticated social engineering attack" orchestrated by an actor posing as a recruiter, tricking Agarwal into installing malware on his device. Bengaluru police subsequently detained Agarwal, who consistently denied direct involvement in the theft, although admitting to freelance work for up to four external clients while still employed at CoinDCX. A suspicious deposit of roughly ₹15 lakh (~$18,000) into his personal account and an alleged WhatsApp call linked to Germany remain under scrutiny.

Source: X /@Smtgpt

Why forensic investigations are indispensable in such cases

• Deep system and endpoint forensic analysis

  It is essential to conduct a full forensic examination of the compromised laptop and server logs to trace malware installation, lateral movements, and unauthorized sessions. Such analysis is fundamental to distinguishing between insider culpability and remote exploitation.

• On‑chain tracing and fund flow reconstruction

  Advanced blockchain intelligence tools are vital to map the movement of funds across chains and exchanges. For example, platforms like Crystal Intelligence or TRM Labs aid investigators in piecing together how stolen assets traverse multiple wallets and obfuscation layers (Figure 1).

• Chain of custody and legal admissibility

  Maintaining an auditable chain of custody is non‑negotiable. Modern forensic frameworks, especially those integrating blockchain-based evidence management, ensure integrity and transparency in legal proceedings.

• Cross‑jurisdiction coordination

  Given that crypto transactions can span borders, forensic labs must collaborate with law enforcement in multiple countries to trace origins, identify beneficiaries, and freeze assets.

Figure 1: Flow visualization of an high-risk wallet address

Source: Crystal Intelligence

Hard Constraints, Not Hopes: The Programmable Custody Stack

• Account-abstraction wallets (ERC-4337) with policy-first design: passkey login → mint scoped session key → policy engine enforces who/what/where/how much.
• Device and context attestation at sign and at send (FIDO/WebAuthn, OS integrity). If posture fails, txn can't be constructed: no 'approve later' loopholes.
• Withdrawal-class segmentation: separate smart accounts (hot ops, warm treasury, cold vault), each with different policy ceilings and approval graphs.
• Live forensic hooks: every policy decision, signature, and session-key grant logged on-chain/off-chain for immediate investigation.
• Destination controls: whitelists, chain/asset allow-lists, time-locks on first-seen addresses; velocity + anomaly caps at the wallet layer.

These preemptive processes and post-event frameworks are paramount to providing an initial shield for customers' funds, as well as a quick response due to time sensitivity, which can prevent bigger losses in these cases. Ensuring coordination and cooperation from exchanges and law enforcement agencies on a national or global scale is equally as important, as these frameworks can serve as the foundations for catching fraudsters and identifying breaches in time to prevent them.

This was underlined by comments in July by Arthur Firstov, Chief Business Officer at Mercuryo (a payment service provider that enables users to buy cryptocurrencies using fiat currency via various payment methods), who said that CoinDCX didn't just suffer a $44M breach; it hit the limits of a non-programmable custody model. He went further to comment that "The fix isn't more training. It's wallet infrastructure that enforces policy by default."

Exchanges keep losing to social engineering because their wallets don't speak policy. Move the control plane into the wallet (via ERC-4337 smart accounts, passkeys, and scoped session keys), and your 'last mile' is code, not a compromised laptop. Privy's reach and Stripe's backing show this is going mainstream; Porto's policy model shows how to do it right. After CoinDCX, treating forensics and policy as infrastructure, not incident response, should be table stakes.

Selecting the right partner for crypto‑forensic resilience

In situations like the CoinDCX hack, timely and rigorous forensic engagement is the linchpin to uncovering attack chains and recovering assets. That's where Blockchain investigators and law enforcement come in. Offering high‑fidelity endpoint investigations, blockchain fund tracing, and legal‑compliant chain‑of‑custody frameworks, investigation experts and dedicated agents bridge the technical and evidentiary gaps in complex cryptocurrency breach cases.

Ondology Labs' insights: Broader implications for the industry

• Strengthened employee risk mitigation: Exchanges must enforce stricter access controls, regular security training, and monitoring to counter sophisticated social engineering.
• Regulatory pressure ahead: As high‑profile hacks accumulate, jurisdictions worldwide are likely to tighten oversight on crypto‑asset custodians and mandate forensic readiness.
• Reputation and trust resilience: Rapid engagement of reputable forensic experts post‑incident helps restore confidence among users and stakeholders.

Reminiscent of the recent major Bybit hack, which featured social engineering as well as the use of mixing, the CoinDCX breach illustrates the dual threats of insider access exploitation and orchestrated social engineering. As investigations continue, only comprehensive digital and blockchain forensic work can clarify responsibility, track fund flows, and support asset recovery. For exchanges, legal teams, and enterprises navigating such crises, turning to a forensic partner can be the decisive step from chaos to clarity.

How Ondology Labs can help: In a breach, speed decides recovery. We deliver blockchain forensics, fund-flow tracing and crypto recovery with legally admissible, court-ready evidence.

Related reading: The 2025 ransomware surge and crypto incident response · Blockchain forensics in Cyprus and Greece.

The European Union has finalized a sweeping Anti‑Money Laundering Regulation (AMLR) set to take effect in 2027, targeting anonymous crypto‑asset accounts and privacy‑preserving tokens like Monero (XMR) and Zcash (ZEC). Under Article 79, credit institutions, financial firms, and crypto‑asset service providers (CASPs) will be banned from facilitating anonymous accounts or handling privacy coins.

Implementation details, such as how providers must adapt internal processes, are still being shaped through "level‑two" implementing and delegated acts directed by the European Banking Authority.

Moreover, direct oversight will expand: AMLA will begin supervising at least 40 entities from mid‑2027, each with substantial operations across multiple EU states and meeting thresholds such as over €50 million in transaction volume or a minimum of 20,000 clients in a host country. Additionally, mandatory due diligence will kick in for transactions exceeding €1,000.

What This Means for Cyprus

Cyprus, a growing hub for blockchain and fintech firms, will need to ensure its CASPs comply with the new EU AMLR framework. As a result of this elevated regulatory scrutiny, providers offering privacy-coin services or anonymous account access face regulatory constraints that may require operational restructuring.

Additionally, compliance overhaul and cost pressures will arise as firms operating in Cyprus will need to overhaul onboarding, due diligence processes, and privacy-linked services. That may involve investing in enhanced identification protocols, now mandatory for any transactions over €1,000.

Conversely, CASPs that invest early in compliant infrastructure and demonstrate strong AML controls may gain trust among EU regulators and institutional clients. They'll be better positioned to scale under the upcoming AMLA oversight regime as they have done so earlier in 2025 with acquiring MiCA licenses.

Cyprus-based firms may increasingly be evaluated in cross-border AML risk assessments, meaning geopolitical and strategic considerations must be undertaken by foreign companies that also seek MiFID by acquiring these Cyprus-based firms (Figure 1). Ensuring transparency and cooperation with EU authorities could become a differentiating factor in an industry where trust is paramount.

Figure 1: Announcement of MiFID acquisition

Source: Crypto.com

Strategic Opportunity For Cyprus to Bridge Regulation and Innovation

As one of the European Union's most active jurisdictions for crypto-assets, Cyprus stands at a pivotal juncture. There is now a clear avenue for local CASPs and MiCA-licensed entities to redefine their value proposition, shifting toward a compliance-first infrastructure that guarantees both security and programmable transparency.

To achieve this, Cypriot institutions can leverage Porto-style programmable wallets. This technology serves as the connective tissue between MiCA's regulatory framework and AMLR's forensic necessities. It allows for the creation of robust financial products, such as tiered corporate wallets equipped with role-based permissions and automated limits. Furthermore, it facilitates cross-chain settlement with immutable compliance trails, granting regulators real-time visibility into policy enforcement while upholding strict client confidentiality.

In essence, Cyprus is becoming the EU's regulatory sandbox. By demonstrating that compliance frameworks can function in harmony with technological flexibility, Cypriot operators are setting a new standard. As the digital asset market matures, the institutions that integrate policy directly into their wallet architecture will secure their place as the ecosystem's most trusted operators.

During a recent interview with Arthur Firstov, Chief Business Officer at Mercuryo (a payment service provider that enables users to buy cryptocurrencies using fiat currency via various payment methods) mentioned that just as the EU's AMLR forces crypto to mature, Porto, for example, offers the missing architecture to make that maturity functional. When combined with Fireblocks' policy engines, Stripe's Privy infrastructure, and forensic intelligence tools from firms like Crystal Intelligence, Elliptic, or Global Ledger, programmable custody evolves into a full-stack compliance layer.

The post-2027 European market will belong to the firms that can prove trust algorithmically, where every wallet, transaction, and audit trail runs on verifiable logic instead of manual checks. Cyprus, with its fintech density and regulatory flexibility, is well-positioned to pilot that vision. Porto and similar programmable wallet frameworks could make the island not just compliant with EU oversight, but a global benchmark for compliant, composable finance.

Why Forensic Investigations Are Crucial Amid Heightened Regulation

With privacy tokens off-limits and anonymous accounts barred, forensic tools become essential in verifying the legitimacy of historical transactions and distinguishing between compliant activity and illicit flows. For CASPs audited by AMLA or subject to investigations, digital and blockchain forensics provide verifiable audit trails (Figure 2). They strengthen institutional defenses and show transparency to both regulators and clients.

In cases of fraud or unauthorized transfers, forensic analytics facilitate tracing and potentially recovering misappropriated funds, even when obfuscated by privacy-layered mechanisms. As anonymity recedes as a feature, user and investor confidence will lean heavily on forensic transparency. Firms effectively leveraging forensic capabilities can position themselves as secure and accountable.

Figure 2: Flow visualization of an high-risk wallet address

Source: Crystal Intelligence

Precision Forensics for a Regulated Future

In light of evolving EU AML mandates and the phasing out of privacy tokens, the role of forensic investigations cannot be overstated. Ondology Labs offers specialized digital forensic services and blockchain investigation frameworks that directly address these new regulatory challenges.

With expertise in endpoint investigations, onchain tracing, and legally robust chains of custody, Ondology Labs equips exchanges, fintech firms, and regulators to reconstruct complex transactional narratives, even when privacy-enhancing technologies were previously employed. Their blend of technical precision and compliance-readiness makes them an ideal partner for any entity operating under the AMLR's upcoming obligations.

The EU's 2027 ban on anonymous accounts and privacy tokens marks a pivotal shift in crypto regulation, aimed at enhancing transparency and combating illicit finance. For Cyprus, the mandate presents both compliance challenges and opportunities for leadership. Against this backdrop, forensic investigations emerge not only as instrumental tools for compliance and accountability but also as foundations for trust in a privacy-curtailed era.

As the crypto ecosystem adapts, partnering with expert forensic firms like Ondology Labs can mean the difference between regulatory entanglement and responsible, resilient growth.

How Ondology Labs can help: As anonymity recedes under the EU's AML regime, verifiable transaction trails become essential. We provide blockchain forensics and transaction tracing alongside blockchain auditing to keep CASPs audit-ready across Cyprus and Greece.

Related reading: The U.S. Treasury's policy shift on crypto mixers · The EU's DAC8 crypto tax directive.

What Blockchain Forensics Is

Every transaction on a public blockchain is permanent and visible to anyone. Blockchain forensics turns that public record into evidence: it links addresses into clusters controlled by the same party, attributes clusters to real-world entities such as exchanges and payment processors, and follows value as it moves through wallets, mixers, bridges and swaps. The output is not a hunch. It is a documented flow of funds with a methodology another expert can test.

The discipline is distinct from general blockchain analytics or compliance monitoring. Monitoring asks whether a transaction looks risky. Forensics asks what actually happened, in a form a court, a regulator or an insolvency practitioner can rely on. That difference shows up in the working papers: chain of custody for the data, stated assumptions, and honest limits on every attribution.

What It Can and Cannot Establish

Tracing can usually establish where funds went, which services they touched, and where they came to rest or were cashed out. When stolen funds reach a regulated exchange, tracing plus a legal process can identify the account holder and freeze what remains. That combination is behind most successful recoveries.

What tracing alone cannot do is name the person behind a private wallet. An address is not an identity. Attribution to a person needs an off-chain anchor: an exchange account opened with KYC, an IP log, a device, a slip in operational security. Any firm that promises to "unmask" a wallet from chain data alone is overselling, and we say so plainly in our transaction tracing work.

How an Investigation Runs

A competent engagement follows a chain. First the trace: transactions mapped across chains, clusters identified, exit points flagged. Then the investigation, where on-chain findings are combined with whatever off-chain material exists, such as exchange records, internal ledgers, correspondence and open-source intelligence; this is the shape of our corporate investigations. If funds are recoverable, the evidence supports freezing orders, police referral or civil claims through crypto asset recovery. And when a matter reaches court, the analysis is presented by an expert witness whose report sets out method, data sources and limitations so it survives cross-examination.

Speed matters more than most victims expect. Funds routed through a mixer or bridged to another chain within hours are far harder to follow, and exchanges can only freeze what has not yet been withdrawn. The practical playbook for the earliest hours is in our step-by-step guide, the first 24 hours after your crypto is stolen.

Who Does What in Cyprus

Cyprus has a defined institutional map for crypto crime, and using it correctly saves weeks.

• Cyprus Police: theft and fraud are reported to the police, whose cybercrime unit handles the digital side. A police report is also the anchor document that exchanges and insurers ask for.
• MOKAS, the Cyprus financial intelligence unit, receives suspicious transaction reports from obliged entities and can act on laundering flows; private victims do not file with MOKAS directly, but investigations often intersect with its work.
• CySEC supervises crypto-asset service providers under MiCA. Since the Article 143(3) transitional period ended on 1 July 2026, providing crypto-asset services from Cyprus without MiCA authorisation is unauthorised activity, which matters when the counterparty in your case is a local platform.
• The courts: Cyprus civil procedure supports freezing and disclosure relief, and blockchain evidence is presented through expert reports. The forensic work has to be built for that standard from the start, not upgraded afterwards.

Who Does What in Greece

• The Hellenic Police Cyber Crime Division investigates crypto fraud and theft; reports can be filed at local stations or through its online channels.
• The Hellenic FIU (the Anti-Money Laundering Authority) receives suspicious transaction reports and can freeze assets connected to laundering.
• The Hellenic Capital Market Commission (HCMC) is Greece's competent authority for crypto-asset service providers under MiCA, the counterpart to CySEC in Cyprus.

Because both countries apply the same EU framework, MiCA for authorisation and the EU anti-money-laundering rulebook for reporting, a trace built to Cypriot evidentiary standards travels well to Greek proceedings and vice versa. Cross-border cases inside the EU can also lean on European cooperation channels between police forces and FIUs.

The Cases Where Forensics Earns Its Keep

Four situations account for most of the forensics work we see in Cyprus and Greece. The first is theft from individuals: wallet drainers, fake trading platforms, romance-led investment fraud and compromised seed phrases, where the immediate questions are where the funds sit now and whether an exchange can still freeze them. The second is incidents at businesses: an exchange hack, an insider moving treasury funds, a payment sent to a spoofed address, where the trace runs alongside an internal investigation. The third is insolvency and disputes: a platform collapses or a counterparty claims the crypto is gone, and a liquidator or litigant needs the assets found and valued before any legal strategy makes sense. The fourth is ransomware, where speed dominates everything; the payment leaves in minutes and the tracing has to start the same day, a dynamic we covered in our analysis of the 2025 ransomware surge.

Each of those cases ends differently, and honesty about the likely ending is part of the job. A trace that shows funds sitting in a mixer with no exit is a real answer, even though it is not the answer anyone wanted. It stops the victim spending more money chasing what cannot be reached, and it is precisely the situation where "guaranteed recovery" firms do the most damage.

What Makes Blockchain Evidence Admissible

Courts in both jurisdictions accept blockchain evidence when it is presented properly, and the standards are the familiar ones for any expert evidence rather than anything crypto-specific. The data must be preserved with a chain of custody, so the analysis can be reproduced from the same inputs. The methodology must be explained: how clusters were formed, which attribution sources were used and how reliable each one is. Assumptions must be separated from findings, and the expert must stay inside their expertise, describing what the chain shows rather than arguing the legal conclusion. Reports written that way survive the other side's expert; reports written as advocacy do not.

This is also why forensic work should be built for court from day one even when litigation looks unlikely. Upgrading a quick informal trace into an evidential report after the fact usually means redoing it.

Choosing a Forensics Provider

Three questions separate serious providers from the rest. First, will the work survive scrutiny: is there a documented methodology, a chain of custody, and a named expert prepared to defend the findings in court? Second, does the provider state limits honestly, including the odds that nothing is recoverable? Third, who is actually behind the firm: a registered company with verifiable people, or a website with a contact form? We keep a verification page for exactly that check, and we encourage you to use it on anyone you consider engaging, including us.

How Ondology Labs can help: If you need to trace or recover stolen crypto, we provide blockchain forensics and crypto recovery backed by court-ready evidence across Cyprus and Greece.

Related reading: The first 24 hours after your crypto is stolen · What lawyers should look for in a crypto expert witness · Inside the CoinDCX $44M hack.