If No Exchange Account is Known
and Bank Records Come Up Empty,
Where Should Discovery Begin?
In the previous article, we examined how a careful review of bank records can reveal cryptocurrency-related activity that might otherwise go unnoticed. In many cases, those records will identify a relationship with a specific cryptocurrency exchange and provide a clear starting point for further discovery and, ultimately, forensic analysis and blockchain tracing.
Sometimes, however, even a thorough review of the available banking records fails to identify the exchange involved.
The absence of identifiable exchange transactions in bank records does not mean that cryptocurrency assets do not exist. Nor does it mean that the investigation has reached a dead end. Instead, it has reached a decision point. Discovery now shifts to identifying other institutions most likely to possess the necessary financial records.
This presents the next practical challenge for counsel: Where should discovery be directed when cryptocurrency ownership is still suspected, but no exchange has yet been identified?
The following principles provide a practical framework for addressing this ‘unknown exchange’ problem. A structured approach can substantially increase the likelihood of identifying exchange accounts while reducing unnecessary cost and delay.
Selecting Suitable Targets for Subpoenas and Civil Process
Cryptocurrency custody is distributed across hundreds of exchanges, brokerages, payment platforms, and related services worldwide.
Before initiating civil discovery, there tend to be few, if any, reliable investigative options for independently determining whether and where a particular party holds exchange accounts, in matters where blockchain records are not already available.
This tends to be different, and more difficult, than locating bank accounts. Sources that can be extremely useful for identifying banking relationships do not exist at a comparable level for cryptocurrency accounts. Traditional financial investigations often benefit from public or quasi-public records that help identify banking relationships. Recorded mortgages, UCC financing statements, consumer credit reports, court garnishments, vendor payments, and utility records may all provide clues regarding financial institutions used by a subject. Yet cryptocurrency exchange relationships generally do not appear in these sources.
Fortunately, for U.S. civil discovery, the total universe of practical subpoena targets – around 20 major cryptocurrency exchanges and related service providers – is relatively small compared to the number of commercial banks and credit unions, which exceeds 10,000.
At the same time, courts and compliance departments are often skeptical of requests that appear overly broad or speculative. Discovery directed to two dozen exchanges and service providers without a clear rationale may face objections on the grounds of burden, proportionality, or relevance.
For that reason, the question is often not whether exchanges should be subpoenaed, but how those requests should be structured. A carefully designed discovery strategy may improve the likelihood of obtaining useful information while reducing delay, objections, and unnecessary expense.
Potential cryptocurrency discovery targets include exchanges, brokerages, fintech platforms, peer-to-peer apps, payment processors, fiat on-ramps, and account verification services.
A Phased Approach to Exchange Subpoenas
After the initial list of discovery targets has been drafted, the structure and extent of the requests must be determined. The first and foremost question tends to be relatively straightforward:
Does this exchange have any account or related information associated with the subject?
Some practitioners favor a multi-staged approach that first seeks to establish the existence of an exchange account before expanding the scope of discovery to address transaction history, compliance records, and other account-level information.
A narrowly tailored request designed to confirm the existence of an account relationship may be easier for a compliance department to evaluate than a request seeking every record, including demands that touch on potentially sensitive areas, such as internal communications or regulatory compliance.
Requests for internal compliance materials – such as Source of Funds (SoF), Anti-Money-Laundering (AML), and Know Your Customer (KYC) reports – may require additional review by a subpoenaed exchange. Similarly, requests for login history, IP addresses, device identifiers, and user-agent information can raise additional privacy, compliance, and jurisdictional considerations.
Such information is often highly valuable in a comprehensive forensic investigation. However, including every category in an initial request may not always be the fastest path to determining whether a customer relationship exists. As the extent of requested information expands, processing time and potential objections may increase as well.
Courts evaluating early third-party discovery have, in some circumstances, favored a phased approach that first seeks identifying information before authorizing broader production. In Jacobo v. Doe and Tyson v. Coinbase, for example, courts permitted expedited subpoenas seeking limited identifying information while declining to authorize broader categories of records at the outset.
Decisions on whether a phased approach is prudent — and how to scale the initial and subsequent requests — should be evaluated within the procedural context of each matter.
Existence-only discovery is not without risk. Depending on the exchange's policies and circumstances of the subpoena, notification of the customer may occur before broader discovery can be pursued. This may prompt concerns that funds could be transferred or withdrawn, before further action can be taken.
Even so, the risk may be outweighed by the speed, proportionality, and greater likelihood of judicial acceptance associated with narrowly sequenced discovery. Potential concerns of asset dissipation may be mitigated, where appropriate, through preservation requests, coordinated service, and prompt follow-up discovery once an exchange confirms an active account.
A structured approach can increase the likelihood of identifying previously unknown exchange accounts while reducing unnecessary cost and delay.
Use the Right Identifiers
The reliability of any search depends upon the identifiers used.
When seeking records from banks and brokerage firms, attorneys are accustomed to relying on names, dates of birth, and tax identification numbers.
Cryptocurrency exchanges often operate differently. Confirmed email addresses associated with the subject may be among the most valuable identifiers for searching exchange accounts.
Attorneys often possess information that may not appear particularly important from a traditional banking perspective, such as past email addresses or usernames. In the cryptocurrency context, however, such information may significantly improve the likelihood of locating responsive accounts.
This is particularly important because customer onboarding and Know Your Customer (KYC) practices vary among exchanges and may have changed over time. Depending on the exchange and the account’s age and status, an email address may be a more reliable search criterion than a name and date of birth (or name and SSN) alone.
What Happens After an Exchange Responds?
A successful subpoena response often marks the start, rather than the end, of the investigation. It is frequently at this stage that blockchain tracing and forensic analysis can finally begin. Exchange records may contain account identifiers, linked financial accounts, transaction history, withdrawal destinations, and other information that can help define, and possibly expand, the scope of the inquiry.
The challenge then shifts from locating exchange accounts to understanding what their records reveal – and what they might conceal. The next article in this series will examine how attorneys and investigators can interpret exchange records and identify the information most relevant to asset location and recovery efforts.
John Powers, CFE, CTCE, is President of Hudson Intelligence. He specializes in cryptocurrency forensic investigations, asset tracing, and expert consulting for attorneys handling judgment enforcement, matrimonial disputes, commercial litigation, fraud, and other matters involving digital assets.
Questions About a Cryptocurrency Matter?
Whether you are attempting to identify undisclosed cryptocurrency holdings, interpret exchange records, or determine the next step in a cryptocurrency asset investigation, we would be glad to discuss your matter and how we might assist.