Germany's account lookup system is set to cover crypto accounts in future. Under a ministerial draft from the Federal Ministry of Finance (BMF) dated October 28, 2026, crypto exchanges and ot
Germany's account lookup system is set to cover crypto accounts in future. Under a ministerial draft from the Federal Ministry of Finance (BMF) dated October 28, 2026, crypto exchanges and other crypto-asset service providers would have to feed the master data of their customer accounts into the account lookup procedure under Section 24c of the German Banking Act (KWG). Authorities would then see which platform you hold an account with, since when, and whether it still exists. Balances and individual transactions are not part of this data. In addition, the Financial Intelligence Unit (FIU) would be allowed to have a crypto asset account frozen for up to five working days if money laundering is suspected, and an objection would not stop the freeze.
One point matters for context: this is a draft being coordinated between government departments, not law in force. The new Anti-Money Laundering Act (GwBG) is set to replace the current Money Laundering Act on July 10, 2027. If you hold bitcoin, ether or other coins on an exchange, nothing changes for you until then. Anyone who keeps crypto assets with a provider will, however, be easier for authorities to find, and an account freeze becomes a clearly regulated tool with a fixed maximum duration.
This guide explains which data goes into the account lookup, who may retrieve it, what the tax office actually learns this way and how an FIU freeze works. It is based on the draft as presented by Blocktrainer, the summary by the law firm ADVANT Beiten and the statutes currently in force.
The draft is titled "Act implementing the Sixth EU Anti-Money Laundering Directive and strengthening money laundering prevention". It implements the EU anti-money laundering package of May 31, 2024. Its core is the EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624), which applies directly in all member states from July 10, 2027. Added to this are the Sixth Anti-Money Laundering Directive (AMLD6, Directive (EU) 2024/1640) and an amendment to the Financial Information Directive that links national account registers across Europe.
Because most obligations for banks and exchanges will in future come directly from Brussels, the ministry is not proposing an amendment. It replaces the 2017 Money Laundering Act with a new framework law, the Anti-Money Laundering Act (Geldwäschebekämpfungsgesetz, GwBG). It keeps what has to be regulated nationally: authorities, powers of intervention, data access and fines. For crypto investors, three points are decisive.
The change for crypto accounts sits in the Crypto Markets Supervision Act (KMAG). According to the draft quoted by Blocktrainer, it states that "crypto-asset service providers must also transmit master data on crypto asset accounts" into the account lookup procedure under Section 24c KWG. This refers to platforms authorised under the European MiCA regulation. Which providers already hold this licence is shown in our overview of regulated crypto exchanges with a MiCA licence.
The account lookup procedure is a central directory of account master data. Under Section 24c KWG, every credit institution in Germany maintains a file system in which it records without delay: the account number, the dates of opening and closing, the first name and surname, address and date of birth of the holder and of every authorised signatory, and the beneficial owner. BaFin, the financial supervisor, can retrieve this data automatically at any time. The law stipulates that the institution must not notice a retrieval.
The same is now set to apply to crypto exchanges. According to the draft, the account ID and the dates of opening and closing would be recorded. One particular point concerns platforms that do not keep a separate blockchain address per customer. Many exchanges hold their customers' coins in shared omnibus wallets and allocate holdings only in their internal accounting. In that case, the internal allocation number would count as the account ID. This means no customer account escapes the register, even if it does not exist on the blockchain as an address of its own.
What expressly does not belong in the account lookup: the balance, holdings of individual coins and account movements. Anyone who finds an account through the procedure therefore knows that it exists and who owns it. An authority only gets the transaction history in a second step, for example through a request for information to the exchange or a court order in criminal proceedings. Separate legal requirements apply to those.
Type of data Banks today (Section 24c KWG) Crypto exchanges under the draft Account number or account ID yes yes, including internal allocation number Date of opening and closing yes yes Name, address, date of birth yes yes, as the holder's master data Balance and coin holdings no no Individual transactions no noThe idea is not new. Banks and savings banks have been feeding this system for many years. According to Finance Ministry statistics reported by Börsen-Zeitung in January 2021, public bodies retrieved account master data via the Federal Central Tax Office around 1.01 million times in 2020, after around 915,000 retrievals the year before. Crypto accounts have so far been a blind spot in this count.
The bank or exchange keeps the register itself; only authorities with a legal basis may query it. Under the current Section 24c KWG, these are BaFin for its supervision and the FIU for its tasks under the Money Laundering Act. Via BaFin, public prosecutors and courts, the Customs Criminological Office and the Central Office for Sanctions Enforcement also receive information on request. Private individuals have no access, not even a creditor or an ex-partner.
A second route runs through the German Fiscal Code (AO). Under Section 93b AO, credit institutions must also keep the file system from Section 24c KWG available for retrievals by the tax authorities. The Federal Central Tax Office then retrieves the data on behalf of the tax office. Under Section 93(8) AO, further bodies are added, such as job centres, social welfare offices, student-grant offices and bailiffs.
Whether the draft also expressly extends this tax route to crypto exchanges cannot be read from the excerpts published so far. The draft explicitly amends Section 24c KWG and the KMAG. Section 93b AO currently refers only to credit institutions. For now, the only reliable statement is that supervisors, the FIU and investigators get a direct route to crypto accounts. For the tax office, it remains to be seen what the government bill contains.
The account lookup under Section 93(7) AO is an automated retrieval of account master data that the tax office triggers via the Federal Central Tax Office. It is only permitted in cases defined by law, for example to collect taxes regulated by federal law. In most cases, the tax office may only retrieve data once a request for information to you as the taxpayer has failed or holds out no prospect of success. Under Section 93(9) AO, the office must inform you of this possibility beforehand, usually through information sheets and forms, and notify you of the retrieval afterwards.
The result of an account lookup is a list of accounts with holder and duration, not account statements. If an authority finds an account at a crypto exchange this way that never appeared in your tax return, that gives an audit a starting point. It then has to request the amounts separately.
Many crypto investors mix up the various reporting channels. The routes interlock, but they deliver different data.
The account lookup thus closes a gap between these routes. DAC8 covers providers that fall under the reporting obligation and delivers annual figures. The account lookup shows at any time, and without warning to the institution, where accounts exist at all.
For taxation itself, the draft changes nothing. Under Section 23 of the German Income Tax Act (EStG), gains from private disposals of crypto assets are tax-free if more than one year passes between purchase and sale. Within the holding period, gains of up to €1,000 a year remain tax-free under the exemption limit. If you document your purchases, sales and wallet transfers completely, you have the records ready for any query. Crypto tax software and portfolio trackers that combine exchange exports and blockchain data are suited to this.
The second part of the draft affects you more directly than the account lookup. If the FIU has indications that a transaction is linked to money laundering, terrorist financing or a breach of foreign trade law, it can order emergency measures against the provider. Under Section 51 of the draft act (GwBG-E), two levels are available to it:
You can lodge an objection against both measures. According to the draft, however, it has no suspensive effect, so the freeze stays in place while the objection is decided. The FIU is also not to be liable for emergency measures (Section 51(8) GwBG-E). If you miss a sale at a better price during those days, the draft gives you no right to claim damages from the authority.
The power itself is not new. Section 40 of the current Money Laundering Act already allows the FIU to prohibit transactions from an account or securities account. What is new is the explicit mention of crypto asset accounts and the time limits. Today, FIU measures end no later than one month after the order or on the fifth working day after the case is handed to the public prosecutor. The draft sets a fixed upper limit of five working days for an account freeze. If the prosecutor wants to hold the funds longer, it then needs its own measures under the Code of Criminal Procedure, such as an asset freeze order.
Five working days for a whole account, ten for a single transaction: the draft gives FIU freezes a fixed maximum duration.
Another new tool is the monitoring order. Under Section 52 GwBG-E, the FIU can instruct a provider to monitor transactions on certain accounts or business relationships specifically for a set period and to report on them. The condition is that the persons concerned pose a significant risk of money laundering, related offences or terrorist financing. Here too, an objection has no suspensive effect.
For customers of a crypto exchange, such an order is invisible. The ban on disclosing information, known as the tipping-off prohibition, already forbids providers from informing customers about a suspicious activity report or ongoing proceedings. A support agent who speaks only vaguely of a "compliance review" during a freeze is therefore often following a legal obligation. Our guide on account terminations over suspected money laundering describes which deadlines apply at banks after a suspicious activity report.
As a counterweight, the draft provides for an independent fundamental rights officer at the FIU (Section 48 GwBG-E), not bound by instructions. The officer is to monitor compliance with fundamental rights in the authority's work and flag possible violations. How much impact this post will have can only be judged once it is up and running.
For advocates of self-custody, one detail in Section 65(5) GwBG-E is of interest. The provision lists the personal data the FIU may analyse with automated applications. Besides names, dates of birth, addresses, email addresses and account IDs of crypto asset accounts, it expressly includes "addresses of self-hosted crypto asset wallets".
This does not create an obligation to register private wallets with an authority. The provision governs what the FIU may do with data it already holds, for example from suspicious activity reports or from the travel rule for crypto transfers. Under that rule, exchanges already record recipients' wallet addresses for withdrawals. The privacy consequence is nevertheless real: once a wallet address is linked to a person, every payment flow of that address can be traced on a public blockchain such as Bitcoin's.
Self-custody therefore protects against a different risk than surveillance. If you hold your coins with your own keys on a hardware wallet, no FIU account freeze at an exchange can affect you, because there is no account a provider could suspend. It does not make you anonymous.
A wallet of your own keeps coins out of reach of any exchange freeze, though their movements stay visible on the blockchain.
If your exchange suddenly stops showing withdrawals, it need not be an FIU measure. Internal reviews by the provider are more common, for example after a large deposit or a withdrawal to a conspicuous address. Our article on self-certification at a crypto exchange describes such a case. In both situations, the same documents help.
One practical conclusion holds regardless of the law: if you keep all your crypto assets at a single exchange, you have no access at all during any freeze. Splitting them between a regulated exchange for trading and a wallet of your own for long-term holdings limits this risk.
The draft is being coordinated between the ministries. According to ADVANT Beiten, a cabinet decision is planned before the end of the year. After that, the Bundesrat and Bundestag deliberate, and until then a good deal of the wording may change, including the time limits for account freezes. The European deadlines, by contrast, are fixed: the EU Anti-Money Laundering Regulation applies from July 10, 2027, and Germany must have implemented the Sixth Anti-Money Laundering Directive by that date.
A change that many overlook takes effect on the same date. From July 10, 2027, an EU-wide cap of €10,000 applies to cash payments in commercial transactions (Art. 80 AMLR). Payments between private individuals are exempt. The ban on paying for a property in Germany with cash or crypto assets already exists under Section 16a of the Money Laundering Act. The draft transfers it to Section 9 GwBG-E and extends it to the purchase of shares in companies that own property in Germany.
For crypto exchanges, the work starts earlier. Providers have to prepare their customer data so that it can be retrieved at any time by the time the procedure starts, including for accounts without their own blockchain address. Anyone who today holds an account with a provider without German or European authorisation is not covered by this reporting obligation, but loses the protection of European supervision, for example the segregation of customer and company assets.
The law will not arrive overnight, but the direction is clear: crypto accounts will become as easy for authorities to find as current accounts, and freezes will get fixed rules. Three steps put you in a good position.
(As of November 9, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
