Why financial privacy matters. And what we demand.

Our reasons

1. Privacy means deciding for yourself

   You decide who knows what about you.

   That is privacy, and with cash it goes without saying: nobody at the till asks for your name.

   “Privacy is not secrecy,” Eric Hughes wrote in 1993 in the Cypherpunk’s Manifesto, the movement of programmers in whose tradition bitcoin stands. “A private matter is something one doesn’t want the whole world to know, but a secret matter is something one doesn’t want anybody to know. Privacy is the power to selectively reveal oneself to the world.”

   Germany’s Federal Constitutional Court saw it the same way in 1983: a legal order in which citizens can no longer know who knows what about them, when and on what occasion, would be incompatible with the right to informational self-determination.

   In Austria, data protection is a fundamental right with constitutional rank. The state may interfere only where necessary, and even then only in the least intrusive way that achieves its aim.

   Sources: Hughes 1993 · BVerfGE 65, 1 · Section 1 DSG

2. Privacy concerns everyone

   Nobody has to be rich to need financial privacy.

   Move bitcoin through an exchange, broker or app, and it stores who pays whom. That can show whom you donate to, whom you support and where you are a member.

   The EU transfer of funds regulation requires it: the names and wallet addresses of sender and recipient, even when the destination is your own wallet. It is kept for every customer, without suspicion, for years.

   Europe’s data protection authorities warn that even single payments reveal a lot: donations can show political or religious beliefs, medical bills someone’s health. Of these, the annual report carries only yearly totals; the provider holds every single payment.

   Two well-known cases show how quickly payment routes and financial data can be used against political causes. In December 2010, Visa, Mastercard and PayPal blocked donations to WikiLeaks without any court order requiring them to. In 2022, during the trucker protests, Canada had around 280 accounts, cards and credit lines frozen, and banks had to pass information about the customers concerned to the police. Canadian courts ruled in 2024 and 2026, not yet finally, that this sharing breached the protection against unreasonable search.

   Surveillance has an effect even without a data leak. Germany’s Federal Constitutional Court wrote in 1983 that anyone unsure whether behaviour that departs from the norm is recorded at any time and permanently stored, used or passed on as information will try not to attract attention through it.

   Sources: Regulation (EU) 2023/1113 · Section 21 FM-GwG · EDPB Guidelines 06/2020 · Bridy 2015 · Parliament of Canada · 2024 FC 42 · 2026 FCA 6 · BVerfGE 65, 1

3. Bitcoin is digital cash

   Bitcoin in your own wallet is like cash at home.

   In self-custody, you hold the keys to your bitcoin yourself, in a wallet, that is an app or a device. As with cash, how much you hold is nobody’s business; the danger comes when others find out.

   Bitcoin was designed in 2008 as electronic cash that passes from person to person without a bank. Whoever has the keys can move their bitcoin without anyone’s approval.

   That makes you independent, but like cash it draws criminals, from far away as well as in person. That is why you should decide for yourself whom you show how much you hold. The danger lies in data stores that identify people, not in your own wallet.

   Sources: Nakamoto 2008

4. Reported even when no tax is due

   Imagine your bank telling the tax authority every year how much cash you withdrew.

   For bitcoin, DAC8 requires exactly that: withdraw bitcoin from an exchange to keep it yourself, and the annual total usually appears in the report, although the transfer triggers no tax by itself.

   Your bank account at home has no such annual report: the automatic exchange of bank-account data covers only customers who are tax resident abroad. At crypto-asset providers, DAC8 also covers customers at home.

   The wallet address, in effect your wallet’s account number, is not in the report, only the total. In the wrong hands, such a report still shows who probably keeps savings in self-custody.

   Sources: Directive (EU) 2023/2226 · GMSG

5. Private until a leak supplies the names

   The blockchain shows payments, but no names.

   The blockchain, the public record of all bitcoin payments, lists them under wallet addresses, a kind of account number. If a data breach reveals which ones are yours, their payments can be traced to you, past and future.

   The bitcoin whitepaper already warns: if the owner of a key is revealed, linking could reveal other transactions that belonged to the same owner. And the blockchain forgets nothing. At the Berlin identity verification service Fractal ID, ID documents, home addresses and wallet addresses sat in one record until attackers copied it.

   Once a wallet address is tied to a name, its payments, together with information about the recipients, allow inferences about purchases, donations and relationships.

   A profile is not proof. Analytics firms infer which wallet addresses belong together from assumptions, and a single wrong one can lump different people’s payments together. Anyone judged by such a profile must be able to find and correct errors.

   Sources: Nakamoto 2008 · Fractal ID · Goldfeder et al. 2018 · Möser and Narayanan 2022

6. Data shows where there might be something to take

   Data breaches turn into target lists.

   Suspected crypto wealth alone can lead to robberies and kidnappings, whether the presumed holdings are real or not. Data held by providers, service providers and authorities can give offenders a starting point.

   Totals and counts of purchases and transfers give a rough estimate of how much someone moves. The estimate can be far off, because the same money can count more than once. Anyone who gets hold of the data still singles out people who appear wealthy.

   At the French crypto tax service Waltio, customers’ email addresses, gains and losses and year-end balances fell into the wrong hands. According to the French police, the leak is one reason for the rise in such violent crime: criminals use the data to select victims, sometimes misjudging what they actually hold.

   In 2020, the names, postal addresses and phone numbers of around 272,000 customers of the hardware wallet maker Ledger were leaked online: a list of people who probably keep bitcoin in self-custody.

   In Austria, fraudsters already use the new crypto tax rules as a pretext: fake FinanzOnline messages ask about crypto holdings, and an SMS scam sent out at random also asks about gold and cash.

   Sources: Waltio · Gendarmerie nationale · Ledger · Watchlist Internet · Watchlist Internet (SMS)

   Documented attacks on the map
7. Each annual report is kept ten years

   Every year, the file grows thicker.

   If you remain a customer, from 2036 ten annual reports will always be on file. The more years it holds, the more a single data leak at the provider gives away.

   The file is built for everyone: the provider must prepare reporting data for every customer, including those who are never reported. Here Austria goes beyond the EU directive. Germany and the Netherlands require it only for customers whose data actually goes to the tax office.

   The provider deletes each annual report only ten years after its reporting year, according to the bill’s explanatory notes “for reasons of simplicity”. For reports on bank accounts, the period is five years, and Ireland generally sets six for crypto-asset providers.

   And whether the data is really deleted when the period ends, you have to take on trust. In 2026, orders from 2019 to 2021 turned up in a data leak at the wallet maker Trezor’s shipping provider, although the shipping company had repeatedly confirmed in writing that it had deleted them.

   Under anti-money-laundering rules, the provider also keeps your ID, wallet addresses and individual transactions, currently until ten years after the relationship ends. For DAC8, it adds your tax identification number and tax residence. At the tax authority, the annual reports from every provider you use come together; if you live in Germany, at the German one.

   Tax authorities lose data too: in 2019, data on more than six million people leaked from the Bulgarian tax authority. According to the OECD, it included account data from the automatic exchange that DAC8 reports will travel through.

   What matters is the overall picture: reports across several providers and years, a breach at a tax tool and attributable blockchain data can together add up to a profile of activity and presumed wealth.

   Sources: Section 20 Krypto-MPfG · Government bill 306 · KStTG · Stb. 2026, 93 · S.I. 584/2025 · Trezor · Section 21 FM-GwG · CJEU C-340/21 · OECD 2019

8. Every customer is recorded, without suspicion

   The file holds whoever uses a provider, not whoever is suspected.

   Anyone who buys through an exchange, broker or app is reported. Anyone who buys from another person or is paid in bitcoin is not: the report follows the route, not any suspicion.

   In 2014, Austria’s Constitutional Court struck down the retention of phone and internet data. It found that the retention captured almost exclusively people who had given no cause for it.

   Even what leads nowhere stays on file: in 2024, Austria’s financial intelligence unit received 11,111 suspicious transaction reports, 1,228 of them from crypto-asset providers. 8,138 led nowhere for now, for lack of an initial suspicion of a crime or of further leads. They are kept for later analysis for up to five years.

   The ID check shows whose ID was presented, not who uses the account. According to the financial intelligence unit, criminals open accounts with forged Austrian passports bearing the data of real, uninvolved people.

   The Commission estimated the extra tax revenue from DAC8 at up to 2.4 billion euros a year. It counted the tax on all bitcoin gains, scaled up to all crypto-assets, although by its own account it did not know how much of that had already been taxed.

   Sources: VfGH G 47/2012 · Money laundering report 2024 · SWD(2022) 401

9. Surveillance grows with every law

   What is collected gets used for more.

   Since DAC8, the directive allows all tax data that states exchange under it, bank-account data included, to be used against money laundering and for EU sanctions. We want to push financial surveillance back instead of watching it grow.

   Austria shows how such uses grow: its account register was created in 2015 by the same act that loosened banking secrecy. Since July 2026, the anti-fraud office uses it too, for example against benefit fraud and shell companies. In Germany, bailiffs looked up who holds which accounts 61,760 times in 2013 and 844,427 times in 2023.

   DAC8 is one building block among several: the provider checks your ID when you open the account and records the sender and recipient of every transfer. By 2029, account registries will be connected across the EU and will then also cover accounts at crypto-asset providers, without balances.

   What it achieves is hardly measured. In 2025, Austria received 13,989 suspicion reports, and there were 139 convictions for money laundering; the convictions cannot be traced to particular reports. Of 100 euros from crime in the EU, about 1.1 euros were finally confiscated in 2010 to 2014, as Europol estimates it.

   Sources: Directive (EU) 2023/2226 · BGBl. I 116/2015 · BGBl. I 46/2026 · Bundestag paper 20/10841 · Directive (EU) 2024/1640 · Money laundering report 2025 · Europol 2016

   How the collection has grown, and what it brings

Objections

• “I have nothing to hide.”

  Privacy needs no justification; state interference does. And everyone has something to protect: their home address, their savings, their family.

• “It’s about tax fairness.”

  Even for taxes, the state may only demand as much data as it needs. In 1993, Austria even laid down in a constitutional act that tax on interest is settled by the bank’s deduction; that needs no annual report on every saver. In the same way, Austrian providers have withheld the tax on gains themselves since 2024 for anyone tax resident in Austria; this does not apply to customers in Germany. Where the tax is already withheld, the state must justify why it also needs the yearly totals, including transfers that trigger no tax.

  Final Taxation Act · Finance Ministry
• “Don’t we need the data to fight crime?”

  Investigations need information. That does not make every extra detail, every further access and every long retention period necessary. Whoever demands data on everyone must prove its benefit and show that targeted investigations based on specific suspicion would not do.

• “But the data is encrypted.”

  Encryption helps against outsiders, not against those who are allowed to see the data anyway. In Austria, a tax official looked up thousands of tax records for years without official reason, more than 1,000 of them on people from his home town. At Coinbase, bribed support staff collected customer data down to ID images and balances.

  Disciplinary board, Finance Ministry · Coinbase (Form 8-K)
• “The Constitutional Court has already allowed the exchange of account data.”

  For balances and interest, yes: according to the court, they did not touch the core of private life. DAC8 reports more, namely amounts, the quantity of bitcoin or other crypto-assets and the number of transactions, also on customers at home, and Austria has providers keep the report ten years instead of five. Whether that is proportionate, the Constitutional Court has not yet decided.

  VfGH E 2097/2021
• “I only use my own wallet.”

  As long as you never use a provider, DAC8 does not report you. If you bought there and transferred to your wallet, the annual total usually appears in the report, without the wallet address. The wallet address stays on file with the provider.

• “Then don’t buy through an exchange.”

  Whether you buy bitcoin through a provider, trade directly with others or receive it as payment: privacy applies on every route. Nobody should have to avoid one to keep it; the protection has to be in the law.