Crypto Tax Forum at INTERPOL 2026

On 29 and 30 September 2026, I attended INTERPOL’s New Technologies Forum at the Complexity Science Hub in Vienna. This year’s theme was NextGen Investigation: Decoding Emerging Technologies.

The discussions brought together law enforcement, researchers, lawyers and technology businesses. We looked at how decentralised platforms change the way evidence is found, shared and used.

For me, the connection with tax was clear. A blockchain can show money moving. But who is behind the wallet? Where are they resident? Which business holds their records? And how can authorities lawfully obtain that information?

These questions connect crypto investigations with the work we do at @O2K and Crypto Tax Forum.

The programme moved between technical research and practical investigations. A researcher may understand the protocol, a provider may hold the customer records, and a prosecutor needs to establish how the findings can be used in a case.

As a lawyer, I am interested in how these perspectives come together. We need to understand the technology well enough to ask the right questions, while keeping the legal consequences clear.

What does decentralised actually mean

Cristina Carata of Imperial College London opened her presentation with a practical question.

What exactly has been decentralised?

A service might use a decentralised protocol while still relying on a centrally operated website, an identifiable team or external providers. Storage, communications, identity and transaction processing can each work differently.

This matters because investigators need to understand where the evidence sits and who can respond to a lawful request. Calling something decentralised does not answer either question.

For example, a legal order requiring disclosure has little practical effect if it is directed at someone who neither holds the records nor controls the relevant function. Conversely, a distributed protocol may still interact with providers that hold useful information.

Carata’s approach was to map the different layers: the application, computation, storage, networking, identity and privacy mechanisms. The next questions are what can be observed, what can be attributed, and which person or part of the system can respond to legal action.

This is also useful for compliance work. Before deciding which obligations apply, we need to understand what a business actually does and where responsibility sits.

The INTERPOL Innovation Centre circulated a proposal to endorse and finalise a draft white paper entitled “Decentralising Law Enforcement”. All New Technologies Forum participants were invited to give feedback and contribute through an online form. The draft considered both the challenges and the opportunities. Distributed systems can make conventional interventions harder. They can also support evidence integrity and collaboration between authorities.

Technical development needs to address the problems investigators actually face, including skills, access to information and cooperation across borders.

When a game becomes a place to move money

Gaming was one of the topics that deserves more attention outside the conference room.

Yasmina Kazitani of the Blockchain Game Alliance examined skins trading through a money laundering and terrorist financing lens. Piotr Bobolowicz of the Global Coalition to Fight Financial Crime then looked beyond skins and loot boxes to the wider gaming ecosystem, with a particular focus on terrorist financing.

A skin may be a cosmetic item inside a game. But if it can be traded and sold for money, it also carries value. Gift cards, gaming balances, virtual items and accounts can become part of a wider payment chain.

The difficulty is that different businesses see different parts of it. A gaming platform may see the trades. A marketplace sees the sale. A payment provider sees the payout. None necessarily sees the whole story.

For investigators, this means gaming records may matter alongside banking and crypto records. For businesses, it means assessing what their services allow users to do with value, rather than relying on the label attached to an item.

A traditional gaming item’s resale price alone does not determine whether it is a crypto-asset under MiCA. Its structure and the services provided around it matter.

A simple example helps explain the risk. Illicit funds might be used to acquire gaming credit or tradable items. Value can then move between accounts before a sale produces a bank or crypto payout. Looking only at that final payout may miss the history behind it.

The presentations also considered recruitment, exploitation and terrorist financing risks within gaming communities. These environments combine communication with transferable value. Investigators may therefore need to examine both the financial activity and the relationships around it.

Bobolowicz drew on the indicators published by the Financial Action Task Force (FATF) in its September 2026 report “Risks of Gaming and Gambling”. He explained how they translate to gaming, including consistent losses to other players in peer-to-peer play, deposits followed by withdrawals with little or no play, apparently automated activity and large dormant balances. A single indicator is insufficient to establish wrongdoing. Several together can warrant a closer look. He also highlighted a distinction in the report. Money laundering is a more established risk in gambling, with casinos and sports betting particularly exposed. The report documented more examples of terrorist financing in gaming than in gambling.

For platforms and payment providers, preserving relevant records and establishing contacts with investigators can make a practical difference. If records have disappeared by the time a request arrives, even a well-founded investigation may struggle to reconstruct events.

The online activity around the transaction

Financial investigations increasingly involve the places where people communicate, recruit others and buy services.

Mat Gillard, founder of THINKPOL, explored Reddit and the investigative value of a person’s online history, including material preserved after it was deleted from the live platform. He drew on THINKPOL’s archive of about 30 billion Reddit posts and comments.

Mike Khytko discussed how information originating from infostealer malware can help identify persons of interest.

These presentations also raised questions about reliability and lawful use. A username, account or device record may provide a lead. It still needs to be checked. Accounts can be shared, compromised or deliberately used to mislead investigators.

Yajin Zhou of the Chinese University of Hong Kong examined Telegram-based guarantee platforms supporting a fraud-as-a-service ecosystem. These marketplaces bring together services that can support different stages of a scam, from obtaining accounts and personal data to moving the proceeds.

The research combined Telegram information with blockchain activity. It also questioned whether removing particular channels or targeting particular addresses produces lasting disruption when an operation can change its infrastructure.

The practical lesson is to understand the wider network and keep information current.

Zhou’s presentation explained how guarantee platforms can supply a form of trust between participants in an illicit marketplace. Merchants provide collateral, the platform sets rules and resolves disputes, and different providers sell the services needed for a fraud operation.

The researchers reported identifying 16 active guarantee platforms, thousands of public transaction groups and associated TRON addresses. Their analysis described approximately 7.164 billion USDT in collateral deposits between January 2025 and June 2026. This is a measure of deposit activity in their dataset; it should not be presented as an equivalent amount of proven victim losses.

That distinction is important when discussing large blockchain figures. Transaction volume, collateral, criminal proceeds and victim losses are different measures.

Gillard’s and Khytko’s presentations also highlighted the importance of preserving a digital footprint. Investigators need to know when information was collected, where it came from and whether it has been altered. Sensitive information also requires a lawful basis for collection, access and use.

A wallet address is only the beginning

Wallet attribution involves connecting an address with an identifiable person or entity and retaining evidence for that connection.

Reliable wallet attribution is fundamental to the evidence used in cryptocurrency investigations. Establishing and documenting those links at scale remains difficult, and some investigations lack verified attribution altogether.

An analytics label is useful only if investigators understand its source, its date and what it actually establishes. Connecting an address with an exchange does not, by itself, identify the customer responsible for a particular transaction.

Bitcoin address clustering can suggest that several addresses are controlled by the same entity. That inference still needs to be tested against evidence linking the on-chain activity to a person or business.

Weaknesses in digital signatures raise a different question. If a signing process exposes a private key, someone who recovers it may be able to move the funds.

Technical findings can therefore create further legal questions. How should affected users be notified? Who has authority to intervene? What evidence supports the next step?

A digital signature relies on a value known as a nonce. Under certain conditions, using the same nonce to sign different transactions can expose the private key.

It illustrates how a security weakness can create both a financial risk and an investigative opportunity. However, discovering that a key is vulnerable does not establish who exploited it or give a researcher authority to move the funds.

Similarly, wallet attribution needs documented support. Investigators should distinguish an observed interaction, an inferred relationship and a verified identification. They should also retain information about the method used and any uncertainty. A graph may look convincing while still containing a connection that needs further evidence.

Privacy and cooperation across borders

Optional privacy mechanisms, such as Litecoin’s MimbleWimble Extension Blocks (MWEB), change what observers can see about transactions.

Privacy features need to be understood technically. Their use alone does not establish criminal activity.

MWEB is particularly interesting because privacy is an optional addition to an established cryptocurrency. Investigators can consider what is visible when funds enter or leave the extension blocks and what information is available about activity inside them.

A conventional transaction trail may no longer reveal the same relationships once funds move within the private environment.

That makes records outside the protocol more significant, including information from connected providers and devices. It also creates a policy question about how to approach optional privacy within assets that are already widely supported by market infrastructure.

The forum also considered how privacy-preserving technology could help authorities cooperate. Priscilla Adams of Bullish discussed tokenized injunctions, cross-border intelligence sharing and compliance by design. Serving a court notice through a blockchain can address an identification problem, but notice does not itself compel compliance or technically freeze assets.

Malvika Mehta explored a related question: can investigators discover that another organisation holds relevant information without first exchanging entire databases?

Her presentation demonstrated a workflow using synthetic data, where a match becomes a starting point for a narrower disclosure request. It was presented as a prototype, rather than a deployed international evidence-sharing system.

Christian Hummert of Cyberagentur discussed research into mobile quantum computers and their potential relevance to law enforcement.

These developments are interesting, but their usefulness depends on people understanding the outputs, testing conclusions and applying the correct legal procedures.

Adams’ proposed cooperation model combined encrypted national records, privacy-preserving matching and AI support, with officers deciding whether particular information should be disclosed. Her presentation called for partners to test the concept. It should therefore be understood as a proposal for development, rather than an existing system operating across all member countries.

The draft white paper explored related uses for distributed ledgers in evidence management. Recording an evidence hash and its handling history can help detect later changes. The accuracy and lawful collection of the original evidence still require investigation and legal review.

The same applies to AI. It can assist with searching, organising material and identifying possible connections. Someone must still check whether the result is supported and explain how the conclusion was reached.

The draft white paper’s recommendations included training and interdisciplinary teams. Technical specialists, investigators and prosecutors can work together from the start of a case so that each understands how the evidence was collected and what it can establish.

Our report on Greek cases and crypto tax transparency

Tonia Pediaditaki and I co-authored a separate written report on criminal activity involving crypto-assets in Greece and on crypto tax transparency as a potential investigative resource. The report was separate from the formal forum programme. I shared our work with participants during networking at the forum.

Tonia researched the Greek cases for our written report.

Her research covered investment fraud, money laundering, tax-related offences and regulatory violations.

The cases included an alleged Ponzi-type investment operation announced by Greek police in March 2026, a Thessaloniki investment scam and an international investigation involving a crypto exchange. Tonia also examined allegations that proceeds obtained through conventional fraud were converted into crypto and moved through foreign exchanges.

One particularly relevant example was EPPO’s July 2026 announcement concerning suspected €46.9 million VAT carousel fraud. Authorities froze approximately €900,000 in cryptocurrency and €4.5 million in other digital assets, alongside properties and bank accounts. The investigation remained ongoing, with those concerned presumed innocent.

This shows why crypto expertise matters beyond cases advertised as crypto scams. Digital assets can appear in an investigation that begins with tax fraud or another underlying offence.

Tonia’s March 2026 example also showed how apparently legitimate companies and online platforms can be used to persuade people to invest. Greek police reported 73 identified victims and losses of at least €760,900, alongside a much larger alleged illicit financial benefit. The report kept these figures separate and described the case as an investigation, rather than a conviction.

In the Thessaloniki case, the alleged demand for additional money to recover an earlier investment illustrated another pattern: a victim may be pressured to keep paying after the original loss. Investigators need to reconstruct the representations made to the victim as well as the movement of funds.

The international exchange case illustrated the role of cross-border cooperation, with an arrest in Greece in a case pursued across jurisdictions. Together, these examples show why identifying the underlying offence, the relevant authorities and the applicable procedures is essential.

My part of the written report focused on DAC8 and the OECD’s Crypto-Asset Reporting Framework, CARF. I discussed this part with forum participants during networking.

These frameworks create an additional source of information connecting identified users and their tax residence with specified crypto-asset activity.

DAC8 requires relevant providers to collect information for the 2026 reporting year. The first exchanges between EU tax authorities are due by 30 September 2027, while providers must check their national reporting deadlines.

The OECD’s list dated 14 September 2026 identifies 77 jurisdictions committed to starting CARF exchanges in 2027, 2028 or 2029. This gives tax transparency a reach beyond the EU. However, commitment dates, data collection periods and actual exchanges must be distinguished.

Decentralised exchanges also require a closer assessment. An identifiable person or entity with sufficient control or influence over a platform may have reporting obligations under CARF. A fully autonomous arrangement may present a different case. The decentralised label alone does not settle the question.

For investigators, reporting can help identify relevant users, jurisdictions and activity requiring further examination. It does not automatically establish taxable profit, control of an external wallet or evidence of an offence.

Tax authorities collect DAC8 and CARF information for tax purposes. Whether law enforcement can obtain or use it in a criminal investigation depends on domestic law, confidentiality rules and the terms under which the information was exchanged. In some jurisdictions, police may need judicial authorisation and may have to show that the records relate directly to the case. Purpose restrictions may also prevent access or use where tax authorities collected the data for a different purpose. A similar issue can arise with large datasets compiled from open sources when an investigator needs to establish the legal basis for using specific information in a case. Where access is permitted, investigators still need to test the reports against underlying records and other evidence.

The information flow has two stages. A reporting provider supplies information to a tax authority. Relevant information can then be exchanged with the authority in the user’s jurisdiction of tax residence. Investigators need to understand both stages when considering where a useful lead may be held.

Suppose funds obtained through fraud move through bank accounts, are converted into crypto and pass through several providers. Blockchain analysis may show the movements. Customer records may identify account holders. Tax reporting may add information about residence and the scale of specified activity. The value comes from comparing these sources and requesting the underlying evidence through the proper channels.

There are also gaps. Countries are implementing CARF on different schedules, and some activity may have no identifiable reporting intermediary. Our report discussed these as possible displacement risks, rather than evidence that particular jurisdictions attract offenders.

Moving to another provider does not itself change a person’s tax residence or remove their obligations. Equally, the absence of an automatic report does not mean that other routes to evidence are unavailable.

Reporting is periodic. It cannot replace urgent requests to preserve records or live tracing when funds are moving. Providers also need to reconcile identity and transaction data, and investigators should test apparent discrepancies before drawing conclusions.

Our recommendation was to explain DAC8 and CARF as complementary sources of investigative leads in the white paper. They can help authorities ask more focused questions about who holds records and how those records can be obtained lawfully.

Conclusion

For me, this was the connection running through the forum. Technology helps us find information. Legal expertise helps us understand what we can do with it. Cooperation helps us connect the pieces across borders.

At @O2K and Crypto Tax Forum, we will continue bringing these perspectives together through our advisory work, training and discussions with the wider crypto community.

Sources

INTERPOL New Technologies Forum agenda and presentation materials:

FATF report on risks of gaming and gambling

European Commission DAC8 guidance

OECD CARF commitments dated 14 September 2026

EPPO Greek VAT fraud investigation dated 14 July 2026

Council Directive 2011/16/EU on administrative cooperation and the DAC8 amendment

Written report by Tonia Pediaditaki and Antonia Eilander, 28 September 2026.

‍