The Privacy Paradox

We demand strict accountability for crypto-assets, yet this means collecting more client data. Where do we draw the line?

From “Know Your Customer” to “Know More and More About Your Customer”

For years, a central question surrounding crypto has been whether heightened regulatory oversight would bring the sector closer to traditional financial services. In Europe, that transformation is already underway.

Crypto-Asset Service Providers (CASPs) operate within an increasingly complex regulatory landscape. MiCAR has introduced a harmonised licensing regime and operational rules. The EU rules on information accompanying transfers of funds and certain crypto-assets have extended the so-called “Travel Rule” to crypto transfers. Anti-money laundering (AML) rules require the identification and monitoring of clients, as well as the retention of certain data. DAC8 adds another dimension: tax transparency and the automatic exchange of information about reportable crypto transactions with tax authorities.

Each of these measures serves a legitimate purpose. Taken together, however, they raise a question that has not received enough attention: how much client information should CASPs collect, store and link to meet their regulatory obligations, and when does doing so create additional privacy and data-security risks?

This is the privacy paradox facing the EU crypto ecosystem.

Identifying customers is nothing new for regulated financial entities. CASPs are already required to hold information such as names, addresses, identification details and other data needed to assess the risk of financial crime.

The Travel Rule goes further in the context of crypto transfers. Depending on the circumstances, information accompanying a transfer may include the names of the originator and beneficiary, distributed ledger addresses, account numbers or additional identification data.

How DAC8 Expands Client Data Collection

DAC8 adds another layer. Under Council Directive (EU) 2023/2226, CASPs within the scope of the reporting regime must identify reportable users and collect the information required for tax reporting.

For individuals, this can include their name, address, country or countries of tax residence, Tax Identification Number (TIN), and date and place of birth.

DAC8 also requires procedures for customers to declare their tax residence, a process known as “self-certification”. Service providers must obtain the declaration and assess whether it is reasonable in light of other information available to them, including information gathered through customer due diligence checks.

The compliance function no longer asks only, “Do we know who our customer is?” It must also consider where the individual is tax resident, whether that information is up to date, which transactions are reportable, and whether other information raises questions about the declaration.

The result is a more comprehensive regulatory profile of each client.

The GDPR Still Sets Boundaries

The General Data Protection Regulation (GDPR) is another key pillar of European law. Its principles include purpose limitation, data minimisation and storage limitation.

This does not mean that DAC8, AML requirements or the Travel Rule necessarily conflict with the GDPR. Where legislation requires a CASP to collect specific information, that obligation may provide a legal basis for processing it. The purpose of the processing and the way the data is handled still matter.

The more complex question is what happens after information has been collected. A client may provide identification data for AML purposes, tax-residency details for DAC8, wallet information linked to a transfer, transaction history for monitoring, and additional records for enhanced due diligence.

Using existing information can reduce repeated requests and make compliance processes more efficient. DAC8 recognises the relevance of information gathered through customer due diligence when a provider assesses the plausibility of a tax-residency self-certification. But avoiding duplication is not the same as assuming that information collected for one purpose can automatically be used for another.

“Collect once” does not mean “use forever”

A sound data-governance framework should be able to answer a few basic questions: Why was this data collected? Who can access it? Which obligation requires it? How long must it be retained? Can it be used for another compliance purpose? When should it be deleted?

These are not merely GDPR questions. They are becoming a fundamental part of regulatory compliance.

More Data Also Means Greater Risk

In a highly regulated environment, the temptation to keep information “just in case” is understandable. But keeping everything is not a data strategy.

Regulation requires the collection of information to help protect the financial system. At the same time, every additional piece of personal information a company stores can increase the potential

consequences of a security breach. A database that links an individual’s identity, tax residence, transaction history and crypto-wallet addresses can be particularly sensitive.

Blockchain transactions are publicly visible, but the identity of the person behind an address usually is not. Linking the two can turn pseudonymous blockchain activity into information attributable to a specific person.

The question is therefore not only, “What are we required to report?” It is also, “What information do we actually need to store together?”

The European Data Protection Board’s Guidelines 02/2025 on the processing of personal data through blockchain technologies highlight the importance of data minimisation, storage limitation and data protection by design. The same thinking should inform compliance systems. Data should be stored when there is a clear need, not simply because technology makes it possible.

Regulatory Asymmetry and Competitiveness

Another part of the debate is regulatory asymmetry. EU CASPs must navigate requirements under MiCAR, AML rules, the Travel Rule, DAC8 and the GDPR. Outside the EU, regulatory frameworks and enforcement practices vary significantly between jurisdictions.

Can the EU continue to raise standards for transparency, accountability and data protection without putting regulated European companies at a competitive disadvantage compared with market participants operating under different or less demanding requirements?

The answer should not be to lower data-protection standards in the EU. However, when regulation requires more data, checks, reporting and complex compliance infrastructure, proportionality and competitiveness must remain part of the discussion.

“Privacy by Design” should also be matched by “Compliance by Design”.

The solution is not less regulation or reduced tax transparency. The challenge is to meet these obligations without creating unnecessary exposure of personal data.

For CASPs, this means giving every data field a clear purpose, reusing existing KYC information only where justified, managing access to AML, tax and operational data appropriately, building retention periods into systems, and minimising unnecessary copies of documents and client records. This is where personal data protection, cybersecurity and regulatory compliance meet.

The Next Major Challenge

The challenge for CASPs is not simply to collect all the information required by each new regulation. It is to build systems that track why each piece of data is held, where it is stored, who is authorised to use it, how different datasets interact and when the information must be deleted.

The strongest compliance framework is not necessarily the one that holds the most information about every client. It is the one that holds what is necessary and can explain why it is necessary.

Regulatory transparency, personal data protection and the competitiveness of the EU crypto ecosystem do not have to be opposing goals. CASPs need to protect client confidentiality while maintaining workable compliance systems. If compliance becomes unnecessarily burdensome, some activity may move to providers operating outside the EU regulatory framework, including providers without a MiCAR licence. Because crypto services can be delivered across borders, these competitive pressures deserve serious consideration.

Conclusion

The privacy paradox is not a choice between regulatory accountability and client confidentiality. CASPs must meet their legal obligations, but they also need to understand what data they collect, why they collect it, who can use it and how long it should be kept.

A practical approach starts with purpose limitation, justified data reuse, appropriate access controls and retention rules built into compliance systems. These measures can help providers meet reporting and anti-financial-crime requirements without exposing more client information than necessary.

The goal should be clear: effective compliance that protects both the integrity of the financial system and the people whose data makes that compliance possible.

Ultimately, crypto-asset service providers (CASPs) must balance regulatory compliance with customer privacy. This requires clear data management policies, strong security measures and careful handling of personal information.

Looking for a simpler way to connect traditional payments with self-custody crypto wallets? Learn more about Unramp and explore its approach to crypto on-ramping and compliance.

‍

‍