MSTR Cat

Crypto Law/Level IV · Holders' traps/4.3 When the state comes/Lesson 3

Summonses and exchange data

What an exchange knows about you, how the IRS and other agencies obtain it, and why US courts have said customers cannot block it on privacy grounds.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. The zero-cost defense is accurate reporting: answer the Form 1040 digital-asset question truthfully and reconcile each exchange’s annual export with your return, because courts hold you have no privacy claim in exchange records (Harper v. Werfel, 2024).
  2. If past crypto was misreported, a qualified amended return (Form 1040-X) avoids the 20% accuracy penalty, but the window closes once the IRS contacts you or serves a John Doe summons covering you (Treas. Reg. §1.6664-2(c)(3)).
  3. Note the date on any third-party summons notice at once: a petition to quash must be filed within 20 days of notice (26 U.S.C. §7609); it succeeds only on a real legal defect.
  4. Lawful public privacy: do not publish addresses tied to your identity and share only what KYC requires; Form 1099-DA reporting and automatic exchange still send the data to tax authorities.

Materials26 U.S.C. §7609, the IRS third-party summons and ‘John Doe’ summons procedureHarper v. Werfel, 118 F.4th 100 (1st Cir. 2024)Your exchange’s privacy policy, section on disclosure to governmentsYour own annual account statements or transaction exports from each exchange you use

Wonder

  1. Can the IRS get my exchange records without telling me first?
  2. What is a John Doe summons, and how can it reach people who are not under investigation?
  3. Do I have any constitutional privacy right in what my exchange knows about me?

Explore

  1. An exchange account is a detailed file: your name, date of birth, tax number, copies of your ID, linked bank accounts, every trade, and every deposit and withdrawal address. Because public blockchains record every transfer (lesson 1.1.5), one address tied to your identity can open a long on-chain history beyond the exchange itself. Governments rarely need to break encryption; they ask the company. In the United States the IRS has a general power to summon records relevant to a tax inquiry (26 U.S.C. §7602), and criminal investigators use grand jury subpoenas and court orders. This lesson focuses on the tax route because it has reached the most ordinary holders.
  2. When the IRS summons a third party, such as an exchange, about a named taxpayer, 26 U.S.C. §7609 requires notice to that taxpayer within 3 days of serving the summons, and no later than the 23rd day before the date set for producing the records. The taxpayer then has until the 20th day after notice is given to begin a court proceeding to quash, meaning cancel, the summons. That 20-day window is short and easy to miss. Courts enforce summonses that meet the long-standing standards in United States v. Powell (1964), so quashing usually requires showing a real defect, not simply a wish for privacy.
  3. A ‘John Doe’ summons does not name anyone. Under §7609(f) the IRS may serve one only with court approval, after showing that it concerns a particular person or an ascertainable group, that there is a reasonable basis to believe the group may have failed to comply with tax law, and that the information is not readily available elsewhere. The request must also be narrowly tailored to that possible non-compliance. In practice this lets the IRS reach every customer who fits a description, such as everyone above a trading threshold, without suspecting any one of them individually.
  4. The leading crypto example is United States v. Coinbase. In November 2016 the IRS sought records on all US Coinbase customers who transacted between 2013 and 2015. After Coinbase resisted, the IRS narrowed the demand to users with at least $20,000 of any one transaction type, such as buying, selling, sending or receiving, in a single year. In an order of November 28, 2017, a federal court in the Northern District of California enforced a version covering 14,355 accounts. Coinbase had to produce names, addresses, tax ID numbers, dates of birth, ID copies, wallet addresses, public keys and transaction records.
  5. One customer, James Harper, sued, arguing the IRS had searched his private papers without a warrant. In Harper v. Werfel, decided September 24, 2024, the US Court of Appeals for the First Circuit disagreed. Applying the ‘third-party doctrine’ from United States v. Miller (1976), it held that he had no reasonable expectation of privacy in records he gave Coinbase, and no property interest in Coinbase’s records. The Supreme Court denied review on June 30, 2025. The Fifth Circuit reached a similar result for Coinbase records in a criminal case, United States v. Gratkowski (2020). In the US, what an exchange holds is generally reachable.
  6. Summonses are now backed by routine reporting. US brokers report digital-asset sales on Form 1099-DA (lesson 2.3.5), and many other countries are adopting automatic exchange of crypto account information (lesson 7.2.7). Outside the US, rules on government access differ, but regulated exchanges everywhere keep customer records for authorities. A practical check: download each year’s statements from every exchange you have used, including closed accounts, and reconcile them with your tax returns (lesson 2.3.7). If you ever receive notice that a third party has been summoned for your records, note the date at once, because the 20-day period to act starts from the notice.

Key facts

  • 26 U.S.C. §7609 requires the IRS to notify a named taxpayer within 3 days of serving a third-party summons and at least 23 days before the production date.
  • A person entitled to notice may begin a proceeding to quash the summons no later than the 20th day after notice is given.
  • A John Doe summons under §7609(f) needs court approval and must concern a particular person or ascertainable group the IRS reasonably believes may not have complied with tax law.
  • In United States v. Coinbase, the IRS narrowed its summons to users with at least $20,000 of one transaction type in a year, covering 14,355 accounts.
  • In Harper v. Werfel (1st Cir., September 24, 2024) the court held a Coinbase customer had no reasonable expectation of privacy in his exchange records.
  • The US Supreme Court denied review of the Harper case on June 30, 2025 (No. 24-922).

Exercise nine, six, three, one

9CollectList up to 9 pieces of information about you that an exchange you use (or used) is likely to hold, such as your ID copy, bank link, trade history, or withdrawal addresses.
6ClusterSort them into 6 categories: identity documents, contact details, bank links, trade history, on-chain addresses, and messages with support.
3DistillReduce the 6 categories to 3 groups: data that identifies you, data that shows your gains and losses, and data that links you to activity outside the exchange.
1CrystallizeWrite 1 sentence explaining whether your own tax records would match what your exchanges could produce if summoned today.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS