Coinbase Law Enforcement Guide: How Police Request Data (LERS)

This guide is general professional reference for law enforcement officers, prosecutors and cybercrime investigators who need records from Coinbase in the course of a lawful investigation. It is not legal advice, and it does not create any obligation on Coinbase or any other party. Every request must rest on proper legal authority in your own jurisdiction, and the appropriate process for compelling data depends on the records sought and the law that applies to you and to Coinbase. Use this as orientation, then follow the formal process and verify current contact details directly with the provider.

Who Coinbase is, and why it matters

Coinbase is one of the largest cryptocurrency exchanges in the world and operates as a regulated VASP. Its principal operating entity is based in the United States, which means data requests are assessed under US law even when the customer or the crime is overseas. The most important consequence for investigators is the Stored Communications Act (SCA), which sets out what legal instrument is required for which category of record. Coinbase reviews every request for legal sufficiency, narrows requests it considers overbroad or vague, and states that it does not give any government direct access to its systems.

The law-enforcement request process and portal

Coinbase does not accept casual requests for customer data. Sworn officers submit and track criminal legal process through Coinbase's dedicated law-enforcement request system, which it runs on the Kodex platform. Officers register with verifiable agency credentials, upload the legal instrument, and correspond through the secured channel. General questions about service of legal documents are directed to Coinbase's subpoena contact mailbox, and civil matters go to its registered agent for service of process rather than the criminal channel.

1. Identify the subject precisely: the email address, account ID, wallet address, transaction hash or full name tied to the Coinbase account.
2. If there is any risk data could be lost, ask Coinbase to retain the records while you obtain process. Coinbase publishes no preservation procedure, so check inside the portal how to send one.
3. Determine the correct legal instrument for the records you need (subscriber data, transaction logs, or stored content) under the law that binds you and Coinbase.
4. Register on the law-enforcement portal with your agency credentials and submit the signed legal process with a clear, narrowly scoped data request.
5. Specify the exact date ranges and record categories; overbroad requests are slowed or narrowed on review.
6. Track the request and respond promptly to any requests from Coinbase to clarify or tailor scope.

What data Coinbase holds and can produce

As a regulated exchange running know-your-customer (KYC) onboarding, Coinbase holds a rich identity and financial record set. Depending on the legal instrument and the scope of the order, it may produce:

• KYC and identity records: verified name, date of birth, address, government ID details and the data collected at onboarding.
• Account records: registration data, email, phone number, account status and history.
• Transaction history: deposits, withdrawals, trades, on-chain send and receive activity, and associated wallet or blockchain addresses.
• Linked funding instruments: connected bank accounts, card details and payment information used to fund or cash out.
• IP and login logs: recently used IP addresses, login and session activity.
• Device data: device and technical identifiers captured during access where retained.

Coinbase has noted that, where appropriate, it provides anonymized or aggregated data instead of individual customer records, so a tightly scoped request returns better results than a broad one.

Preservation versus production

These are two different actions and investigators routinely conflate them.

• Preservation request: a formal request asking Coinbase to retain a defined set of records so they are not deleted while you secure legal process. It buys time. It does not disclose anything to you and it does not freeze the account or funds. Send it early.
• Production request: the legal instrument that actually compels Coinbase to hand over records. Under the US SCA framework the instrument scales with the sensitivity of the data: a subpoena reaches basic subscriber and transaction records, a court order reaches additional non-content records, and a search warrant based on probable cause is required for stored content.

Data types, what they yield, and the legal threshold

Coinbase does not publish a schedule of which instrument unlocks which records. Thresholds above reflect the US SCA model because Coinbase is US-based. Investigators in other jurisdictions should map these categories to the equivalent instruments their own law provides, and recognise that compelling content from a US provider usually still routes through US legal process.

Emergency disclosure requests

Coinbase publishes no emergency procedure or contact. Its privacy policy says it may preserve, review and share information with law enforcement where needed to protect vital interests, for example in emergencies, and that is a matter for its discretion. Where there is a genuine emergency involving a risk of death or serious physical harm, a request should explain the nature of the threat, why it is imminent, and what specific data is needed to address it. This is an exception for imminent-harm situations, not a shortcut around ordinary legal process for routine investigations, and it is assessed on the facts presented.

Foreign investigators and MLAT

Because Coinbase's principal entity sits in the United States, non-US agencies generally cannot compel content directly. The established route is a mutual legal assistance treaty (MLAT) request or a letter rogatory, processed through your central authority and the US Department of Justice, which then secures US legal process served on Coinbase. MLAT is reliable but slow, often taking months, so send a preservation request immediately to protect the records while the MLAT proceeds. Some basic subscriber information may be obtainable through more direct channels depending on the provider's policy and the applicable law, but stored content typically requires the formal cross-border route.

Account freezes and holds

Freezing funds is separate from obtaining data. A freeze, hold or seizure restricts the customer's ability to move assets and is generally actioned on the strength of an appropriate court order, seizure warrant or specific legal request, depending on jurisdiction. Asset restraint and recovery follow the seizure and forfeiture process in your jurisdiction, and the practical mechanics of moving seized crypto to law-enforcement-controlled custody are a distinct workstream from the data request covered here.

The FATF Travel Rule context

The FATF Travel Rule (Recommendation 16) requires VASPs such as Coinbase to collect, verify and share originator and beneficiary information for qualifying virtual asset transfers, commonly above a 1,000 USD or EUR threshold, with the counterparty VASP. For investigators this matters because compliant exchanges hold structured counterparty data: who sent value, who received it, and which VASP sat on the other side. When you trace funds from Coinbase to another regulated exchange, Travel Rule records can help attribute the counterparty, and a follow-on request to that VASP can extend the chain.

Response timelines

Coinbase reviews each request for legal sufficiency and scope before producing data, so turnaround depends on the request type, its clarity and its breadth. Coinbase publishes no turnaround times. Broad or ambiguous requests are narrowed on review, so a clear, tightly scoped request is the best way to avoid delay. Treat any specific number of days as variable and confirm current expectations through the portal rather than relying on a fixed SLA.

Frequently asked questions

Can I just email Coinbase a subpoena? Criminal legal process is submitted and tracked through Coinbase's online law-enforcement request system rather than informal email. General questions can go to its subpoena contact mailbox, and civil documents go to its registered agent, but use the official portal for service.

What is the difference between a preservation request and a subpoena? A preservation request tells Coinbase to keep the records so they are not lost; it discloses nothing. A subpoena, court order or warrant is what actually compels production, with the instrument depending on whether you seek subscriber data, non-content records or stored content.

I am outside the US. How do I get content from Coinbase? Generally through an MLAT request or letter rogatory routed via your central authority and the US Department of Justice, which obtains US legal process served on Coinbase. Send a preservation request straight away to protect the data while the MLAT runs.

Will Coinbase freeze an account if I ask? Freezing funds is separate from data production and is generally actioned on an appropriate court order, seizure warrant or specific legal request. Specify clearly whether you are seeking records, a freeze, or both.

• Binance law enforcement request guide
• How to trace a cryptocurrency transaction: a guide for investigators
• Freezing and seizing crypto: from exchange request to wallet seizure

For the full directory of platform law-enforcement request portals, see our LERS portal hub.

Hero image: Bitcoin on a laptop keyboard. · Credit: Satheesh Sankaran · via Flickr / Wikimedia Commons · CC BY 2.0 · source

See also: Coinbase Preservation & Emergency Requests: Police Guide and Template.