Coinbase Law Enforcement Guide: How Police Request Data (LERS)
How police, prosecutors and cybercrime investigators worldwide request data from Coinbase: its law-enforcement portal, preservation versus production, emergency disclosure, MLAT for foreign agencies, account freezes and the FATF Travel Rule.
This guide is general professional reference for law enforcement officers, prosecutors and cybercrime investigators who need records from Coinbase in the course of a lawful investigation. It is not legal advice, and it does not create any obligation on Coinbase or any other party. Every request must rest on proper legal authority in your own jurisdiction, and the appropriate process for compelling data depends on the records sought and the law that applies to you and to Coinbase. Use this as orientation, then follow the formal process and verify current contact details directly with the provider.
- Coinbase is a regulated US-based virtual asset service provider (VASP); requests are governed by US law, principally the Stored Communications Act (SCA).
- Criminal law-enforcement requests are submitted through Coinbase's online law-enforcement request system (operated via the Kodex platform), not by informal email.
- A preservation request freezes data so it is not deleted; it does not give you the data. Production needs a subpoena, court order or search warrant matched to the record type.
- Non-US agencies generally need a mutual legal assistance treaty (MLAT) or letter rogatory to compel content, though basic subscriber records may be obtainable more directly.
- Emergency disclosure is possible where there is a risk of death or serious physical harm; account freezes are a separate ask from data production.
Who Coinbase is, and why it matters
Coinbase is one of the largest cryptocurrency exchanges in the world and operates as a regulated VASP. Its principal operating entity is based in the United States, which means data requests are assessed under US law even when the customer or the crime is overseas. The most important consequence for investigators is the Stored Communications Act (SCA), which sets out what legal instrument is required for which category of record. Coinbase reviews every request for legal sufficiency, narrows requests it considers overbroad or vague, and states that it does not give any government direct access to its systems.
The law-enforcement request process and portal
Coinbase does not accept casual requests for customer data. Sworn officers submit and track criminal legal process through Coinbase's dedicated law-enforcement request system, which it runs on the Kodex platform. Officers register with verifiable agency credentials, upload the legal instrument, and correspond through the secured channel. General questions about service of legal documents are directed to Coinbase's subpoena contact mailbox, and civil matters go to its registered agent for service of process rather than the criminal channel.
- Identify the subject precisely: the email address, account ID, wallet address, transaction hash or full name tied to the Coinbase account.
- If there is any risk data could be lost, send a preservation request first to lock the records while you obtain process.
- Determine the correct legal instrument for the records you need (subscriber data, transaction logs, or stored content) under the law that binds you and Coinbase.
- Register on the law-enforcement portal with your agency credentials and submit the signed legal process with a clear, narrowly scoped data request.
- Specify the exact date ranges and record categories; overbroad requests are slowed or narrowed on review.
- Track the request and respond promptly to any requests from Coinbase to clarify or tailor scope.
What data Coinbase holds and can produce
As a regulated exchange running know-your-customer (KYC) onboarding, Coinbase holds a rich identity and financial record set. Depending on the legal instrument and the scope of the order, it may produce:
- KYC and identity records: verified name, date of birth, address, government ID details and the data collected at onboarding.
- Account records: registration data, email, phone number, account status and history.
- Transaction history: deposits, withdrawals, trades, on-chain send and receive activity, and associated wallet or blockchain addresses.
- Linked funding instruments: connected bank accounts, card details and payment information used to fund or cash out.
- IP and login logs: recently used IP addresses, login and session activity.
- Device data: device and technical identifiers captured during access where retained.
Coinbase has noted that, where appropriate, it provides anonymized or aggregated data instead of individual customer records, so a tightly scoped request returns better results than a broad one.
Preservation versus production
These are two different actions and investigators routinely conflate them.
- Preservation request: a formal request asking Coinbase to retain a defined set of records so they are not deleted while you secure legal process. It buys time. It does not disclose anything to you. Send it early.
- Production request: the legal instrument that actually compels Coinbase to hand over records. Under the US SCA framework the instrument scales with the sensitivity of the data: a subpoena reaches basic subscriber and transaction records, a court order reaches additional non-content records, and a search warrant based on probable cause is required for stored content.
Data types, what they yield, and the legal threshold
| Data type | What it yields | Typical US legal threshold |
|---|---|---|
| Preservation | Records held, not disclosed | Preservation request (no court order needed) |
| Basic subscriber / KYC identity | Name, contact, account identifiers | Subpoena |
| Transaction history, IP and login logs | Account activity, wallet addresses, access records | Subpoena or court order, depending on category |
| Linked bank and card data | Funding and cash-out trail | Subpoena or court order |
| Stored content | Contents of communications and stored files | Search warrant (probable cause) |
| Account freeze or hold | Funds restricted, not disclosed | Court order, seizure warrant or specific legal request |
Thresholds above reflect the US SCA model because Coinbase is US-based. Investigators in other jurisdictions should map these categories to the equivalent instruments their own law provides, and recognise that compelling content from a US provider usually still routes through US legal process.
Emergency disclosure requests
Where there is a genuine emergency involving a risk of death or serious physical harm, Coinbase, like other US providers, can consider voluntary disclosure of relevant information on an expedited basis. Emergency requests must explain the nature of the threat, why it is imminent, and what specific data is needed to address it. This is an exception for imminent-harm situations, not a shortcut around ordinary legal process for routine investigations, and it is assessed on the facts presented.
Foreign investigators and MLAT
Because Coinbase's principal entity sits in the United States, non-US agencies generally cannot compel content directly. The established route is a mutual legal assistance treaty (MLAT) request or a letter rogatory, processed through your central authority and the US Department of Justice, which then secures US legal process served on Coinbase. MLAT is reliable but slow, often taking months, so send a preservation request immediately to protect the records while the MLAT proceeds. Some basic subscriber information may be obtainable through more direct channels depending on the provider's policy and the applicable law, but stored content typically requires the formal cross-border route.
Account freezes and holds
Freezing funds is separate from obtaining data. A freeze, hold or seizure restricts the customer's ability to move assets and is generally actioned on the strength of an appropriate court order, seizure warrant or specific legal request, depending on jurisdiction. Asset restraint and recovery follow the seizure and forfeiture process in your jurisdiction, and the practical mechanics of moving seized crypto to law-enforcement-controlled custody are a distinct workstream from the data request covered here.
The FATF Travel Rule context
The FATF Travel Rule (Recommendation 16) requires VASPs such as Coinbase to collect, verify and share originator and beneficiary information for qualifying virtual asset transfers, commonly above a 1,000 USD or EUR threshold, with the counterparty VASP. For investigators this matters because compliant exchanges hold structured counterparty data: who sent value, who received it, and which VASP sat on the other side. When you trace funds from Coinbase to another regulated exchange, Travel Rule records can help attribute the counterparty, and a follow-on request to that VASP can extend the chain.
Response timelines
Coinbase reviews each request for legal sufficiency and scope before producing data, so turnaround depends on the request type, its clarity and its breadth. Preservation is typically actioned quickly. Routine production on valid process is handled in the ordinary course, while broad or ambiguous requests take longer because Coinbase will seek to narrow them. Emergency requests are expedited. Treat any specific number of days as variable and confirm current expectations through the portal rather than relying on a fixed SLA.
Frequently asked questions
Can I just email Coinbase a subpoena? Criminal legal process is submitted and tracked through Coinbase's online law-enforcement request system rather than informal email. General questions can go to its subpoena contact mailbox, and civil documents go to its registered agent, but use the official portal for service.
What is the difference between a preservation request and a subpoena? A preservation request tells Coinbase to keep the records so they are not lost; it discloses nothing. A subpoena, court order or warrant is what actually compels production, with the instrument depending on whether you seek subscriber data, non-content records or stored content.
I am outside the US. How do I get content from Coinbase? Generally through an MLAT request or letter rogatory routed via your central authority and the US Department of Justice, which obtains US legal process served on Coinbase. Send a preservation request straight away to protect the data while the MLAT runs.
Will Coinbase freeze an account if I ask? Freezing funds is separate from data production and is generally actioned on an appropriate court order, seizure warrant or specific legal request. Specify clearly whether you are seeking records, a freeze, or both.
- Binance law enforcement request guide
- How to trace a cryptocurrency transaction: a guide for investigators
- Freezing and seizing crypto: from exchange request to wallet seizure
For the full directory of platform law-enforcement request portals, see our LERS portal hub.