Digital-asset disclosure orders in Guernsey

A payment leaves your wallet on a Thursday evening. By Friday morning it has cleared two exchanges, bridged chains, and settled in a cold wallet you cannot identify. The assumption – understandable, but wrong – is that the money is gone for good.

Guernsey courts can grant digital-asset disclosure orders that compel virtual-asset service providers, custodians, and intermediaries to identify wallet holders and reveal account information – even where the defendant is initially unknown. Combined with on-chain tracing, those orders create a route from a stolen balance to a freezing order within days, not months.

This guide sets out each step in that process: the legal instruments available in Guernsey, the sequencing that practitioners use, the cross-border complications that arise when assets move off-island, and the practical decisions that determine whether recovery remains possible.

Why Guernsey Is a Useful Forum for Digital-Asset Disclosure

Guernsey's courts have adapted common-law disclosure instruments to digital assets, making the jurisdiction a practical forum for claimants whose stolen funds have touched a Guernsey-registered entity or a VASP with operations connected to the island. The Royal Court has jurisdiction to grant orders with extra-territorial effect, subject to appropriate conditions and safeguards.

As of early 2026, Guernsey's regulatory regime for virtual-asset businesses has matured considerably. Guernsey-licensed VASPs are subject to anti-money-laundering obligations that include record-keeping on beneficial ownership of wallets and transaction counterparties. That record-keeping creates the very data that a disclosure order can unlock.

What does this mean for a claimant? It means that if stolen crypto has passed through a Guernsey-regulated intermediary – even briefly – there is a paper trail held by an entity that is subject to the Royal Court's jurisdiction. A Norwich Pharmal order, directed at that intermediary, can surface wallet-holder identity, account credentials, and transaction history before the defendant has any opportunity to dissipate further.

We routinely coordinate proceedings with local counsel in Guernsey, and in our experience the island's compact, specialised court environment allows urgent applications to move faster than many larger jurisdictions. That speed matters when digital assets are still in motion.

For a broader view of how on-chain tracing intersects with legal process, see our Crypto Asset Recovery insight hub.

What Instruments Does Guernsey Law Offer?

Guernsey offers a suite of common-law disclosure and freezing instruments that apply to digital assets as well as conventional property. Each serves a distinct function; practitioners sequence them strategically rather than deploying all at once.

A Norwich Pharmal order is the disclosure instrument of first resort. It compels a third party – a VASP, a custodian, a correspondent bank – to disclose information that identifies a wrongdoer. In digital-asset matters, the target of the order is typically the exchange or intermediary that received or processed the stolen funds. The applicant does not need to have commenced proceedings against the wrongdoer; the order is designed for the earlier stage, when identity is the problem.

A Bankers Trust order is closely related but specifically directed at financial institutions holding account records. Where stolen crypto has been converted to fiat and deposited with a bank connected to Guernsey, a Bankers Trust order can compel that bank to produce account statements, KYC documentation, and correspondence. The two instruments are often used in tandem.

A freezing order over digital assets – the Guernsey equivalent of a worldwide freezing order – can be sought once the defendant or the wallet is identified. The order restrains the defendant from moving, converting, or otherwise dissipating the digital assets. Guernsey courts have granted such orders over specific wallet addresses and token balances, including stablecoins, on appropriate legal process.

A proprietary injunction goes further: it asserts the claimant's equitable interest in specific assets, and can be granted even against persons unknown. This is particularly useful where the defendant's identity has not yet been established but the stolen tokens can be identified on-chain.

Finally, a gagging or no-notification order is routinely sought alongside any without-notice disclosure application. It prevents the third party from alerting the defendant that an order has been made – buying time for the claimant to secure a freezing order before funds are moved again.

Step One – On-Chain Tracing Before You File

Disclosure applications succeed or fail on the quality of the underlying evidence. Before any approach to the Royal Court, practitioners undertake a structured on-chain tracing exercise to establish where the stolen funds have moved and which intermediaries they have passed through.

Blockchain-analytics tools allow analysts to follow a transaction from the originating wallet through every hop, bridge, and conversion event. Public blockchains record every transaction permanently; even where the attacker has used mixers or privacy protocols, subsequent cash-out attempts typically involve a regulated VASP that holds KYC data. The tracing exercise maps that route and identifies the choke point – the VASP or custodian most likely to hold identifying information.

This stage has three outputs. First, a transaction graph showing the movement of funds from the victim's wallet to the current or last known resting point. Second, identification of the entities – exchanges, VASPs, bridging protocols – that processed the funds and are therefore amenable to disclosure orders. Third, a preliminary assessment of whether any of those entities are connected to Guernsey, either by registration, operation, or correspondent-banking relationship.

Can the tracing exercise be completed quickly enough to matter? In our experience, a preliminary trace covering the first several hops can be produced within hours. A fuller report, suitable for court use, typically takes days rather than weeks. The practical ceiling is the number of bridging events and the sophistication of any obfuscation technique used.

One honest caveat: if the attacker has moved funds through a fully non-custodial chain and never touched a regulated intermediary, the route to disclosure is narrower. The on-chain record still exists – but disclosure orders require a respondent who holds data, and a smart-contract protocol does not.

Step Two – Designing the Application Without Notice

A disclosure application in a digital-asset matter is almost always made without notice. This is not tactical aggression; it is the logical consequence of the risk of dissipation. If the target VASP or custodian is alerted before the order is served, a sophisticated attacker can move the balance within minutes. The without-notice procedure exists precisely for this situation.

What does a without-notice application require? The applicant must satisfy the court of three things. First, that there is a good arguable case that the applicant has suffered a wrong and has a legitimate purpose in seeking disclosure. Second, that the respondent is likely to hold the information sought. Third, that delay would risk frustrating the purpose of the application – a threshold that is straightforwardly met in most digital-asset theft cases given the speed at which assets can be moved.

The applicant must also make full and frank disclosure of all material facts, including anything that might be adverse to the application. Failure to do so risks the order being set aside on return. This is an area where early preparation pays: gathering all available evidence before filing, rather than relying on the court to fill gaps.

The application is accompanied by evidence in support – typically a sworn statement or affidavit setting out the facts of the theft, the results of the on-chain trace, and the basis for believing the respondent holds the relevant information. Local counsel in Guernsey drafts and files the application; our role is to supply the forensic evidence and coordinate the strategy.

A gagging order preventing the respondent from notifying the defendant is routinely included. This bridges the gap between service of the disclosure order and service of the freezing application.

Step Three – From Disclosure to Freezing

A disclosure order produces information. The next step is to use that information to restrain the assets before they move again. The transition from disclosure to freezing must be executed quickly; in digital-asset matters, hours matter.

Once the VASP or custodian has responded to the disclosure order – identifying the wallet holder and account details – the claimant applies on a without-notice basis for a freezing order over the identified digital assets. In Guernsey, this may take the form of a domestic freezing injunction over Guernsey-held assets, or a worldwide freezing order if the evidence supports a belief that assets are held or controlled both on and off the island.

Where the identified balance is a stablecoin, practitioners may also approach the stablecoin issuer directly on appropriate legal process, since stablecoin issuers have the technical ability to freeze specific token balances at a wallet address. This is an additional lever – not a substitute for a court order, but a parallel step that can be taken simultaneously.

The freezing order is served on the defendant and on any third parties holding the relevant assets – the VASP, the custodian, the correspondent bank. From the moment of service, those parties are at risk of contempt if they permit dissipation. The order typically includes an ancillary disclosure obligation requiring the defendant to identify all assets worldwide above a specified threshold.

What happens if the defendant cannot be identified even after the disclosure order has been answered? Guernsey courts can grant a proprietary injunction against persons unknown – restraining any person with knowledge of the order from dealing with the identified assets. This is a useful bridge when the attacker has used anonymising techniques that the VASP's KYC records do not resolve.

For related procedure in an adjacent jurisdiction, see our piece on crypto recovery and VASP regulation in England and Wales – a forum that often runs parallel proceedings where assets have moved between the two jurisdictions.

Cross-Border Complications – When Assets Leave Guernsey

Digital assets do not respect borders. A claimant who traces stolen funds to a Guernsey-regulated VASP may find that by the time the disclosure order is served, those funds have already moved to an exchange in a different jurisdiction. This is the most common source of friction in cross-border crypto recovery, and it requires a parallel enforcement strategy from the outset.

There are several scenarios to plan for. Where the funds have moved to an exchange regulated in England and Wales, the Guernsey freezing order can be used as the evidential foundation for a parallel without-notice application in that jurisdiction. The two proceedings run concurrently, each supporting the other.

Where the funds have moved to a VASP in a jurisdiction with a mutual-legal-assistance relationship with Guernsey, it may be possible to use letters of request to compel that VASP to preserve records and disclose account information. This is slower than a direct court order but relevant where the receiving VASP is not susceptible to a Guernsey disclosure order.

Where the funds have moved to a non-cooperative jurisdiction – or have been converted into a non-custodial form – the position is harder but not necessarily hopeless. The on-chain trace continues regardless of jurisdiction; if the attacker eventually attempts to cash out through a regulated entity in any jurisdiction where proceedings can be brought, the accumulated tracing evidence supports a disclosure application in that forum.

One practical complication worth naming: some VASPs registered in offshore jurisdictions take the position that a foreign court order does not bind them absent local process. This is a genuine issue. The strategic response is to identify, at the tracing stage, which entities in the chain are registered in enforcement-friendly jurisdictions and to anchor the litigation there rather than in the weakest link.

In our experience, the most successful cross-border crypto recovery matters involve coordinated applications in two or three jurisdictions simultaneously – timed so that none of the targeted VASPs can alert the others before the orders are served. This requires allied counsel across forums working from the same forensic picture.

Evidence Preservation and Maintaining the Chain of Custody

Disclosure orders produce raw data – transaction records, KYC files, wallet information. That data must be preserved and verified in a form suitable for use in further proceedings, whether in Guernsey or abroad.

Chain of custody matters. If evidence is gathered informally – screenshots taken by a victim, transaction records exported without attestation – opposing counsel will challenge its integrity. The practical standard is to obtain certified copies of VASP records through the disclosure order itself, and to record the provenance of all blockchain data produced by analytics tools.

The on-chain data is, by its nature, independently verifiable. Every transaction on a public blockchain is recorded permanently and can be independently confirmed by any party with access to the relevant block explorer. That immutability is an evidential advantage; the question is authentication, not accuracy. Practitioners address this by having the analytics output attested to in a witness statement by the person who ran the trace.

Where the matter is likely to proceed to trial – or to enforcement of a judgment in another jurisdiction – the evidentiary record built at the tracing and disclosure stage becomes the foundation for everything that follows. Cutting corners at this stage is a false economy.

Assessing Viability – When Is a Guernsey Disclosure Order Worth Pursuing?

Not every digital-asset theft supports a viable disclosure application. A candid viability assessment before filing saves time and cost on both sides.

The question to ask is not whether the funds can be traced on-chain – they almost always can be, at least partially. The question is whether the trace leads to a respondent that is connected to Guernsey and that holds information the court can compel it to produce. Without an addressable respondent, the disclosure mechanism has nothing to bite on.

There are also proportionality considerations. The cost of an urgent without-notice application, including local counsel fees, forensic tracing, and the ongoing costs of maintaining a freezing order, must be weighed against the quantum at stake and the realistic prospect of reaching assets that remain available. A matter involving a high quantum, an identifiable VASP respondent connected to Guernsey, and a relatively recent theft presents the strongest viability profile.

What are the warning signs of low viability? Assets moved entirely through non-custodial protocols with no regulated choke point. A very long period between theft and discovery, allowing multiple chain-bridge events and jurisdictional hops. A defendant known to be based in a jurisdiction with no enforcement relationship with Guernsey. These factors do not make recovery impossible, but they increase cost and reduce the probability of a timely result.

What about recovery scams? This is where a myth needs to be addressed directly. Some operators present themselves as asset-recovery specialists and promise that stolen crypto can be retrieved quickly, for an upfront fee, using proprietary methods. They cannot. Real recovery is a legal and forensic process, measured in weeks to months, dependent on cooperation from courts and VASPs, and never guaranteed. Any operator that promises a specific percentage of recovery or demands upfront fees in exchange for guaranteed results is itself a fraud risk.

The practical check is straightforward: a legitimate recovery specialist will explain the legal instruments available, the conditions for their use, and the realistic range of outcomes before accepting any engagement. If the conversation skips to fees before it addresses facts, that is a signal worth heeding.

A confidential case review at the outset – covering where the funds went, which entities processed them, and which forums can act – is the first step toward a realistic assessment. If you are at this stage, contact info@axiomtracel.com to request one.

Related Insight

• Crypto Asset Recovery – insight hub: on-chain tracing, exchange choke points, and freezing digital assets
• Guernsey as a recovery jurisdiction – regulatory environment, court access, and cross-border enforcement
• Crypto recovery and VASP regulation in England and Wales – parallel proceedings and coordinated freezing

Frequently Asked Questions

Q: Can stolen crypto really be traced and frozen in Guernsey?

A: Yes, subject to the specific facts. Public blockchains record every transaction permanently, and on-chain tracing tools can follow stolen funds through multiple hops and exchanges. If the trace leads to a virtual-asset service provider connected to Guernsey, a Norwich Pharmal order or Bankers Trust order can compel that entity to disclose wallet-holder identity and account information. A freezing order over digital assets can then be sought on an urgent without-notice basis. Recovery is conditional on facts – but the legal mechanism exists and is used.

Q: How quickly do I need to act after a crypto theft?

A: As quickly as possible. Digital assets can be moved, bridged, and converted within minutes. The gap between theft and application is directly correlated with the number of additional chain hops an attacker can take, each of which adds complexity and cost to the trace. Urgent applications in Guernsey are measured in hours to days, not weeks. The without-notice procedure exists precisely because delay defeats the purpose. If you are aware of a theft, the priority is to begin the on-chain trace immediately – before the funding and court strategy is finalised – so that the forensic picture is ready the moment proceedings are issued.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate specialist explains the legal instruments available – Norwich Pharmal orders, freezing orders over digital assets, cross-border enforcement mechanisms – before discussing fees, and is clear that recovery is conditional on facts and court decisions, never guaranteed. Recovery scam operators typically promise a specific percentage of recovery, demand upfront fees, and offer proprietary or informal methods that have no legal basis. If an operator cannot name the legal instruments they intend to use, or asks for payment before providing a substantive assessment, treat that as a serious warning sign. Real asset recovery is a court-driven, evidence-dependent process.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We routinely coordinate proceedings with local counsel in Guernsey, and in our experience the island's legal system offers effective, fast-moving tools for digital-asset disclosure and freezing that compare favourably with larger common-law jurisdictions. We work lawfully and within applicable sanctions regimes. Our approach is forensic first: the on-chain trace is the foundation; the legal instruments are the tools that convert it into results. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace routinely coordinates proceedings with local counsel in Guernsey; this article does not constitute Guernsey legal advice. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.