For nine years Matthias Steger conducted these audits himself. That perspective decides matters: we know which positions get taken up, which requests are justified — and which go beyond what the statute provides for.
What determines whether a field audit is permissible at all, and what powers the auditor has.
Anyone carrying on a trade or a professional activity can be audited without special justification. In the crypto field that covers commercial traders, miners beyond a certain scale, node operators and every company holding crypto assets.
The full duty to cooperate under section 200 AO, duties to record and retain under sections 140 et seq., and — following from those — electronic data access under section 147(6).
Anyone exceeding the threshold in section 147a AO is placed on the same footing as a trader so far as auditability is concerned: a field audit is likewise permitted under section 193(1), with no need to justify its expediency.
Gains from private disposals and rewards count as surplus income. A single strong year can therefore be enough to fall into this category — with the retention duty and data access following from it. Exactly when is set out further below.
For all remaining taxpayers a field audit is permissible only where the circumstances relevant to taxation require clarification and an examination at the tax office would not be expedient given the nature and scale of the matter. Both conditions must be met, and both must be reasoned.
The reasoning on expediency is reviewable by the courts. Where it is missing or does not hold, the audit order is open to challenge. And without a duty to record there is no basis for electronic data access — the auditor depends on the production of documents.
The duty to cooperate is wide but not unlimited. It extends to information and to documents relevant to taxation — not to everything that exists.
You must give information, produce records, books, business papers and other documents, and give the explanations needed to understand them. For crypto assets that means transaction summaries, wallet addresses, acquisition evidence and valuation records.
With foreign exchanges — which is to say with most of them — you are subject to an enhanced duty of cooperation, including securing evidence in advance. You must obtain the records while that remains possible. Anyone who waits until the platform shuts down bears the consequences.
Since the reform of audit procedure the authority can issue a qualified request for cooperation. If it is not met within the deadline, a delay penalty may follow — independently of any later dispute about the substance.
Where documents are missing, the tax base is estimated. With crypto assets that regularly means acquisition costs of zero, and therefore taxation of the entire proceeds. A reconstructed history is almost always cheaper than going without evidence.
The decisive connection is often overlooked: the right of access attaches to a duty to record and retain. Where none exists, there is no access either.
| Category | Duty to record | Data access |
|---|---|---|
| Trades and professions | yes, sections 140 et seq. AO | permitted, in all three forms |
| Income above 500,000 € | yes, section 147a AO | permitted, to the extent of the records subject to retention |
| Other private investors | none | no right of access — production under section 200 AO only |
Which form is chosen is in principle for the authority to decide. In practice it can be negotiated — and handing over a properly prepared data set is usually the route that offers the least exposure. It also has the advantage that you know what the auditor is looking at.
A detail of section 147a AO that makes a considerable difference in practice.
Anyone with surplus income of more than 500,000 euros in a calendar year must retain the underlying records and documents. For crypto investors that is reached faster than it sounds: gains from private disposals and rewards both count towards it.
The retention duty exists only from the beginning of the calendar year following the year in which the threshold was exceeded. Someone above the threshold for the first time in 2026 is subject to the duty from 2027 — not retrospectively for 2026.
That is not a formality: it decides whether a right of data access exists for the year in which the threshold was crossed.
Not in the next weaker year. It falls away only once the threshold has not been exceeded in five consecutive calendar years. A single strong year therefore reaches years into the future.
Anyone approaching the threshold should build the documentation before the duty bites, not afterwards. Records are easy to keep going forward and laborious to reconstruct backwards. That preparation is one of the points on which an initial consultation pays for itself.
The question now comes up regularly in audits — and the answer is clearer than many assume.
You owe the production of documents and, where a retention duty exists, the provision of an evaluable data set. You owe no ongoing access to third-party systems.
Data access under section 147(6) AO covers the data subject to retention on your own system. It creates no right to API keys, login credentials or wallet access at an exchange. Such access would in any event expose ongoing and future activity that the audit period does not cover at all.
With wallets there is a further point: a private key is not a means of information but control over assets. Nobody owes its disclosure — and nobody should give it.
This is not obstruction. Someone producing a complete, ordered data set discharges their duty better than someone opening an access route — and keeps control over what was handed over.
Is the audit permissible at all, is its scope in time and subject matter correctly defined, and — in category 3 — does the reasoning on expediency hold? The appeal against the order is subject to a deadline.
Before anything is handed over it is put in order: transactions consolidated, transfers between your own wallets removed, valuations documented. What you produce, you should have understood yourself first.
Requests are answered by us, not by you. That protects against remarks in passing that are later treated as concessions.
Not every position is worth a fight. We say plainly where we see good prospects and where a concession is the cheaper route.
Preparing the closing meeting, reviewing the audit report and the amended assessments, then appealing where that is indicated. The appeal procedure (in German)
Once proceedings are opened the position changes fundamentally — including your duties to cooperate. In those cases we work alongside criminal defence counsel and handle the tax side.