On August 19, 2026, the Belgian Department for Combating Online Harm (BAPO) issued five decisions requiring four domain registrars and one registry to provide a complete file on operators of
On August 19, 2026, the Belgian Department for Combating Online Harm (BAPO) issued five decisions requiring four domain registrars and one registry to provide a complete file on operators of illicit sports streaming sites: identity, IBAN, bank cards, crypto wallets, and transaction identifiers, plus twelve months of connection logs. All under seal of secrecy. The cross-border scope of the injunction remains, in practice, to be tested.
The traceability of European crypto actors remains at the heart of debates. The Belgian injunction fits into this same logic, but through another link: the registrars. The five decisions result from an order by the French-speaking Brussels Enterprise Court, seized in late July 2026.
Your 1st cryptos with BitpandaThis link uses an affiliate program.Four requests were sent to domain registrars. The fifth concerns a domain name registry.
Three companies appear in the publicly released documents: Hosting Concepts, a company linked to Openprovider, Hostinger and Key-Systems. They are all established in the European Union, but outside Belgium.
The name of a fourth registrar as well as that of the registry concerned have been masked. The authorities also did not reveal the domain names targeted by the procedure. However, the Court found that the requests made were proportionate.
The requested information is extensive. BAPO notably wants to obtain the full identity of account holders, as well as the history of their postal addresses, email addresses, and phone numbers.
The authorities also request available banking details, including IBANs and the exact identity of the account holder. Data linked to payment cards are also concerned: BIN, last four digits, issuing bank, and country of issue.
The most unusual part concerns crypto payments. Registrars must provide any crypto payment methods used by their clients, including wallet addresses, type of asset involved, and transaction hash.
Finally, the decisions also request detailed technical information, notably IP addresses, device type, operating system, and browser used. Up to twelve months of connection logs can be requested, with very precisely timestamped data.
The injunctions rely on Article 10 of the Digital Services Act, intended to regulate the application of an “information order” to a provider established elsewhere in the Union. The problem is that BAPO is a Belgian federal service, whereas the targeted registrars are not all Belgian.
Nothing prevents a Dutch, Lithuanian, or German registrar from contesting the transmission based on its national law or the GDPR, or even from bringing the matter before the Court of Justice of the European Union.
To this initial weakness is added the secrecy imposed by the gag order: BAPO invokes the exception related to criminal investigations to exempt itself from the duty of information provided by the DSA. Concretely, an operator may see its identity, banking history, and logs transmitted to rights holders without being warned.
For an operator who billed their service in stablecoins or bitcoin, this injunction turns the registrar into a gateway to their on-chain identification. A wallet is in itself only a public address.
However, combined with the transaction hash, then cross-referenced with twelve months of IP logs, it provides rights holders a procedural starting point to request removal of anonymity from European exchanges, already subject to Travel Rule and KYC rules.
The short-term test will be simple to observe: Will Hostinger, Hosting Concepts, and Key-Systems transmit the data, contest the injunction, or request a stay? If one of the three appeals to the CJEU, this Belgian case will become a landmark on the cross-border enforceability of Article 10 of the DSA. This type of aggregation of clues has already produced results in the past, as shown by the Movie2K case documented by Cointribune.
