By cryptoadmin Nine Signatories in Strasbourg
The European Union and eight European states have signed an additional protocol to the Council of Europe Secretary General Alain Berset announced alongside the 2026 Octopus cybercrime conference, a treaty that extends the 2005 anti-money laundering framework's asset recovery machinery to virtual assets. Georgia, Greece, Hungary, Luxembourg, Monaco, Montenegro, San Marino and the United Kingdom joined the EU at the signing ceremony in Strasbourg, France, held on 2026-10-14. The underlying convention governs the laundering, search, seizure and confiscation of criminal proceeds and the financing of terrorism; the protocol modernizes that framework for digital assets and widens the legal instruments each party can deploy against proceeds that cross borders. Berset put the case in blunt terms: criminal money feeds organized crime and buys what should never be for sale, democracy itself, and no single country can recover criminal assets across borders on its own. With the protocol, he argued, none has to try. Nothing takes effect from the ceremony alone. The treaty text shows the protocol enters into force only once five parties ratify it, at least three of them Council of Europe member states, so the operative start date rests on national ratification votes that have not yet happened. Member states of the organization had already adopted the new provisions in May 2026, moving the text from drafting to the signature stage. The change that matters for the industry is definitional. Virtual assets and virtual asset service providers, the VASPs that custody and transmit them, now sit inside the convention's scope, placing exchanges and custodians in these jurisdictions within cross-border seizure and information-sharing machinery previously aimed at bank accounts. The stated goal is to close the gap between enforcement powers built for bank money and value that settles in minutes across jurisdictions.
Seizure Without a Conviction
The substantive changes are wide. Courts may confiscate property even where it is not directly tied to a named offence, provided the court finds it derives from criminal activity, and in defined cases a court order suffices without any criminal conviction at all. Assets held by third parties can be swept into confiscation, though the text protects parties who acquired the property in good faith. To stop value from moving before authorities act, the protocol permits urgent measures: freezing or seizure without prior notice, aimed at intercepting proceeds before they reach another account or jurisdiction. Each party must establish or designate an Asset Recovery Office to trace criminal proceeds and an Asset Management Office to manage frozen, seized and confiscated assets. Financial intelligence units get expanded powers, including the ability to obtain information from VASPs, to monitor and halt transactions suspected of laundering, and to access account records held by financial institutions and digital asset service providers quickly. Parties must run a centralized automated system, or an equivalent, covering both bank and virtual asset account data. Cross-border cooperation between the recovery offices themselves becomes obligatory rather than discretionary, with a 3-day response deadline for urgent requests. The text then sets out where recovered value goes. Victims and legitimate owners come first, and return or compensation can occur before a final confiscation decision under set conditions. Amounts above 10,000 euros are split equally among the states that took part in the recovery, and parties are encouraged to apply confiscated crypto to social reuse, the public interest or other specified purposes.
Our reading: the binding constraints land first on centralized entities. FIU suspension powers and rapid account access operate on VASPs and banks, which is where enforcement can actually pull a lever. Value that has already moved into self-custody, where holders control their own private keys or onto a hardware wallet, sits outside those account provisions, and tracing typically follows flows through exchanges and a stablecoin before it reaches that point, with laundering routes increasingly pushed across cross-chain bridges. For compliance teams in signatory jurisdictions, the 3-day clock on urgent requests and the new suspension authority turn the compliance desk into part of the recovery chain. The five-party ratification threshold means none of this has a start date yet, so the practical test is which states ratify first.