My crypto exchange closed my account for no reason, how can I defend myself against it? A couple of years ago, I opened an account in Bitpanda, deeming it a serious and professional crypto exchange. In the last year I haven't carried out any operations, a few days ago I decided to go back to do some trading. I had to supplement my account with new personal info, selfies and photos of my passport. All approved, so I moved to the platform, click on deposit, where I noticed that the maximum deposit I could make was 0 euros. Then I tried to make a withdrawal, but that too was disabled. So I contacted the support and this is what they told me: After a further check by our security department, we have to permanently close your account for security reasons. Also, it is not possible to create a new account or reactivate an existing one. Please note that we cannot provide any further information on this decision and will not deal with any complaints about it. The bottom line is that they actually stole my money, for no reason, as I have never done any weird transactions. Even if it's little money, it seems to me an injustice. Is there anything I can do about this action? UPDATE 2 JAN 2023 On December 29th, I opened a dispute and after 4 days with no response, I look at my ticket directly on the website, so what a surprise when I saw that my dispute was closed without any reason.
Think through what really happened. You are using terms like fraud, while they may be thinking they're doing fraud protection, or otherwise following laws and regulations. You wrote that you didn't use it for a long time, could the credentials have been compromised? It sounds highly implausible that a platform would defraud a single user. Either there are many more people with similar stories, or your claim is a bit suspect. Think about what your goal is. Reactivating the account, or getting the balance back? Is the balance big enough to spend time and money? Check with which legal entity you have a contract. AFAIK BitPanda is Austrian, so they cannot refuse a GDPR information request on what they have about you all that easily. Consider communication in writing, by registered mail.
I'm pretty sure that under GDPR, you can indeed request them to send all data they have on you. If it's a complex request, they may charge you something like £10. If they have a lot of data on you, they may list the categories of data they have and ask you to pick one, rather than them having to collect and send everything. They should respond within one month, but iirc in the UK implementation, they can inform you (within that month) that they will respond within three months instead. For the rest, I only know current Dutch law. GDPR is not that different from what we already had (in general terms) and in many cases it even extends it. Under our law (WBP), you can also request a correction of the data in case it is incorrect, or deletion if they no longer need it for the purpose for which it was collected and stored. I don't really know how that works out in practice though, as Facebook can of course claim that "being able to connect you to your friends when you sign up for WhatsApp or Facebook with that number" is a legitimate purpose (in their eyes). They might also not have your full name and therefore not be able to connect your data to your request. Or, perhaps, they have only your full name (and there are probably more people with your name), so they'll have a hard time verifying that it's really your data which they would be handing over or deleting. The company is required to verify your identity before acting on your request. How they implement that is up to them. Under Dutch law, if I remember correctly, any data that can be connected to your person by any party is personally identifiable information (PII). While Facebook might not be able to find who's behind a phone number, your carrier most certainly can. Therefore, the data falls under PII protection laws and they will have to implement a way to verify you and get you your data. Finally, whether your local laws apply to Facebook, I don't know exactly. There's lots of information on this though, so you should be able to find it. Generally, countries say that if something happened within their territory (e.g. you signed up for WhatsApp while in the UK), their law applies. Companies, I've read, will instead try to claim that their main office is in SomeCountry and therefore SomeCountry's laws apply. But I'm pretty sure you'll be able to find a Facebook office somewhere where GDPR applies, so that's probably fine. While not an exact answer and while I am not sure about everything, I hope this gave you some pointers to go on!
The applicable law is the New Zealand Anti-Money Laundering law. The regulations describing exactly what is covered don't mention Bitcoin cleaning, but the "wire transfer" and "currency exchange" bits probably cover such a thing. I certainly wouldn't like to be the test case. There was also this case in Europe.
So, in short, the bank did what you asked them to do (close your account). What do you think they did that might be unlawful?
In most cases, there is no direct legal recourse for such a withdrawal. Money in a joint account is co-owned, and any account holder may withdraw any of it for any lawful purpose. As the article &quot;What is a joint bank account?&quot; from Bankrate.com states: The money in joint accounts belongs to both owners. Either person can withdraw or spend the money at will — even if they weren’t the one to deposit the funds. The bank makes no distinction between money deposited by one person or the other, making a joint account useful for handling shared expenses. But a joint bank account should only be opened with someone whom you trust, since that person has equal control over the account’s funds. If the account holders have a contract or legal agreement that controls what money can be withdrawn and for what purposes, then a violation of such an agreement might be a cause for legal action. But merely opening a joint account does not create such an agreement nor imply it.
I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith. Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time. (Note: the term &quot;EU resident&quot; above is an approximation of the territorial scope).
The guy does not imitate his brother, but instead claims that money donated will be split with him -- however, his brother has no agreement/idea with this. That's called Fraud (Wikipedia), "...a deliberate deception to secure unfair or unlawful gain..." and will be recognized as such in almost every legal jurisdiction in the world. At very least, it's against Patreon's Terms of Use: "Fraud - Don’t post information that is false or otherwise misleading. Impersonation - Don’t impersonate anyone. Don’t use another’s account, or allow others to use your account." The way this would not be fraud is to clearly state on Patreon that you are raising money for your brother, and to involve him in the process and have him choose to accept the money before you start to collect it. If he won't accept the money, don't collect it in the first place.
Although crypto space may be little regulated, insurance is in most jurisdictions highly regulated. Any such arrangement would need to comply with current laws on insurance, until and unless modified laws to cover this sort of thing are passed, and then it would need to comply with those. Tax authorities generally allow one to declare &quot;other business income&quot; or &quot;other investment income&quot; without forming a legal entity. I cannot say how such income would be classified in any given jurisdiction. Whether the platform, or some legal entity associated with the platform, would need to be registered will depend on the current laws and regulations governing insurance, and on the way in which teh contracts are structured. A disclaimer cannot prevent one from being sued. The contracts would need to carefully and explicitly state who is liable for what. Programs cannot be held accountable for anything. Legal entities, including operators of programs, can be. If negligence in the creation or operation of a program causes a loss, the operator may well be liable. Programs cannot be sued for anything. Legal entities, including operators of programs, can be. It may well be essential to constitute the &quot;platform&quot; as a legal entity of some sort. Otherwise its operator will be liable for its actions. I cannot be sure. I once encountered a somewhat similar system in which insurance was provided by individuals exchanging contracts, so that in a sense each member insured all the others. There was a company that supervised and provided legal and administrative services to the group of individuals, and collected fees for this. That sounds a bit similar to the suggested platform, but I don't know exactly how that company was organized. The system was called &quot;NJ CURE&quot;. I don't know if it is still in operation.