An overview of civil and criminal statutes of limitations — with case law references and a practical checklist. Status: July 2026.
Whitepaper 2026
Executive Summary
The most practically important windows of opportunity in cases of crypto fraud arise not from the law, but from the rules and regulations of payment service providers. These windows are significantly shorter than any statute of limitations and often determine whether the money can be recovered at all.
Claims for damages arising from tortious acts, such as those under Section 823 Paragraph 2 of the German Civil Code (BGB) in conjunction with Section 263 of the German Criminal Code (StGB) (fraud), generally become time-barred after three years. The limitation period begins at the end of the year in which the claim arose and the injured party had knowledge of the damage and the tortfeasor, or should have had such knowledge without gross negligence.
In complex fraud schemes such as multi-tiered crypto platforms, it is important to note that victims cannot be expected to file charges solely based on initial findings by the public prosecutor's office. In such cases, the statute of limitations typically only begins to run once the victim is aware of the essential findings of the investigation—usually through access to the investigation files.
Regardless of knowledge or gross negligence in failing to know, most claims for damages become time-barred no later than ten years after they arise – to the exact day. This absolute upper limit applies even if the fraud has not been discovered by then.
In the case of unauthorized payments, such as those resulting from account takeover or spoofing, a separate legal basis applies: According to Section 675u Sentence 2 of the German Civil Code (BGB), the bank must reimburse the amount immediately and regardless of fault; the burden of proof for valid authorization lies with the bank (Section 675w BGB). However, a significantly shorter limitation period of generally 13 months from the debit date applies to reporting an unauthorized payment transaction (Section 676b BGB) – after which the claim against the bank is usually forfeited.
In cases of authorized but fraudulently obtained transfers—the most common scenario in investment fraud, since the victim authorizes the payment themselves—bank liability is more difficult to establish. It is primarily governed by the bank's general duty to warn and investigate, as well as the regular limitation periods outlined in sections 2.1 and 2.2.
For claims against authorized securities services companies, the shorter limitation period of Section 37a of the German Securities Trading Act (WpHG) (old version) may be relevant. However, the Federal Court of Justice has ruled that this short limitation period does not apply to companies operating without a BaFin license. Since fraudulent crypto platforms almost never have a BaFin license, the general limitation periods from sections 2.1 and 2.2 usually apply.
| Claim | deadline | Start of the time period |
|---|---|---|
| Damages arising from a tort | 3 years | End of year, from the date of knowledge of damage and perpetrator |
| Absolute maximum period | 10 years | Origin of the claim (to the exact day) |
| Refund to own bank (unauthorized) | 13 months | Debit to account (exclusion period) |
Overview of civil law deadlines. The 13-month period is not a limitation period, but a preclusive period — it cannot be suspended.
Fraud (§ 263 of the German Criminal Code) is a crime prosecuted ex officio. A criminal complaint can generally be filed at any time until the statute of limitations expires. A formal criminal complaint is only required in exceptional cases, such as minor damages to family members; in such cases, the filing deadline is three months from the date of knowledge of the crime and the perpetrator. This is practically rarely applicable in cases of typical cryptocurrency fraud perpetrated by third parties.
The statute of limitations depends on the maximum penalty prescribed for the offense. For simple fraud under Section 263 Paragraph 1 of the German Criminal Code (StGB) – punishable by imprisonment of up to five years or a fine – the limitation period is five years. If the offense is considered a particularly serious case, such as gang-related or commercial fraud with a penalty of six months to ten years, the limitation period is extended to ten years. Organized crypto fraud platforms frequently meet these criteria. Attempted fraud is subject to the same limitation period as completed fraud.
The statute of limitations does not begin with the planning or the first attempt at deception, but only with the completion of the crime. According to the Federal Court of Justice, in cases of investment fraud, the crime is considered complete as soon as the misleading information has been made accessible to a larger group of people. In ongoing fraud schemes with many victims over a longer period, the last fraudulent act is generally considered the starting point—an active platform effectively postpones the start of the limitation period as long as it recruits new victims.
Investigative measures such as interrogations or searches can interrupt the statute of limitations, causing it to begin anew. However, this is not possible indefinitely: The absolute limitation period is twice the statutory period. For simple fraud, this is ten years; for aggravated fraud, it is twenty years. After this period, a conviction is definitively precluded.
Filing a criminal complaint is important for investigations and potential asset seizures under Sections 73 and 111b of the German Code of Criminal Procedure (StPO), but it does not replace the need for civil enforcement. For this, targeted legal motions are necessary in the criminal proceedings, as the police rarely act on their own initiative. Seized assets can potentially be distributed among the victims through an application for damages in criminal proceedings or a subsequent civil lawsuit.
| variant of the act | Limitation period | Absolute limitation period |
|---|---|---|
| Simple fraud (§ 263 para. 1 StGB) | 5 years | 10 years |
| Organized/commercial fraud (§ 263 para. 3 of the German Criminal Code) | 10 years | 20 years |
| Attempted fraud | like a perfect | accordingly |
Statute of limitations for criminal fraud. The absolute deadline is twice the statutory deadline and cannot be extended further by interrupting actions.
„"The shortest deadlines are not stipulated in any law — they are found in the rules and regulations of the payment service providers."“
Immediate action vs. statute of limitations
Since October 2025, IBAN name verification has been mandatory for bank transfers across the EU. The planned PSD3/PSR reform will also introduce bank liability for authorized payments obtained through spoofing—for example, if a perpetrator impersonates a bank employee and the customer subsequently authorizes a payment. This extended liability is expected to be implemented in 2027 or 2028; it is not currently in effect.
Cryptocurrency exchanges and other crypto asset service providers (CASPs) have been subject to anti-money laundering regulations in Germany since January 1, 2020, as obliged entities under Section 2 Paragraph 1 No. 2 of the German Money Laundering Act (GwG). Since the expiration of the MiCAR transition period—shortened to December 31, 2025 in Germany, and no later than July 1, 2026 across the EU—crypto asset services in the European Union may only be provided by providers licensed under the MiCA Regulation. This category is relevant for victims because a breach of these obligations can result in both regulatory and criminal consequences for the exchange, as well as—in individual cases—civil law claims.
Cryptocurrency service providers must, among other things, verify the identity of their customers (Know Your Customer), conduct a risk analysis in accordance with Sections 4 and 5 of the German Money Laundering Act (GwG), and immediately submit a suspicious activity report to the Financial Intelligence Unit (FIU) in accordance with Section 43 of the GwG if they suspect any wrongdoing. Under the conditions of Section 46 of the GwG, the transaction in question must be stopped. In 2024, the FIU registered approximately 8,700 suspicious activity reports related to cryptocurrencies—a new record high out of a total of 265,708 reports received. Bitcoin was by far the most frequently mentioned cryptocurrency, followed by Ethereum, XRP, Tether, and Litecoin. The reported cases often involved trading platforms, mixing services, or gambling.
The criminal law classification of crypto assets is the subject of several landmark decisions. The Berlin Court of Appeal (Kammergericht) has ruled that Bitcoin is not a unit of account within the meaning of the German Banking Act (Kreditwesengesetz)—a decision which the German Federal Financial Supervisory Authority (BaFin) nevertheless does not adhere to in its supervisory practice due to the lack of binding effect of a criminal judgment. Also crucial for the anti-money laundering assessment of crypto transactions is a decision by the Munich I Regional Court (Landgericht München I), which convicted a defendant of money laundering after he acquired Bitcoin of unknown origin via darknet marketplaces; the court considered the anonymity of the transaction and a price significantly below market value as sufficient evidence of the assets' criminal origin.
For victims, the anti-money laundering obligations of the cryptocurrency exchange involved can provide an additional point of leverage: If an exchange fails to report under Section 43 of the German Money Laundering Act (GwG) or block accounts under Section 46 GwG despite recognizable grounds for suspicion, legal scholars debate whether this may also constitute a breach of contractual protective obligations (Section 280 Paragraph 1 of the German Civil Code (BGB)) or a protective statute within the meaning of Section 823 Paragraph 2 BGB. According to current research, there is no established, published case law on this specific legal basis for claims against cryptocurrency exchanges; the question must be examined on a case-by-case basis and should be accompanied by specialized legal advice. Also practically significant is the right to information under data protection law pursuant to Article 15 of the GDPR, which allows victims to request transaction data and risk assessments from the platform for their own evidentiary purposes.
This aspect of civil law is to be distinguished from the time limits presented in Chapter 2: Here, too, the general limitation periods of §§ 195, 199 BGB apply, whereby the commencement of the period is regularly linked to the knowledge of the relevant breach of duty by the stock exchange.
The civil law classification of AML/G violations as a basis for claims against cryptocurrency exchanges, referenced in section 5.4, is based on legal scholarship, not on established published case law. It should be understood as a guideline, not as a definitively settled legal situation, and must be examined separately in each individual case.
| measure | Rule of thumb deadline |
|---|---|
| Bank transfer recall | Immediately, count the minutes |
| Credit card chargeback | approximately 120 days |
| PayPal Buyer Protection | approximately 180 days |
| Objection to authorized direct debit | 8 weeks |
| Dispute unauthorized direct debit | 13 months |
| Claim for reimbursement against one's own bank (unauthorized) | 13 months (exclusion period) |
| Criminal charges | No deadline |
| Civil law limitation period (standard case) | 3 years, at the latest 10 years |
| Statute of limitations for prosecution of fraud | 5–10 years (10–20 in total) |
Rules of thumb, not legal advice. Chargeback and buyer protection deadlines depend on the rules of the respective providers and may vary in individual cases. Regarding criminal charges: there is no fixed deadline, but the sooner the better for securing evidence.
Why short deadlines are more important than long ones. The limitation periods determine whether a claim is enforceable — the recall and chargeback windows determine whether there are any assets left against which a claim can be made.
Why the start of the time limit is the point of contention in practice. On multi-stage platforms, more than a year often passes between the initial payment, suspicion, and reliable knowledge of the damage and the perpetrator. Linking the start of the limitation period to the date of the first transfer regularly results in wasted time.
What needs to be secured forensically at an early stage. Transaction hashes, wallet addresses, and off-ramp references are persistent on-chain, but the association with a counterparty is not—exchange data is subject to deletion periods. Early backup and a data access request under Article 15 GDPR preserve the evidence that will later determine the validity of a claim.
What this means for those affected. Two parallel paths – a criminal complaint for investigation and asset seizure, and legal representation to prevent further action on one's own claim. One does not replace the other.
This white paper provides general information and does not constitute legal advice for any specific case. The commencement and duration of any limitation period depend heavily on the specific circumstances, particularly on when exactly knowledge of the damage and the perpetrator arose and how the act is classified under criminal law. For a binding assessment and to ensure compliance with any deadlines, a lawyer specializing in banking and capital markets law or criminal law should be consulted promptly.
Research overview as of July 2026. Not legal advice in individual cases; the start and duration of deadlines depend on the specific circumstances.
David Lüdtke
Managing Director · OSINT Analyst & Crypto Forensic Expert · Financial Forensics GmbH
Court-admissible crypto transaction analysis, OSINT-based asset investigation, and expert reports for defense attorneys, insolvency administrators, and companies. Certified Crystal Expert (CECF, CEEI, CEUI). Financial Forensics Supports law firms, companies, investigative bodies and insolvency administrators — focus areas: Blockchain forensics, wallet analysis, court-admissible documentation, OSINT.
Contact: postfach@finanz-forensik.de +49 6057 772 994 86
We secure evidence, create legally sound crypto forensics reports, and support law firms and victims in asset recovery — before deadlines expire.
You are currently viewing a placeholder content from Vimeo. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from YouTube. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Google Maps. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Vimeo. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from YouTube. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Instagram. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Google Maps. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou need to load content from hCaptcha to submit the form. Please note that doing so will share data with third-party providers.
More informationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Turnstile. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More information
