When Supervisors Know the Addresses

The most consequential sentence in a recent study of Austria’s cryptoasset market is not a finding. It is a legal obligation: Austrian CASPs “must report the blockchain addresses under their control to the competent financial authority.”

Bernhard Haslhofer of the Complexity Science Hub presented the study at the ESMA Research Conference in Paris on 22 September 2026. Written with Pietro Saggese, Michael Sigmund, Burkhard Raunig, Esther Segalla and Christos A. Makridis, it examines how stablecoins and other cryptoassets behave under stress inside one national economy.

That obligation is what makes the study possible. Blockchains record addresses, not names, and carry no geographic identifier. Until now, anyone measuring activity within a jurisdiction had to guess: location from web traffic, IP data or surveys, and ownership from clustering heuristics that both miss and misattribute addresses. Austria replaced inference with disclosure. Only a CASP knows which addresses it controls, and only a supervisor can compel it to say so.

What disclosure makes visible

From the pseudonymised registry of all 12 CASPs registered in Austria at the end of 2024, the authors reconstructed every Bitcoin, Ether, USDT and USDC transfer through May 2025: almost 12 million transfers and $50.4 billion in volume. Ownership is known by construction, so no heuristic stands between the data and the conclusion.

The picture that emerges would be distorted in aggregate on-chain data. Some $20.7 billion, 41% of all volume, is CASPs moving funds between their own wallets: bookkeeping, not economic activity. Of the roughly $30 billion exchanged with outside counterparties, almost none stays domestic; flows between Austrian CASPs total just $5.8 million. The market is integrated globally, not locally.

Knowing the role of each address also separates small actors from large ones. Transfers that reach CASP warm and cold wallets are under 1% of external transfers but carry 57.8% of external volume. About 98% of counterparties behave like retail users, transacting a few times for around $1,500 each.

That separation changes how stress reads. After FTX failed, retail-like users withdrew persistently while institutions moved large deposits, consistent with liquidity management. Around the Silicon Valley Bank failure, retail-like users deposited USDC as institutions withdrew it, matching a redemption design that offers par only to verified institutions. In aggregate, such opposing flows cancel out. Stablecoins did not act as a uniform safe haven in any of the three shocks studied.

A foundation for independent analysis

An address registry gives a supervisor something it rarely has in this field: its own ground truth. With it, an authority can measure activity in its jurisdiction, test third-party attributions against disclosed data, and reproduce its results rather than accept them. That is the basis of an independent data analysis capability.

Nothing in the approach is specific to Austria. Any authority able to compel disclosure from the CASPs it supervises can collect the same registry, and the authors recommend going further. Supervisors could ask CASPs to add counterparty attribution drawn from their own KYC records, sharpening the retail-institutional split that on-chain behaviour can only approximate. Registries collected across jurisdictions could then feed a shared observatory of cryptoasset flows, global in scope.

The study is also candid about what such a registry needs. The authors found addresses likely controlled by Austrian CASPs that were missing from the reports. A registry must be kept current as wallet infrastructure changes, and checked independently rather than assumed complete.

Why replication needs standards

Replication alone does not produce comparable evidence. If each authority defines its own registry format, wallet tiers, attribution sources and flow categories, it will build a pipeline that cannot be compared with any other. The observatory the authors envisage would then remain out of reach, and every finding would depend on whichever proprietary method produced it.

This is the gap Open Blockchain Intelligence Standards (OBIS) sets out to close. OBIS is an open, vendor-neutral, community-developed set of specifications for blockchain intelligence. Its focus areas map directly onto the needs this study exposes: investigations, forensics and attribution; regulatory reporting and supervision; and open analytics and research data. Common definitions would let a registry collected in Vienna, Bucharest or Singapore be read the same way, and let attribution carry its provenance with it.

BIPA, the Complexity Science Hub and ICI Bucharest promote OBIS and facilitate its development. None of them owns it: the specifications are written openly by contributors and published at obistandards.org, with drafts on GitHub. Supervisory authorities, researchers and industry are invited to contribute and comment at [email protected].

From one registry to a shared view

Austria has shown that a single reporting obligation can turn an opaque market into a measurable one. The next step is for other supervisors to adopt the same obligation, and to build on common, open standards so that what each of them measures can be compared, verified and trusted. That is the work OBIS exists to support.

Denisa Voicu, Policy & Institutional Lead, BIPA

 

Reference: Saggese, P., Sigmund, M., Raunig, B., Segalla, E., Haslhofer, B., Makridis, C. A. (2026). Stablecoins under Stress in a National Economy: Transaction-Level Evidence from Austrian Crypto-Asset Service Providers. arXiv:2607.08524. Presented at the ESMA Research Conference 2026, Paris.

Conference: ESMA Research Conference 2026: Strong EU financial markets in a volatile world