A request by the Internal Revenue Service for user data from a bitcoin exchange highlights simmering tensions between compliance and customer privacy for financial institutions and will test how those demands are balanced in the young field of cryptocurrency.

Under a procedure called a John Doe summons, the IRS this month asked a federal court in California to approve its request for Coinbase to turn over records on any user who had made digital currency transactions between 2013 and 2015.

At issue is the indiscriminate nature of the request. Coinbase has accumulated nearly 5 million users, according to its website—which could mean the company might be forced to turn over financial records on millions of U.S. taxpayers.

In the past, the IRS had targeted a number of banks with John Doe summonses. The requests were broad, but did not ask financial institutions to turn over information on every single one of their accountholders as the IRS is now demanding Coinbase do, industry lawyers said.

“It’s much broader in scope than anything that’s been issued to the banks,” said Carol Van Cleef, a partner at the law firm of BakerHostetler.

Digital currency supporters are concerned that in addition to any genuine tax cheats, the IRS could hoover up the transaction data of a wide swath of innocent Coinbase users.

“If you’re using bitcoin to buy politically incorrect books, the government’s going to have a history of all your transactions,” said Jerry Brito, the executive director of the cryptocurrency think tank Coin Center.

To support his case, IRS agent David Utzke argued in the filing that all bitcoin users are by nature suspect, because cryptocurrency transactions do not require third parties—including companies like Coinbase—to report them to the government.

“Tax noncompliance increases in the absence of third-party information reporting,” said Utzke. “This experience is a reasonable basis to believe that members of the ‘John Doe’ class [the Coinbase users] may have failed to comply with the internal revenue laws of the United States.”

Coinbase—a company whose know-your-customer and transaction monitoring practices have chafed hardcore bitcoin users—said it would appeal the summons if it gets approved in court.

“Our general tack is to work with law enforcement’s reasonably targeted and lawful requests for information,” said Juan Suarez, the counsel at Coinbase. “This is a very, very broad request for all information on customers over a three-year period.”

Though the John Doe summons procedure can allow the agency to go after unnamed tax evaders, it cannot be used toward an investigation of “specific taxpayers,” according to the IRS’s own Internal Revenue Manual.

In 2015, for instance, the IRS asked Bank of America and Citibank to turn over records on customers who held accounts at BBIL, a correspondent bank in Belize the agency suspected of facilitating tax evasion schemes.

“A John Doe summons cannot be used to conduct a ‘fishing expedition,'” said P. Faisal Islam, a compliance and anti-money-laundering consultant for fintech companies, citing the IRS’s own language.
Here, Islam added, “it would seem like a fishing expedition because [the IRS] hasn’t established, A, that Coinbase has users that engage in tax avoidance; or, B, that Coinbase has primarily engaged in bitcoin transactions for the purpose of tax evasion.”

But some argue that the IRS is on solid ground to ask for the records of bitcoin users, because it needs to get a better sense of how prevalent the use of the digital currency for tax avoidance purposes is.
The IRS has “two different things in mind,” said D.E. Wilson, a partner at the law firm Venable. “One is to try to gain a sense of the size of the market, and the other is get a sense of what percentage of that market is filing tax returns, disclosing their digital currency transactions.”

Wilson added: “That’s not fishing. That’s trying to get a handle on the market.”

Data that feeds analytics insights is controlled by local, national or federated regulations. Companies must heed these rules to ensure they comply.

The IRS is under pressure to crack down on bitcoin tax evasion. In a September report, the Treasury’s Office of Inspector General had criticized the agency for not committing enough resources to fighting tax evasion schemes committed through the use of a digital currency.

“IRS management needs to develop an overall strategy to address taxpayer use of digital currencies as property and as currency,” the watchdog urged.

In 2014, the IRS announced that it considered bitcoin a form of property for tax reporting purposes. This means that every time someone sells (or spends) bitcoin at a profit, they are liable for a capital gains tax on that transaction, which needs to be reported.

As a result, digital currency watchers are questioning whether the IRS’s request might be an attempt to go after both people using bitcoin as a tax-evasion tool, and those who have—inadvertently or not—failed to comply with the complicated reporting requirements related to bitcoin’s classification as property.

“The IRS has a habit of spreading out its compliance activities across all levels of income,” said Wilson. “If you applied that theory to what’s going on here, you’re likely to see the small trader as well as the large trader be caught somewhere along this system.”

But others hope the IRS will not focus its attention on those types of penny ante tax-reporting violations.

“If in the course of their investigations they turn up that somebody bought $5 worth of bitcoin and they cashed it in for $10,” said Brito, “I would be very surprised if the IRS [brought] in this person.”

Coinbase may face an uphill battle fighting the summons. According to an annual report to Congress by the IRS’s Taxpayer Advocate Service branch, in the year that ended in May 2015, 96 percent of lawsuits appealing summons enforcements were successfully fought off by the agency.

“Taxpayers and third parties rarely succeed in contesting IRS summonses due to the significant burden of proof and strict procedural requirements,” the 2015 report said.

This request could therefore drive bitcoin users—many of whom are attracted to the digital currency’s privacy features—away from companies like Coinbase, a licensed money transmitter in 35 states that offers currency conversion and storage services.

“They may not want to use a third-party service to conduct transactions,” said Brito. “They might use a service like Coinbase to acquire bitcoin—but not as a wallet.”