For years, the management and owners of the Dutch crypto platform Bitvavo were able to access customer data and accounts. Experts call this problematic, as privacy regulations stipulate that only a limited group of company employees, such as the anti-money laundering department or customer service, may have access to such data.
The company confirms that management had access to customer data until the spring of 2024. According to Bitvavo, this access was necessary in the company’s early years, when management still helped sign up new customers and answer questions.
Privacy law professor Gerrit-Jan Zwenne says in the Financieele Dagblad that “given the company’s size and growth, it might be useful to grant management all kinds of access rights, but that is at odds with privacy law.”
An investigation is currently underway to determine whether employees have complied with the privacy and conduct regulations. This investigation is being conducted by law firm Stibbe and accounting firm PwC.
Smaller back then
A spokesperson for the crypto company says that Bitvavo was much smaller back then. The Amsterdam crypto exchange now has 460 full-time jobs, about three hundred more than at that time. With a transaction volume of over 34 billion euros, Bitvavo was the largest crypto exchange in Europe in 2023.
The internal investigation into Bitvavo’s compliance with privacy and conduct regulations was launched after CEO Mark Nuvelstijn resigned last summer, following reports in the FD newspaper. The newspaper revealed that he had given his bank inaccurate information and profited from insider trading.
In chat messages, he seemed to suggest he could use Bitvavo’s systems to resolve a personal matter. Nuvelstijn denied this and said he hadn’t viewed any customer data. He claimed he himself was a victim of the now-convicted investment fraudster Max R., against whom he filed a complaint.
Bitvavo says that now only the departments that are entitled to it have access to customer data.
