Embedding Victims in Criminal Enforcement: Spain's Public– Private Model for Crypto Asset Recovery

Executive Overview

Cross-border cyberfraud and crypto-asset crime continue to test the limits of traditional enforcement models. Speed, technical complexity and jurisdictional fragmentation often allow illicit proceeds to disappear long before courts can react. 

Against this backdrop, Spain offers a particularly distinctive example of how public authorities and private practitioners can work together effectively in asset recovery — an approach that has proven especially useful in cases involving crypto fraud.

What sets the Spanish system apart is not merely the availability of investigative powers or forensic tools, but the structural role assigned to victims within criminal proceedings. By design, victims are not passive observers of public enforcement but active participants in it. This institutional feature has enabled a form of public–private cooperation that, in practice, has delivered tangible results in tracing, freezing and ultimately recovering digital assets.

Victims as Private Prosecutors: A Structural Difference

Unlike common law jurisdictions, where private prosecutions exist but remain exceptional, discretionary and tightly circumscribed, Spanish criminal procedure allows victims, as a matter of principle, to participate in criminal proceedings as acusadores particulares (private prosecutors) alongside the public prosecutor.

This is not an ancillary or symbolic role. Victims and their counsel have standing to:

• propose investigative measures,
• submit expert evidence,
• participate in hearings, and pursue both criminal responsibility and civil liability within the same proceedings.

As a result, victims' lawyers maintain a continuous and legitimate presence throughout the investigation phase. This creates a natural framework for cooperation with law enforcement authorities — particularly specialized cybercrime and financial crime units — from the earliest stages of a case.

In crypto-related matters, where time is often the decisive factor, this embedded participation has proven critical.

Comparative Context: Why Other Civil-Law Systems Struggle

Comparatively, civil-law jurisdictions with analogous victim-participation frameworks—such as France and Germany—have struggled to leverage this structural advantage in crypto and asset-recovery cases, largely due to institutional bottlenecks. 

In France, prosecutor discretion in prioritizing asset-recovery investigative measures frequently conflicts with conviction-focused strategies, and coordination between the judicial police (PJ) and financial-crime units remains fragmented. 

German victim participation, while constitutionally protected, is often operationalized through victim-advocacy offices disconnected from the investigation itself, limiting the technical input that specialist counsel can provide in real time.

Switzerland's experience, instructively, reveals how restrictive victim-definition statutes and mandatory-prosecution doctrines can paradoxically inhibit effective cooperation. Swiss law, while requiring prosecutors to act on complaints, simultaneously limits standing to narrow categories of "direct victims," excluding associations of defrauded investors or victims' collectives—a constraint that has proven particularly acute in mass-fraud scenarios. Additionally, Switzerland's prohibition on private prosecution in serious offences removes the incentive structure that motivates specialist legal teams to invest in complex, forensically intensive investigations.

By contrast, Spain's framework explicitly enables mass participation through private prosecution, while also allowing prosecutors to maintain strategic control. This dual-track approach has proven more adaptable to the demands of distributed, cross-border crypto fraud.

Case Studies: Public–Private Cooperation in Action 

(2020–2024) 

1. The Arbistar Pyramid Scheme (Tenerife)

One of the clearest illustrations of this model is the Arbistar case, a large-scale cryptocurrency investment scheme investigated between 2020 and 2024. Thousands of affected investors grouped together through private prosecution, while their legal team worked closely with the Central Cybercrime Unit of the National Police and Spain's Asset Recovery and Management Office (ORGA).

Private practitioners contributed expert reports analyzing blockchain flows and assisted in the judicial custody of seized wallets. Importantly, patrimonial reports prepared by the private accusers were incorporated into the court's investigative measures and used by ORGA to locate, freeze and manage digital assets.

The result was the recovery of more than €2.5 million in crypto-assets through European exchanges, alongside a strengthened evidentiary basis for charges of large-scale crypto fraud. This outcome would have been difficult to achieve through purely public enforcement acting in isolation.

2. Exchange Frauds and "Rug Pulls"

Between 2021 and 2023, Spanish courts—particularly the National Court (Audiencia Nacional)—dealt with multiple cases involving unregistered exchanges and DeFi frauds, including so-called rug pulls. In these matters, several specialized law firms representing victims collaborated with the Money Laundering and Cybercrime Section of the UDEF and with SEPBLAC, Spain's Financial Intelligence Unit.

Private prosecution teams provided on-chain transaction traces and audited smart contracts. Police analysts, working in coordination with blockchain-analytics platforms such as Chainalysis and TRM Labs, reconstructed the flow of funds across multiple wallets and jurisdictions.

This cooperation enabled judicial freezing of wallets and accounts located in Malta and Estonia before assets could be transferred outside the EU—a decisive factor in preserving recoverable value for victims.

3. Ransomware Investigations (Barcelona)

A further example comes from ransomware investigations coordinated by the Barcelona Provincial Prosecutor's Office in 2022. A cybersecurity-focused law firm representing several victimized companies worked alongside the National Centre for Infrastructure and Cybersecurity Protection (CNPIC) and the Central Brigade for Technological Crimes.

Private counsel supplied server logs and evidence tracing crypto payments from ransom wallets through mixing services. Acting on this information, authorities obtained rapid judicial orders to European exchanges, leading to the freezing of a Bitcoin wallet valued at approximately €400,000 before laundering could be completed.

Once again, speed and technical alignment between public and private actors proved decisive.

4. Joint Operations: ORGA and Private Plaintiffs in Corruption Cases (2019–2024)

In various corruption and money-laundering proceedings linked to illicit crypto payments—including spinoff proceedings from the Tándem case and so-called "digital EREs"—private prosecutors and identified victims collaborated with ORGA and the UDEF to supply blockchain-tracing evidence and asset intelligence.

This cooperation enabled courts to apply early sale mechanisms for seized assets under Article 367 octies of the Spanish Criminal Procedure Act, including the management and liquidation of cryptoassets held in judicial custody. These mechanisms, relatively novel in the digital-asset context, allowed seized crypto to be converted into liquid funds at an early stage, reducing volatility risk and facilitating eventual compensation.

Operational Architecture: How Public–Private Cooperation

Works in Practice

What enables this cooperation is not informal goodwill but structured institutional design. Coordination occurs through multiple, complementary channels:

• Joint Investigative Teams (JITs): In significant crypto-fraud cases, UDEF and local cybercrime units formally designate specialists from private firms as forensic consultants or expert advisors, operating under judicial oversight. This arrangement preserves chain-of-custody requirements while enabling real-time technical input from lawyers with deep blockchain expertise.
• Case-Management Conferences: Regular coordination meetings—convened by the investigative judge, prosecutor, and victim counsel—establish common timelines, share intelligence within confidentiality protocols, and resolve procedural conflicts before they escalate. These forums allow private practitioners to propose investigative measures and flag time-sensitive asset movements.
• Confidentiality Protocols and Information-Sharing: Spain's framework distinguishes between investigation secrecy (reserved to public authorities) and derecho de defensa (defence rights, including victim counsel's entitlement to discovery). Protocols negotiated case-by-case clarify which information private counsel may access, which must remain sealed, and which can be shared with victim collectives. This balance is critical: too restrictive, and private investigation stalls; too permissive, and suspect networks are alerted.
• Expedited Asset-Freezing Orders: Courts have adopted procedural innovations allowing prosecutors or private accusers to petition for emergency freeze orders ex parte based on preliminary blockchain evidence, with judicial confirmation within 48–72 hours. This compressed timeline—compared to traditional multi-month investigation sequences—has reduced the window during which assets can be moved or laundered. In Arbistar and the ransomware cases, these accelerated orders proved decisive.

Quantified Impact: Evidence of Effectiveness Data from Spain's Asset Recovery and Management Office (ORGA) corroborate the functional advantages of this cooperative model. Between 2016 and 2024:

• Total expedients initiated: 2,842 (cumulative through 2024)
• Cumulative assets located: 7,763 items
• Crypto-specific cases with private-prosecution participation: 34% of ORGA's 2020–2024 caseload
• Asset-recovery rate (private-prosecution cases vs. prosecutor-only cases): Cases involving structured private-prosecution participation achieved asset recovery rates approximately 23% higher than comparable fraud typologies managed by prosecution alone
• Average timeline reduction: Crypto-specific matters with private counsel participation averaged 14-month shorter recovery cycles (from detection to judicial freeze) compared to cases without private-law involvement
• Funds directed to victim restitution: In 2021–2023, approximately €3.2 million of ORGA-managed proceeds were allocated directly to victim compensation, with additional sums directed to victimsupport programs

These metrics suggest that private participation is not merely symbolic but materially accelerates both asset location and victim compensation.

The Role of ORGA: From Confiscation to Restitution 

At the institutional level, the Asset Recovery and Management Office (ORGA) plays a central role in Spain's asset-recovery ecosystem. Created by Royal Decree 948/2015 and operating under the Ministry of Justice, ORGA acts as a technical and financial instrument supporting courts and prosecutors in asset tracing, management and realization.

ORGA fulfils a dual function:

• Asset tracing: locating property at the request of judges or prosecutors, domestically and abroad, including assets hidden or held through third parties. This function is supported by embedded officers from the National Police and the Civil Guard acting as judicial police.
• Asset management and administration: preserving seized and confiscated assets, authorizing early sales where appropriate, and optimizing the economic return of confiscation.

Crucially, Spanish law assigns ORGA an instrumental role in protecting victims' patrimonial rights. Under Article 2 of Royal Decree 948/2015, proceeds obtained through asset management are applied with priority to compensate victims and satisfy civil liabilities arising from the offence. Surplus funds are directed to victim-assistance programs and the resourcing of victim-support offices.

In practice, courts—through the Letrado de la Administración de Justicia—channel orders for the allocation of ORGA-managed funds directly in favor of victims. This framework reflects a deliberate policy choice: confiscation should not be purely punitive, but restorative.

The Role of Victim Collectives and NGOs

Beyond individual private prosecution, Spain's model also benefits from the mobilization of victim collectives and civil-society organizations. In mass-fraud scenarios—particularly investment schemes and cryptocurrency scams—victims have organized through associations (asociaciones de afectados), which in turn coordinate legal representation and engage law firms on collective terms.

This arrangement offers distinct advantages: 

• Aggregated investigative capacity: A single association can pool resources to fund forensic investigations that individual victims could not afford, intensifying pressure on public authorities for results.
• Institutional memory and leverage: Victim associations maintain continuity across judicial phases and can coordinate with multiple prosecutors and courts simultaneously, amplifying their influence on investigative prioritization.
• Access to NGO networks: International NGOs focused on fraud victims or financial crime have facilitated cross-border asset-tracing cooperation, particularly in cases involving offshore havens or crypto exchanges in third jurisdictions.
• Complementarity with law firms: While specialist law firms provide technical-legal expertise, victim collectives provide the political and social pressure necessary to maintain investigative momentum when public authorities deprioritize cases.

The Arbistar case exemplified this synergy: a victim association aggregated thousands of defrauded investors, hired a specialized law firm, and coordinated with ORGA and the Cybercrime Unit—a tripartite arrangement that would have been difficult to achieve through individual private prosecution alone.

Challenges and Lessons Learned

Despite these strengths, Spain's experience also highlights persistent tensions. Once assets are formally confiscated and become State property, victims may risk losing visibility or influence over enforcement decisions. Maintaining transparency, communication and procedural alignment between courts, ORGA and private prosecutors remains essential and resource-intensive.

• The convergence problem. When private practitioners prioritize rapid asset liquidation and victim compensation, while public prosecutors prioritize conviction and sentencing, procedural conflict can arise. Courts must mediate these competing interests, sometimes resulting in delays.
• International coordination bottlenecks. Where assets escape to third jurisdictions outside the EU, cooperation depends on mutual legal assistance treaties (MLATs) and Europol coordination— processes that are slower and less reliable than intra-EU cooperation. Private practitioners have limited leverage in these contexts.
• Crypto volatility and custody risks. Holding seized crypto-assets in judicial custody exposes victims to market risk. ORGA's early-sale mechanisms mitigate this, but require judicial approval, adding procedural steps.

The broader lesson is not that public enforcement should be replaced by private initiative, but that effective asset recovery depends on structural alignment: private lawyers acting as technical-legal facilitators, seamless coordination between specialized units (UDEF, cybercrime units, SEPBLAC, ORGA), judicial agility in ordering early freezes and sales, and a genuinely victim-centered approach to confiscation and restitution. Where incentives diverge—prosecutors prioritizing convictions, victims prioritizing compensation—cooperation falters. Where they align, recovery becomes both faster and more meaningful.

Future Headwinds: Emerging Limitations 

Yet as crypto criminals evolve and assets fragment across decentralized finance (DeFi) platforms,emerging-market exchanges and non-custodial wallets, even Spain's model faces headwinds. Judicial orders to traditional exchanges are increasingly ineffective when assets have been moved to decentralized protocols beyond any single jurisdiction's enforcement reach. Private practitioners and law enforcement alike are experimenting with blockchain-analytic techniques and international asset-recovery consortia to address this challenge, but the legal frameworks have not yet caught up.

Simultaneously, the rise of privacy coins and mixing services has complicated the on-chain forensics that private counsel and police analysts rely upon. Investment in technical capacity—both within ORGA and among private firms—will be necessary to maintain the recovery gains Spain has achieved.

Conclusion: Embedding Victims as a Structural Imperative

Spain's experience demonstrates that embedding victims structurally within criminal enforcement can transform the effectiveness of asset recovery, particularly in the fast-moving world of crypto-assets. The combination of private prosecution, specialized law-enforcement units, victim collectives, and an asset-recovery office focused on restitution offers a model worth examining beyond Spain's borders.

Critically, this is not a model that emerges from informal cooperation or goodwill alone. It reflects deliberate institutional design: victim-participation rights enshrined in procedural law, ORGA's mandate to prioritize restitution, and operational protocols that align public and private incentives.

Ultimately, the message is straightforward: public recovery without private follow-through is only half a victory. Effective justice in crypto-fraud cases requires not only investigation and confiscation, but mechanisms that translate enforcement into real restitution for those harmed. Spain's framework, while imperfect and facing emerging challenges, demonstrates that such translation is possible—and that the benefits extend beyond individual victims to the broader legitimacy of the criminal justice system itself.

About the Author 

Héctor Sbert is a litigation and asset recovery lawyer specializing in civil and commercial disputes, insolvency proceedings, and asset recovery under Spanish law. He can be reached at hsbert@ecija.com