Asset tracing

What asset tracing is, and what it is not#

Asset tracing is the evidentiary exercise of following specific money or property from the point it was taken to wherever it now sits, hop by hop, with a document supporting each hop. It differs from a net-worth investigation, which asks what a person owns. Tracing asks whether this money became that asset — and that is the question a court has to answer before it will freeze, return or forfeit anything.

The distinction matters because the remedies turn on it. A constructive trust, a proprietary claim over a specific account, or a forfeiture of "traceable proceeds" each require the trace itself to be proved. A money judgment does not — but a money judgment against a defendant who has moved everything offshore is a piece of paper.

The methods#

Bank-record analysis. Statements, wire confirmations and internal transfer records are obtained by subpoena, court order or cooperation, and every movement is entered into a flow-of-funds schedule. Each hop is verified on both sides: the debit on the sending account is matched to the credit on the receiving one by amount, date and reference. Wire messages carry originator and beneficiary fields that identify the next institution to subpoena, which is how a trace crosses borders.

Source-and-application-of-funds analysis. Over a defined period, every dollar that came in to a person or entity is set against every dollar that went out. A gap between known income and known spending is not proof of concealment, but it is where the undisclosed account usually turns out to be, and it gives counsel something specific to ask for in discovery.

Blockchain analysis. The ledger is complete and public, so on-chain tracing rarely loses the money; the work is attribution. Addresses are grouped by clustering heuristics — patterns of spending that indicate common control — and connected to people at the points where crypto meets the regulated system, principally exchanges holding know-your-customer records. A competent analysis states which heuristics it relied on and how confident each is, because a cluster is an inference and will be cross-examined as one.

Corporate-structure and property review. Beneficial-ownership filings, financing documents and correspondence establish who controls an entity or a property regardless of whose name is on the register.

Tracing through commingled funds#

When traced money is mixed with clean money in one account, the balance no longer answers the question on its own, and a legal tracing rule has to be applied. The Second Circuit's decision in United States v. Banco Cafetero Panama sets out the three approaches, and they are the ones a tracing report has to be able to run:

1. Lowest intermediate balance. The traced funds are treated as remaining in the account so long as the balance never drops below the amount deposited; once it does, the claimant can trace into the account only up to the lowest balance it reached. This is the rule the law of trusts applies to a trustee who mixes trust money with his own.
2. Pro rata (averaging). Each withdrawal, and anything bought with it, carries a proportionate share of the traced money, in the ratio the tainted deposit bore to the balance immediately after it.
3. First-out. Any single withdrawal, up to the amount of the tainted deposit, may be treated as the traced money — an approach the court allowed the government to elect in a drug-proceeds forfeiture.

Which rule applies depends on the claim and the forum: trust and restitution claims, civil recovery and criminal forfeiture do not all use the same one. In federal civil forfeiture the government now bears the burden of proving by a preponderance of the evidence that property is subject to forfeiture, and a claimant asserting innocent ownership bears the burden of proving that defence — so the schedule has to be built to a preponderance standard, not to suspicion. The practical answer is to compute the trace under each rule and let counsel argue for the one that fits, rather than discovering at the hearing that the report assumed the wrong one.

What digital forensics contributes#

Financial records show that money moved. Devices show who decided it should, and when:

• Communications among participants establishing knowledge and coordination.
• Working documents — the spreadsheet that tracks the real arrangement, drafts of the paperwork used to dress it up.
• Metadata dating when a structure or a document was created relative to the events in dispute, which frequently contradicts the account given.
• Search and browsing history showing research into jurisdictions, nominees and concealment.
• Wallet artifacts — wallet software, seed phrases, exchange logins — which are usually the strongest available link between an on-chain address and a named defendant.

Device evidence is only usable if it was acquired properly: a verified forensic image with a documented chain of custody, not screenshots taken by an investigator on the phone itself.

The evidence a court needs#

A tracing report that can support a freezing order or survive a forfeiture hearing has a recognisable shape:

• A flow-of-funds schedule in which every hop cites the document that proves it — statement line, wire confirmation, ledger entry or transaction hash — with those documents exhibited.
• A stated methodology, including which tracing rule was applied to each commingled account and what the result would be under the alternatives.
• The attribution basis for every on-chain address, with the confidence of each inference.
• Specific, current targets: the institution, the account, the balance where known, and the reason to believe dissipation is likely — because that is what an application for a freezing or preservation order has to plead.
• Acquisition and custody records for any device evidence relied on.

Speed and enforceability#

Assets move faster than litigation, so the trace that matters most is usually done before a claim is filed, and the first substantive step is often an application to freeze rather than a complaint. It is also entirely possible to trace funds precisely and recover nothing: money in a jurisdiction that will not enforce, or already spent, is knowledge rather than recovery. Enforceability is assessed alongside the trace, and a client is told early when the realistic recovery no longer justifies the cost of pursuing it.