Scope
This guide is for financial intelligence units (FIUs) and fraud investigation teams looking to integrate cryptocurrency tracing into existing anti-money laundering (AML) investigations without hiring blockchain specialists. It's aimed at teams already handling traditional financial intelligence work who now encounter digital asset flows in their cases.
You'll find a breakdown of requirements for building internal capability, guidance on using open-source tools, and a reference table mapping investigation stages to crypto tracing techniques.
This guide doesn't cover vendor selection for commercial blockchain analytics platforms or technical blockchain architecture.
Key Concepts and Definitions
Financial Intelligence Tradecraft: Methods used to identify, trace, and document illicit financial flows for investigations or prosecutions. Traditionally, this involves following wire transfers and cash deposits. In crypto cases, it involves tracking on-chain transactions across wallets and exchanges.
Cryptocurrency Tracing: Tracking virtual asset movements across blockchain networks using transaction identifiers, wallet addresses, and clustering techniques. Unlike bank account tracing, this requires understanding pseudonymous addressing systems and decentralized ledgers.
Open-Source Intelligence (OSINT) Tools: Publicly available blockchain explorers, wallet clustering databases, and transaction visualization platforms that don't require commercial licenses. These tools are the foundation of crypto tracing capability before investing in enterprise-grade platforms.
Cross-Border Virtual Asset Flow: Cryptocurrency transactions that move value between jurisdictions without traditional banking infrastructure. These flows bypass SWIFT messaging, making them harder to detect through conventional transaction monitoring.
Requirements Breakdown
Core Capabilities Your Team Needs
1. Blockchain Literacy
Your analysts don't need to code smart contracts, but they must understand how transactions are recorded on public ledgers. This includes knowing the difference between Bitcoin's UTXO model and Ethereum's account-based system, recognizing wallet address formats, and interpreting transaction confirmations.
2. OSINT Tool Proficiency
AUSTRAC trained representatives from 12 Pacific FIUs on cryptocurrency tracing using open-source tools. Most FIUs start with free blockchain explorers before budgeting for commercial platforms.
Your team should be able to:
- Query transactions on blockchain explorers (Blockchain.com for Bitcoin, Etherscan for Ethereum)
- Follow transaction chains across multiple wallet addresses
- Identify exchange deposit addresses using clustering heuristics
- Export transaction data for case documentation
3. Integration with Traditional Financial Intelligence
Crypto tracing connects to existing casework when suspects convert fiat to crypto, move proceeds through exchanges, or use mixers and tumblers. Develop procedures that trigger crypto investigation steps when virtual asset indicators appear in bank statements, SAR narratives, or law enforcement referrals.
Regulatory and Cooperation Framework
Cross-Border Intelligence Sharing
AUSTRAC's training emphasizes that serious criminals don't respect borders, and neither do blockchain transactions. A wallet-to-wallet transfer can happen in minutes without banking rails.
Your FIU needs:
- Established channels to request crypto intelligence from counterpart FIUs
- Participation in Egmont Group secure communication networks
- Memoranda of understanding that cover virtual asset intelligence requests
Predicate Offense Linkage
Cryptocurrency tracing produces wallet addresses and transaction hashes. Your prosecutors need these linked to identifiable individuals and predicate offenses. This requires:
- Exchange subpoena procedures to identify wallet owners
- Documentation standards connecting on-chain activity to real-world criminal conduct
- Chain-of-custody protocols for blockchain evidence
Implementation Guidance
Phase 1: Build Internal Awareness (Months 1-2)
Start with a working group that includes analysts, investigators, and at least one prosecutor. Run tabletop exercises using publicly documented crypto cases to understand how blockchain evidence supports prosecutions.
Phase 2: Establish OSINT Protocols (Months 3-4)
Document your process for:
- Receiving wallet addresses from reporting entities or law enforcement
- Conducting initial blockchain queries
- Screenshotting and timestamping blockchain explorer results
- Exporting transaction data in formats your case management system accepts
Create checklists that mirror your existing financial intelligence workflows.
Phase 3: Integrate with Transaction Monitoring (Months 5-6)
Work with reporting entities to identify crypto exposure in their customer base. Establish reporting relationships with VASPs that mirror your bank SAR processes.
Update transaction monitoring guidance to include crypto red flags:
- Customers receiving funds from known exchange hot wallets
- Rapid conversion of crypto to fiat through peer-to-peer platforms
- Structured purchases of cryptocurrency just below reporting thresholds
Phase 4: Develop Cross-Border Request Capacity (Ongoing)
Map which Pacific FIUs have crypto tracing capability. When you identify wallet activity crossing jurisdictions, know which counterpart FIU can help trace the next transaction hop.
If your jurisdiction hasn't received similar training to AUSTRAC's Solomon Islands programme, request it through bilateral channels or regional AML bodies.
Common Pitfalls
Assuming Blockchain Equals Anonymity
Bitcoin and Ethereum transactions are pseudonymous, not anonymous. Every transaction is permanently recorded on a public ledger. Your challenge is connecting wallet addresses to real identities.
Waiting for Perfect Tools Before Starting
Commercial blockchain analytics platforms are expensive. Open-source tools are free and sufficient for initial capability building. Start with what's available and build a business case for commercial tools based on actual casework volume.
Treating Crypto as a Separate Investigation Track
Cryptocurrency flows intersect with traditional banking. Your case file should show the full financial picture: bank account to exchange account to wallet to mixer to new wallet to exchange to bank account.
Ignoring Prosecutor Education
Your prosecutors may not understand how blockchain evidence works. Include them in your training from day one to ensure successful prosecutions.
Overlooking Documentation Standards
A blockchain explorer screenshot from August might look different in November if the explorer updates its interface. Timestamp your queries, export raw transaction data, and document which version of which tool you used.
Quick Reference Table
| Investigation Stage | Traditional Method | Crypto Tracing Method | Tool/Resource |
|---|---|---|---|
| Initial Lead | SAR with account number | SAR with wallet address | Blockchain explorer query |
| Transaction Tracing | SWIFT message analysis | On-chain transaction graph | Blockchain.com, Etherscan |
| Entity Identification | Bank subpoena for account holder | Exchange subpoena for wallet owner | Legal process to VASP |
| Value Quantification | Account statement totals | Sum of transaction outputs | Blockchain explorer address page |
| Cross-Border Coordination | Egmont request for banking records | Egmont request for wallet intelligence | Egmont Secure Web |
This table assumes you're working with transparent blockchains (Bitcoin, Ethereum). Privacy coins (Monero, Zcash) and mixing services require different approaches not covered in this introductory guide.
Next Steps: If your FIU hasn't yet conducted crypto tracing training, request support through your regional AML coordination body or bilateral agreements with jurisdictions that have established programmes. AUSTRAC's Pacific initiatives show that capability building starts with structured training, not expensive tools.
