Cryptocurrency in a money laundering investigation

Ask which money laundering act is being accused

Money laundering is not a collective term for every unusual crypto transaction. The provisions in the Criminal Code cover different types of behavior and forms of guilt. Ask which specific act, period and assets relate to the accusation. It can make a difference whether the accusation concerns receiving, possessing, converting or concealing. A file that describes many technical movements must still make clear what legal conclusion is drawn with regard to the individual suspect.

Therefore, at the beginning of the lawyer's meeting, make a list of the relevant transactions according to the file. Copy the source and the amount mentioned, without presenting your own total that adds the same value multiple times. A move between wallets can be a new rule administratively, while economically the same asset moves through the chain. This does not rule out criminal liability, but does influence how an overview should be read. Have every correction substantiated and keep a technical explanation separate from a legal conclusion.

A presumption is not a reverse burden of proof

In HR December 18, 2018, ECLI:NL:HR:2018:2352, the Supreme Court summarizes the assessment framework for situations without a direct demonstrable connection with a specific crime. The Public Prosecution Service must provide facts and circumstances that can support the relevant suspicion. Under certain circumstances, a concrete, verifiable and not highly improbable statement regarding legal origin may then be required. According to the Supreme Court, this does not mean that the suspect himself must prove that the assets did not originate from crime.

The judgment was about cash payments for a boat, not about a blockchain analysis. The practical meaning for a crypto case is therefore an application of a legal framework, not an equation of facts. If a sufficiently concrete explanation is given, the Public Prosecution Service must conduct further investigation. The lack of an explanation can be taken into account in the evidence assessment. So carefully discuss with a lawyer which response is responsible and verifiable; Both automatic silence and unprepared telling of a financial life story can leave important questions undiscussed.

An address on the blockchain is not yet an identity

Distinguish between a public address, an account with a service and actual access to a wallet. A person can receive payments to an address without having made all subsequent movements themselves. An account can be managed by multiple people or work through a service. At the same time, other evidence can actually strengthen the relationship with a person. The question is which combination of data carries the allocation and how reliable it is for the period examined, not whether a technical label sounds convincing.

Ask for the source of a link: account information, a device found, correspondence, a self-declaration, or a method of analysis. A name associated with a cluster in software must be distinguished from a proven identification. Let the lawyer assess whether an expert should investigate the method, margins of error and alternatives. Do not access other people's accounts yourself to refute an attribution. Save the data you lawfully possess and describe exactly which user or administrator you know from your own observation.

Connect the technical chain with an economic explanation

An overview becomes useful when each major step has a date, asset, quantity, network, transaction identification, and purpose. In addition, note where the economic origin is substantiated, for example by wages, a sale or a previous purchase. A later price increase explains a higher value, but does not automatically explain the origin of the first purchase. Therefore, make the transition from bank money to crypto and possibly back again visible. Do not lose sight of the fact that the legal question may concern a specific period or a specific partial amount.

Keep costs, exchange rate differences and internal movements recognizable. An overview that enters euro amounts everywhere at today's exchange rate can give a wrong impression of the value at the time. Write down which price source and date are used and leave unknown values. The defense does not have to create a seemingly precise dashboard to be taken seriously. A limited but verifiable chain is more informative than a large scheme where the origin of labels, exchange rates and totals can no longer be explained.

Check what a tax or banking document proves

A tax return, bank statement or trade report can be important, but it has its own function. The fact that assets have been declared somewhere does not independently prove that every underlying transaction was legal. A bank payment proves a money movement, not necessarily the agreed purpose. Conversely, a missing old export does not mean that there cannot be a legal origin. Search for other verifiable sources and document why an original document is missing. Let an accountant or expert clearly distinguish his factual reconstruction from legal judgments.

Collect original exports and keep track of which service, period and download they come from. Do not create a manual file that is presented as an original account history without explanation. If a summary is needed, add a column with the location in the source. Also check time zones and currencies used; otherwise the same event may appear to occur on two different dates. Small technical differences can undermine a major defense if they are not first examined as an administrative question.

Provenance research does not require careless key management

A normal file array should not contain a recovery phrase or private key. Anyone who shares that data unchecked can give away access to assets. Discuss with the attorney how to assess and execute a legal claim, device investigation, or request for information. This is not advice to withhold information or frustrate investigations. The point is not to distribute access data beyond a necessary and legally agreed route. Even a well-intentioned helper does not automatically have a reason to gain complete control.

Do not move assets to avoid investigation or change transaction visibility. New actions can take on their own legal meaning and make existing questions more difficult to reconstruct. If access is likely to be lost or a service closes an account, ask immediately how data and legal position can be carefully protected. The seizure guide deals with the individual question of seized or blocked goods. Fighting seizure does not replace defense against suspicion of money laundering. (guide to criminal seizure of goods or assets)

Fictional example: price gain with a missing first step

In a fictional example, Ruben explains that his crypto assets were created exclusively by price increases. He has a record of recent sales, but not of the first purchase. The investigation focuses precisely on the origin of the funds used to pay for that purchase. Ruben wants to send a price chart to prove that his explanation can be correct. That graph can illustrate the value development, but leaves the missing initial financing undiscussed. So it is a relevant source for a more limited question than he thinks.

The lawyer has the chain of origin worked back to bank statements, contracts and available historical data. Uncertain wallet links are given a separate label instead of being entered as a fact. If necessary, an expert can investigate whether the transaction schedule is economically and technically correct. The example does not guarantee an outcome: a plausible price gain can coexist with incriminating origin data. Above all, it shows that a defense becomes stronger when it identifies which gap a document actually fills and which investigation still needs to take place.

A wallet and origin matrix without access keys

Work with a limited inventory and store sensitive source files via an appropriately secure route. If necessary, use recognizable file labels in the summary and indicate where full public identification is available. Do not add passwords or recovery phrases. Ask the lawyer in advance what data is needed and who processes it. A good matrix should help a reader check provenance without making the table itself a collection of means of access to different accounts.

• Object: asset, asset, network and the relevant file number or label.
• Allocation: who had access or control according to which source and in what period.
• Inlay: original economic source, bank link and supporting piece.
• Movement: date, quantity, transaction identification, costs and known counterparty.
• Value: price date used, source and explanation of a difference in totals.
• Explanation: own observation, expert reconstruction and yet unconfirmed hypothesis.
• Investigation: missing export, disputed link and specific follow-up question for the lawyer.

After completing it, check whether the diagram remains readable without prior technical knowledge. An arrow can represent a proven transaction, but also an assumed economic relationship. Use different word descriptions for this. Otherwise, a visually coherent chain may suggest more certainty than the sources bear. Above all, leave the unfavorable or unexplained step visible; brushing it aside prevents targeted research and can turn a reliable reconstruction into an untenable story.

Research methods do not constitute individual condemnation

The FIOD describes the focus on digital money flows and crypto exchange services in the 2024 annual report. This shows that technical analysis and international cooperation can be part of investigative practice. However, a general investigation picture does not prove anything about the guilt of an individual user. A press release about an arrest is also not a final statement. Use such sources to understand what data might be investigated, not to automatically label an entire product group or every user of a service as criminal. (FIOD describes attention for digital money flows and crypto exchange services in the 2024 annual report)

Ask in your own case which information from the general picture leads to a specific suspicion. A similarity in transaction pattern may give rise to investigation, but the attribution, origin and required science require its own substantiation. The route for procedural documents is important. Have a lawyer request specific documents or clarification instead of speculating based on a general news report. The distinction between a signal, a research hypothesis and evidence must also remain visible in your own summary.

A testable explanation is better than a conclusive story afterwards

Before making a substantive statement, discuss what you actually know and what information still needs to be looked up. The Code of Criminal Procedure provides the procedural law framework; the fact that a subject is technical does not make legal aid less important. Tell the lawyer when you have lost original access or administration and what you have already stated to authorities. Don't try to fill in a missing detail with a reasonable guess. A later-checked correction is different from an ever-changing statement without a source.

Our analysis is that crypto business is not just a data problem. They require precise connections between person, action, ability and knowledge. Technical transparency can help control, but does not take over the legal evidentiary requirements. A carefully defined provenance file keeps legal statements researchable and allows for incriminating conclusions to be discussed. For the broader context there is the fraud guide; this depth revolves around the special combination of economic origin and technical attribution, without ending the proof on the basis of a wallet label.