Forensic Economic Examination in Crypto Cases: Which Questions to Ask

Cryptocurrency appears ever more often in criminal proceedings, tax disputes and civil claims — and with it grows the demand for forensic economic examination. Yet the value of such an examination depends far less on the expert than on how the questions are worded in the court’s ruling (ukhvala) or the investigator’s resolution (postanova). Below I explain what a forensic economic expert can genuinely examine in cases involving virtual assets, where the limits of that competence lie, and which formulations most often lead to a refusal to provide an opinion.

Who the forensic economic expert is and which specialties they work under

In Ukraine, forensic economic examination is carried out by certified experts entered in the Register of Certified Forensic Experts (Реєстр атестованих судових експертів), maintained by the Ministry of Justice. Within the economic class, three key expert specialties matter:

• 11.1 — examination of accounting, tax-accounting and reporting documents. This is the basis for questions about whether income was fully recorded, how tax liabilities are determined, and how transactions are reflected in the books.
• 11.2 — examination of documents on the economic activity of enterprises and organizations. This covers the analysis of financial and business operations, the movement of assets, settlements between parties, and financial results.
• 11.3 — examination of documents on financial and credit operations. These are account operations, loans, payments, and the movement of funds through banking and payment instruments.

In crypto cases these specialties frequently work in tandem: for example, to assess whether income from virtual-asset transactions was recorded in the books (11.1) and how funds moved across accounts (11.3). Before filing a motion, make sure the chosen expert is certified for exactly the specialty you need — a question “outside the specialty” is one the expert has no right to resolve.

The legal framework and who orders the examination

The procedure for ordering and conducting forensic examinations is set by the Law of Ukraine “On Forensic Examination”, by the procedural codes — the Criminal Procedure Code (KPK), the Commercial Procedure Code (HPK), the Civil Procedure Code (TsPK) and the Code of Administrative Procedure (KAS), depending on the type of proceeding — and by Instruction No. 53/5 of the Ministry of Justice on ordering and conducting forensic examinations and expert studies. It is this Instruction that contains the Scientific and Methodological Recommendations on preparing and ordering forensic examinations — effectively the reference for which questions are correct for each type of examination.

The methodologies an expert applies are entered in the Register of Forensic Examination Methodologies, also maintained by the Ministry of Justice. This is important for the party ordering the examination to understand: the expert does not “invent” an approach for a particular case but applies a validated methodology. If a question falls outside the available methodologies and the expert’s competence, the expert is obliged to say so rather than answer “at their own discretion”.

The body ordering the examination varies with the type of proceeding. In criminal proceedings on economic crime, the examination is usually initiated by detectives of the Bureau of Economic Security (BEB); in tax disputes heard by administrative courts, the opposing party is the State Tax Service (DPS), and some proceedings rely on materials from the State Financial Monitoring Service (Derzhfinmonitoring). The final set of questions is fixed by the court in its ruling, or by the investigator or detective in a resolution.

One fact is worth keeping in mind throughout: the legislative regulation of virtual assets in Ukraine is still taking shape, and their tax regime is not yet finally settled. For that reason, questions about income and taxation should be tied to the requirements of the tax law in force and to primary documents, not to assumptions about future rules.

What an economic expert can genuinely examine in a crypto case

In practice, the most correct and sought-after questions fall into the following groups.

1. The amount of damage (losses) caused

The classic question for criminal proceedings and civil claims: what amount of material damage caused by particular operations is confirmed by the documents provided. The expert calculates not “abstract” damage but a figure that follows from the primary documents and statements over a defined period.

2. The amount of income, revenue or asset growth

Questions such as: whether the receipt of income from virtual-asset transactions over a given period is documentarily confirmed, and in what amount. This is critical for tax disputes and non-payment cases, where the documented income must be compared with the determined tax liabilities.

3. Confirmation of the movement of funds against documents

Whether the documented inflows and outflows of funds match the data of bank statements, exchange reports and contracts. Here the expert cross-checks the sources and records what is confirmed and what is not.

The key principle: the economic expert works with documents and figures, not with legal qualification. The expert will say “the amount is X and is confirmed by such-and-such documents”, but will not say “the person committed fraud” — that is the province of the pre-trial investigation body and the court.

The limit of competence: why the economist does not do blockchain tracing

This is the most common misunderstanding. The economic expert does not trace the movement of crypto-assets across the blockchain, does not establish the ownership of wallets, and does not analyse transactions at the level of network data or smart contracts. That is the subject of computer-technical examination (KTE) — a separate class with its own specialties and methodologies.

In practice, this means that in a complex crypto case a single economist is not enough. The optimal solution is a complex examination (комплексна експертиза), in which:

• a computer-technical examination specialist establishes the technical facts (addresses, transactions, links between wallets, data from devices);
• the economic expert takes those established facts as input data and calculates the economic indicators — amount, income, damage.

If, instead, you put the question “trace the movement of bitcoins from wallet A to wallet B” to an economist, they will justifiably decline, because it is beyond their competence. The type of examination should therefore be decided while the ruling or resolution is being prepared, not after the materials have already reached the expert.

Which documents to provide to the expert

An opinion is only as sound as the materials supplied. A minimum list for a crypto case:

• bank statements for all relevant accounts (in hryvnia and in foreign currency);
• exchange reports — transaction history, order history, withdrawals and deposits, preferably in a machine-readable format (CSV/Excel) with official confirmation of the source;
• contracts, invoices, acts and other primary documentation for the operations;
• blockchain data — but already processed (for example, as part of a KTE opinion or a corresponding certificate), not “raw” addresses for the economist to trace independently;
• accounting and tax-accounting data and declarations — where income and taxes are at issue.

A separate warning: if documents are supplied only in part or in an unreadable form, this is a direct route to a notice of the impossibility of providing an opinion on part of the questions — that is, to lost time.

How to word the questions correctly (and which mistakes to avoid)

The most frequent cause of a “spoiled” examination is not the complexity of the case but poorly framed questions. Two typical mistakes: (1) legal questions the expert has no right to resolve, and (2) technically incorrect questions that mix competences.

The ban on legal questions. The expert does not establish guilt, does not qualify an act, does not interpret the rules of law and does not evaluate evidence. Questions such as “do the person’s actions contain the elements of a crime”, “was the operation lawful”, “who is to blame for the losses” are legal. Under the Scientific and Methodological Recommendations the expert does not answer them, and doing so may entail a refusal to give an opinion on that part.

Here is how to reformulate typical faulty questions:

Incorrect question (leads to refusal)	Correct formulation
Did the person commit fraud with cryptocurrency?	What amount of funds was received under the operations according to the documents provided, and is their subsequent write-off confirmed?
Did the person unlawfully fail to pay tax on the income?	Is the receipt of income from virtual-asset transactions over the period documentarily confirmed, and in what amount?
Trace the movement of cryptocurrency between wallets.	(A KTE question.) For the economist: given the movement of assets established by the KTE opinion, what is their valuation as at the date of the operation?
Are the operations fictitious?	Do the documented operations match the data of bank statements and exchange reports?

Practical drafting rules:

1. Each question should be specific, relate to figures and documents, and begin with “what amount”, “is it confirmed”, or “do they match”.
2. Do not mix a technical (blockchain) and an economic component in one question — split them between the KTE and the economist.
3. Avoid evaluative and legal wording (“lawful”, “legitimate”, “fraud”, “intent”).
4. Tie each question to a specific period, specific persons and specific documents.
5. Where possible, agree the wording of the questions with the expert before the ruling or resolution is issued — this is normal practice that saves months.

In brief: a checklist before ordering the examination

• The correct type of examination is chosen (economic / KTE / complex).
• The questions concern amounts and documents, without legal qualification.
• Technical (blockchain) questions are addressed to a KTE, not to an economist.
• A full package of documents is assembled (statements, exchange reports, contracts, accounting).
• The wording of the questions has been agreed with the expert in advance.

A properly framed question is half the result. If you are preparing a ruling, a resolution or a lawyer’s request in a case involving virtual assets, and you want the opinion to be admissible evidence rather than grounds for a refusal, I will be glad to help formulate correct questions and to check whether the available materials are sufficient for a complete and evidentiary opinion.