Follow the Money: Fund Tracing in Financial Investigations

When money becomes the subject of an investigation, it always leaves a trail. The “follow the money” method lets you reconstruct the route of funds from source to final recipient by tracing banking flows, turning scattered transactions into a coherent, legally significant chain. In my expert practice, this kind of tracing often becomes the backbone around which the entire evidentiary base of a case is built.

The core of the method: why the route matters more than any single payment

Fund tracing is the sequential reconstruction of how money moves across accounts: from who paid it and when, through every intermediate link, to whoever actually used it. The logic is simple. Unlike testimony or documents, which can be rewritten, a bank transaction always carries four fixed coordinates: date, amount, counterparty and payment purpose.

The classic beginner’s mistake is to fixate on a single “suspicious” transfer. In reality, evidentiary weight belongs not to an isolated operation but to the reconstructed route: where the money entered, how it moved, where it settled. The expert’s job is therefore not to find one transaction, but to rebuild the whole chain in chronological order.

Data sources: where information about the movement of funds comes from

Bank statements and lawful access to them

The primary source for tracing is bank account statements. Information about a client’s operations and accounts constitutes banking secrecy (Article 60 of the Law “On Banks and Banking Activity”), so it can be obtained only through procedural channels.

• In criminal proceedings, access is granted by a ruling of the investigating judge on temporary access to items and documents (Chapter 15 of the Criminal Procedure Code of Ukraine (KPK), Articles 159-166). This ruling is the lawful basis for demanding statements from a bank.
• In civil, commercial or administrative proceedings, the statements are obtained by the court at a party’s request.

An expert works exclusively with materials provided through the established procedure. Data obtained outside the lawful process is not merely useless: it casts doubt on the entire expert report.

SWIFT, payment registers and other sources

Beyond statements, a fuller picture draws on:

• SWIFT messages for cross-border transfers (notably the MT103 format for customer transfers), which reveal the true sender and recipient, intermediary banks and the stated purpose;
• the payment purpose field in each operation, where the mismatch between the “cover story” and the substance is often hidden;
• materials and reports from primary financial monitoring entities, aggregated by the State Financial Monitoring Service (Derzhfinmonitoring);
• state registers used to establish assets and connections: the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Formations, together with the real-estate and vehicle registers.

Building the transaction chain

Reconstructing the route is essentially drawing a “map” of how money moves. I arrange operations in chronological order and match them against three parameters: amount, date, counterparty. When a sum that lands on an account leaves it again within a day or two, almost unchanged, that alone is a signal.

Transit and “technical” accounts

A transit (or “technical”) account is a link with no independent economic purpose, serving only to “pump” funds through. Typical signs:

• incoming and outgoing amounts almost coincide, and the balance stays near zero;
• funds remain on the account for a short time, whether hours or one to two days;
• there is no genuine business activity: none of the rent, salaries, utility payments or taxes normal for the declared line of business;
• payment purposes are monotonously uniform or, conversely, wildly varied with no underlying logic.

Identifying such accounts is half the battle: they are precisely what severs the visible link between source and final recipient.

Signs of structuring payments below the monitoring threshold

Mandatory financial monitoring is triggered when an operation reaches a threshold amount: under the current anti-money-laundering legislation, that is UAH 400,000. To stay under the radar, the sum is often artificially split, or structured, into several payments each slightly below the threshold. What I look for:

Sign of structuring	What the expert sees
A series of “just under threshold” payments	Several operations slightly below UAH 400,000 in a row
Proximity in time	Payments to one counterparty within a day or two
A single economic substance	The split sum covers one contract or one delivery
”Remainder” logic	A large obligation divided into equal shares

An important caveat: payments below the threshold are not in themselves a violation. What carries evidentiary meaning is the pattern, when the splitting is systematic and serves a single business purpose.

Establishing the ultimate beneficial owner

The final goal of tracing is to reach whoever genuinely controls the funds and receives the benefit, the ultimate beneficial owner (UBO). The starting point is the UBO and ownership-structure data in the Unified State Register. But the formal owner and the actual beneficiary often diverge.

What deserves attention:

• nominee persons, directors or founders who sign documents but make no decisions; markers include mass registration to a single individual, no connection to the activity, and socially vulnerable people;
• chains of legal entities, where one company owns another, which owns a third, until the trail “dissolves”;
• foreign structures and trusts that conceal the real beneficiary abroad.

Here fund tracing converges with corporate-structure analysis: the movement of money often points to the real master more precisely than the register does. Adjacent avenues include verification of asset declarations and lifestyle, overseen by the National Agency on Corruption Prevention (NAZK), and civil forfeiture of unjustified assets, where the prosecutor files suit with the court.

Typical schemes that tracing exposes

In the practice of financial investigations conducted, among others, by the Bureau of Economic Security (BEB) in cooperation with the State Tax Service (DPS) and other bodies, a few patterns recur:

1. Conversion centres, a network of controlled enterprises that, for a fee, turn non-cash funds into cash while generating fictitious paperwork. Tracing shows a “fan” of payments converging on a handful of accounts and vanishing into cash.
2. Transit through sole proprietors, where funds are routed through individual entrepreneurs (often on the simplified tax system), from which cash is easily withdrawn with minimal trace.
3. Cash-out, the final link of most schemes: wherever the route breaks off in a cash withdrawal is where the beneficiary sits.

The expert’s task is not to “unmask a criminal”, since legal qualification belongs to the investigation and the court, but to show the movement of funds objectively together with its economic indicators.

How the results are formalised in the expert report

Tracing acquires evidentiary force only when it is set out according to the rules of forensic examination. I prepare a forensic expert report on the basis of the Law “On Forensic Expert Activity” and the departmental Instruction on the ordering and conducting of forensic examinations, approved by Order of the Ministry of Justice No. 53/5. Such a report becomes evidence within the meaning of the procedural law, be it the KPK, the Commercial Procedure Code (GPK), the Civil Procedure Code (TsPK) or the Code of Administrative Judicial Procedure (KASU), depending on the case.

A sound report meets three requirements:

• traceability, where each conclusion rests on a specific transaction from a specific, verifiable document;
• methodological transparency, describing exactly how the chain was built and on what indicators the conclusions rest;
• boundaries of competence, where the expert answers economic questions rather than legal ones: not “was a crime committed” but “how did the funds move and what are their economic indicators”.

The completed report is added to the case file; anonymised court decisions involving similar examinations are available in the Unified State Register of Court Decisions.

Common mistakes worth avoiding

• Working without primary documents. A statement without contracts and payment orders gives only an outline, not proof.
• Ignoring the payment purpose. This is where the divergence between the form and the substance of an operation is most often visible.
• Equating transit with misappropriation. Money passing through an account does not by itself prove an unlawful aim; a combination of indicators is required.
• Overstepping competence. Legal assessment is the prerogative of the investigator and the court, not the expert.

Fund tracing is a precise instrument, but a demanding one when it comes to the quality of the source data and the lawfulness of its collection. If, as a lawyer, investigator or business leader, you face the need to trace the movement of funds or to assess an existing report, it is worth engaging a forensic economic expert at an early stage; it saves time and safeguards the evidentiary base. I would be glad to help with a consultation or with a forensic economic examination within the scope of your case.