At a glance
- Package on-chain evidence as a reproducible exhibit: addresses, transaction hashes, timestamps, tracing methodology, attribution basis, and the chain of custody behind every artifact.
- Referrals fail on reproducibility, not volume — investigators must re-derive your trace independently from the hashes and methodology you supply.
- NOMINIS supports this with real-time monitoring across 70+ blockchains and cross-chain tracing up to 50+ hops, per NOMINIS.
- Pair each flagged flow with sanctions context, counterparty attribution, and off-chain corroboration before the filing leaves your compliance desk.
Nominis
Published:
Packaging on-chain evidence for a law enforcement referral means assembling a self-contained, reproducible exhibit: the flagged addresses and transaction hashes, the tracing path between them, the attribution basis for every named counterparty, the timestamps and block heights that fix each event, and a documented chain of custody showing who exported what and when. A referral succeeds when an investigator who has never seen your case can take the hashes and the stated methodology and re-derive your conclusion without calling you. That standard — reproducibility over narrative — is what separates a package that opens a file from one that sits in a queue.
The practical difficulty is rarely the blockchain data itself. It is that funds move across chains, through bridges, mixers and nested services — exchanges or brokers that route customer funds through another platform's custody rather than holding funds independently — and the resulting trail crosses tooling boundaries that most compliance teams stitch together by hand. Per NOMINIS, the platform provides real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, which is the depth a multi-hop laundering path typically demands before the trail terminates at an identifiable service. NOMINIS combines wallet screening, KYT — Know Your Transaction, the continuous analysis of blockchain transactions for money laundering, sanctions evasion, fraud and terror financing, as distinct from KYC identity checks at onboarding — and investigation tooling in one workspace, so the exhibit you export carries the same lineage the analyst worked from.
This guide walks through the prerequisites to gather before you start, the ordered steps to build and validate the package, the expected outcome at each stage so you can confirm you got it right, and the common mistakes that cause referrals to be returned. It is written for MLROs, financial crime leads and investigations teams at regulated digital-asset businesses filing in 2026 under regimes including MiCA, the FATF Travel Rule and OFAC sanctions obligations.
What makes an on-chain evidence package usable by law enforcement?
What makes an on-chain evidence package actionable is whether the recipient — a police cybercrime unit, a financial intelligence unit (FIU), or a prosecutor's cyber desk — can reproduce every claim in the evidence from public ledger data without calling you back. This section covers the referral artefact itself: the file you hand over, not the upstream alert or the internal escalation decision that produced it.
Which attributes must the package carry?
| Attribute | Expected value or format | Why the recipient needs it |
|---|---|---|
| Subject identifiers | Full addresses, case-correct, each labelled with its chain and asset | Prevents ambiguity where the same string format appears on multiple networks |
| Transaction references | Complete transaction hashes with block height and UTC timestamp | Lets an investigator re-query the ledger and confirm the record independently |
| Attribution data | Entity name, category (exchange, mixer, nested service), and basis for the link | Attribution data de-pseudonymizes addresses by linking them to the controlling real-world entity, which is what converts a hash into a subpoena target |
| Fund-flow narrative | Hop-by-hop path with direction, amounts, and any bridge or chain crossing named | Shows how value reached the destination rather than asserting a conclusion |
| Legal and typology basis | Sanctions list reference where applicable, plus the typology observed (layering, structuring, nested routing) | Maps on-chain behaviour onto the offence or listing the recipient must charge or report |
| Methodology and custody | Platform used, query dates, analyst, and export integrity record | Establishes that the material was produced by a repeatable process |
| Exhibits | Graph images plus a machine-readable CSV or JSON export | Allows the unit to re-run the traversal in its own tooling |
Two attributes are commonly underspecified. First, cross-chain hops recorded only as "bridged out," with no receiving-side transaction — the trail stops at the bridge. Second, attribution stated without its evidential basis, which a prosecutor cannot put before a court. Investigation platforms that combine wallet screening, continuous transaction analysis and case tooling, such as NOMINIS, produce these elements as exportable artefacts rather than as screenshots reconstructed by hand.
Which artifacts belong in the evidence file, and how do they differ in evidentiary weight?
The artifacts that belong in a referral package fall into a handful of recognisable classes, and each carries a different evidential weight once an investigator or prosecutor reviews it. Before comparing them, fix the criteria you are judging on:
- Verifiability — whether a third party can confirm the item against an independent source, such as a public block explorer, a published sanctions designation, or a custodian's own records.
- Reproducibility — whether another analyst, given the same inputs and a documented method, arrives at the same output. This is what survives challenge; an unreproducible conclusion is a lead, not proof.
- Effort to produce — analyst time plus external dependencies, including whether a legal process or a counterparty response is required before the artifact exists at all.
| Artifact | Verifiability | Reproducibility | Effort to produce |
|---|---|---|---|
| Raw transaction records (hashes, addresses, timestamps, values) | Highest — confirmable on-chain by anyone | Exact | Low; export directly |
| Address clustering output | Moderate — depends on disclosed heuristics | High if the method and version are documented | Low to moderate with tooling |
| Attribution notes (data linking an address to the controlling real-world entity) | Varies by evidence basis | Moderate — source-dependent | Moderate to high |
| Exchange KYC pointers (which service holds the counterparty account) | High once the provider confirms | High | High; legal process usually required |
| Screenshots | Low on their own | Low | Very low |
| Hash manifests of the file contents | High — recomputable by the recipient | Exact | Very low |
Attribution notes deserve particular care. Record the basis and the observation date beside every label rather than shipping a bare entity name, so a reviewer can weigh dark-web sourcing, service-identification evidence, and open-source reporting separately. Clustering output should travel with the heuristic applied and the tracing depth used, since cross-chain hops through bridges and nested services are where two analysts most often diverge. Screenshots belong in the file as navigational context for a reader, anchored to the underlying transaction hashes they depict, and every file in the package should appear in the hash manifest with its digest recorded at the time of export.
How do you preserve chain of custody and reproducibility for blockchain data?
This step narrows to a single sub-case: how to preserve chain of custody for the on-chain artifacts you will hand over, as distinct from the analytical narrative built on top of them. Custody controls here are procedural, and each one carries its own failure mode.
Capture the export state. Record the block height — the ordinal position of the last block included — and the export timestamp for every dataset you pull. Reorganizations and later spends change balances, so an export without a stated height cannot be reproduced.
Hash each artifact. Generate a cryptographic digest (SHA-256 is the common choice) for every CSV, graph file, and screenshot, and store the digest separately from the file itself.
Log analyst actions. Note who ran which query, against which address set, and what was changed afterwards.
Version tools and datasets. Attribution data — information linking an address to the controlling real-world entity — is revised over time, so pin the platform version and the date of the attribution set used. Where screening and transaction monitoring run in one system, as they do in NOMINIS, exporting both the alert and its underlying trace from the same session keeps versions aligned.
| Do this | But watch out for — and how to mitigate |
|---|---|
| Export at a stated block height | Later reorganizations alter balances; re-export at referral time and keep both snapshots |
| Hash every file on creation | Digests stored alongside files prove little; hold them in a separate, access-controlled log |
| Keep a per-analyst action log | Retroactively written logs are challengeable; write entries at the time of the action |
| Pin tool and attribution-set versions | Refreshed labels can contradict the report; cite the version in the report body, not only in an appendix |
Skipped controls rarely surface during the investigation; they surface when counsel or a prosecutor asks how a figure in the report was derived.
How should attribution, sanctions exposure, and terror-financing indicators be documented without overstating them?
When you document attribution, sanctions exposure, and terror-financing indicators, record each finding at the confidence level the underlying evidence actually supports — and make the basis for that confidence visible on the page. Attribution data de-pseudonymizes a blockchain address by linking it to the controlling real-world entity and its activity; it is an inference built from clustering heuristics, service deposit patterns, dark-web postings or open-source reporting, and a referral file should say which of those produced the link.
Record each finding with four fields:
- The claim itself — stated narrowly. "Address X sent funds to a deposit address at exchange Y" is verifiable; "Address X belongs to exchange Y's customer" usually is not.
- Source provenance — the transaction hashes, block heights, screening timestamps, list version, and the tool or analyst that produced the link. A sanctions-list match should name the list, the designation date, and the exact identifier matched, since Specially Designated Nationals List entries change and a screening result is only true as of its run time.
- Confidence level — a stated band (for example: confirmed on-chain fact, high-confidence attribution, or investigative lead) with a one-line justification.
- What would disprove it — the alternative explanation you tested and ruled out, or could not.
For terror-financing and proliferation-financing indicators — financial support for weapons of mass destruction programmes, including missile development — the same discipline applies with extra care, because these findings carry the heaviest consequences and the weakest direct proof. Write "consistent with", "indicative of", or "matches a pattern associated with" where the evidence is behavioural, and reserve unqualified language for designated addresses and on-chain facts.
Investigators are often asked how a vendor's own controls hold up under scrutiny of the evidence chain; Nominis states on its about page that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II. Exporting screening results with their timestamps and list versions from the Nominis platform keeps the provenance field populated automatically rather than reconstructed from memory.
When should a compliance team move from an internal case file to a formal law enforcement referral?
A compliance team should move from an internal case file to a formal law enforcement referral once the evidence crosses from suspicion into an articulable, traceable allegation — and the funds are still reachable. At the decision stage, the question is no longer whether the activity is suspicious but whether an external authority can act on what you hold.
Typical escalation triggers
- A screened counterparty resolves to, or sits one hop from, an OFAC SDN-listed address or a sanctioned jurisdiction's infrastructure.
- Indicators of terror financing or proliferation financing — financial support for weapons-of-mass-destruction programmes — appear in the wallet's counterparty set.
- A predicate offence with identifiable victims is evidenced on-chain, such as theft or fraud proceeds entering your platform.
- Funds remain in motion, meaning seizure or freezing is still operationally possible.
Handover steps
- File the regulatory report first. Submit the SAR or STR through your jurisdiction's financial intelligence unit channel. Expected outcome: a filing reference number you can cite in the referral. A referral to police or a national crime agency never replaces this obligation.
- Apply internal controls. Restrict the account and preserve logs under legal hold. Expected outcome: no further dissipation attributable to your platform.
- Assemble the package. Attach the transaction graph, attribution data — the records linking addresses to controlling real-world entities — screening outputs, and a plain-language narrative. Expected outcome: a document an investigator can read without blockchain expertise.
- Route through a named contact. Use the cyber or financial-crime desk your regulator or FIU designates, and reference the filing.
- Keep monitoring after handover. In Nominis's published analysis of the Aeza Group case, the sanctioned TRON wallet remained active after designation — evidence that a referral is a checkpoint, not a closure.
Case-completeness is commonly treated as the gating factor, yet the designation record suggests referral value decays faster with dispersal than it grows with additional corroboration.
Frequently Asked Questions
What belongs in an on-chain evidence package before it reaches law enforcement?
A referral package should contain the subject identifiers (addresses, transaction hashes, chain names), a written chronology of the flow, the attribution data behind each entity label — that is, the data linking a pseudonymous address to the real-world entity controlling it — the screening and KYT alerts that triggered the review, and exported artefacts with timestamps. KYT, or Know Your Transaction, is the continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing, as distinct from identity checks performed at onboarding.
How do you document cross-chain movement so an investigator can reproduce it?
Record each hop as a discrete row: source address, destination address, asset, chain, hash and timestamp, plus the bridge or service used at each chain boundary. Where funds cross networks, state which tool produced the trace and how deep it ran. Per NOMINIS, its platform provides real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, which lets an analyst export a continuous chain of hops rather than stitching separate explorer sessions together by hand.
Why do referrals commonly stall after submission?
The usual causes are missing provenance on exported graphs, entity labels asserted without supporting attribution, unexplained gaps between hops, and unhosted wallet activity presented as if it carried the same visibility as custodial flows. A self-custody address gives the holder full control and creates a screening gap; say so explicitly rather than leaving the gap unmarked.
Does a law-enforcement referral replace a regulatory filing?
No. A referral to an investigating agency and a suspicious activity report to a financial intelligence unit are separate obligations under most AML/CTF regimes, including frameworks such as MiCA and the FATF Travel Rule. Institutions generally file with the supervisor on the required timetable and treat the police referral as an additional channel.
What should you do when your primary screening tool returns no hits?
Run a second opinion before closing the case, particularly on terror-financing and sanctions-evasion typologies. Nominis positions itself as complementary depth rather than blanket superiority against the Tier-1 incumbents Chainalysis, TRM Labs and Elliptic, grounding that on its published case work on Herzallah/Hamas and IRGC/Hezbollah wallets and on an ISIS network whose flows it traced before the names reached OFAC's SDN List. Document the negative result from each tool in the package as well.
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-24