Follow-the-money methodology explained

On paper, the money is gone. In practice, it has moved – and movement, even through layers of shell companies and offshore accounts, leaves traces that a disciplined reconstruction can follow.

Follow-the-money methodology is the structured discipline of tracing the path of misappropriated or dissipated funds from the point of loss through every intermediate vehicle – bank accounts, corporate entities, nominee structures, and on-chain wallets – to wherever value has come to rest. It combines forensic accounting, documentary analysis, and legal process to produce an evidential map that courts and creditors can act on. The methodology does not depend on perfect records. It depends on knowing which gaps matter, what can substitute for missing documents, and how disclosure orders fill the rest.

This analysis covers how follow-the-money tracing actually works: the methodology's structure, its limits, where contrasting views on technique divide practitioners, and how cross-border complexity changes every step of the process.

What Is Follow-the-Money Tracing and Why Does Methodology Matter?

Follow-the-money tracing is not a single tool – it is a sequence of analytical steps applied to evidence that is rarely complete and never neutral. The methodology matters because courts require evidential chains, not conclusions. A reconstruction that cannot show its working is a narrative. One that is documented and defensible is a basis for relief.

The distinction is significant. In our experience, poorly structured tracing work produces a story of what probably happened. Disciplined methodology produces an exhibit bundle – one that can support a freezing order, a Bankers Trust order compelling bank disclosure, or a Norwich Pharmal order against a third party who holds identifying information. The difference between those two outcomes is process, not luck.

Asset tracing as a discipline draws on three overlapping sources: documentary evidence (statements, contracts, payment instructions, corporate registers), open-source intelligence (public filings, land registries, UBO registers, on-chain data), and compelled disclosure obtained through legal process. Each source has strengths. Each has gaps. Methodology is the art of triangulating across all three.

As of early 2026, the tools available for compelled disclosure have expanded – particularly in common-law jurisdictions and in the on-chain environment, where disclosure orders against virtual-asset service providers (VASPs) are now routine where previously they were novel. That expansion has not changed the underlying methodology. It has added instruments to the toolkit.

The Structure of a Follow-the-Money Investigation: From Loss Event to Settled Value

A follow-the-money investigation begins at the point of loss and works forward, or – in dissipation cases – begins with what can be seen at the far end and works backward. Both directions are valid. Which to choose depends on where evidence is available.

The standard forward methodology runs through four phases. First, the loss event itself: when did value leave the victim's control, in what form, and to what account or wallet? Second, the first movement: where did the funds go on day one, and what intermediaries touched them? Third, layering: how many hops, entities, and jurisdictions sit between the loss event and the current location of value? Fourth, settlement: where does the trail lead to an asset – real property, a corporate shareholding, a liquid account, a crypto balance – that can be frozen or attached?

Each phase has a corresponding evidentiary demand. The loss event needs the victim's records and, typically, the records of the originating bank. The first movement needs the receiving institution's records. Layering requires disclosure orders in each jurisdiction through which funds passed. Settlement requires identification of the ultimate beneficiary – and that is where corporate-structure analysis and UBO register searches become indispensable.

A worldwide freezing order can, in principle, reach assets in any jurisdiction, not just the forum where it is granted – though its enforcement in a foreign court requires separate recognition. Understanding that distinction early determines whether the tracing work is building toward an enforceable outcome or an academic exercise.

In our experience, the layering phase is where most follow-the-money investigations stall. It is also where the methodology's rigour is most tested. Weak tracing work treats each hop as a separate problem. Disciplined work maps the entire network first – using whatever open-source intelligence is available – and targets disclosure orders strategically, so that each compelled disclosure opens the next layer rather than arriving in isolation.

Where Does the Evidence Come From When Records Are Incomplete?

Incomplete records do not kill a trace. They change its architecture. This is the point most commonly misunderstood – by clients, and occasionally by lawyers who have not run a follow-the-money investigation before.

When primary records are missing, the methodology shifts to corroborative sourcing. A bank statement is gone? The counterparty's statement may reflect the same transaction from the other side. Corporate minutes are missing? Share registers, filed accounts, and correspondent-bank records may reconstruct the same payment. A beneficial owner is obscured? UBO register filings – mandatory in an expanding list of jurisdictions – may identify them directly, or identify the nominee whose appointment they instructed.

The practical hierarchy of substitute evidence runs from internal records (the victim's own files, which are the most immediate) outward through counterparty records, institutional records (banks, registries, exchanges), and finally public registries and on-chain data. Public blockchains are transparent by design: every on-chain movement is permanently recorded, even when the addresses involved are pseudonymous. That transparency means a crypto trail is rarely destroyed – only obscured, and often recoverable through blockchain-analytics tools and wallet clustering.

A matter in the Gulf, in the autumn of 2024, illustrated this pattern. Funds had moved through three corporate layers in two jurisdictions. The client's immediate records covered only the originating payment. Working outward, the trace recovered the first hop from correspondent-bank data, the second from a UBO register filing, and the third from on-chain records showing the ultimate conversion. The investigation located value in a form susceptible to freezing. No single record was sufficient alone; the methodology made the combination work.

The harder question is not whether gaps can be bridged – they usually can – but which gaps are material to the outcome sought. A gap in the chain between the loss event and an identified asset may not matter if the final asset can be reached through a proprietary injunction or a receivership without proving every intermediate step. A gap at the identity stage is harder: without a name or entity to freeze against, most relief is unavailable.

For a confidential read on whether a specific money trail is reconstructible, request a case review: info@axiomtracel.com.

Contrasting Positions: Forensic Accounting First or Legal Process First?

Practitioners in cross-border recovery divide on a fundamental sequencing question: do you build the forensic picture first and then seek legal process, or do you use legal process to drive the forensic picture? The debate is real, and the answer depends on what you have at the start.

The forensic-first position holds that a well-built evidential picture – assembled from available records, open-source intelligence, and the victim's own documents – should precede any application to court. The argument is that disclosure orders are costly, jurisdictionally limited, and risk tipping off a defendant if not accompanied by a simultaneous freezing application. Better, the argument goes, to map as much as possible before committing to a legal pathway, so that the pathway chosen is calibrated to the actual target.

The legal-process-first position holds that in fast-moving cases, delay to build a perfect forensic picture is itself the risk. Assets dissipate. A freezing order or disclosure order obtained on a partial evidential base – combined with a without-notice application to preserve confidentiality – is better than a complete picture obtained three months after the assets have moved again. A freezing or disclosure application is typically made without notice to avoid alerting the defendant to the proceedings. Speed and the without-notice procedure go together.

In our experience, neither position is universally correct. The right answer is a function of three variables: how fast is the target moving funds, how much open-source intelligence is already available, and which jurisdiction offers the most powerful combination of speed and disclosure reach? Where a target has demonstrated rapid layering – multiple hops in days – legal process first is almost always right. Where a target is static and the primary need is to understand the ownership structure before committing to a jurisdiction, forensic work should lead.

There is a third position, less often articulated, which is that the choice is false. The most effective follow-the-money investigations run forensic work and legal process in parallel: open-source and victim-record analysis during the first hours; a without-notice freezing application, if jurisdictionally viable, within the first days; and then disclosure orders to fill the evidential gaps that the early forensic work identified. This parallel model demands genuine coordination between the analytical and legal functions – something that sequential outsourcing rarely achieves.

How Cross-Border Layering Changes the Methodology

A single-jurisdiction money trail is, in practice, the exception. Most significant fraud involves movement across at least two legal systems. Many involve four or five. Each additional jurisdiction introduces a new disclosure regime, a new set of procedural requirements for recognition of foreign orders, and a new opportunity for the dissipating party to exploit the delay.

The methodology must adapt to this reality in three specific ways. First, jurisdiction mapping: before any formal legal step, the investigation should identify every jurisdiction in which assets appear to have paused, even briefly. A pause of 48 hours in a transit jurisdiction may be enough to ground a disclosure application in that jurisdiction if the assets were materially present. It is rarely enough to justify the cost unless there is reason to believe the trail bifurcates there.

Second, enforcement pathway analysis: obtaining a freezing order in one jurisdiction does not automatically freeze assets elsewhere. The worldwide freezing order is a powerful instrument precisely because it operates extraterritorially – but its enforcement in a third jurisdiction requires that jurisdiction to recognise it, either by treaty, by common-law principles of comity, or by a separate domestic application. Building a multi-jurisdictional enforcement chain requires knowing, at the outset, which jurisdictions on the trail will cooperate and which require fresh proceedings.

Third, parallel application strategy: where the trail passes through jurisdictions that cannot easily enforce a foreign order, parallel applications – run simultaneously through local counsel in each forum – are often necessary. The cost is higher. The coordination requirement is significant. The alternative – sequential applications that allow a defendant days to move funds between each step – is routinely exploited by sophisticated dissipators.

What is the critical timing variable in a cross-border trace? It is not the complexity of the trail – complex trails can be mapped. It is the latency between each enforcement step. Time sensitivity is real: dissipation can defeat recovery, and urgent applications are measured in hours to days. A defendant who receives 72 hours' warning between a freeze in jurisdiction A and an application in jurisdiction B has everything they need to move the assets again.

Explore how these cross-border principles apply to a specific context: reconstructing payment trails through the Cayman Islands.

On-Chain Tracing: Where Follow-the-Money Methodology Meets the Blockchain

The emergence of digital assets has not changed the core methodology. It has added a new class of evidence and a new set of legal instruments to interact with it. On-chain tracing is, at its base, follow-the-money applied to a public and permanent ledger rather than to bank records that must be compelled.

The starting point is always the same: a wallet address associated with the loss event. From that address, blockchain-analytics tools can follow movements forward – tracking value as it moves to exchange deposit addresses, mixing or obfuscation services, bridge contracts that move assets between chains, and ultimately to withdrawal points where pseudonymous addresses intersect with identifiable institutions.

The critical choke point in on-chain tracing is the centralised exchange. A centralised exchange holds know-your-customer records that link a deposit address to a real identity. A disclosure order against a VASP – or a stablecoin issuer, which can freeze specific token balances on appropriate legal process – converts on-chain intelligence into actionable identity evidence. That conversion is what makes the follow-the-money methodology effective in the crypto environment, rather than merely descriptive.

Where funds have been moved through decentralised protocols or mixing services, the methodology is more demanding. Wallet clustering and attribution – analysing patterns of on-chain behaviour to group addresses controlled by the same entity – can often recover the thread even after deliberate obfuscation. But the time sensitivity is acute: once funds reach a fiat off-ramp and the exchange withdraws them, the on-chain trace terminates and the follow-the-money investigation shifts back to conventional financial forensics.

A matter in Southeast Asia, in the first quarter of 2025, demonstrated the integration of both methodologies. Funds moved from the victim's account through two wire transfers, then converted to cryptocurrency and passed through several on-chain hops before arriving at a centralised exchange. The on-chain trace identified the deposit address. A disclosure order against the VASP produced the identity. A freezing order followed. The methodology was continuous – bank record to blockchain to legal process – with no break in the analytical chain.

To assess the viability of tracing assets that have moved on-chain or across borders, contact info@axiomtracel.com.

Limits of the Methodology: What Follow-the-Money Cannot Do

Honest analysis requires stating the limits alongside the capability. Follow-the-money methodology is powerful. It is not unlimited. Knowing where it stops is as important as knowing where it starts.

The first limit is evidential destruction. Where records have been deliberately destroyed, proceedings may produce inference but not proof. Courts in common-law jurisdictions can draw adverse inferences from document destruction, and a proprietary injunction may be available against persons unknown where conventional identification has failed – but inference is not the same as a traced asset. A defendant who destroys records before a Bankers Trust order reaches the bank has materially damaged the trace. This is rare in practice, because destruction requires advance knowledge of the investigation; but it happens.

The second limit is jurisdictional reach. Follow-the-money methodology identifies where assets are. It does not automatically create a right to freeze them. Jurisdictions that are not parties to multilateral enforcement instruments, or where local procedure does not provide for recognition of foreign orders, can become effective safe harbours for a determined dissipator. The methodology maps those havens. It cannot dissolve them without local legal process – and local process is not always available or practical.

The third limit is proportionality. A full follow-the-money investigation – documentary reconstruction, open-source intelligence, multi-jurisdictional disclosure orders – is not free. For smaller claims, the cost of process can exceed the realistic recovery. This is not a failure of methodology; it is a threshold question that should be asked at the start, not at the end. The viability assessment that precedes a full investigation is itself part of the methodology.

The fourth, and most misunderstood, limit is identity lag. On-chain tracing can follow value with precision. It cannot always identify who controls an address without a disclosure order against an exchange or VASP. Conventional financial tracing can follow a payment through a correspondent bank. It cannot identify a beneficial owner who sits behind three nominee layers without a Norwich Pharmal order or a UBO register search. The methodology closes identity gaps through legal process – but legal process takes time, and in that time, a sophisticated defendant may move again.

Does this mean that a case with significant gaps is unrecoverable? Not necessarily. It means the recovery strategy must be calibrated to the actual evidential base and the realistic cost of filling the remaining gaps. That calibration is the professional judgment at the core of follow-the-money methodology.

The Honest Calculus: When Is a Follow-the-Money Investigation Worth Starting?

The question every client asks – and deserves a straight answer to – is whether the effort is worth it. The honest answer requires weighing four variables: the size of the loss, the speed of dissipation, the jurisdictional accessibility of the trail, and the quality of the starting evidence.

Size matters because the cost of multi-jurisdictional disclosure orders, legal fees, and analytical work is real. A trace that can justify its own budget is one where the recoverable amount meaningfully exceeds the anticipated cost. That threshold varies by trail complexity. It is not a fixed number – and any firm that quotes a fixed success percentage is overstating its knowledge of your facts.

Speed of dissipation matters because a trail that is still moving is harder to freeze than one that has settled. Counter-intuitively, however, a still-moving trail also means the assets have not yet been laundered beyond reach. The window is narrow. Acting within days – not weeks – of discovery is consistently the factor that separates recoverable from unrecoverable matters in our experience.

Jurisdictional accessibility matters because the follow-the-money methodology only produces outcomes where legal instruments are available at the point where value has settled. A detailed forensic map showing precisely where funds rested – in a jurisdiction that provides no accessible legal process for a foreign claimant – is informative but not immediately actionable.

Quality of starting evidence matters because the methodology is a multiplication, not a creation. Strong starting evidence – clear loss documentation, identified receiving account, a counterparty name – multiplies into a complete trace with moderate additional effort. Thin starting evidence requires more legal process, more time, and more cost to reach the same standard of proof.

Practitioners in cross-border recovery note that the cases which fail most often do so not because the trail was untraceable but because the investigation started too late, with too little evidence, and without a clear view of which jurisdiction would ultimately need to act. The methodology is sound. The discipline is in applying it to the specific facts – quickly, and with a clear-eyed view of what it will cost to reach the next evidential step.

For further context on the financial forensics discipline that underlies follow-the-money work, see the Financial Forensics insight section. For a description of how Axiom Trace applies this methodology in practice, see our asset tracing service.

Related Topics in Financial Forensics

• Financial Forensics overview – methodology, tools, and cross-border considerations
• Asset Tracing service – how Axiom Trace investigates and coordinates recovery
• Reconstructing payment trails through the Cayman Islands – a worked cross-border example

Frequently Asked Questions

Q: Can a money trail be reconstructed from incomplete records?

A: Yes – though the methodology changes when primary records are missing. Corroborative sources – counterparty statements, correspondent-bank data, public registry filings, UBO registers, and on-chain data – can substitute for missing documents across large portions of a trail. A Norwich Pharmal order or Bankers Trust order can compel disclosure from third parties who hold records the victim cannot obtain voluntarily. Gaps in the chain are bridged through legal process, not assumed away. What matters is identifying which gaps are material to the relief sought – and acting before the trail cools further.

Q: How do you trace funds routed through several jurisdictions?

A: Multi-jurisdictional tracing requires disclosure applications in each relevant forum, coordinated so that each order opens the next layer before the defendant has time to move again. A worldwide freezing order can be sought in the primary forum to give global reach in principle; enforcement in each jurisdiction then follows through local recognition proceedings or parallel applications. The critical variable is not complexity – complex trails can be mapped – but latency: the gap between enforcement steps in which a sophisticated dissipator can act. Parallel applications run through local counsel in multiple forums simultaneously are the standard response to fast-moving, multi-hop trails.

Q: What information do you need from me to start tracing?

A: The minimum starting point is: documentation of the loss event (what moved, when, and to what account or address), any identifying information on the recipient (entity name, account details, wallet address), and the client's own records of any communication or transaction with the counterparty. More is always better – but investigations have been started successfully on less. A common misconception is that missing records mean the investigation cannot begin. In practice, the investigation design is built around the evidence that exists; compelled disclosure fills the gaps. An initial case review – which assesses the starting evidence, the trail's likely jurisdiction map, and the realistic cost of the next evidential step – is the right first action.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed.

We reconstruct payment trails from partial records – identifying where value settled through documentary analysis, open-source intelligence, and legal process – and we have coordinated follow-the-money investigations that have moved from initial tracing through to freezing orders across multiple forums. We do not promise outcomes, and we will tell you plainly when a matter is unlikely to justify the cost of pursuit. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.