Last Updated: March 2026

On-chain forensic report standards define the specific data elements, methodological disclosures, and structural requirements that a blockchain forensic report must satisfy to be relied upon in court, regulatory proceedings, or law enforcement referrals. In the UK, these standards are shaped by CPR Part 35, the Forensic Science Regulator’s 2024 Codes of Practice, and the developing case law on cryptocurrency tracing evidence. A report that traces funds accurately but omits tool disclosure, fails to distinguish confirmed from probabilistic attribution, or lacks a complete wallet address schedule will be challenged – and in many cases excluded – regardless of the correctness of its analytical conclusions.

Crypto Trace Labs prepares on-chain forensic reports that meet the standards required by UK High Court proceedings, FCA regulatory investigations, and criminal referrals. The team – ACAMS (Association of Certified Anti-Money Laundering Specialists) accredited, MLRO (Money Laundering Reporting Officer) qualified across UK, US, and EU, and Chartered Fellow Grade at the CMI – brings VP and Director-level experience from Blockchain.com, Kraken, and Coinbase.

Key Takeaways

• Transaction traces must be hop-by-hop: Every transaction in the trace must be individually documented with transaction hash, block height, timestamp, sending address, receiving address, and value – no gaps.
• Attribution must be graded: According to Elliptic’s 2024 forensic methodology guide, courts require clear distinction between confirmed attribution (KYC-backed) and probabilistic attribution (clustering heuristics), with confidence levels stated.
• Tool disclosure is not optional: The report must name every blockchain analytics tool used – Chainalysis, Elliptic, TRM Labs, Crystal Intelligence, or open-source alternatives – and acknowledge their documented limitations.
• Chain of custody must be appended: The report must include or reference a chain of custody log covering all data from collection through analysis to report preparation.
• The expert declaration is a legal requirement: CPR Part 35 mandates a signed statement that the expert’s duty is to the court and that the report complies with the Practice Direction on expert evidence.

Why This Matters

On-chain forensic reports are the primary instrument through which blockchain evidence reaches courts and regulators. A technically accurate report that does not meet structural and disclosure standards is as vulnerable to challenge as a technically flawed one. According to the UK Jurisdictional Taskforce’s 2023 Legal Statement on Cryptoassets, the reliability of blockchain evidence is assessed not merely by its technical correctness but by the transparency of the methodology used to produce it. Firms relying on informal or undisclosed methods – even if their conclusions are correct – provide opposing experts with grounds to attack the entire report. A well-structured report with full methodological disclosure is significantly harder to undermine.

Transaction Trace Data Requirements

The transaction trace is the core of any on-chain forensic report, documenting the path taken by cryptocurrency from its origin to its current or final location.

For each hop in the trace, the report must record: the transaction hash (txid) as a unique identifier; the block height at which the transaction was confirmed; the block timestamp in UTC; the input addresses and their balances; the output addresses and values sent; the change address if identifiable; and the transaction fee. Each of these fields must be sourced from primary blockchain data, not derived from a tool’s interface without citing the underlying source.

Where assets pass through mixers (Tornado Cash, CoinJoin implementations), cross-chain bridges, or privacy protocols (Monero, Zcash shielded transactions), the trace must document the point at which tracing certainty decreases and clearly label the remainder of the trace as probabilistic. Courts that have dealt with Tornado Cash cases have specifically noted the importance of separating pre-mixer confirmed traces from post-mixer probabilistic traces.

Attribution Methodology Disclosure Standards

Attribution methodology disclosure is the section of the forensic report that explains how wallet addresses were linked to specific entities, and it is the section most frequently attacked by opposing experts.

The report must separately describe: confirmed attribution – where a wallet address has been linked to an entity through KYC records from an exchange, court disclosure, law enforcement data, or the entity’s own published wallet address; and probabilistic attribution – where a wallet address has been clustered with an entity through co-spend analysis (the common input ownership heuristic), peel chain analysis, or other inference-based methods.

For each probabilistic attribution, the report must state the heuristic applied, the tool or method used, the confidence level, and any assumptions underlying the attribution. According to Chainalysis’s 2024 compliance reporting standards, courts are increasingly requiring experts to quantify the false positive rate of clustering heuristics for the specific blockchain and transaction type analysed.

Tool Disclosure Requirements

Tool disclosure means identifying every commercial or open-source software tool used in the analysis, the version employed, and the published methodology documentation the tool relies upon.

For commercial tools such as Chainalysis Reactor, Elliptic Lens, or TRM Labs Forensics, the disclosure must reference the tool’s published methodology documentation and acknowledge any limitations relevant to the specific analysis performed. For example, Chainalysis Reactor’s address clustering methodology performs differently for different Bitcoin transaction types, and reports using Reactor for CoinJoin analysis must acknowledge this limitation.

For open-source tools or custom scripts, the report must either include the tool code as an appendix or provide a detailed description of the algorithm applied. Describing an analysis as conducted using a “proprietary methodology” without further disclosure is not acceptable in UK proceedings and will be challenged on the basis that it prevents the opposing expert from reproducing and verifying the analysis.

Wallet Address Schedule Requirements

The wallet address schedule is an appendix to the forensic report that lists every address identified in the tracing exercise, and it forms the operational basis for any freezing order or restraint application.

The schedule must include: the wallet address in full; the entity attributed to that address and the basis for attribution; the current balance at the date of the report; the jurisdiction of any exchange or custodian if the address is an exchange deposit address; and any relevant notes such as mixer association or privacy coin conversion. Addresses that have been spent out entirely should be included with a note that the balance is zero and the funds have moved to the next identified address.

For freezing injunction applications, the court will use the wallet address schedule to specify exactly which addresses are subject to the order. Addresses omitted from the schedule are not covered by the order, even if they hold traced funds. This makes the completeness of the schedule directly consequential to the effectiveness of the legal relief obtained.

Expert Declaration and CPR Part 35 Compliance

The expert declaration is the signed statement at the end of the forensic report in which the expert formally confirms their qualifications, their overriding duty to the court, and their compliance with CPR Part 35 and its Practice Direction.

The declaration must state the expert’s name, qualifications, and relevant experience; confirm that the report has been prepared in accordance with CPR Part 35 and Practice Direction 35; state that the expert understands their duty to the court and has complied with that duty; and confirm that the facts and opinions in the report are within the expert’s area of expertise. The expert must also disclose any relationship with the instructing party that could give rise to a perception of bias.

CPR Part 35 also requires the expert to state which instructions they received, what documents they were provided, and any assumptions they were asked to make. A declaration that is incomplete, unsigned, or that fails to address these elements renders the entire report non-compliant.

Frequently Asked Questions

What must an on-chain forensic report include at minimum?

At minimum, an on-chain forensic report must include a hop-by-hop transaction trace with transaction hashes, timestamps, and addresses; attribution methodology distinguishing confirmed from probabilistic attribution; disclosure of all tools used and their methodology sources; a chain of custody record covering data from collection to report; a wallet address schedule; and a CPR Part 35 compliant expert declaration. Omitting any of these elements creates specific grounds for challenge in court or regulatory proceedings.

How is probabilistic attribution disclosed in a forensic report?

Probabilistic attribution is disclosed by identifying the heuristic applied (common input ownership, peel chain, deposit address reuse), naming the tool or algorithm used, stating the confidence level as a percentage or qualitative grade, and acknowledging the false positive rate or known limitations. Courts treat probabilistic attribution as evidence of lower weight than confirmed attribution. Both must be clearly labelled so the court understands exactly what has been proven and what has been inferred.

Does the forensic report need to be signed by the expert personally?

Yes. CPR Part 35 requires the expert declaration to be personally signed by the expert whose qualifications are cited in the report. A report prepared by a junior analyst but signed by a senior partner without direct involvement in the analysis is non-compliant. In high-value proceedings, courts may examine the expert’s direct involvement in the analysis during cross-examination.

How should mixer-obscured transactions be handled in the trace?

Transactions that pass through mixers such as Tornado Cash, Wasabi Wallet CoinJoin, or similar should be documented with the pre-mixer trace confirmed and the post-mixer trace clearly labelled as probabilistic. The mixer type, the analytical method used to attempt to trace through it (demixing heuristics, deposit/withdrawal timing correlation), and the confidence level of any post-mixer conclusions must all be disclosed. Courts have accepted post-mixer probabilistic traces where the methodology is transparent and the confidence level is appropriately stated.

What is the wallet address schedule and how detailed must it be?

The wallet address schedule is a complete list of all identified addresses in the tracing exercise, with entity attribution, current balance, jurisdiction, and any relevant notes such as mixer association. Every address – including zero-balance addresses that have been spent out – must be included. The schedule must be accurate at the report date and flagged for update if asset movements occur before court proceedings. For freezing applications, only addresses in the schedule will be covered by the order.

How are cryptocurrency values reported in forensic reports?

Cryptocurrency values must be reported in the native denomination (BTC, ETH, USDT) and in GBP at the exchange rate prevailing at the specific date and time of each transaction. The exchange rate source must be documented. The current GBP value at the report date must also be provided for each active wallet. Reports that provide only current values without historical values at transaction dates create arguments about the quantum of loss or gain.

Can a forensic report prepared for one jurisdiction be used in another?

A forensic report prepared for UK proceedings may be used in other jurisdictions, but it will likely need to be supplemented with jurisdiction-specific disclosure. Different courts have different rules on expert evidence, tool disclosure, and attribution standards. Where enforcement is sought in multiple jurisdictions, jurisdiction-specific supplemental reports prepared in collaboration with local experts are the most effective approach.

How often should forensic reports be updated during proceedings?

Forensic reports should be updated whenever material asset movements occur, significant new attribution evidence becomes available, or an opposing expert raises substantive methodology challenges that require a response. For freezing injunction applications, the report must remain current between the without-notice application and the return date. In longer proceedings, formal updates should be timed to coincide with key hearings.

Executive Summary

On-chain forensic reports that fail to meet structural and disclosure standards are routinely challenged and excluded in UK proceedings, regardless of the technical accuracy of their analytical conclusions. The minimum requirements are clear: a hop-by-hop transaction trace, graded attribution methodology, full tool disclosure, chain of custody records, a complete wallet address schedule, and a CPR Part 35 compliant expert declaration. Firms instructed on crypto fraud, asset recovery, or regulatory matters should ensure their forensic providers produce reports to this standard from the initial instruction, not as a retrofit when litigation is already underway.

What Should You Do Next?

If you need a court-ready on-chain forensic report for litigation support, a freezing application, or a regulatory submission, Crypto Trace Labs prepares reports that meet all UK court standards and can be defended under cross-examination by specialist opposing experts.

The team at Crypto Trace Labs – ACAMS-accredited, MLRO-qualified across the UK, US, and EU, Chartered Fellow Grade at the CMI, with founding members from Blockchain.com, Kraken, and Coinbase – has recovered 101 Bitcoin for clients in the last 12 months and regularly provides expert witness testimony in High Court proceedings. We offer no upfront charge for non-custodial wallet recoveries. Contact us to discuss your requirements.

People Also Read

• How Does Blockchain Forensics Work? Expert Methods Explained
• Definition of Digital Evidence: Complete Guide for 2026
• Crypto Freezing Injunctions: How Courts Protect Victims of Cryptocurrency Theft
• On-Chain Clustering Algorithms: How Investigators Group Addresses

About the Author

Crypto Trace Labs is a specialist crypto asset recovery and blockchain forensics firm founded by VP and Director-level executives formerly of Blockchain.com, Kraken, and Coinbase. Our team holds ACAMS accreditations, MLRO qualifications across the UK, US, and EU, and Chartered Fellow Grade status at the CMI. With over 10 years of experience in financial crime investigation and court-recognized blockchain forensics expertise, we have recovered 101 Bitcoin for clients in the last 12 months and delivered record fraud reduction for a $14bn crypto exchange. We work with law enforcement agencies, regulated financial institutions, and private clients on crypto asset recovery, blockchain forensics, AML compliance, and expert witness testimony – globally. We offer no upfront charge for non-custodial wallet recoveries. Contact us

This content is for informational purposes only and does not constitute legal, financial, or compliance advice. Crypto asset recovery outcomes depend on specific circumstances, regulatory cooperation, and technical factors. Consult qualified professionals regarding your specific situation.