ACAMS CCAS Crypto Transaction Investigation Workflow

Table of Contents

• • 1. Define the trigger and decision
• • 2. Build the customer and product context
• • 3. Identify custody and control
• • 4. Trace the transaction path
• • 5. Test attribution quality
• • 6. Add off-chain evidence
• • 7. Apply the legal and policy overlay
• • Worked scenario: indirect mixer exposure
• • When should tracing stop?
• • A defensible case record
• • CCAS exam traps

A cryptoasset transaction investigation should not begin with “is this wallet bad?” It should begin with a defined alert, a known transaction path and a clear decision to make. Wallet labels and blockchain analytics scores can focus the work, but neither is a substitute for evidence and judgement.

For ACAMS CCAS preparation, use one repeatable sequence:

trigger → customer context → custody → transaction path → attribution → off-chain evidence → legal overlay → documented decision

This workflow joins technical blockchain facts with anti-financial-crime controls. That connection is the central skill: explain what the data shows, what it does not show and what a proportionate investigator should do next.

1. Define the trigger and decision

Record exactly why the case opened. Examples include:

• a direct link to a sanctioned or illicit service;
• indirect exposure to a mixer or dark-market cluster;
• rapid movement through many addresses;
• use of a new withdrawal address inconsistent with the profile;
• Travel Rule information that is missing or inconsistent; or
• transaction size, frequency or geography without a clear economic explanation.

Then define the decision: release or hold a transaction where lawful, request information, continue monitoring, restrict activity, escalate internally or consider an external report through the authorised process.

An alert is not a conclusion. FATF’s virtual-asset red-flag report groups indicators around anonymity-enhancing features, geography, transaction patterns, size, sender or recipient profiles and source of funds or wealth. The report presents indicators for analysis—not automatic proof of criminal conduct.

2. Build the customer and product context

Compare the activity with what the organisation knows:

• customer identity and beneficial ownership;
• occupation or business model;
• expected transaction purpose, size and frequency;
• source of funds and, where relevant, source of wealth;
• products and services used;
• connected accounts, devices and counterparties;
• previous alerts, cases or restrictions; and
• current customer and geographic risk assessment.

Do not treat the original profile as infallible. If it is vague, old or contradicted by reliable evidence, update the investigation scope rather than forcing the activity to fit it.

3. Identify custody and control

A wallet manages the keys used to control cryptoassets; the asset itself remains represented on the blockchain.

Question	Hosted wallet	Unhosted wallet
Who normally manages the keys?	A VASP or custody provider	The user
What evidence may be available?	Provider records, account identity, deposit and withdrawal history	Ownership proof, transaction challenge, device or customer-supplied evidence
Is the category itself high risk?	No	No

Hosted versus unhosted describes custody and key control. It does not establish legal ownership, beneficial ownership or criminal intent. Even proof that someone controls a private key shows transaction authority at that time; it may not settle every ownership question.

Also separate hot and cold storage from hosted and unhosted custody. Hot and cold describe connectivity and accessibility. They are not synonyms for legitimate and suspicious.

4. Trace the transaction path

Map the transaction before interpreting it. Record:

• asset and network;
• sending and receiving addresses;
• transaction hash, time and amount;
• immediate counterparties;
• direct and indirect exposure;
• number of hops;
• value reaching the relevant exposure;
• timing between movements;
• exchange, bridge, mixer, DeFi or other services used; and
• points where value moves off-ledger or to another chain.

A complete wallet view can matter more than one transaction. Look for behaviour such as rapid pass-through, fragmentation, consolidation, chain hopping, repeated exposure, peel chains or activity inconsistent with the stated purpose.

5. Test attribution quality

Blockchain data can show addresses, amounts, timing and transaction paths. Attribution links those addresses to an entity or service and can be less certain.

For every important label or score, ask:

1. What source supports the label?
2. Is it a named service, a behavioural inference or a third-party cluster?
3. How recent is the attribution?
4. Is the exposure direct or indirect?
5. What share of the funds is affected?
6. Could a shared service or deposit address explain the connection?
7. Would another source corroborate the conclusion?

A tool’s “high-risk” score may combine several inputs. The investigator should understand the underlying path and evidence instead of copying the score into the decision record.

6. Add off-chain evidence

On-chain tracing is one part of the investigation. Off-chain evidence can include:

• VASP customer and transaction records;
• Travel Rule information;
• account funding and withdrawal records;
• invoices, contracts or proof of purpose;
• source-of-funds or source-of-wealth documents;
• customer explanations tested against the full activity;
• reliable public information; and
• lawful information requests or responses.

The strongest cases connect the ledger path to customer identity, purpose and control. A neat transaction graph without reliable attribution may remain incomplete; a plausible customer explanation without supporting evidence may also remain incomplete.

7. Apply the legal and policy overlay

Map the service, customer, legal entity, transaction and locations to the rules that apply. The FATF Travel Rule is an information-transfer requirement for qualifying virtual-asset transfers, not a universal prohibition on unhosted-wallet activity.

Ask:

• which entities are VASPs or other obliged institutions;
• which jurisdictions and thresholds apply;
• what originator and beneficiary information is required;
• whether sanctions or other prohibitions apply;
• whether missing information requires rejection, suspension, inquiry or risk-based handling under the applicable rule; and
• which internal role owns the decision.

A global policy may provide a baseline, but it does not automatically satisfy every local requirement.

Worked scenario: indirect mixer exposure

A long-standing customer withdraws to an unhosted wallet. Two days later, some value returns from a different address. Analytics show that a small portion of the returning funds passed through an intermediary that received funds from a mixer three hops earlier.

The weak answer is either “mixer means reject” or “three hops means ignore.” The disciplined workflow is:

1. confirm the precise alert and affected value;
2. verify the address path, hop count, timing and attribution confidence;
3. compare the activity with the customer’s expected use;
4. establish the customer’s control of relevant wallets where appropriate;
5. request and test the purpose and source of the returned funds;
6. review direct and indirect counterparties and any other linked activity;
7. apply the organisation’s risk appetite, stopping rules and legal requirements; and
8. document why the evidence supports closure, monitoring, restriction or escalation.

The mixer exposure remains relevant, but its meaning depends on the complete facts. The investigation record should separate confirmed data, third-party attribution, customer statement, inference and unresolved uncertainty.

When should tracing stop?

More hops do not always create a better decision. A stopping rule should consider whether further work is proportionate and likely to change the outcome.

Stop or narrow tracing when the relevant question has been answered, the remaining path cannot be resolved with available lawful sources, or additional analysis is unlikely to change the decision. Continue or escalate when material value, close exposure, strong attribution, conflicting evidence or legal requirements make the unresolved path important.

Stopping at the first mixer is not automatically sound. Neither is tracing indefinitely because a tool can keep drawing edges.

A defensible case record

The final note should contain:

• alert and decision required;
• customer and product context;
• wallets, transactions and review period;
• direct and indirect exposure with amounts and timing;
• attribution sources and confidence;
• on-chain and off-chain evidence;
• legal and policy considerations;
• explanation tested and unresolved issues;
• decision, owner and approval; and
• monitoring, restriction, reporting or follow-up actions.

Avoid claiming that a customer committed a crime. Record the evidence, the applicable control decision and the authorised escalation clearly.

CCAS exam traps

• Wallet equals the asset: a wallet manages keys; it is not a container holding coins off the ledger.
• Unhosted equals suspicious: custody type is a fact, not a verdict.
• Pseudonymous equals anonymous: public activity may be traceable and later attributable.
• Score equals evidence: inspect what produced the score.
• Indirect equals irrelevant: distance matters but does not erase value, timing or attribution.
• Mixer ends the investigation: document what can still be established and use proportionate stopping rules.
• Travel Rule equals transfer ban: it is an information requirement whose implementation depends on applicable rules.
• Reporting equals account closure: reporting, restriction and exit are related but separate decisions.

The ACAMS CCAS exam guide covers the 100-question format, three-domain weighting and six-week plan. Use the current ACAMS CCAS certification page for live certification policies and FATF’s official virtual-asset materials for international standards and red-flag context.

The strongest investigation follows the path without overstating it: trace the value, test the attribution, connect it to the customer and record a proportionate decision.