7.2 Tracing illicit transactions & asset recovery

Following the Money

Once a fraud is suspected, the examiner must trace the flow of illicit funds — from the point of theft, through layering transactions, to the assets those funds ultimately purchase. Tracing serves two goals at once: proving the subject received money they cannot legitimately explain, and locating assets that can be frozen and recovered. Broadly, there are two families of approach: the direct (specific-item) method and the indirect (circumstantial) methods.

The direct method

The direct method — also called the transaction or specific-item method — follows identifiable funds through a documentary trail. The examiner begins with a specific transaction (a diverted check, a wire, a suspicious cash deposit) and traces it account by account: out of the victim organization, into the fraudster's account, and onward to whatever it bought. Bank statements, wire confirmations, cancelled checks, invoices, and property deeds link each step in the chain. The direct method is the strongest form of proof because it ties specific dollars to specific acts, but it demands a relatively complete paper trail — precisely what sophisticated launderers deliberately break by moving through cash, multiple accounts, or nominee owners. Red flags that a trail is being obscured include funds passed to family members, rapid in-and-out transfers, structured deposits kept below reporting thresholds, and payments with no business purpose. Each traced step should be tied back to a source document so the completed chart of the money flow can be introduced as an exhibit.

Layering and the money-laundering cycle

Illicit funds typically move through three classic stages: placement (introducing cash into the financial system), layering (moving it through complex transactions to obscure its origin), and integration (returning it to the launderer as apparently legitimate wealth). Tracing works directly against layering — the more accounts, shell entities, and jurisdictions the money crosses, the harder the direct method becomes and the more the examiner must lean on indirect proof and pattern analysis to reconstruct the flow.

Indirect (circumstantial) methods

When records are missing or funds are commingled, examiners prove illicit income circumstantially by demonstrating that the subject spent or accumulated far more than their known legitimate income could support. Three methods dominate:

• Net worth method — Compute the subject's net worth (assets minus liabilities) at the beginning and end of a period. The increase in net worth, plus living expenses, minus funds from known legitimate sources, equals the unexplained (likely illicit) income. In formula form: (Ending net worth − Beginning net worth) + Living expenses − Funds from known sources = Unexplained income.
• Expenditures method — Best when the subject spends rather than accumulates. It compares total expenditures during the period against known sources of funds; the excess of spending over legitimate income is the unexplained income. It is essentially the net-worth logic focused on outflows.
• Bank deposits method — Analyzes total deposits into all accounts, eliminates transfers between accounts and identified non-income items (loans, redeposits), and treats the balance of unexplained deposits — plus cash expenditures made without first depositing the cash — as income. It works well when the subject runs money through bank accounts.

A closely related variant, the sources-and-application-of-funds method, tallies all known sources of funds against all known applications (uses) of funds; when applications exceed sources, the difference points to unreported income. Every indirect method requires establishing a firm starting point (a documented "cash on hand" and net-worth baseline) and then negating reasonable innocent explanations — gifts, loans, inheritances, or a prior hoard of accumulated cash, often called the "cash hoard" defense.

Tracing methods compared

Financial profiling and asset recovery

Before choosing a method, examiners build a financial profile of the subject — mapping known income, assets, accounts, and lifestyle — so the analysis rests on a complete picture rather than a single suspicious transaction. Recovering stolen assets is frequently the client's primary objective, and it is a race against time. The examiner identifies, traces, and helps freeze assets before they vanish, using tools such as civil freezing (or restraining) orders, liens, constructive trusts, and — where available — court-ordered seizure. Because value often moves to third parties, tracing may follow assets into the hands of relatives or nominees who hold them for the fraudster. Launderers deliberately layer funds through shell companies, nominee owners, and offshore secrecy jurisdictions to sever the trail. Warning signs of concealment include round-trip transactions, payments to entities with no genuine operations, sudden movement of funds abroad, and routing through correspondent banks. International recovery leans on mutual legal assistance treaties (MLATs), letters rogatory, and cooperation with foreign financial intelligence units. Because bank secrecy and jurisdictional limits slow every step, the CFE documents the money trail meticulously and works with counsel to pursue civil and criminal remedies in parallel, so that a win in one forum reinforces the other.