How should investigators distinguish traceability from culpability?¶

Traceability asks where value moved. Culpability asks who controlled that movement, what they knew and intended, and what participation or benefit can be proved.

The same record can answer only the first question¶

A statement may establish receipt and onward transfer without identifying the operator or purpose. A named customer can be deceived, coerced or compromised, while an offender may control an account registered to someone else. Provider identity checks establish a customer relationship, not every later user.

Add attribution and state-of-mind evidence¶

First reconstruct the transaction chain. Then assess authorised access, endpoints, sessions, communications, instructions, security changes, retained value, concealment and repetition. Test both accusation and denial against the records.

Reports should separate financial movements, evidence identifying the operator, and evidence of knowledge or intent. If the trace is strong but culpability remains uncertain, say so rather than overstating what the money trail proves.