[{"data":1,"prerenderedAt":2417},["ShallowReactive",2],{"article-cftc-blockchain-regulatory-records":3,"content-query-5jgu37RD26":453,"related-cftc-blockchain-regulatory-records":772},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"slug":10,"date":11,"lastUpdated":11,"author":12,"readingTime":13,"category":14,"tags":15,"ogImage":20,"featured":6,"body":21,"_type":447,"_id":448,"_source":449,"_file":450,"_stem":451,"_extension":452},"\u002Farticles\u002F41-cftc-blockchain-regulatory-records","articles",false,"","A public blockchain is not a records archive","CFTC staff said it would not object to blockchain recordkeeping, but a public explorer alone may not satisfy existing retention and production rules.","cftc-blockchain-regulatory-records","2026-09-28","Nick Kampe",10,"Legal Reference",[16,17,18,19],"cftc","blockchain-evidence","regulatory-records","e-discovery","\u002Fog\u002Fcftc-blockchain-regulatory-records.png",{"type":22,"children":23,"toc":431},"root",[24,32,48,53,60,74,79,84,89,94,100,112,117,122,134,139,145,150,155,169,182,188,193,198,203,238,243,257,263,268,273,278,283,289,294,299,304,309,315,320,325,330,350,356,362,373,379,388,394,403,409,418],{"type":25,"tag":26,"props":27,"children":28},"element","p",{},[29],{"type":30,"value":31},"text","A transaction may remain visible on a public blockchain for years. That does not mean the chain preserves the complete record a regulated firm must keep, or the evidence counsel will need in a dispute.",{"type":25,"tag":26,"props":33,"children":34},{},[35,37,46],{"type":30,"value":36},"On September 24, 2026, three divisions of the Commodity Futures Trading Commission added new recordkeeping answers to their ",{"type":25,"tag":38,"props":39,"children":43},"a",{"href":40,"rel":41},"https:\u002F\u002Fwww.cftc.gov\u002Fmedia\u002F14671\u002FFAQ_CryptoAsset092426\u002Fdownload",[42],"nofollow",[44],{"type":30,"value":45},"crypto assets and blockchain technologies FAQ",{"type":30,"value":47},". The staff position is practical: a covered entity may use blockchain technology to create and maintain regulatory records. The technology does not displace the recordkeeping obligation.",{"type":25,"tag":26,"props":49,"children":50},{},[51],{"type":30,"value":52},"That distinction matters when a trading venue, clearing organization, swap dealer, futures commission merchant, or swap counterparty says the responsive record is \"on the blockchain.\" The public transaction may be one part of the record. The entity's metadata, account mapping, correction history, system controls, and production capability may be separate evidence.",{"type":25,"tag":54,"props":55,"children":57},"h3",{"id":56},"what-cftc-staff-changed-on-september-24",[58],{"type":30,"value":59},"What CFTC staff changed on September 24",{"type":25,"tag":26,"props":61,"children":62},{},[63,65,72],{"type":30,"value":64},"The ",{"type":25,"tag":38,"props":66,"children":69},{"href":67,"rel":68},"https:\u002F\u002Fwww.cftc.gov\u002FPressRoom\u002FPressReleases\u002F9303-26",[42],[70],{"type":30,"value":71},"CFTC release announcing the update",{"type":30,"value":73}," says staff added guidance on tokenized investments of customer funds and the use of blockchain technology for recordkeeping. Questions 13 through 15 address records.",{"type":25,"tag":26,"props":75,"children":76},{},[77],{"type":30,"value":78},"Question 13 says CFTC Regulation 1.31 is technology neutral. Staff would not object if a records entity used blockchain technology to create and maintain onchain records, provided the entity fully satisfies the rule.",{"type":25,"tag":26,"props":80,"children":81},{},[82],{"type":30,"value":83},"Question 14 applies the same position to swap records under Regulation 45.2. It names swap execution facilities, designated contract markets, derivatives clearing organizations, swap dealers, major swap participants, and certain other counterparties.",{"type":25,"tag":26,"props":85,"children":86},{},[87],{"type":30,"value":88},"Question 15 addresses a narrower point. Staff would not object solely because one of those entities chose not to maintain an offchain version of a record. If the entity uses a public and permissionless network, staff said it should establish systems and controls that allow it to retain and produce the record during an emergency or disruption, including an outage affecting the network or its associated block explorer.",{"type":25,"tag":26,"props":90,"children":91},{},[92],{"type":30,"value":93},"The FAQ is staff guidance, not a Commission rule. Footnote 2 says the answers represent the views of the named divisions, create no enforceable rights, do not amend existing rules, and do not supply a no-action position. Counsel should cite the underlying regulation for the obligation and use the FAQ to understand how staff currently applies it to blockchain systems.",{"type":25,"tag":54,"props":95,"children":97},{"id":96},"the-regulatory-record-is-larger-than-the-transaction",[98],{"type":30,"value":99},"The regulatory record is larger than the transaction",{"type":25,"tag":26,"props":101,"children":102},{},[103,110],{"type":25,"tag":38,"props":104,"children":107},{"href":105,"rel":106},"https:\u002F\u002Fwww.ecfr.gov\u002Fcurrent\u002Ftitle-17\u002Fchapter-I\u002Fpart-1\u002Fsection-1.31",[42],[108],{"type":30,"value":109},"Regulation 1.31",{"type":30,"value":111}," defines a regulatory record to include books and records required by the Commodity Exchange Act or CFTC regulations. For electronically stored books and records, the definition also reaches data needed to access, search, or display them, plus electronically stored data describing how and when they were created, formatted, or modified.",{"type":25,"tag":26,"props":113,"children":114},{},[115],{"type":30,"value":116},"That text matters in discovery. A block explorer page may display a transaction hash, addresses, an amount, a block reference, and emitted events. It usually does not identify the firm's customer account, the order or position that caused the transfer, the employee or automated process that approved it, the source used to decode contract data, or a later internal correction.",{"type":25,"tag":26,"props":118,"children":119},{},[120],{"type":30,"value":121},"Regulation 1.31 also requires systems and controls that support the authenticity and reliability of electronic regulatory records. Electronic records must remain accessible for the required retention period. Upon a CFTC request, the entity must promptly produce them in the form and medium specified by the Commission, unless the Commission directs otherwise.",{"type":25,"tag":26,"props":123,"children":124},{},[125,132],{"type":25,"tag":38,"props":126,"children":129},{"href":127,"rel":128},"https:\u002F\u002Fwww.ecfr.gov\u002Fcurrent\u002Ftitle-17\u002Fchapter-I\u002Fpart-45\u002Fsection-45.2",[42],[130],{"type":30,"value":131},"Regulation 45.2",{"type":30,"value":133}," requires covered entities to keep full, complete, and systematic swap records with pertinent data and memoranda. It also makes those records available for inspection by designated government authorities and addresses the form in which copies must be provided.",{"type":25,"tag":26,"props":135,"children":136},{},[137],{"type":30,"value":138},"Neither rule treats public visibility as completeness. The chain can show that a particular network accepted a transaction at a particular place in its history. Whether that transaction settled a customer's obligation, changed a firm's books, satisfied a margin call, or corresponded to an authorized instruction may depend on records outside the chain.",{"type":25,"tag":54,"props":140,"children":142},{"id":141},"immutability-does-not-solve-production",[143],{"type":30,"value":144},"Immutability does not solve production",{"type":25,"tag":26,"props":146,"children":147},{},[148],{"type":30,"value":149},"People often use \"immutable\" as shorthand for permanent, complete, and self-explaining. Those are different propositions.",{"type":25,"tag":26,"props":151,"children":152},{},[153],{"type":30,"value":154},"A public chain may preserve transaction data while an explorer changes its interface, removes decoded fields, loses an API feature, or becomes unavailable. Contract interpretation can also change when an ABI is corrected or a proxy begins using a new implementation. The underlying bytes may remain, but the means used to search and explain them may not.",{"type":25,"tag":26,"props":156,"children":157},{},[158,160,167],{"type":30,"value":159},"The CFTC addressed this point when it revised Regulation 1.31 in 2017. The ",{"type":25,"tag":38,"props":161,"children":164},{"href":162,"rel":163},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2017\u002F05\u002F30\u002F2017-11014\u002Frecordkeeping",[42],[165],{"type":30,"value":166},"final recordkeeping rule",{"type":30,"value":168}," was intended to make the form and manner of retention technology neutral while preserving authenticity, reliability, retention, and production requirements. The 2026 FAQ applies that existing design to blockchain systems.",{"type":25,"tag":26,"props":170,"children":171},{},[172,174,180],{"type":30,"value":173},"For counsel, an explorer URL should be treated as a locator, not the whole acquisition. ",{"type":25,"tag":38,"props":175,"children":177},{"href":176},"\u002Fresources\u002Freproducible-blockchain-evidence",[178],{"type":30,"value":179},"Reproducible blockchain evidence",{"type":30,"value":181}," requires the network, block and transaction identifiers, collection time, raw response, query method, and source provenance. When the producing party is a regulated entity, the request should also reach the internal records that give the public transaction business meaning.",{"type":25,"tag":54,"props":183,"children":185},{"id":184},"ask-which-system-holds-each-fact",[186],{"type":30,"value":187},"Ask which system holds each fact",{"type":25,"tag":26,"props":189,"children":190},{},[191],{"type":30,"value":192},"\"Produce the blockchain records\" is too vague for most contested matters. It invites a stack of explorer PDFs and leaves the important systems untouched.",{"type":25,"tag":26,"props":194,"children":195},{},[196],{"type":30,"value":197},"Start by separating the facts in dispute. If the issue is whether a transfer executed, request the raw transaction, receipt, relevant logs, block reference, and the decoding materials used by the entity. If the issue is authorization, request the instruction, account mapping, approval record, access logs, and applicable role or policy data. If the issue is valuation or margin, request the price source, timestamp, haircut, calculation inputs, and the ledger entry that used them.",{"type":25,"tag":26,"props":199,"children":200},{},[201],{"type":30,"value":202},"A focused request may seek:",{"type":25,"tag":204,"props":205,"children":206},"ul",{},[207,213,218,223,228,233],{"type":25,"tag":208,"props":209,"children":210},"li",{},[211],{"type":30,"value":212},"the canonical network identifier, transaction hash, block number, and raw node or provider response retained by the entity;",{"type":25,"tag":208,"props":214,"children":215},{},[216],{"type":30,"value":217},"data needed to search, access, display, and decode the record, including the contract address, ABI version, proxy implementation, token decimals, and relevant internal schema;",{"type":25,"tag":208,"props":219,"children":220},{},[221],{"type":30,"value":222},"the mapping between blockchain addresses and the firm's customer, account, order, position, wallet, or custody records;",{"type":25,"tag":208,"props":224,"children":225},{},[226],{"type":30,"value":227},"corrections, annotations, reversals, exception records, and modification metadata associated with the transaction;",{"type":25,"tag":208,"props":229,"children":230},{},[231],{"type":30,"value":232},"policies, architecture documents, control tests, and outage procedures for the blockchain recordkeeping system; and",{"type":25,"tag":208,"props":234,"children":235},{},[236],{"type":30,"value":237},"records showing whether the firm could produce the material when its normal explorer, provider, or network path was unavailable.",{"type":25,"tag":26,"props":239,"children":240},{},[241],{"type":30,"value":242},"The correct scope depends on the claim, the entity, and the governing retention rule. Regulation 1.31 does not make every system artifact relevant to every case. It does make it harder to defend a blanket response that the explorer page is all that exists.",{"type":25,"tag":26,"props":244,"children":245},{},[246,248,255],{"type":30,"value":247},"In federal civil litigation, ",{"type":25,"tag":38,"props":249,"children":252},{"href":250,"rel":251},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocument\u002Ffederal-rules-of-civil-procedure.pdf",[42],[253],{"type":30,"value":254},"Rule 34",{"type":30,"value":256}," allows a request to specify the form of electronically stored information and requires requests to describe items with reasonable particularity. The rule does not create routine direct access to an opponent's systems. A request for raw JSON, native audit records, and the data dictionary may be more useful and less intrusive than asking to inspect a production database.",{"type":25,"tag":54,"props":258,"children":260},{"id":259},"hypothetical-an-onchain-margin-transfer",[261],{"type":30,"value":262},"Hypothetical: an onchain margin transfer",{"type":25,"tag":26,"props":264,"children":265},{},[266],{"type":30,"value":267},"Assume, hypothetically, that a futures commission merchant accepts an eligible crypto asset as customer margin and records the movement on a public EVM network. A later dispute concerns whether the firm credited the correct account before liquidation.",{"type":25,"tag":26,"props":269,"children":270},{},[271],{"type":30,"value":272},"The transaction receipt can show that tokens moved from one address to another and that execution succeeded. It cannot, by itself, establish which customer account the destination represented in the firm's books. It also may not show when the firm's risk engine recognized the deposit, which price and haircut the firm applied, whether a confirmation threshold delayed credit, or who handled an exception.",{"type":25,"tag":26,"props":274,"children":275},{},[276],{"type":30,"value":277},"Counsel should preserve the public transaction immediately. The production request should then connect it to the firm's account ledger, address registry, margin calculation, confirmation policy, exception queue, and system timestamps. If the firm says its blockchain record is the regulatory record, questions 13 and 15 of the FAQ make its authenticity, reliability, and outage-production controls fair subjects for examination.",{"type":25,"tag":26,"props":279,"children":280},{},[281],{"type":30,"value":282},"This does not prove misconduct. A timing difference may follow a disclosed confirmation policy or another valid control. The point is narrower: the public transaction and the firm's legal or operational treatment of it are separate facts.",{"type":25,"tag":54,"props":284,"children":286},{"id":285},"what-the-new-faq-does-not-decide",[287],{"type":30,"value":288},"What the new FAQ does not decide",{"type":25,"tag":26,"props":290,"children":291},{},[292],{"type":30,"value":293},"The update does not turn every onchain record into a CFTC regulatory record. The underlying Commodity Exchange Act provision or regulation must first require the entity to keep the record.",{"type":25,"tag":26,"props":295,"children":296},{},[297],{"type":30,"value":298},"It does not make a blockchain entry self-authenticating in litigation, prove that a decoded explorer page is accurate, or establish who controlled an address. Those questions depend on the offered evidence, the governing evidentiary rules, and any supporting testimony.",{"type":25,"tag":26,"props":300,"children":301},{},[302],{"type":30,"value":303},"Staff said it would not object solely because a covered entity did not maintain an offchain duplicate. For a public and permissionless network, staff said the entity should establish systems and controls that enable retention and production during a disruption. An internal archival node, redundant provider, permissioned replica, export process, or another control might serve that purpose. The FAQ does not prescribe one architecture.",{"type":25,"tag":26,"props":305,"children":306},{},[307],{"type":30,"value":308},"Finally, the FAQ does not resolve state discovery rules, contractual record duties, or preservation obligations created by pending or anticipated litigation. Those questions need separate analysis in the governing forum.",{"type":25,"tag":54,"props":310,"children":312},{"id":311},"questions-for-the-records-witness",[313],{"type":30,"value":314},"Questions for the records witness",{"type":25,"tag":26,"props":316,"children":317},{},[318],{"type":30,"value":319},"A Rule 30(b)(6) notice, records-custodian deposition, or informal technical conference should test the path from the business event to the produced file.",{"type":25,"tag":26,"props":321,"children":322},{},[323],{"type":30,"value":324},"Ask which application created the record and which system is authoritative. Identify the network, node or provider, explorer, indexer, decoding source, and internal database involved. Determine how the entity maps an address to an account and how it records corrections without rewriting chain history.",{"type":25,"tag":26,"props":326,"children":327},{},[328],{"type":30,"value":329},"Then test production. What happens if the primary provider or explorer is unavailable? Can the entity reproduce the exact record and its metadata from another source? Which timestamps come from the blockchain, the provider, and the firm's own systems? Can the witness explain why those times differ?",{"type":25,"tag":26,"props":331,"children":332},{},[333,334,340,342,348],{"type":30,"value":64},{"type":25,"tag":38,"props":335,"children":337},{"href":336},"\u002Fservices#evidence-review",[338],{"type":30,"value":339},"technical evidence review service",{"type":30,"value":341}," examines those links instead of treating an explorer display as the final record. The same separation appears in ConsensusIntel's ",{"type":25,"tag":38,"props":343,"children":345},{"href":344},"\u002Fmethodology",[346],{"type":30,"value":347},"published methodology",{"type":30,"value":349},": source data, processing, and conclusions are documented independently.",{"type":25,"tag":54,"props":351,"children":353},{"id":352},"frequently-asked-questions",[354],{"type":30,"value":355},"Frequently Asked Questions",{"type":25,"tag":54,"props":357,"children":359},{"id":358},"q-did-the-cftc-authorize-blockchain-recordkeeping",[360],{"type":30,"value":361},"Q: Did the CFTC authorize blockchain recordkeeping?",{"type":25,"tag":26,"props":363,"children":364},{},[365,371],{"type":25,"tag":366,"props":367,"children":368},"strong",{},[369],{"type":30,"value":370},"A:",{"type":30,"value":372}," CFTC staff said it would not object to covered entities using blockchain technology to create and maintain records under Regulations 1.31 and 45.2 if they fully satisfy the existing requirements. The FAQ is a staff view, not a new Commission rule or a general safe harbor.",{"type":25,"tag":54,"props":374,"children":376},{"id":375},"q-must-a-regulated-firm-keep-an-offchain-copy",[377],{"type":30,"value":378},"Q: Must a regulated firm keep an offchain copy?",{"type":25,"tag":26,"props":380,"children":381},{},[382,386],{"type":25,"tag":366,"props":383,"children":384},{},[385],{"type":30,"value":370},{"type":30,"value":387}," The September 24 FAQ says staff would not object solely because a covered entity elected not to keep an offchain version. For a firm using a public and permissionless network, staff said the firm should establish systems and controls that permit retention and production during an outage or other disruption.",{"type":25,"tag":54,"props":389,"children":391},{"id":390},"q-is-a-block-explorer-page-enough-for-discovery",[392],{"type":30,"value":393},"Q: Is a block explorer page enough for discovery?",{"type":25,"tag":26,"props":395,"children":396},{},[397,401],{"type":25,"tag":366,"props":398,"children":399},{},[400],{"type":30,"value":370},{"type":30,"value":402}," Usually not if the dispute concerns account ownership, authorization, valuation, margin treatment, or the firm's internal response. The explorer may show public transaction data. It may omit the internal records that connect the transaction to the business event.",{"type":25,"tag":54,"props":404,"children":406},{"id":405},"q-does-an-onchain-record-prove-who-authorized-a-transfer",[407],{"type":30,"value":408},"Q: Does an onchain record prove who authorized a transfer?",{"type":25,"tag":26,"props":410,"children":411},{},[412,416],{"type":25,"tag":366,"props":413,"children":414},{},[415],{"type":30,"value":370},{"type":30,"value":417}," No. It may identify the submitting address or transaction signer at the protocol level. Attribution to a person, customer, employee, or automated process usually requires account records, access logs, key-management evidence, testimony, or other offchain proof.",{"type":25,"tag":26,"props":419,"children":420},{},[421,423,429],{"type":30,"value":422},"If a production stops at an explorer screenshot, the missing question is simple: what records did the firm use to understand and act on that transaction? ",{"type":25,"tag":38,"props":424,"children":426},{"href":425},"\u002Fcontact",[427],{"type":30,"value":428},"Contact ConsensusIntel",{"type":30,"value":430}," to assess the onchain record, the surrounding systems, and the limits of the resulting evidence.",{"title":7,"searchDepth":432,"depth":432,"links":433},2,[434,436,437,438,439,440,441,442,443,444,445,446],{"id":56,"depth":435,"text":59},3,{"id":96,"depth":435,"text":99},{"id":141,"depth":435,"text":144},{"id":184,"depth":435,"text":187},{"id":259,"depth":435,"text":262},{"id":285,"depth":435,"text":288},{"id":311,"depth":435,"text":314},{"id":352,"depth":435,"text":355},{"id":358,"depth":435,"text":361},{"id":375,"depth":435,"text":378},{"id":390,"depth":435,"text":393},{"id":405,"depth":435,"text":408},"markdown","content:articles:41-cftc-blockchain-regulatory-records.md","content","articles\u002F41-cftc-blockchain-regulatory-records.md","articles\u002F41-cftc-blockchain-regulatory-records","md",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"slug":10,"date":11,"lastUpdated":11,"author":12,"readingTime":13,"category":14,"tags":454,"ogImage":20,"featured":6,"body":455,"_type":447,"_id":448,"_source":449,"_file":450,"_stem":451,"_extension":452},[16,17,18,19],{"type":22,"children":456,"toc":758},[457,461,471,475,479,489,493,497,501,505,509,518,522,526,535,539,543,547,551,561,570,574,578,582,586,613,617,627,631,635,639,643,647,651,655,659,663,667,671,675,679,683,697,701,705,713,717,725,729,737,741,749],{"type":25,"tag":26,"props":458,"children":459},{},[460],{"type":30,"value":31},{"type":25,"tag":26,"props":462,"children":463},{},[464,465,470],{"type":30,"value":36},{"type":25,"tag":38,"props":466,"children":468},{"href":40,"rel":467},[42],[469],{"type":30,"value":45},{"type":30,"value":47},{"type":25,"tag":26,"props":472,"children":473},{},[474],{"type":30,"value":52},{"type":25,"tag":54,"props":476,"children":477},{"id":56},[478],{"type":30,"value":59},{"type":25,"tag":26,"props":480,"children":481},{},[482,483,488],{"type":30,"value":64},{"type":25,"tag":38,"props":484,"children":486},{"href":67,"rel":485},[42],[487],{"type":30,"value":71},{"type":30,"value":73},{"type":25,"tag":26,"props":490,"children":491},{},[492],{"type":30,"value":78},{"type":25,"tag":26,"props":494,"children":495},{},[496],{"type":30,"value":83},{"type":25,"tag":26,"props":498,"children":499},{},[500],{"type":30,"value":88},{"type":25,"tag":26,"props":502,"children":503},{},[504],{"type":30,"value":93},{"type":25,"tag":54,"props":506,"children":507},{"id":96},[508],{"type":30,"value":99},{"type":25,"tag":26,"props":510,"children":511},{},[512,517],{"type":25,"tag":38,"props":513,"children":515},{"href":105,"rel":514},[42],[516],{"type":30,"value":109},{"type":30,"value":111},{"type":25,"tag":26,"props":519,"children":520},{},[521],{"type":30,"value":116},{"type":25,"tag":26,"props":523,"children":524},{},[525],{"type":30,"value":121},{"type":25,"tag":26,"props":527,"children":528},{},[529,534],{"type":25,"tag":38,"props":530,"children":532},{"href":127,"rel":531},[42],[533],{"type":30,"value":131},{"type":30,"value":133},{"type":25,"tag":26,"props":536,"children":537},{},[538],{"type":30,"value":138},{"type":25,"tag":54,"props":540,"children":541},{"id":141},[542],{"type":30,"value":144},{"type":25,"tag":26,"props":544,"children":545},{},[546],{"type":30,"value":149},{"type":25,"tag":26,"props":548,"children":549},{},[550],{"type":30,"value":154},{"type":25,"tag":26,"props":552,"children":553},{},[554,555,560],{"type":30,"value":159},{"type":25,"tag":38,"props":556,"children":558},{"href":162,"rel":557},[42],[559],{"type":30,"value":166},{"type":30,"value":168},{"type":25,"tag":26,"props":562,"children":563},{},[564,565,569],{"type":30,"value":173},{"type":25,"tag":38,"props":566,"children":567},{"href":176},[568],{"type":30,"value":179},{"type":30,"value":181},{"type":25,"tag":54,"props":571,"children":572},{"id":184},[573],{"type":30,"value":187},{"type":25,"tag":26,"props":575,"children":576},{},[577],{"type":30,"value":192},{"type":25,"tag":26,"props":579,"children":580},{},[581],{"type":30,"value":197},{"type":25,"tag":26,"props":583,"children":584},{},[585],{"type":30,"value":202},{"type":25,"tag":204,"props":587,"children":588},{},[589,593,597,601,605,609],{"type":25,"tag":208,"props":590,"children":591},{},[592],{"type":30,"value":212},{"type":25,"tag":208,"props":594,"children":595},{},[596],{"type":30,"value":217},{"type":25,"tag":208,"props":598,"children":599},{},[600],{"type":30,"value":222},{"type":25,"tag":208,"props":602,"children":603},{},[604],{"type":30,"value":227},{"type":25,"tag":208,"props":606,"children":607},{},[608],{"type":30,"value":232},{"type":25,"tag":208,"props":610,"children":611},{},[612],{"type":30,"value":237},{"type":25,"tag":26,"props":614,"children":615},{},[616],{"type":30,"value":242},{"type":25,"tag":26,"props":618,"children":619},{},[620,621,626],{"type":30,"value":247},{"type":25,"tag":38,"props":622,"children":624},{"href":250,"rel":623},[42],[625],{"type":30,"value":254},{"type":30,"value":256},{"type":25,"tag":54,"props":628,"children":629},{"id":259},[630],{"type":30,"value":262},{"type":25,"tag":26,"props":632,"children":633},{},[634],{"type":30,"value":267},{"type":25,"tag":26,"props":636,"children":637},{},[638],{"type":30,"value":272},{"type":25,"tag":26,"props":640,"children":641},{},[642],{"type":30,"value":277},{"type":25,"tag":26,"props":644,"children":645},{},[646],{"type":30,"value":282},{"type":25,"tag":54,"props":648,"children":649},{"id":285},[650],{"type":30,"value":288},{"type":25,"tag":26,"props":652,"children":653},{},[654],{"type":30,"value":293},{"type":25,"tag":26,"props":656,"children":657},{},[658],{"type":30,"value":298},{"type":25,"tag":26,"props":660,"children":661},{},[662],{"type":30,"value":303},{"type":25,"tag":26,"props":664,"children":665},{},[666],{"type":30,"value":308},{"type":25,"tag":54,"props":668,"children":669},{"id":311},[670],{"type":30,"value":314},{"type":25,"tag":26,"props":672,"children":673},{},[674],{"type":30,"value":319},{"type":25,"tag":26,"props":676,"children":677},{},[678],{"type":30,"value":324},{"type":25,"tag":26,"props":680,"children":681},{},[682],{"type":30,"value":329},{"type":25,"tag":26,"props":684,"children":685},{},[686,687,691,692,696],{"type":30,"value":64},{"type":25,"tag":38,"props":688,"children":689},{"href":336},[690],{"type":30,"value":339},{"type":30,"value":341},{"type":25,"tag":38,"props":693,"children":694},{"href":344},[695],{"type":30,"value":347},{"type":30,"value":349},{"type":25,"tag":54,"props":698,"children":699},{"id":352},[700],{"type":30,"value":355},{"type":25,"tag":54,"props":702,"children":703},{"id":358},[704],{"type":30,"value":361},{"type":25,"tag":26,"props":706,"children":707},{},[708,712],{"type":25,"tag":366,"props":709,"children":710},{},[711],{"type":30,"value":370},{"type":30,"value":372},{"type":25,"tag":54,"props":714,"children":715},{"id":375},[716],{"type":30,"value":378},{"type":25,"tag":26,"props":718,"children":719},{},[720,724],{"type":25,"tag":366,"props":721,"children":722},{},[723],{"type":30,"value":370},{"type":30,"value":387},{"type":25,"tag":54,"props":726,"children":727},{"id":390},[728],{"type":30,"value":393},{"type":25,"tag":26,"props":730,"children":731},{},[732,736],{"type":25,"tag":366,"props":733,"children":734},{},[735],{"type":30,"value":370},{"type":30,"value":402},{"type":25,"tag":54,"props":738,"children":739},{"id":405},[740],{"type":30,"value":408},{"type":25,"tag":26,"props":742,"children":743},{},[744,748],{"type":25,"tag":366,"props":745,"children":746},{},[747],{"type":30,"value":370},{"type":30,"value":417},{"type":25,"tag":26,"props":750,"children":751},{},[752,753,757],{"type":30,"value":422},{"type":25,"tag":38,"props":754,"children":755},{"href":425},[756],{"type":30,"value":428},{"type":30,"value":430},{"title":7,"searchDepth":432,"depth":432,"links":759},[760,761,762,763,764,765,766,767,768,769,770,771],{"id":56,"depth":435,"text":59},{"id":96,"depth":435,"text":99},{"id":141,"depth":435,"text":144},{"id":184,"depth":435,"text":187},{"id":259,"depth":435,"text":262},{"id":285,"depth":435,"text":288},{"id":311,"depth":435,"text":314},{"id":352,"depth":435,"text":355},{"id":358,"depth":435,"text":361},{"id":375,"depth":435,"text":378},{"id":390,"depth":435,"text":393},{"id":405,"depth":435,"text":408},[773,1217,1639],{"_path":774,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":775,"description":776,"slug":777,"date":778,"lastUpdated":778,"author":12,"readingTime":13,"category":14,"tags":779,"ogImage":784,"featured":6,"body":785,"_type":447,"_id":1214,"_source":449,"_file":1215,"_stem":1216,"_extension":452},"\u002Farticles\u002F21-telegram-evidence-crypto-cases-authentication","Telegram evidence in crypto cases: beyond the screenshot","How attorneys can preserve, authenticate, and test Telegram messages that link users, wallet addresses, and cryptocurrency transactions in litigation.","telegram-evidence-crypto-cases-authentication","2026-09-23",[780,781,782,783],"telegram-evidence","digital-evidence","authentication","blockchain-tracing","\u002Fog\u002Ftelegram-evidence-crypto-cases-authentication.png",{"type":22,"children":786,"toc":1201},[787,792,797,811,816,821,827,832,837,851,856,861,866,872,884,889,903,908,913,918,923,929,934,939,950,988,993,1007,1021,1027,1032,1037,1042,1047,1056,1062,1067,1072,1077,1082,1100,1106,1111,1116,1121,1126,1130,1136,1145,1151,1160,1166,1175,1181,1190],{"type":25,"tag":26,"props":788,"children":789},{},[790],{"type":30,"value":791},"A Telegram screenshot shows what appeared on a screen. It does not necessarily show who controlled the account, who wrote the message, whether surrounding messages were omitted, or whether the author controlled a wallet address pasted into the chat.",{"type":25,"tag":26,"props":793,"children":794},{},[795],{"type":30,"value":796},"Those distinctions matter in cryptocurrency cases because the message may supply the off-chain link that the public ledger cannot. A transaction can establish that assets moved to an address. A Telegram post can place that address in a conversation. Neither record alone proves that a named person authored the post or controlled the destination.",{"type":25,"tag":26,"props":798,"children":799},{},[800,802,809],{"type":30,"value":801},"A recent federal action puts the problem in practical terms. In a ",{"type":25,"tag":38,"props":803,"children":806},{"href":804,"rel":805},"https:\u002F\u002Fwww.justice.gov\u002Fusao-dc\u002Fpr\u002Fscam-center-strike-force-conducts-seizures-chinese-run-illicit-scammer-marketplace-and",[42],[807],{"type":30,"value":808},"September 9, 2026 announcement",{"type":30,"value":810},", the Justice Department described Xinbi Guarantee as an alleged Chinese-language marketplace operated on Telegram. DOJ said vendors advertised services in the channel, posted cryptocurrency wallets for payment, and received victim funds traced to specific vendors. The U.S. District Court for the District of Columbia authorized seizure of the Telegram channels on September 7, according to the announcement.",{"type":25,"tag":26,"props":812,"children":813},{},[814],{"type":30,"value":815},"That is an allegation and an account of court-authorized investigative action. It is not a verdict, a forfeiture judgment, or a finding that every channel participant committed a crime. For private counsel, it is useful for a narrower reason: it shows how a messaging record and a blockchain path may depend on each other.",{"type":25,"tag":26,"props":817,"children":818},{},[819],{"type":30,"value":820},"This article applies the Federal Rules of Evidence. State evidence rules and the law governing subpoenas, privacy, and access can produce a different answer. Counsel should resolve those issues in the forum where the evidence will be used.",{"type":25,"tag":54,"props":822,"children":824},{"id":823},"separate-the-propositions-before-collecting-evidence",[825],{"type":30,"value":826},"Separate the propositions before collecting evidence",{"type":25,"tag":26,"props":828,"children":829},{},[830],{"type":30,"value":831},"A Telegram exhibit can be offered to prove several different facts. Each needs its own foundation.",{"type":25,"tag":26,"props":833,"children":834},{},[835],{"type":30,"value":836},"First is content: the exhibit accurately reflects the words, images, wallet address, date, and visible context that appeared in the application.",{"type":25,"tag":26,"props":838,"children":839},{},[840,842,849],{"type":30,"value":841},"Second is account identity: the message came from a particular Telegram account, group, or channel. A username or display name is not enough by itself. Telegram's ",{"type":25,"tag":38,"props":843,"children":846},{"href":844,"rel":845},"https:\u002F\u002Ftelegram.org\u002Fprivacy",[42],[847],{"type":30,"value":848},"privacy policy",{"type":30,"value":850}," says users provide a mobile number and basic account data, while the public screen name and username can differ from a person's real identity.",{"type":25,"tag":26,"props":852,"children":853},{},[854],{"type":30,"value":855},"Third is authorship or control: a person or organization operated the account or wrote the message at issue. Shared devices, channel administrators, bots, forwarded posts, and compromised accounts can break a simple account-to-person inference.",{"type":25,"tag":26,"props":857,"children":858},{},[859],{"type":30,"value":860},"Fourth is the blockchain connection: the address in the message matches the address used in the relevant transaction, and the asserted relationship to that address is supported by evidence. Exact text matching and a transaction hash can establish a ledger connection. They do not establish who held the private key, who owned the assets, or who later received value through an exchange account.",{"type":25,"tag":26,"props":862,"children":863},{},[864],{"type":30,"value":865},"A sound report states each proposition separately. It should not compress them into a conclusion such as \"the defendant's Telegram wallet.\"",{"type":25,"tag":54,"props":867,"children":869},{"id":868},"what-the-federal-rules-require",[870],{"type":30,"value":871},"What the federal rules require",{"type":25,"tag":26,"props":873,"children":874},{},[875,882],{"type":25,"tag":38,"props":876,"children":879},{"href":877,"rel":878},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocument\u002Ffederal-rules-of-evidence.pdf",[42],[880],{"type":30,"value":881},"Rule 901(a)",{"type":30,"value":883}," requires evidence sufficient to support a finding that an item is what its proponent claims. The same rule lists several possible routes, including testimony from a knowledgeable witness, distinctive characteristics considered with the circumstances, and evidence that a process or system produces an accurate result. No single route fits every Telegram collection.",{"type":25,"tag":26,"props":885,"children":886},{},[887],{"type":30,"value":888},"A participant who saw and sent the messages may authenticate a conversation through personal knowledge. A forensic examiner may explain how data was acquired from a device or export. Circumstantial evidence may include a stable account identifier, facts known to the alleged author, linked devices, replies from known participants, or records that connect the account to other conduct. The strength of that evidence goes to the particular claim being made.",{"type":25,"tag":26,"props":890,"children":891},{},[892,894,901],{"type":30,"value":893},"Rules 902(13) and 902(14) provide certification routes for records generated by an electronic process and data copied from an electronic device, storage medium, or file. The ",{"type":25,"tag":38,"props":895,"children":898},{"href":896,"rel":897},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffre\u002Frule_902",[42],[899],{"type":30,"value":900},"Rule 902 committee note",{"type":30,"value":902}," explains that copied electronic data is commonly identified with a hash value. A proper certification may remove the need for a foundation witness to authenticate the record or the copy.",{"type":25,"tag":26,"props":904,"children":905},{},[906],{"type":30,"value":907},"Certification has limits. It can support the integrity of the acquired file or the operation of the collection process. It does not prove that a named person typed a message, that the message is true, or that a wallet belonged to that person. Authentication also does not answer hearsay.",{"type":25,"tag":26,"props":909,"children":910},{},[911],{"type":30,"value":912},"Rule 801(d)(2) addresses statements offered against an opposing party. For statements allegedly made by an authorized speaker, agent, employee, or coconspirator, the rule says the statement itself does not establish the required authority, relationship, or conspiracy. Counsel still needs evidence connecting the declarant and the party.",{"type":25,"tag":26,"props":914,"children":915},{},[916],{"type":30,"value":917},"The original-writing rule does not create a blanket ban on screenshots. Rule 1001 treats an output readable by sight as an original of electronically stored information if it accurately reflects that information. Rule 1003 generally permits a duplicate unless authenticity is genuinely questioned or admission would be unfair. A screenshot may therefore be usable, but accuracy and scope remain factual questions. A cropped image with no collection history is much easier to challenge than a preserved export tied to a device and documented process.",{"type":25,"tag":26,"props":919,"children":920},{},[921],{"type":30,"value":922},"Context matters too. Under Rule 106, an adverse party may require related statements that fairness calls for considering at the same time, even over a hearsay objection. Collecting only the message that contains the wallet address can leave counsel unable to assess a correction, reply, forwarded-message marker, or explanation immediately beside it.",{"type":25,"tag":54,"props":924,"children":926},{"id":925},"preserve-the-account-and-device-before-building-the-trace",[927],{"type":30,"value":928},"Preserve the account and device before building the trace",{"type":25,"tag":26,"props":930,"children":931},{},[932],{"type":30,"value":933},"Telegram's architecture changes the preservation question. Its policy says cloud-chat messages and media are stored on its servers so users can reach them from multiple devices. Secret chats are different: Telegram says they are not available in the cloud and can be accessed only from the sending or receiving device.",{"type":25,"tag":26,"props":935,"children":936},{},[937],{"type":30,"value":938},"Deletion risk is also real. Telegram says either participant in a one-on-one chat can clear the entire chat history for both parties without a time limit. An account can also be deleted with its cloud data. Counsel should address lawful preservation promptly and should not assume that a public blockchain preserves the related conversation.",{"type":25,"tag":26,"props":940,"children":941},{},[942,948],{"type":25,"tag":38,"props":943,"children":945},{"href":944},"\u002Fresources\u002Fpreserving-crypto-native-esi",[946],{"type":30,"value":947},"Preserving crypto-native ESI",{"type":30,"value":949}," explains the broader hold and collection problem. For Telegram evidence, the practical collection package should usually include:",{"type":25,"tag":204,"props":951,"children":952},{},[953,958,963,968,973,978,983],{"type":25,"tag":208,"props":954,"children":955},{},[956],{"type":30,"value":957},"the original device or a qualified forensic acquisition when proportional and authorized;",{"type":25,"tag":208,"props":959,"children":960},{},[961],{"type":30,"value":962},"a native chat or account export, including media, rather than screenshots alone;",{"type":25,"tag":208,"props":964,"children":965},{},[966],{"type":30,"value":967},"screenshots or video that document how the relevant conversation appeared in the application;",{"type":25,"tag":208,"props":969,"children":970},{},[971],{"type":30,"value":972},"the visible account, group, or channel identifiers and the participants or administrators available to the collector;",{"type":25,"tag":208,"props":974,"children":975},{},[976],{"type":30,"value":977},"messages before and after the cited passage, with reply, edit, and forwarding indicators preserved where available;",{"type":25,"tag":208,"props":979,"children":980},{},[981],{"type":30,"value":982},"collection date and time, displayed time zone, device clock, operating system, Telegram version, export settings, and collector identity; and",{"type":25,"tag":208,"props":984,"children":985},{},[986],{"type":30,"value":987},"cryptographic hashes for exported files, followed by preservation of the untouched originals.",{"type":25,"tag":26,"props":989,"children":990},{},[991],{"type":30,"value":992},"These are collection recommendations, not elements imposed in every case. Scope should follow relevance, proportionality, privilege, privacy, and the governing discovery order.",{"type":25,"tag":26,"props":994,"children":995},{},[996,998,1005],{"type":30,"value":997},"Telegram's ",{"type":25,"tag":38,"props":999,"children":1002},{"href":1000,"rel":1001},"https:\u002F\u002Ftelegram.org\u002Fblog\u002Fexport-and-more",[42],[1003],{"type":30,"value":1004},"desktop export documentation",{"type":30,"value":1006}," says a user can export some or all chats, including media, in JSON or HTML. An HTML export is useful for review. JSON may preserve structure that a rendered page hides. Neither format should be treated as self-proving. Record who initiated the export, from which account and device, what options were selected, and whether any filters or date ranges were used.",{"type":25,"tag":26,"props":1008,"children":1009},{},[1010,1012,1019],{"type":30,"value":1011},"NIST's ",{"type":25,"tag":38,"props":1013,"children":1016},{"href":1014,"rel":1015},"https:\u002F\u002Fnvlpubs.nist.gov\u002Fnistpubs\u002FSpecialPublications\u002FNIST.SP.800-101r1.pdf",[42],[1017],{"type":30,"value":1018},"mobile device forensics guidance",{"type":30,"value":1020}," distinguishes manual extraction from logical and physical acquisition. It warns that manual examination can modify data and cannot recover deleted information. It also recommends integrity hashing of acquired evidence. The publication dates to 2014, so it is a source for collection principles, not current Telegram feature behavior.",{"type":25,"tag":54,"props":1022,"children":1024},{"id":1023},"worked-hypothetical-a-wallet-posted-in-a-fraud-channel",[1025],{"type":30,"value":1026},"Worked hypothetical: a wallet posted in a fraud channel",{"type":25,"tag":26,"props":1028,"children":1029},{},[1030],{"type":30,"value":1031},"Assume a plaintiff received a Telegram message directing payment to a USDT address. The plaintiff has a screenshot, an exchange withdrawal receipt, and a transaction hash showing the transfer to the same address. This is a hypothetical, not a client matter.",{"type":25,"tag":26,"props":1033,"children":1034},{},[1035],{"type":30,"value":1036},"The three records can establish a useful sequence. The screenshot can show that the address appeared in the conversation. The exchange record can show that the plaintiff instructed a withdrawal. The blockchain record can show that the transaction reached the matching address.",{"type":25,"tag":26,"props":1038,"children":1039},{},[1040],{"type":30,"value":1041},"The sequence still does not prove who authored the message or controlled the address. Counsel should look for independent links: a native export from the plaintiff's account, testimony from the participant who received the message, account identifiers preserved from the application, device records from the alleged author if obtainable, provider or exchange records produced through lawful process, and later communications showing knowledge of transaction details not visible to the public.",{"type":25,"tag":26,"props":1043,"children":1044},{},[1045],{"type":30,"value":1046},"If funds later enter a custodial exchange, the public chain may show only a transfer to an address associated with that service. Customer attribution then depends on the exchange's internal records. If the wallet is self-custodied, a signed message or device evidence may support control, but the requested proof must be designed so it does not expose a seed phrase or private key.",{"type":25,"tag":26,"props":1048,"children":1049},{},[1050,1054],{"type":25,"tag":38,"props":1051,"children":1052},{"href":176},[1053],{"type":30,"value":179},{"type":30,"value":1055}," should accompany the messaging collection. Preserve the full address, network, asset, transaction hash, block reference, raw transaction data, query source, query time, and any third-party attribution. A Telegram message and a transaction table should be cross-referenced, not merged into a single unsupported ownership label.",{"type":25,"tag":54,"props":1057,"children":1059},{"id":1058},"how-to-test-the-opposing-partys-exhibit",[1060],{"type":30,"value":1061},"How to test the opposing party's exhibit",{"type":25,"tag":26,"props":1063,"children":1064},{},[1065],{"type":30,"value":1066},"Start with the claim. Is the exhibit offered to prove that a message existed, that a person authored it, that its contents were true, or that the person controlled a wallet? The necessary proof changes with the answer.",{"type":25,"tag":26,"props":1068,"children":1069},{},[1070],{"type":30,"value":1071},"Then request the material behind the image. Ask for the uncropped file, native export, original device or forensic report, collection notes, hashes, account and channel identifiers, surrounding messages, attachments, and any certification. Identify search terms, date filters, excluded chats, translation steps, and time-zone conversions.",{"type":25,"tag":26,"props":1073,"children":1074},{},[1075],{"type":30,"value":1076},"Check for application-specific context. A forwarded message does not show that the forwarding account wrote the original. A channel post may have more than one administrator. A public username may be changed or imitated. A wallet address can be copied by anyone. These facts do not make the exhibit false, but they narrow the inferences it can support.",{"type":25,"tag":26,"props":1078,"children":1079},{},[1080],{"type":30,"value":1081},"For a non-English conversation, preserve the original text and identify who translated it, the method used, and any disputed slang or technical terms. The Xinbi announcement describes a channel operated primarily in Chinese. Translation can affect the meaning of service descriptions, payment instructions, and speaker identity. A translated exhibit should remain traceable to the source message.",{"type":25,"tag":26,"props":1083,"children":1084},{},[1085,1087,1092,1094,1098],{"type":30,"value":1086},"Finally, compare the address character by character and verify it on the correct network. Similar-looking addresses, address poisoning, tokens with the same symbol on different networks, and omitted memo fields can produce a false match. The ",{"type":25,"tag":38,"props":1088,"children":1089},{"href":336},[1090],{"type":30,"value":1091},"evidence review service",{"type":30,"value":1093}," is structured around testing the collection, attribution, and transaction analysis as separate workstreams. The ",{"type":25,"tag":38,"props":1095,"children":1096},{"href":344},[1097],{"type":30,"value":347},{"type":30,"value":1099}," explains how source records and analyst conclusions are documented.",{"type":25,"tag":54,"props":1101,"children":1103},{"id":1102},"what-a-defensible-exhibit-package-looks-like",[1104],{"type":30,"value":1105},"What a defensible exhibit package looks like",{"type":25,"tag":26,"props":1107,"children":1108},{},[1109],{"type":30,"value":1110},"A useful production keeps the source and the courtroom view together. Preserve the native export or forensic image as the source. Create a review copy that counsel can search. Prepare the proposed exhibit from that source, and maintain a manifest linking the exhibit pages to the underlying files and hashes.",{"type":25,"tag":26,"props":1112,"children":1113},{},[1114],{"type":30,"value":1115},"The authentication declaration or testimony should identify the collector, device or account, acquisition method, dates, settings, output files, and integrity checks. Any Rule 902 certification should track the process actually used rather than reciting the rule in general terms.",{"type":25,"tag":26,"props":1117,"children":1118},{},[1119],{"type":30,"value":1120},"The expert analysis should then separate observable facts from opinions. Observable facts may include the displayed account identifier, exact wallet string, message timestamp as rendered, transaction hash, and block data. Opinions may address whether the records are consistent with common control, whether an address attribution is reliable, or whether omitted context changes the analysis. State the assumptions and competing explanations.",{"type":25,"tag":26,"props":1122,"children":1123},{},[1124],{"type":30,"value":1125},"This structure does not guarantee admission. It gives counsel and the court a record that can be tested.",{"type":25,"tag":54,"props":1127,"children":1128},{"id":352},[1129],{"type":30,"value":355},{"type":25,"tag":54,"props":1131,"children":1133},{"id":1132},"q-is-a-telegram-screenshot-admissible-in-federal-court",[1134],{"type":30,"value":1135},"Q: Is a Telegram screenshot admissible in federal court?",{"type":25,"tag":26,"props":1137,"children":1138},{},[1139,1143],{"type":25,"tag":366,"props":1140,"children":1141},{},[1142],{"type":30,"value":370},{"type":30,"value":1144}," It can be. The proponent still must authenticate it for the purpose offered, address hearsay if the message is offered for its truth, and show that the image accurately reflects the relevant content. A screenshot is weaker when it is cropped, lacks context, or has no documented source.",{"type":25,"tag":54,"props":1146,"children":1148},{"id":1147},"q-does-posting-a-wallet-address-prove-the-poster-controls-it",[1149],{"type":30,"value":1150},"Q: Does posting a wallet address prove the poster controls it?",{"type":25,"tag":26,"props":1152,"children":1153},{},[1154,1158],{"type":25,"tag":366,"props":1155,"children":1156},{},[1157],{"type":30,"value":370},{"type":30,"value":1159}," No. The post proves, at most, that the address appeared in the message if the exhibit is authentic. Control needs separate evidence, such as device artifacts, a valid signed message, exchange records, or conduct tied to the address.",{"type":25,"tag":54,"props":1161,"children":1163},{"id":1162},"q-does-a-rule-902-certification-prove-who-wrote-the-message",[1164],{"type":30,"value":1165},"Q: Does a Rule 902 certification prove who wrote the message?",{"type":25,"tag":26,"props":1167,"children":1168},{},[1169,1173],{"type":25,"tag":366,"props":1170,"children":1171},{},[1172],{"type":30,"value":370},{"type":30,"value":1174}," No. Rules 902(13) and 902(14) can authenticate an electronic process or a copied data set through certification. They do not establish authorship, truth, ownership, or wallet control.",{"type":25,"tag":54,"props":1176,"children":1178},{"id":1177},"q-what-should-counsel-preserve-first",[1179],{"type":30,"value":1180},"Q: What should counsel preserve first?",{"type":25,"tag":26,"props":1182,"children":1183},{},[1184,1188],{"type":25,"tag":366,"props":1185,"children":1186},{},[1187],{"type":30,"value":370},{"type":30,"value":1189}," Preserve the available device and account data through lawful means, then capture the full conversation and native export before messages or accounts disappear. Record the collection method and time, retain untouched source files, hash the exports, and keep the messaging evidence separate from the blockchain analysis.",{"type":25,"tag":26,"props":1191,"children":1192},{},[1193,1195,1199],{"type":30,"value":1194},"If a matter turns on a Telegram conversation and a wallet path, start with the evidence that can disappear. ",{"type":25,"tag":38,"props":1196,"children":1197},{"href":425},[1198],{"type":30,"value":428},{"type":30,"value":1200}," to scope preservation, authentication, or transaction analysis before the record is reduced to screenshots.",{"title":7,"searchDepth":432,"depth":432,"links":1202},[1203,1204,1205,1206,1207,1208,1209,1210,1211,1212,1213],{"id":823,"depth":435,"text":826},{"id":868,"depth":435,"text":871},{"id":925,"depth":435,"text":928},{"id":1023,"depth":435,"text":1026},{"id":1058,"depth":435,"text":1061},{"id":1102,"depth":435,"text":1105},{"id":352,"depth":435,"text":355},{"id":1132,"depth":435,"text":1135},{"id":1147,"depth":435,"text":1150},{"id":1162,"depth":435,"text":1165},{"id":1177,"depth":435,"text":1180},"content:articles:21-telegram-evidence-crypto-cases-authentication.md","articles\u002F21-telegram-evidence-crypto-cases-authentication.md","articles\u002F21-telegram-evidence-crypto-cases-authentication",{"_path":1218,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":1219,"description":1220,"slug":1221,"date":778,"lastUpdated":778,"author":12,"readingTime":1222,"category":14,"tags":1223,"ogImage":1228,"featured":6,"body":1229,"_type":447,"_id":1636,"_source":449,"_file":1637,"_stem":1638,"_extension":452},"\u002Farticles\u002Ftokenized-stock-ownership-evidence","Tokenized stock evidence: which record proves ownership?","How attorneys should separate blockchain transfers, master securityholder files, custody records, and synthetic exposure in tokenized stock disputes.","tokenized-stock-ownership-evidence",11,[1224,1225,1226,1227],"tokenized-securities","securities","custody","evidence","\u002Fog\u002Ftokenized-stock-ownership-evidence.png",{"type":22,"children":1230,"toc":1616},[1231,1236,1241,1248,1262,1267,1281,1286,1292,1306,1312,1317,1322,1328,1333,1338,1344,1349,1362,1368,1373,1378,1384,1397,1410,1415,1421,1426,1431,1436,1441,1446,1452,1457,1462,1486,1498,1504,1509,1514,1519,1525,1530,1535,1540,1544,1550,1559,1565,1574,1580,1589,1595,1604],{"type":25,"tag":26,"props":1232,"children":1233},{},[1234],{"type":30,"value":1235},"A wallet can display a token with the name and ticker of a public company's stock without making the wallet holder a registered shareholder. The token may be the stock itself, evidence of a security entitlement held through an intermediary, a record that prompts an offchain ownership update, or a separate security whose return tracks the stock. Each model creates a different evidentiary chain.",{"type":25,"tag":26,"props":1237,"children":1238},{},[1239],{"type":30,"value":1240},"For counsel, the first question is not whether a blockchain transfer occurred. It is what legal and operational record the transfer changed. The answer determines which records support ownership, which party must be examined or subpoenaed, and how narrowly an expert should state a conclusion.",{"type":25,"tag":1242,"props":1243,"children":1245},"h2",{"id":1244},"what-changed-in-september-2026",[1246],{"type":30,"value":1247},"What changed in September 2026?",{"type":25,"tag":26,"props":1249,"children":1250},{},[1251,1253,1260],{"type":30,"value":1252},"On September 17, 2026, the Securities and Exchange Commission issued an ",{"type":25,"tag":38,"props":1254,"children":1257},{"href":1255,"rel":1256},"https:\u002F\u002Fwww.sec.gov\u002Ffiles\u002Frules\u002Fexorders\u002F2026\u002F34-106402.pdf",[42],[1258],{"type":30,"value":1259},"order granting temporary conditional exemptive relief",{"type":30,"value":1261}," for certain Tokenized Securities Venues, or TSVs. A TSV that satisfies the order's conditions may operate a permissioned automated market maker for tokenized National Market System stock without being treated as an exchange under Section 3(a)(1) of the Securities Exchange Act of 1934. The order also provides narrower dealer relief for certain liquidity providers using proprietary capital.",{"type":25,"tag":26,"props":1263,"children":1264},{},[1265],{"type":30,"value":1266},"The exemptions took effect on September 17, 2026, and run through September 17, 2031, unless the Commission modifies them. They are not a general approval of tokenized stock. The order covers specified secondary trading under stated conditions, excludes primary issuance, and does not displace antifraud, antimanipulation, registration, sanctions, or other applicable law. A TSV relying on the order must be a U.S. person, but the property rights associated with a security can still depend on state law, governing documents, and the holding structure.",{"type":25,"tag":26,"props":1268,"children":1269},{},[1270,1272,1279],{"type":30,"value":1271},"A second development concerns the records behind the token. The SEC issued proposed transfer agent rules on September 1, 2026, and the proposal was ",{"type":25,"tag":38,"props":1273,"children":1276},{"href":1274,"rel":1275},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F09\u002F04\u002F2026-18190\u002Ftransfer-agent-rules",[42],[1277],{"type":30,"value":1278},"published in the Federal Register on September 4",{"type":30,"value":1280},". Comments are due November 3, 2026. This is a proposal, not a live obligation. Its discussion of existing market structure is still useful because it identifies the master securityholder file as the official list of registered owners and distinguishes registered ownership from beneficial ownership through an intermediary.",{"type":25,"tag":26,"props":1282,"children":1283},{},[1284],{"type":30,"value":1285},"Taken together, the September actions make one point hard to avoid: an onchain balance is part of the evidence, but the system's record hierarchy determines what that balance means.",{"type":25,"tag":1242,"props":1287,"children":1289},{"id":1288},"which-record-carries-the-ownership-fact",[1290],{"type":30,"value":1291},"Which record carries the ownership fact?",{"type":25,"tag":26,"props":1293,"children":1294},{},[1295,1297,1304],{"type":30,"value":1296},"The SEC staff's January 28, 2026 ",{"type":25,"tag":38,"props":1298,"children":1301},{"href":1299,"rel":1300},"https:\u002F\u002Fwww.sec.gov\u002Fnewsroom\u002Fspeeches-statements\u002Fcorp-fin-statement-tokenized-securities-012826-statement-tokenized-securities",[42],[1302],{"type":30,"value":1303},"Statement on Tokenized Securities",{"type":30,"value":1305}," describes several models. The statement is staff analysis, not a Commission rule, and it creates no new legal obligations. Its taxonomy is useful for classifying the instrument before drawing conclusions from blockchain data.",{"type":25,"tag":54,"props":1307,"children":1309},{"id":1308},"issuer-sponsored-tokenization-with-an-onchain-master-file",[1310],{"type":30,"value":1311},"Issuer-sponsored tokenization with an onchain master file",{"type":25,"tag":26,"props":1313,"children":1314},{},[1315],{"type":30,"value":1316},"An issuer or its transfer agent may integrate distributed ledger technology into the master securityholder file. In that model, a transfer of the crypto asset changes the ownership record. The onchain system may record the wallet address, quantity, and issue date while associated offchain records identify the securityholder by name and address.",{"type":25,"tag":26,"props":1318,"children":1319},{},[1320],{"type":30,"value":1321},"The blockchain record matters directly here, but a wallet address alone may still be incomplete. Counsel should obtain the issuer or transfer agent's wallet-to-holder mapping, the applicable governing documents, any restrictions on transfer, the complete transfer history, and records of corrections or administrative changes. A visible token balance supports a technical state at a point in time. Identifying the registered holder may require the linked offchain data.",{"type":25,"tag":54,"props":1323,"children":1325},{"id":1324},"issuer-sponsored-tokenization-with-an-offchain-master-file",[1326],{"type":30,"value":1327},"Issuer-sponsored tokenization with an offchain master file",{"type":25,"tag":26,"props":1329,"children":1330},{},[1331],{"type":30,"value":1332},"An issuer may instead maintain the authoritative ownership record offchain. The token does not itself convey the security's rights. A token transfer acts as notice or an instruction that causes the issuer or its agent to update the master securityholder file.",{"type":25,"tag":26,"props":1334,"children":1335},{},[1336],{"type":30,"value":1337},"This distinction can decide a dispute. A confirmed blockchain transaction may prove that the token moved, while the offchain file shows whether the requested ownership update was accepted, rejected, delayed, reversed, or posted to a different account. The two records should be reconciled rather than treated as duplicates.",{"type":25,"tag":54,"props":1339,"children":1341},{"id":1340},"third-party-custodial-tokenization",[1342],{"type":30,"value":1343},"Third-party custodial tokenization",{"type":25,"tag":26,"props":1345,"children":1346},{},[1347],{"type":30,"value":1348},"A third party may hold the underlying stock and issue a tokenized security entitlement. The token represents an indirect interest in stock held in custody, not direct registration on the issuer's books. The intermediary's entitlement records, custody account, reserve or reconciliation records, and customer agreement become central.",{"type":25,"tag":26,"props":1350,"children":1351},{},[1352,1354,1360],{"type":30,"value":1353},"The blockchain can show transfers of the tokenized entitlement. It does not, without the intermediary's records, establish that enough underlying shares were held, that the claimant was credited correctly, or that the holder could exercise voting, dividend, conversion, or withdrawal rights. Attorneys reviewing these arrangements may need ",{"type":25,"tag":38,"props":1355,"children":1357},{"href":1356},"\u002Fservices#exchange-custody",[1358],{"type":30,"value":1359},"exchange and custody analysis",{"type":30,"value":1361}," in addition to transaction tracing.",{"type":25,"tag":54,"props":1363,"children":1365},{"id":1364},"synthetic-exposure",[1366],{"type":30,"value":1367},"Synthetic exposure",{"type":25,"tag":26,"props":1369,"children":1370},{},[1371],{"type":30,"value":1372},"A third party may issue its own linked security or security-based swap whose value refers to another company's stock. The holder may have a claim against the third-party issuer without any ownership or entitlement in the referenced stock. The SEC's September 17 TSV order expressly excludes these synthetic instruments from its definition of Tokenized NMS Stock.",{"type":25,"tag":26,"props":1374,"children":1375},{},[1376],{"type":30,"value":1377},"A ticker, logo, or price link is therefore poor evidence of the instrument's legal character. Counsel should start with the offering documents, token terms, issuer identity, contract code, custody arrangement, and rights granted to the holder. If the instrument provides no rights against the referenced issuer, a report should not call the wallet holder a shareholder of that issuer.",{"type":25,"tag":1242,"props":1379,"children":1381},{"id":1380},"what-can-the-blockchain-establish",[1382],{"type":30,"value":1383},"What can the blockchain establish?",{"type":25,"tag":26,"props":1385,"children":1386},{},[1387,1389,1395],{"type":30,"value":1388},"A properly collected blockchain record can establish that a transaction was included in a particular block, which addresses and contracts participated, what state changes and event logs were recorded, and what the relevant contract reported as a balance. For EVM networks, the transaction receipt and execution trace may be needed because a transaction hash alone does not prove successful execution. ",{"type":25,"tag":38,"props":1390,"children":1392},{"href":1391},"\u002Fresources\u002Fevm-receipts-logs-execution-traces",[1393],{"type":30,"value":1394},"Receipts, logs, and EVM traces",{"type":30,"value":1396}," explains that distinction.",{"type":25,"tag":26,"props":1398,"children":1399},{},[1400,1402,1408],{"type":30,"value":1401},"Those facts do not automatically identify a human or company behind a wallet. They also do not resolve whether a transfer was authorized under governing documents, whether an offchain record was updated, whether the issuer recognizes the holder, or whether a custodian maintained the promised underlying position. Control of a signing key is evidence of technical power. It is not a substitute for the ownership and priority analysis discussed in ",{"type":25,"tag":38,"props":1403,"children":1405},{"href":1404},"\u002Fresources\u002Fucc-article-12-digital-asset-control",[1406],{"type":30,"value":1407},"UCC Article 12 and digital asset control",{"type":30,"value":1409},".",{"type":25,"tag":26,"props":1411,"children":1412},{},[1413],{"type":30,"value":1414},"Technical collection should include the network, complete token contract address, transaction hash, block number, block timestamp, receipt status, relevant logs, pre-transfer and post-transfer balances, and contract code or verified source used in the analysis. If the contract is upgradeable, preserve the implementation address, proxy state, administrator, and upgrade history. These are evidence recommendations, not requirements imposed on every litigant by the SEC order.",{"type":25,"tag":1242,"props":1416,"children":1418},{"id":1417},"what-evidence-will-a-tsv-create",[1419],{"type":30,"value":1420},"What evidence will a TSV create?",{"type":25,"tag":26,"props":1422,"children":1423},{},[1424],{"type":30,"value":1425},"The September 17 order requires a TSV to publish a detailed notice at least 30 calendar days before operating under the exemption. The notice must describe the venue's ownership and governance, eligible participants, permissioning criteria, tokenization process, treatment of issuer-sponsored and third-party tokens, smart contract addresses, upgrade authority, trading procedures, fees, settlement arrangements, service providers, systems safeguards, known risks, and complaint procedures. Revised versions must remain available on the venue's website.",{"type":25,"tag":26,"props":1427,"children":1428},{},[1429],{"type":30,"value":1430},"For each Tokenized NMS Stock, the notice must describe the TSV's procedures for evaluating its legal status, technical soundness, and operational integrity. It must also describe the steps used to verify that holders receive the same rights and privileges as holders of the equivalent traditional NMS stock. For stock tokenized by an unaffiliated third party, the issuer may object within 30 calendar days after receiving the required notice to that token being made available for trading on the TSV. A timely objection prevents the TSV from making that token available under the exemption.",{"type":25,"tag":26,"props":1432,"children":1433},{},[1434],{"type":30,"value":1435},"The order also requires transaction data for the prior 30 days to be freely available in a machine-readable format and updated within ten minutes of a transaction. The data must include the asset symbols, U.S. dollar price, size, transaction time, and direction. The venue must also identify the liquidity pool and smart contract address and publish specified pool volume and size data.",{"type":25,"tag":26,"props":1437,"children":1438},{},[1439],{"type":30,"value":1440},"The public feed is not the complete evidentiary record. A TSV must keep current records of trading interest, executions, cancellations, modifications, participant screening, wallet verification, fees, trading stoppages, volume calculations, operational events, and notices. It must preserve those records while the exemption is effective and for three years afterward. Distributed ledger records can satisfy the condition only if the Commission can readily access them in both human-readable and reasonably usable electronic formats.",{"type":25,"tag":26,"props":1442,"children":1443},{},[1444],{"type":30,"value":1445},"These duties apply to a TSV relying on this order. They should not be attributed to every token issuer, exchange, broker, transfer agent, or blockchain application. The order also says the TSV is not registered with the Commission for the exempt activity and is not subject to Regulation NMS for that activity. Counsel should identify the entity, activity, and source of each duty before treating the order as a discovery checklist.",{"type":25,"tag":1242,"props":1447,"children":1449},{"id":1448},"what-should-counsel-preserve-and-request",[1450],{"type":30,"value":1451},"What should counsel preserve and request?",{"type":25,"tag":26,"props":1453,"children":1454},{},[1455],{"type":30,"value":1456},"Start by classifying the instrument. Obtain the token terms, offering documents, issuer and intermediary agreements, contract address, network, and any conversion or redemption terms. Determine whether the token represents registered stock, a security entitlement, an offchain instruction, or synthetic exposure.",{"type":25,"tag":26,"props":1458,"children":1459},{},[1460],{"type":30,"value":1461},"Then identify the authoritative record and the party that maintains it:",{"type":25,"tag":1463,"props":1464,"children":1465},"ol",{},[1466,1471,1476,1481],{"type":25,"tag":208,"props":1467,"children":1468},{},[1469],{"type":30,"value":1470},"For issuer-sponsored stock, request the master securityholder file, transfer journal, wallet mapping, rejected transfer records, correction history, and relevant governing documents.",{"type":25,"tag":208,"props":1472,"children":1473},{},[1474],{"type":30,"value":1475},"For a custodial entitlement, request the intermediary's entitlement ledger, customer account records, underlying custody statements, position reconciliations, corporate action allocations, and records of any shortfall or freeze.",{"type":25,"tag":208,"props":1477,"children":1478},{},[1479],{"type":30,"value":1480},"For a TSV trade, preserve every version of the public notice, public transaction data, smart contract code, wallet permissioning records, order or trading interest data, execution records, fee records, and stoppage or incident notices.",{"type":25,"tag":208,"props":1482,"children":1483},{},[1484],{"type":30,"value":1485},"For a synthetic instrument, request the issuing party's obligation, collateral terms, valuation method, hedging or reference-price records, and communications describing the holder's rights.",{"type":25,"tag":26,"props":1487,"children":1488},{},[1489,1491,1496],{"type":30,"value":1490},"Requests should preserve native fields and system identifiers, not just PDF statements or explorer screenshots. The issuer, transfer agent, intermediary, custodian, and venue may each use a different account identifier for the same person or position. A useful production includes the mapping among those identifiers and the timestamp, timezone, source system, and change history for each record. This follows ConsensusIntel's ",{"type":25,"tag":38,"props":1492,"children":1493},{"href":344},[1494],{"type":30,"value":1495},"reproducible forensic methodology",{"type":30,"value":1497},", which separates source data, processing, and conclusion.",{"type":25,"tag":1242,"props":1499,"children":1501},{"id":1500},"how-does-the-record-hierarchy-work-in-practice",[1502],{"type":30,"value":1503},"How does the record hierarchy work in practice?",{"type":25,"tag":26,"props":1505,"children":1506},{},[1507],{"type":30,"value":1508},"Hypothetical example: A client controls a wallet showing 500 tokens labeled as shares of Public Company A. The blockchain records a successful transfer to the client's allowlisted address. A dispute later arises over whether the client owned 500 shares on the transfer date.",{"type":25,"tag":26,"props":1510,"children":1511},{},[1512],{"type":30,"value":1513},"If Company A's transfer agent used the blockchain as part of its master securityholder file, the onchain transfer and the linked holder record may support registered ownership. If the master file remained offchain, counsel must determine whether the transfer agent posted the ownership change after receiving the onchain instruction. If an unaffiliated custodian issued a tokenized security entitlement, the client may hold an indirect interest that depends on the intermediary's books and custody position. If the token was a linked security, the client may have only a contractual claim against its issuer.",{"type":25,"tag":26,"props":1515,"children":1516},{},[1517],{"type":30,"value":1518},"The same wallet balance can therefore support four different conclusions. The expert should identify the model and state the evidence for it before using the word \"owner.\" If the necessary issuer, intermediary, or custody records are missing, the report should say what the blockchain establishes and leave the ownership question unresolved.",{"type":25,"tag":1242,"props":1520,"children":1522},{"id":1521},"how-should-an-expert-frame-the-opinion",[1523],{"type":30,"value":1524},"How should an expert frame the opinion?",{"type":25,"tag":26,"props":1526,"children":1527},{},[1528],{"type":30,"value":1529},"A defensible report separates observation, attribution, record reconciliation, and legal assumption. It might state that the blockchain recorded 500 token units at a specified address at a specified block, that the venue associated the address with a named account, and that the transfer agent's produced file credited the same account with 500 shares. Each statement identifies its source.",{"type":25,"tag":26,"props":1531,"children":1532},{},[1533],{"type":30,"value":1534},"The report should also identify gaps. A wallet signature may support control of an address at a particular time, but not authority to act for a company. A token contract may report a balance, but not prove that a custodian held matching shares. A TSV notice may describe intended rights, but the actual agreement, transfer agent file, and custody records may be needed to test whether those rights existed and were performed.",{"type":25,"tag":26,"props":1536,"children":1537},{},[1538],{"type":30,"value":1539},"The September 2026 SEC materials supply a useful vocabulary and new records. They do not decide ownership in a private dispute. Federal securities law, state commercial and corporate law, contracts, issuer records, intermediary records, and the technical system may all bear on the answer. Counsel should define the jurisdiction and claim before asking an expert to bridge any missing layer.",{"type":25,"tag":1242,"props":1541,"children":1542},{"id":352},[1543],{"type":30,"value":355},{"type":25,"tag":54,"props":1545,"children":1547},{"id":1546},"q-does-a-tokenized-stock-balance-prove-that-the-wallet-holder-owns-shares",[1548],{"type":30,"value":1549},"Q: Does a tokenized stock balance prove that the wallet holder owns shares?",{"type":25,"tag":26,"props":1551,"children":1552},{},[1553,1557],{"type":25,"tag":366,"props":1554,"children":1555},{},[1556],{"type":30,"value":370},{"type":30,"value":1558}," Not by itself. The balance proves what the token contract recorded for an address. Ownership may depend on whether the blockchain is part of the master securityholder file, whether an offchain transfer was posted, whether the token represents a security entitlement, and what rights the governing documents grant.",{"type":25,"tag":54,"props":1560,"children":1562},{"id":1561},"q-is-a-tokenized-securities-venue-registered-as-an-sec-exchange",[1563],{"type":30,"value":1564},"Q: Is a Tokenized Securities Venue registered as an SEC exchange?",{"type":25,"tag":26,"props":1566,"children":1567},{},[1568,1572],{"type":25,"tag":366,"props":1569,"children":1570},{},[1571],{"type":30,"value":370},{"type":30,"value":1573}," No. A venue that satisfies the September 17, 2026 order may rely on temporary conditional relief from the Exchange Act definition of \"exchange\" for the covered activity. The order requires the venue to disclose that it is not registered with the Commission for that activity.",{"type":25,"tag":54,"props":1575,"children":1577},{"id":1576},"q-what-record-should-counsel-request-first",[1578],{"type":30,"value":1579},"Q: What record should counsel request first?",{"type":25,"tag":26,"props":1581,"children":1582},{},[1583,1587],{"type":25,"tag":366,"props":1584,"children":1585},{},[1586],{"type":30,"value":370},{"type":30,"value":1588}," Request the instrument terms and identify the authoritative ownership or entitlement record. For direct registered stock, that is generally the issuer's or transfer agent's master securityholder file. For an indirect interest, the intermediary's entitlement ledger and custody records may be more important than the public blockchain balance.",{"type":25,"tag":54,"props":1590,"children":1592},{"id":1591},"q-are-the-september-2026-transfer-agent-changes-already-binding",[1593],{"type":30,"value":1594},"Q: Are the September 2026 transfer agent changes already binding?",{"type":25,"tag":26,"props":1596,"children":1597},{},[1598,1602],{"type":25,"tag":366,"props":1599,"children":1600},{},[1601],{"type":30,"value":370},{"type":30,"value":1603}," No. The SEC's transfer agent release is a proposed rule, with comments due November 3, 2026. Existing law and rules remain in force unless and until the Commission adopts final changes. The separate TSV order became effective on September 17, 2026, subject to its conditions.",{"type":25,"tag":26,"props":1605,"children":1606},{},[1607,1609,1614],{"type":30,"value":1608},"A tokenized stock matter should begin with instrument classification and the record hierarchy, not a wallet screenshot. If a dispute turns on those records, ",{"type":25,"tag":38,"props":1610,"children":1611},{"href":425},[1612],{"type":30,"value":1613},"contact ConsensusIntel",{"type":30,"value":1615}," to scope a technical review alongside counsel's legal analysis.",{"title":7,"searchDepth":432,"depth":432,"links":1617},[1618,1619,1625,1626,1627,1628,1629,1630],{"id":1244,"depth":432,"text":1247},{"id":1288,"depth":432,"text":1291,"children":1620},[1621,1622,1623,1624],{"id":1308,"depth":435,"text":1311},{"id":1324,"depth":435,"text":1327},{"id":1340,"depth":435,"text":1343},{"id":1364,"depth":435,"text":1367},{"id":1380,"depth":432,"text":1383},{"id":1417,"depth":432,"text":1420},{"id":1448,"depth":432,"text":1451},{"id":1500,"depth":432,"text":1503},{"id":1521,"depth":432,"text":1524},{"id":352,"depth":432,"text":355,"children":1631},[1632,1633,1634,1635],{"id":1546,"depth":435,"text":1549},{"id":1561,"depth":435,"text":1564},{"id":1576,"depth":435,"text":1579},{"id":1591,"depth":435,"text":1594},"content:articles:tokenized-stock-ownership-evidence.md","articles\u002Ftokenized-stock-ownership-evidence.md","articles\u002Ftokenized-stock-ownership-evidence",{"_path":1640,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":1641,"description":1642,"slug":1643,"date":1644,"lastUpdated":1644,"author":12,"readingTime":1645,"category":14,"tags":1646,"ogImage":1649,"featured":6,"body":1650,"_type":447,"_id":2414,"_source":449,"_file":2415,"_stem":2416,"_extension":452},"\u002Farticles\u002F23-sanctions-blockchain-tracing-ofac-match-evidence","Sanctions and blockchain tracing: What an OFAC match proves","How attorneys should distinguish OFAC-listed addresses, vendor attributions, indirect transaction paths, ownership rules, and risk-score evidence.","sanctions-blockchain-tracing-ofac-match-evidence","2026-09-19",13,[1647,1648,783,1227],"ofac","sanctions","\u002Fog\u002Fsanctions-blockchain-tracing-ofac-match-evidence.png",{"type":22,"children":1651,"toc":2391},[1652,1657,1662,1668,1673,1696,1701,1715,1729,1735,1741,1755,1767,1781,1786,1792,1797,1810,1816,1839,1853,1858,1864,1869,1883,1896,1902,1907,1920,1926,1931,1974,1986,1999,2005,2010,2058,2071,2092,2098,2103,2108,2119,2125,2139,2144,2158,2171,2177,2182,2187,2192,2198,2301,2305,2311,2320,2326,2335,2341,2350,2356,2365,2371,2380],{"type":25,"tag":26,"props":1653,"children":1654},{},[1655],{"type":30,"value":1656},"A blockchain tracing report says a wallet is “connected to a sanctioned exchange.” That phrase may describe an exact address published by the U.S. Department of the Treasury's Office of Foreign Assets Control, a commercial attribution to a listed person, an indirect transaction path, or a vendor-generated risk score. Those findings are not interchangeable.",{"type":25,"tag":26,"props":1658,"children":1659},{},[1660],{"type":30,"value":1661},"A public blockchain can establish transactions between addresses. It does not, by itself, establish who controlled an address, who owned the property, what a party knew, which sanctions authority applied, or whether a transaction was prohibited. Counsel should begin with a narrower question: What exactly matched, on what date, under which authority, and based on what evidence?",{"type":25,"tag":1242,"props":1663,"children":1665},{"id":1664},"why-is-an-ofac-designation-not-a-tracing-conclusion",[1666],{"type":30,"value":1667},"Why is an OFAC designation not a tracing conclusion?",{"type":25,"tag":26,"props":1669,"children":1670},{},[1671],{"type":30,"value":1672},"OFAC administers sanctions programs under different statutes, executive orders, and regulations. The legal effect of a match depends on the governing program, the parties and property involved, jurisdiction, ownership, and timing. A blockchain trace may supply relevant facts, but it does not determine which legal rule applies.",{"type":25,"tag":26,"props":1674,"children":1675},{},[1676,1678,1685,1687,1694],{"type":30,"value":1677},"The September 17, 2026 BitBank action illustrates the distinction. OFAC added BitBank, its developer Pishtaz Simorgh Electronic Trade Company, and three individuals to the Specially Designated Nationals and Blocked Persons List. Treasury described BitBank as a digital asset venture controlled by OFAC-designated Iranian financier Babak Zanjani and stated that Zanjani used it to facilitate transfers of hundreds of millions of dollars' worth of Bitcoin to the Islamic Revolutionary Guard Corps. Those are Treasury's administrative findings and allegations, not judicial findings. (",{"type":25,"tag":38,"props":1679,"children":1682},{"href":1680,"rel":1681},"https:\u002F\u002Fhome.treasury.gov\u002Fnews\u002Fpress-releases\u002Fsb0632",[42],[1683],{"type":30,"value":1684},"Treasury release",{"type":30,"value":1686},"; ",{"type":25,"tag":38,"props":1688,"children":1691},{"href":1689,"rel":1690},"https:\u002F\u002Fofac.treasury.gov\u002Frecent-actions\u002F20260917",[42],[1692],{"type":30,"value":1693},"OFAC list update",{"type":30,"value":1695},")",{"type":25,"tag":26,"props":1697,"children":1698},{},[1699],{"type":30,"value":1700},"The public entries issued with that action did not publish a digital currency address for BitBank. A later provider label connecting an address to BitBank would therefore be a third-party attribution unless OFAC separately published the address. Calling it an “OFAC-listed address” would overstate the official record.",{"type":25,"tag":26,"props":1702,"children":1703},{},[1704,1706,1713],{"type":30,"value":1705},"The designation date also is not necessarily the first date on which restrictions applied. ",{"type":25,"tag":38,"props":1707,"children":1710},{"href":1708,"rel":1709},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F1250",[42],[1711],{"type":30,"value":1712},"OFAC FAQ 1250",{"type":30,"value":1714}," states that Iranian digital asset exchanges meet the regulatory definition of an Iranian financial institution and are blocked under Executive Order 13599 and the Iranian Transactions and Sanctions Regulations regardless of whether they appear by name on the SDN List. Property and interests in property of those exchanges within U.S. jurisdiction or the possession or control of a U.S. person are blocked and must be reported.",{"type":25,"tag":26,"props":1716,"children":1717},{},[1718,1720,1727],{"type":30,"value":1719},"The analysis for non-U.S. persons is different. ",{"type":25,"tag":38,"props":1721,"children":1724},{"href":1722,"rel":1723},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F1257",[42],[1725],{"type":30,"value":1726},"OFAC FAQ 1257",{"type":30,"value":1728}," identifies separate potential consequences: designation of a person that materially assists or supports a designated exchange; correspondent or payable-through account restrictions on a foreign financial institution that knowingly conducts or facilitates a significant financial transaction for the exchange; and statutory sanctions involving significant transactions with designated Iranian financial institutions. Those authorities address different actors, conduct, and consequences.",{"type":25,"tag":1242,"props":1730,"children":1732},{"id":1731},"what-are-the-five-findings-that-reports-often-collapse-into-one-match",[1733],{"type":30,"value":1734},"What are the five findings that reports often collapse into one match?",{"type":25,"tag":54,"props":1736,"children":1738},{"id":1737},"_1-an-exact-match-to-an-address-published-by-ofac",[1739],{"type":30,"value":1740},"1. An exact match to an address published by OFAC",{"type":25,"tag":26,"props":1742,"children":1743},{},[1744,1746,1753],{"type":30,"value":1745},"OFAC may add digital currency addresses to an SDN List entry as identifiers associated with a blocked person, although ",{"type":25,"tag":38,"props":1747,"children":1750},{"href":1748,"rel":1749},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F562",[42],[1751],{"type":30,"value":1752},"OFAC FAQ 562",{"type":30,"value":1754}," warns that published addresses are not likely to be exhaustive. The absence of an address from an entry does not prove that the listed person has no interest in it.",{"type":25,"tag":26,"props":1756,"children":1757},{},[1758,1765],{"type":25,"tag":38,"props":1759,"children":1762},{"href":1760,"rel":1761},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F594",[42],[1763],{"type":30,"value":1764},"OFAC FAQ 594",{"type":30,"value":1766}," directs users to enter a digital currency address in the Sanctions List Search tool's ID # field. That field does not use fuzzy logic, so it returns only exact matches. The search result should still be validated under the relevant network's parsing and canonicalization rules.",{"type":25,"tag":26,"props":1768,"children":1769},{},[1770,1772,1779],{"type":30,"value":1771},"Ethereum is an important example. An Ethereum address represents a 20-byte value, while mixed capitalization can encode an ",{"type":25,"tag":38,"props":1773,"children":1776},{"href":1774,"rel":1775},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-55",[42],[1777],{"type":30,"value":1778},"ERC-55 checksum",{"type":30,"value":1780},". A casing correction can therefore identify the same underlying address. A report should not claim that every visible character difference necessarily creates a different Ethereum address without first applying the network's rules.",{"type":25,"tag":26,"props":1782,"children":1783},{},[1784],{"type":30,"value":1785},"A network-validated exact match supports the statement that OFAC publicly associated the identifier with the listed person as of the applicable entry. It does not independently establish who controlled the address on every earlier date, who authorized a transaction, or what another party knew.",{"type":25,"tag":54,"props":1787,"children":1789},{"id":1788},"_2-a-third-party-attribution-to-a-listed-person-or-entity",[1790],{"type":30,"value":1791},"2. A third-party attribution to a listed person or entity",{"type":25,"tag":26,"props":1793,"children":1794},{},[1795],{"type":30,"value":1796},"A commercial analytics provider may attribute addresses that OFAC has not published. The report should identify the provider, product, query date, label, confidence or category, and disclosed basis. “The provider attributed this address to BitBank” accurately describes the evidence. “OFAC listed this address” does not, unless the official entry contains it.",{"type":25,"tag":26,"props":1798,"children":1799},{},[1800,1802,1808],{"type":30,"value":1801},"Attribution also does not necessarily resolve ownership. Exchange records, account data, device evidence, corporate records, signed messages, and testimony may be needed to connect an address to a person or entity. ",{"type":25,"tag":38,"props":1803,"children":1805},{"href":1804},"\u002Fresources\u002Funderstanding-wallet-ownership-evidence",[1806],{"type":30,"value":1807},"Understanding wallet ownership evidence",{"type":30,"value":1809}," explains why control of keys, account ownership, and ownership of the assets are separate questions.",{"type":25,"tag":54,"props":1811,"children":1813},{"id":1812},"_3-an-unlisted-entity-blocked-under-the-50-percent-rule",[1814],{"type":30,"value":1815},"3. An unlisted entity blocked under the 50 Percent Rule",{"type":25,"tag":26,"props":1817,"children":1818},{},[1819,1821,1828,1830,1837],{"type":30,"value":1820},"An entity need not appear by name on the SDN List to be blocked. ",{"type":25,"tag":38,"props":1822,"children":1825},{"href":1823,"rel":1824},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F401",[42],[1826],{"type":30,"value":1827},"OFAC FAQ 401",{"type":30,"value":1829}," states that an entity directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is considered blocked. OFAC's ",{"type":25,"tag":38,"props":1831,"children":1834},{"href":1832,"rel":1833},"https:\u002F\u002Fofac.treasury.gov\u002Fmedia\u002F6186\u002Fdownload?inline",[42],[1835],{"type":30,"value":1836},"50 Percent Rule guidance",{"type":30,"value":1838}," explains that qualifying interests held by multiple blocked persons are aggregated.",{"type":25,"tag":26,"props":1840,"children":1841},{},[1842,1844,1851],{"type":30,"value":1843},"Control is a separate issue. ",{"type":25,"tag":38,"props":1845,"children":1848},{"href":1846,"rel":1847},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F398",[42],[1849],{"type":30,"value":1850},"OFAC FAQ 398",{"type":30,"value":1852}," states that an entity controlled by blocked persons, but not owned 50 percent or more in the aggregate, is not automatically blocked under the rule. OFAC may separately designate the entity and urges caution when blocked persons hold significant minority interests or exercise control.",{"type":25,"tag":26,"props":1854,"children":1855},{},[1856],{"type":30,"value":1857},"Blockchain activity rarely proves corporate ownership percentages by itself. Counsel may need shareholder records, beneficial-ownership information, formation documents, agreements, governance records, and testimony. Operational control of a wallet is not a substitute for the ownership analysis.",{"type":25,"tag":54,"props":1859,"children":1861},{"id":1860},"_4-an-indirect-transaction-path",[1862],{"type":30,"value":1863},"4. An indirect transaction path",{"type":25,"tag":26,"props":1865,"children":1866},{},[1867],{"type":30,"value":1868},"A transaction graph may show funds moving from a listed or attributed address through intermediaries to the wallet under review. That path is transaction history. It is not automatic proof that each downstream wallet is blocked, owned by the sanctioned party, or involved in evasion.",{"type":25,"tag":26,"props":1870,"children":1871},{},[1872,1874,1881],{"type":30,"value":1873},"OFAC's ",{"type":25,"tag":38,"props":1875,"children":1878},{"href":1876,"rel":1877},"https:\u002F\u002Fofac.treasury.gov\u002Fsystem\u002Ffiles\u002F126\u002Fvirtual_currency_guidance_brochure.pdf",[42],[1879],{"type":30,"value":1880},"Sanctions Compliance Guidance for the Virtual Currency Industry",{"type":30,"value":1882}," recommends a risk-based compliance program that may include address screening, transaction monitoring, investigation, and blockchain analytics. It does not establish a universal rule under which every wallet within a fixed number of hops acquires the legal status of the original listed address.",{"type":25,"tag":26,"props":1884,"children":1885},{},[1886,1888,1894],{"type":30,"value":1887},"Terms such as “direct,” “one hop,” and “indirect” should describe the transaction path. They should not silently substitute for an ownership, attribution, knowledge, or liability conclusion. A sound ",{"type":25,"tag":38,"props":1889,"children":1891},{"href":1890},"\u002Fservices#blockchain-tracing",[1892],{"type":30,"value":1893},"blockchain tracing analysis",{"type":30,"value":1895}," separates ledger facts from the inferences drawn from them.",{"type":25,"tag":54,"props":1897,"children":1899},{"id":1898},"_5-a-vendor-generated-risk-score-or-alert",[1900],{"type":30,"value":1901},"5. A vendor-generated risk score or alert",{"type":25,"tag":26,"props":1903,"children":1904},{},[1905],{"type":30,"value":1906},"A risk score is an analytical output, not an OFAC determination. Counsel should obtain the transactions and attribution evidence behind it, including what triggered the alert, which addresses contributed, the exposure settings and time period, and when the provider applied or changed the label.",{"type":25,"tag":26,"props":1908,"children":1909},{},[1910,1912,1918],{"type":30,"value":1911},"A score may be useful for triage, but its meaning depends on the provider's methodology. ",{"type":25,"tag":38,"props":1913,"children":1915},{"href":1914},"\u002Fresources\u002Fwhy-blockchain-forensic-reports-fail-daubert",[1916],{"type":30,"value":1917},"Why most blockchain forensic reports fail Daubert scrutiny",{"type":30,"value":1919}," addresses the broader problems created when a dispositive conclusion rests on untested commercial labels or opaque rules.",{"type":25,"tag":1242,"props":1921,"children":1923},{"id":1922},"how-should-counsel-build-the-sanctions-timeline",[1924],{"type":30,"value":1925},"How should counsel build the sanctions timeline?",{"type":25,"tag":26,"props":1927,"children":1928},{},[1929],{"type":30,"value":1930},"Chronology is often the difference between a useful trace and a misleading conclusion. Record at least:",{"type":25,"tag":1463,"props":1932,"children":1933},{},[1934,1939,1944,1949,1954,1959,1964,1969],{"type":25,"tag":208,"props":1935,"children":1936},{},[1937],{"type":30,"value":1938},"the date and time of each relevant blockchain transaction;",{"type":25,"tag":208,"props":1940,"children":1941},{},[1942],{"type":30,"value":1943},"the block number and transaction hash;",{"type":25,"tag":208,"props":1945,"children":1946},{},[1947],{"type":30,"value":1948},"the date the person, entity, or address was listed;",{"type":25,"tag":208,"props":1950,"children":1951},{},[1952],{"type":30,"value":1953},"any earlier authority under which the person or property may already have been blocked;",{"type":25,"tag":208,"props":1955,"children":1956},{},[1957],{"type":30,"value":1958},"the date the analytics provider created, changed, or withdrew its attribution;",{"type":25,"tag":208,"props":1960,"children":1961},{},[1962],{"type":30,"value":1963},"the date the client or institution received the alert;",{"type":25,"tag":208,"props":1965,"children":1966},{},[1967],{"type":30,"value":1968},"any blocking, rejection, return, unblocking, or transfer date; and",{"type":25,"tag":208,"props":1970,"children":1971},{},[1972],{"type":30,"value":1973},"any report, license request, subpoena response, or OFAC communication date.",{"type":25,"tag":26,"props":1975,"children":1976},{},[1977,1984],{"type":25,"tag":38,"props":1978,"children":1981},{"href":1979,"rel":1980},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F5",[42],[1982],{"type":30,"value":1983},"OFAC FAQ 5",{"type":30,"value":1985}," recommends that organizations investigating a potential name match identify the list or sanctions program that generated the alert, review the complete entry, compare available identifiers, obtain additional information where necessary, and follow their sanctions procedures for likely matches. It does not say that every doubtful match must be reported to OFAC. OFAC also explains that it does not confirm potential matches or false positives for organizations and instead expects risk-based determinations.",{"type":25,"tag":26,"props":1987,"children":1988},{},[1989,1991,1998],{"type":30,"value":1990},"As an evidentiary practice, preserve the search result, list data, provider output, and analysis date so the decision can be reconstructed. That preservation recommendation is separate from FAQ 5. Questions about whether virtual currency must be blocked may be directed to OFAC's Compliance Hotline under ",{"type":25,"tag":38,"props":1992,"children":1995},{"href":1993,"rel":1994},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F646",[42],[1996],{"type":30,"value":1997},"FAQ 646",{"type":30,"value":1409},{"type":25,"tag":1242,"props":2000,"children":2002},{"id":2001},"what-should-a-reproducible-evidence-package-contain",[2003],{"type":30,"value":2004},"What should a reproducible evidence package contain?",{"type":25,"tag":26,"props":2006,"children":2007},{},[2008],{"type":30,"value":2009},"Preserve enough material for another qualified analyst to repeat the work:",{"type":25,"tag":204,"props":2011,"children":2012},{},[2013,2018,2023,2028,2033,2038,2043,2048,2053],{"type":25,"tag":208,"props":2014,"children":2015},{},[2016],{"type":30,"value":2017},"the complete address in plain text and the relevant blockchain or network;",{"type":25,"tag":208,"props":2019,"children":2020},{},[2021],{"type":30,"value":2022},"the canonical or checksum-validated form used for comparison;",{"type":25,"tag":208,"props":2024,"children":2025},{},[2026],{"type":30,"value":2027},"transaction hashes, block numbers, timestamps, asset type, and amount;",{"type":25,"tag":208,"props":2029,"children":2030},{},[2031],{"type":30,"value":2032},"raw transaction and receipt data where available;",{"type":25,"tag":208,"props":2034,"children":2035},{},[2036],{"type":30,"value":2037},"the dated OFAC entry or sanctions-list data;",{"type":25,"tag":208,"props":2039,"children":2040},{},[2041],{"type":30,"value":2042},"the provider, product, version, query date, report identifier, and settings;",{"type":25,"tag":208,"props":2044,"children":2045},{},[2046],{"type":30,"value":2047},"labels, confidence levels, exposure thresholds, hop settings, and the relied-upon path;",{"type":25,"tag":208,"props":2049,"children":2050},{},[2051],{"type":30,"value":2052},"analyst notes and any manual changes to automated output; and",{"type":25,"tag":208,"props":2054,"children":2055},{},[2056],{"type":30,"value":2057},"records showing when the alert was received, investigated, and resolved.",{"type":25,"tag":26,"props":2059,"children":2060},{},[2061,2063,2070],{"type":30,"value":2062},"The current recordkeeping rule generally requires full and accurate transaction records for at least ten years. Records of blocked property must be retained while the property remains blocked and for at least ten years after it is unblocked. (",{"type":25,"tag":38,"props":2064,"children":2067},{"href":2065,"rel":2066},"https:\u002F\u002Fwww.ecfr.gov\u002Fcurrent\u002Ftitle-31\u002Fsubtitle-B\u002Fchapter-V\u002Fpart-501\u002Fsubpart-C\u002Fsection-501.601",[42],[2068],{"type":30,"value":2069},"31 C.F.R. § 501.601",{"type":30,"value":1695},{"type":25,"tag":26,"props":2072,"children":2073},{},[2074,2076,2083,2084,2091],{"type":30,"value":2075},"OFAC's 2021 virtual currency guidance PDF still contains a five-year recordkeeping statement. That text predates the amendment that extended the regulatory period from five to ten years, effective in March 2025. The current regulation controls. (",{"type":25,"tag":38,"props":2077,"children":2080},{"href":2078,"rel":2079},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2024\u002F09\u002F13\u002F2024-20674\u002Freporting-recordkeeping-and-instructions-requirements-extension-of-recordkeeping-requirements",[42],[2081],{"type":30,"value":2082},"2024 interim final rule",{"type":30,"value":1686},{"type":25,"tag":38,"props":2085,"children":2088},{"href":2086,"rel":2087},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2025\u002F03\u002F21\u002F2025-04864\u002Freporting-recordkeeping-and-instructions-requirements-extension-of-recordkeeping-requirements",[42],[2089],{"type":30,"value":2090},"2025 final rule",{"type":30,"value":1695},{"type":25,"tag":1242,"props":2093,"children":2095},{"id":2094},"what-discovery-is-most-useful",[2096],{"type":30,"value":2097},"What discovery is most useful?",{"type":25,"tag":26,"props":2099,"children":2100},{},[2101],{"type":30,"value":2102},"Discovery should connect an address to a person, account, property interest, or business process. For a custodian, requests may seek KYC materials, beneficial owners, assigned deposit addresses, ledgers, internal identifiers, login and device data, withdrawal approvals, communications, sanctions alerts, investigation notes, and OFAC reports.",{"type":25,"tag":26,"props":2104,"children":2105},{},[2106],{"type":30,"value":2107},"For an analytics provider or expert, seek the transaction set, source and date of each attribution, software and ruleset, exposure settings, overrides, validation procedures, limitations, and label history. A protective order may address proprietary material without preventing meaningful testing of a dispositive attribution.",{"type":25,"tag":26,"props":2109,"children":2110},{},[2111,2113,2118],{"type":30,"value":2112},"For a 50 Percent Rule issue, request evidence of direct and indirect equity interests, intermediary entities, nominee arrangements, and ownership changes over time. Do not infer aggregate corporate ownership from wallet activity alone. The same separation of source data, method, and conclusion should appear in the final report and is part of ConsensusIntel's ",{"type":25,"tag":38,"props":2114,"children":2115},{"href":344},[2116],{"type":30,"value":2117},"forensic methodology",{"type":30,"value":1409},{"type":25,"tag":1242,"props":2120,"children":2122},{"id":2121},"what-happens-when-property-must-be-blocked",[2123],{"type":30,"value":2124},"What happens when property must be blocked?",{"type":25,"tag":26,"props":2126,"children":2127},{},[2128,2130,2137],{"type":30,"value":2129},"Blocking freezes property; it does not transfer title to the government. ",{"type":25,"tag":38,"props":2131,"children":2134},{"href":2132,"rel":2133},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F9",[42],[2135],{"type":30,"value":2136},"OFAC FAQ 9",{"type":30,"value":2138}," states that title remains with the blocked person, while transfers and other exercises of ownership are prohibited without authorization.",{"type":25,"tag":26,"props":2140,"children":2141},{},[2142],{"type":30,"value":2143},"Once a U.S. person determines that it holds virtual currency required to be blocked, FAQ 646 requires denial of access, compliance with holding and reporting requirements, and risk-based controls. OFAC describes blocking each affected wallet or consolidating blocked virtual currency into another controlled wallet as permissible examples for a virtual currency company. It does not require every holder to move every blocked asset into a new wallet. Conversion to fiat currency is not required.",{"type":25,"tag":26,"props":2145,"children":2146},{},[2147,2149,2156],{"type":30,"value":2148},"The initial blocking report is due within ten business days, with annual reports required while the property remains blocked. ",{"type":25,"tag":38,"props":2150,"children":2153},{"href":2151,"rel":2152},"https:\u002F\u002Fwww.ecfr.gov\u002Fcurrent\u002Ftitle-31\u002Fsubtitle-B\u002Fchapter-V\u002Fpart-501\u002Fsubpart-C\u002Fsection-501.603",[42],[2154],{"type":30,"value":2155},"31 C.F.R. § 501.603",{"type":30,"value":2157}," assigns primary responsibility to the holder or other specified person and permits an attorney or agent to file on that person's behalf.",{"type":25,"tag":26,"props":2159,"children":2160},{},[2161,2163,2169],{"type":30,"value":2162},"Regulatory blocking is also different from a stablecoin issuer's technical ability to blacklist tokens at an address. ",{"type":25,"tag":38,"props":2164,"children":2166},{"href":2165},"\u002Fresources\u002Fstablecoins-freeze-option-usdt-usdc",[2167],{"type":30,"value":2168},"Stablecoins and the freeze option",{"type":30,"value":2170}," explains that separate mechanism.",{"type":25,"tag":1242,"props":2172,"children":2174},{"id":2173},"how-does-the-framework-apply-to-a-transaction-path",[2175],{"type":30,"value":2176},"How does the framework apply to a transaction path?",{"type":25,"tag":26,"props":2178,"children":2179},{},[2180],{"type":30,"value":2181},"Hypothetical example: A client's wallet receives 12 ETH from Address B in June. In September, a tracing provider reports that Address B received funds two transactions earlier from an address the provider attributes to a newly designated exchange.",{"type":25,"tag":26,"props":2183,"children":2184},{},[2185],{"type":30,"value":2186},"The blockchain may establish the transaction path. The provider's records may establish that it applied the exchange label to the upstream address on a particular date. Neither fact alone establishes that Address B was controlled by the exchange, that the client's June receipt involved property in which the exchange had an interest, that the client knew of the upstream source, or that the September designation was the first restriction applicable to the exchange.",{"type":25,"tag":26,"props":2188,"children":2189},{},[2190],{"type":30,"value":2191},"A defensible analysis would verify the path, timing, any OFAC-published address, the governing authority, any earlier blocking status, ownership or control of Address B, available custodial records, and the client's jurisdictional status. The report should separate on-chain facts, third-party attribution, legal assumptions, and unresolved questions.",{"type":25,"tag":1242,"props":2193,"children":2195},{"id":2194},"what-is-the-practical-response-to-an-ofac-related-alert",[2196],{"type":30,"value":2197},"What is the practical response to an OFAC-related alert?",{"type":25,"tag":1463,"props":2199,"children":2200},{},[2201,2211,2221,2231,2241,2251,2261,2271,2281,2291],{"type":25,"tag":208,"props":2202,"children":2203},{},[2204,2209],{"type":25,"tag":366,"props":2205,"children":2206},{},[2207],{"type":30,"value":2208},"Preserve the exact result.",{"type":30,"value":2210}," Save the address, network, list entry, provider output, settings, date, and underlying transactions.",{"type":25,"tag":208,"props":2212,"children":2213},{},[2214,2219],{"type":25,"tag":366,"props":2215,"children":2216},{},[2217],{"type":30,"value":2218},"Validate the address correctly.",{"type":30,"value":2220}," Use the OFAC ID # field and apply the blockchain's canonicalization and checksum rules.",{"type":25,"tag":208,"props":2222,"children":2223},{},[2224,2229],{"type":25,"tag":366,"props":2225,"children":2226},{},[2227],{"type":30,"value":2228},"Identify what matched.",{"type":30,"value":2230}," Distinguish an OFAC-published address from a vendor attribution, ownership conclusion, indirect path, or score.",{"type":25,"tag":208,"props":2232,"children":2233},{},[2234,2239],{"type":25,"tag":366,"props":2235,"children":2236},{},[2237],{"type":30,"value":2238},"Identify the authority.",{"type":30,"value":2240}," Determine the sanctions program, executive order, regulation, and any earlier blocking rule.",{"type":25,"tag":208,"props":2242,"children":2243},{},[2244,2249],{"type":25,"tag":366,"props":2245,"children":2246},{},[2247],{"type":30,"value":2248},"Build the timeline.",{"type":30,"value":2250}," Separate transaction, designation, attribution, discovery, blocking, and reporting dates.",{"type":25,"tag":208,"props":2252,"children":2253},{},[2254,2259],{"type":25,"tag":366,"props":2255,"children":2256},{},[2257],{"type":30,"value":2258},"Determine jurisdiction and actor.",{"type":30,"value":2260}," Identify the relevant person, institution, holder, property, and conduct.",{"type":25,"tag":208,"props":2262,"children":2263},{},[2264,2269],{"type":25,"tag":366,"props":2265,"children":2266},{},[2267],{"type":30,"value":2268},"Investigate ownership and control.",{"type":30,"value":2270}," Apply the 50 Percent Rule to documented ownership, not wallet activity alone.",{"type":25,"tag":208,"props":2272,"children":2273},{},[2274,2279],{"type":25,"tag":366,"props":2275,"children":2276},{},[2277],{"type":30,"value":2278},"Separate fact from inference.",{"type":30,"value":2280}," State what the ledger records, what a provider attributes, and what counsel or the expert concludes.",{"type":25,"tag":208,"props":2282,"children":2283},{},[2284,2289],{"type":25,"tag":366,"props":2285,"children":2286},{},[2287],{"type":30,"value":2288},"Assess blocking and reporting duties promptly.",{"type":30,"value":2290}," Apply the governing authority rather than a generic “sanctions exposure” label.",{"type":25,"tag":208,"props":2292,"children":2293},{},[2294,2299],{"type":25,"tag":366,"props":2295,"children":2296},{},[2297],{"type":30,"value":2298},"Use program-specific legal advice.",{"type":30,"value":2300}," Blockchain expertise reconstructs transactions; it does not replace sanctions counsel.",{"type":25,"tag":1242,"props":2302,"children":2303},{"id":352},[2304],{"type":30,"value":355},{"type":25,"tag":54,"props":2306,"children":2308},{"id":2307},"q-does-an-exact-match-to-an-ofac-published-address-prove-who-owned-the-wallet",[2309],{"type":30,"value":2310},"Q: Does an exact match to an OFAC-published address prove who owned the wallet?",{"type":25,"tag":26,"props":2312,"children":2313},{},[2314,2318],{"type":25,"tag":366,"props":2315,"children":2316},{},[2317],{"type":30,"value":370},{"type":30,"value":2319}," No. It proves that OFAC publicly associated that identifier with a listed person as of the relevant entry. Ownership or control on a particular date may require exchange records, account data, device evidence, corporate records, signed messages, or testimony.",{"type":25,"tag":54,"props":2321,"children":2323},{"id":2322},"q-does-a-one-hop-or-indirect-connection-make-the-receiving-wallet-sanctioned",[2324],{"type":30,"value":2325},"Q: Does a one-hop or indirect connection make the receiving wallet sanctioned?",{"type":25,"tag":26,"props":2327,"children":2328},{},[2329,2333],{"type":25,"tag":366,"props":2330,"children":2331},{},[2332],{"type":30,"value":370},{"type":30,"value":2334}," Not automatically. The path establishes transaction history. Counsel must separately analyze attribution, property interests, ownership, jurisdiction, timing, knowledge where relevant, and the governing sanctions authority.",{"type":25,"tag":54,"props":2336,"children":2338},{"id":2337},"q-can-an-entity-be-blocked-even-if-it-is-not-named-on-the-sdn-list",[2339],{"type":30,"value":2340},"Q: Can an entity be blocked even if it is not named on the SDN List?",{"type":25,"tag":26,"props":2342,"children":2343},{},[2344,2348],{"type":25,"tag":366,"props":2345,"children":2346},{},[2347],{"type":30,"value":370},{"type":30,"value":2349}," Yes. An entity directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is considered blocked under OFAC's 50 Percent Rule. Control without the required ownership percentage does not automatically produce that result.",{"type":25,"tag":54,"props":2351,"children":2353},{"id":2352},"q-how-long-should-sanctions-related-cryptocurrency-records-be-retained",[2354],{"type":30,"value":2355},"Q: How long should sanctions-related cryptocurrency records be retained?",{"type":25,"tag":26,"props":2357,"children":2358},{},[2359,2363],{"type":25,"tag":366,"props":2360,"children":2361},{},[2362],{"type":30,"value":370},{"type":30,"value":2364}," The current OFAC recordkeeping rule generally requires transaction records for at least ten years. Records of blocked property must be kept while the property remains blocked and for at least ten years after unblocking. Other litigation, regulatory, or contractual preservation duties may require longer retention.",{"type":25,"tag":54,"props":2366,"children":2368},{"id":2367},"q-what-should-counsel-request-from-a-blockchain-analytics-provider",[2369],{"type":30,"value":2370},"Q: What should counsel request from a blockchain analytics provider?",{"type":25,"tag":26,"props":2372,"children":2373},{},[2374,2378],{"type":25,"tag":366,"props":2375,"children":2376},{},[2377],{"type":30,"value":370},{"type":30,"value":2379}," Request the underlying transactions, attribution sources and dates, product and version, ruleset, exposure and hop settings, confidence categories, overrides, validation procedures, limitations, and label history. The goal is to make the reported conclusion testable rather than relying on a score alone.",{"type":25,"tag":26,"props":2381,"children":2382},{},[2383,2385,2389],{"type":30,"value":2384},"Every matter turns on its facts, the applicable sanctions program, and the evidence available. For a case-specific tracing or evidentiary question, ",{"type":25,"tag":38,"props":2386,"children":2387},{"href":425},[2388],{"type":30,"value":1613},{"type":30,"value":2390}," to discuss the record and the scope of analysis needed.",{"title":7,"searchDepth":432,"depth":432,"links":2392},[2393,2394,2401,2402,2403,2404,2405,2406,2407],{"id":1664,"depth":432,"text":1667},{"id":1731,"depth":432,"text":1734,"children":2395},[2396,2397,2398,2399,2400],{"id":1737,"depth":435,"text":1740},{"id":1788,"depth":435,"text":1791},{"id":1812,"depth":435,"text":1815},{"id":1860,"depth":435,"text":1863},{"id":1898,"depth":435,"text":1901},{"id":1922,"depth":432,"text":1925},{"id":2001,"depth":432,"text":2004},{"id":2094,"depth":432,"text":2097},{"id":2121,"depth":432,"text":2124},{"id":2173,"depth":432,"text":2176},{"id":2194,"depth":432,"text":2197},{"id":352,"depth":432,"text":355,"children":2408},[2409,2410,2411,2412,2413],{"id":2307,"depth":435,"text":2310},{"id":2322,"depth":435,"text":2325},{"id":2337,"depth":435,"text":2340},{"id":2352,"depth":435,"text":2355},{"id":2367,"depth":435,"text":2370},"content:articles:23-sanctions-blockchain-tracing-ofac-match-evidence.md","articles\u002F23-sanctions-blockchain-tracing-ofac-match-evidence.md","articles\u002F23-sanctions-blockchain-tracing-ofac-match-evidence",1790738184002]