[{"data":1,"prerenderedAt":2693},["ShallowReactive",2],{"article-crypto-wallet-exchange-device-discovery":3,"content-query-U6JQpNDUqq":603,"related-crypto-wallet-exchange-device-discovery":1031},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"slug":10,"date":11,"lastUpdated":11,"author":12,"readingTime":13,"category":14,"tags":15,"ogImage":21,"featured":6,"body":22,"_type":597,"_id":598,"_source":599,"_file":600,"_stem":601,"_extension":602},"\u002Farticles\u002F31-crypto-wallet-exchange-device-discovery","articles",false,"","Discovery for wallets, exchanges, and devices: beyond the CSV","Draft discovery requests for native exchange data, device records, and authentication history, not bare CSVs, so your expert can tie transactions to users.","crypto-wallet-exchange-device-discovery","2026-07-11","Nick Kampe",13,"Legal Reference",[16,17,18,19,20],"discovery","exchange-records","wallet","device-forensics","kyc","\u002Fog\u002Fcrypto-wallet-exchange-device-discovery.png",{"type":23,"children":24,"toc":564},"root",[25,33,40,45,61,67,72,97,110,116,121,144,149,156,161,167,172,178,183,189,194,200,205,211,216,229,235,248,254,259,265,270,276,281,311,317,322,335,341,346,370,375,381,424,430,435,440,446,459,465,471,482,488,497,503,520,526,543],{"type":26,"tag":27,"props":28,"children":29},"element","p",{},[30],{"type":31,"value":32},"text","A party may produce a CSV labeled \"transaction history\" that lacks a timezone, field definitions, reconcilable identifiers, or documented fiat-conversion rates. Such an export may be inadequate for reconstruction. This article is about drafting discovery so that does not happen: requests to parties, exchanges, and devices that deliver native data, schemas, identifiers, timestamps, and authentication history. The working assumption is federal practice; state rules vary, so check the forum's counterpart.",{"type":26,"tag":34,"props":35,"children":37},"h2",{"id":36},"why-a-transaction-csv-is-not-enough",[38],{"type":31,"value":39},"Why a Transaction CSV Is Not Enough",{"type":26,"tag":27,"props":41,"children":42},{},[43],{"type":31,"value":44},"A recurring discovery failure is accepting a summary export as the production. A CSV from an exchange's reporting tab may be a curated customer view rather than a record set built for reconstruction: it may omit internal transfers or failed orders, convert amounts to fiat at undocumented rates, truncate identifiers, or log times in a local timezone.",{"type":26,"tag":27,"props":46,"children":47},{},[48,50,59],{"type":31,"value":49},"Rule 34(b)(1)(C) permits the request to specify the form or forms in which ESI will be produced (",{"type":26,"tag":51,"props":52,"children":56},"a",{"href":53,"rel":54},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocument\u002Ffederal-rules-of-civil-procedure.pdf",[55],"nofollow",[57],{"type":31,"value":58},"Federal Rules of Civil Procedure, amended through December 1, 2025",{"type":31,"value":60},"). If no form is specified, Rule 34(b)(2)(E) requires production in a form in which the information is ordinarily maintained or in a reasonably usable form. A party need not produce the same ESI in more than one form. If the request omits a form, or the responding party objects to the requested form, Rule 34(b)(2)(D) requires the responding party to state the form or forms it intends to use. Specify the form up front so the issue is addressed in the response, not after the expert receives an unusable production.",{"type":26,"tag":34,"props":62,"children":64},{"id":63},"start-with-the-disputed-propositions-then-map-each-to-a-record-source",[65],{"type":31,"value":66},"Start with the Disputed Propositions, Then Map Each to a Record Source",{"type":26,"tag":27,"props":68,"children":69},{},[70],{"type":31,"value":71},"Draft backward from what the case must prove, then name the record source for each proposition:",{"type":26,"tag":73,"props":74,"children":75},"ul",{},[76,82,87,92],{"type":26,"tag":77,"props":78,"children":79},"li",{},[80],{"type":31,"value":81},"\"X held the account\" maps to registration records, KYC verification steps with dates, linked payment methods, and assigned deposit addresses.",{"type":26,"tag":77,"props":83,"children":84},{},[85],{"type":31,"value":86},"\"X controlled the withdrawal destination\" maps to withdrawal records with destination addresses, address book and whitelist entries with add dates, and withdrawal approvals.",{"type":26,"tag":77,"props":88,"children":89},{},[90],{"type":31,"value":91},"\"The transfers were authorized by X\" maps to authentication history: logins, sessions, device identifiers, two-factor changes, API key usage.",{"type":26,"tag":77,"props":93,"children":94},{},[95],{"type":31,"value":96},"\"The amounts and values on the relevant dates\" maps to order and trade records with native timestamps; \"X knew about or directed the activity\" maps to support tickets, chat logs, and the party's own communications.",{"type":26,"tag":27,"props":98,"children":99},{},[100,102,108],{"type":31,"value":101},"That source list should come from an expert who knows which fields an export must contain and which records exist only internally; that expertise defines the categories a ",{"type":26,"tag":51,"props":103,"children":105},{"href":104},"\u002Fservices#evidence-review",[106],{"type":31,"value":107},"discovery and evidence review engagement",{"type":31,"value":109}," can verify before the RFP goes out, cheaper than a motion to compel after an unusable production.",{"type":26,"tag":34,"props":111,"children":113},{"id":112},"what-to-request-native-data-schemas-and-field-definitions",[114],{"type":31,"value":115},"What to Request: Native Data, Schemas, and Field Definitions",{"type":26,"tag":27,"props":117,"children":118},{},[119],{"type":31,"value":120},"Name actual record categories rather than asking for \"all documents relating to cryptocurrency.\" For each category, specify:",{"type":26,"tag":73,"props":122,"children":123},{},[124,129,134,139],{"type":26,"tag":77,"props":125,"children":126},{},[127],{"type":31,"value":128},"Structured export format (CSV or JSON with full precision) with a schema or data dictionary defining every field, not PDFs or screenshots.",{"type":26,"tag":77,"props":130,"children":131},{},[132],{"type":31,"value":133},"Field definitions for identifiers: account identifier, wallet address, transaction hash, order identifier, internal transfer identifier.",{"type":26,"tag":77,"props":135,"children":136},{},[137],{"type":31,"value":138},"All timestamps in UTC with the source timezone documented, plus block height where relevant.",{"type":26,"tag":77,"props":140,"children":141},{},[142],{"type":31,"value":143},"Amounts in the asset's base units or with the exchange's recorded rate, and chain and network identifiers so exports from different sources can be joined.",{"type":26,"tag":27,"props":145,"children":146},{},[147],{"type":31,"value":148},"This is not a demand for the exchange's internal database; it is a demand for exports plus the documentation that makes them legible. Where a party operates its own Ethereum node, name the block, transaction, and receipt objects and fields needed rather than accepting any flat export.",{"type":26,"tag":150,"props":151,"children":153},"h3",{"id":152},"form-specifications-that-survive-objections",[154],{"type":31,"value":155},"Form specifications that survive objections",{"type":26,"tag":27,"props":157,"children":158},{},[159],{"type":31,"value":160},"Three habits keep these requests defensible. Tie each form specification to usability: the specified form is needed to reconcile the production against blockchain data and other productions, and Rule 34(b)(1)(C) lets the request name that form. Ask for one form per category, since a party need not produce the same ESI in more than one form. Anticipate an objection that a source is not reasonably accessible because of undue burden or cost under Rule 26(b)(2)(B): scope requests to the disputed period and be ready to show good cause if the source is an encrypted legacy backup.",{"type":26,"tag":34,"props":162,"children":164},{"id":163},"beyond-transactions-account-authentication-and-device-records",[165],{"type":31,"value":166},"Beyond Transactions: Account, Authentication, and Device Records",{"type":26,"tag":27,"props":168,"children":169},{},[170],{"type":31,"value":171},"Transaction exports capture value movement, not the account-level facts that tie movement to a person.",{"type":26,"tag":150,"props":173,"children":175},{"id":174},"account-lifecycle-records",[176],{"type":31,"value":177},"Account lifecycle records",{"type":26,"tag":27,"props":179,"children":180},{},[181],{"type":31,"value":182},"Request registration data, KYC steps with dates and outcomes, linked payment methods, every deposit address assigned, and address book and whitelist entries with add dates, often correlating with the disputed transfers. Also request hold, freeze, and flag records with the reasons recorded; a compliance flag is itself a relevant fact about the account.",{"type":26,"tag":150,"props":184,"children":186},{"id":185},"authentication-and-access-history",[187],{"type":31,"value":188},"Authentication and access history",{"type":26,"tag":27,"props":190,"children":191},{},[192],{"type":31,"value":193},"Login events with IP addresses and device fingerprints, session records, password and two-factor changes, recovery code issuance, and new-device notifications. This separates \"the account was used\" from \"the party used the account,\" and the fingerprints later reconcile against the device production.",{"type":26,"tag":150,"props":195,"children":197},{"id":196},"api-keys-and-automated-activity",[198],{"type":31,"value":199},"API keys and automated activity",{"type":26,"tag":27,"props":201,"children":202},{},[203],{"type":31,"value":204},"Request API key creation, scopes, last-use timestamps, and, if retained, the hosts from which keys were used. These records can help test a claim that a bot initiated transfers the party denies authorizing.",{"type":26,"tag":150,"props":206,"children":208},{"id":207},"support-and-communications-records",[209],{"type":31,"value":210},"Support and communications records",{"type":26,"tag":27,"props":212,"children":213},{},[214],{"type":31,"value":215},"Support tickets, chat logs, and emails, including KYC appeals and fraud reports, often contain the party's own admissions about the account and activity.",{"type":26,"tag":27,"props":217,"children":218},{},[219,221,227],{"type":31,"value":220},"The mechanics of enforcing these categories against nonparties are covered in ",{"type":26,"tag":51,"props":222,"children":224},{"href":223},"\u002Fresources\u002Fsubpoenaing-cryptocurrency-exchange-records",[225],{"type":31,"value":226},"how to subpoena cryptocurrency exchange records",{"type":31,"value":228},"; the point here is that party discovery and nonparty subpoenas should be one system. Serve the party first for identifiers and device records, then feed those identifiers into the exchange subpoena so the exchange searches by email, phone, and wallet address. If the party cooperates, consider a signed authorization to the exchange as an additional avenue for requesting account records.",{"type":26,"tag":34,"props":230,"children":232},{"id":231},"device-and-app-records-the-self-custody-evidence-layer",[233],{"type":31,"value":234},"Device and App Records: The Self-Custody Evidence Layer",{"type":26,"tag":27,"props":236,"children":237},{},[238,240,246],{"type":31,"value":239},"For self-custody wallets there is no institution holding records; the evidence lives on devices and in the party's files. Device production is a Rule 34 request too: phones, computers, and hardware wallets are tangible things within the scope of ",{"type":26,"tag":51,"props":241,"children":243},{"href":53,"rel":242},[55],[244],{"type":31,"value":245},"Rule 34(a)(1)",{"type":31,"value":247},", and the ESI on them is within the same rule.",{"type":26,"tag":150,"props":249,"children":251},{"id":250},"wallet-software-and-browser-extensions",[252],{"type":31,"value":253},"Wallet software and browser extensions",{"type":26,"tag":27,"props":255,"children":256},{},[257],{"type":31,"value":258},"Request installed wallet applications, app data directories, local databases, configuration files, and logs, plus browser extension storage. App data may persist after uninstall, though a qualified examiner must determine whether any artifact is recoverable. Seed material in notes apps, password managers, photos, and cloud documents belongs in the same category, requested explicitly.",{"type":26,"tag":150,"props":260,"children":262},{"id":261},"hardware-wallets",[263],{"type":31,"value":264},"Hardware wallets",{"type":26,"tag":27,"props":266,"children":267},{},[268],{"type":31,"value":269},"The device itself can be produced for examination, and its companion application may leave address and transaction artifacts on the host computer. The most productive target is often that computer: request connection artifacts, app install history, and records of which addresses the party managed through the device.",{"type":26,"tag":150,"props":271,"children":273},{"id":272},"backups-seed-material-and-signed-messages",[274],{"type":31,"value":275},"Backups, seed material, and signed messages",{"type":26,"tag":27,"props":277,"children":278},{},[279],{"type":31,"value":280},"Request cloud backups of wallet data, password manager exports, encrypted containers, and any written or photographed seed phrase material. Where control of an address is disputed, request a signed message from it: a valid signature demonstrates that the signer controlled the relevant private key at the time of signing without disclosing the key. A refusal may become a factual issue, but it is not proof by itself.",{"type":26,"tag":27,"props":282,"children":283},{},[284,286,293,295,301,303,309],{"type":31,"value":285},"Collection integrity is the expert's prerequisite. The four-phase forensic process in ",{"type":26,"tag":51,"props":287,"children":290},{"href":288,"rel":289},"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F86\u002Ffinal",[55],[291],{"type":31,"value":292},"NIST SP 800-86",{"type":31,"value":294}," (published by NIST in August 2006) runs collection, examination, analysis, and reporting, with data integrity preserved through collection and examination. Devices should be imaged under a defensible protocol with hashing and documented chain of custody, and the request should permit that methodology rather than demanding raw devices with no safeguards. See ",{"type":26,"tag":51,"props":296,"children":298},{"href":297},"\u002Fresources\u002Funderstanding-wallet-ownership-evidence",[299],{"type":31,"value":300},"understanding wallet ownership evidence",{"type":31,"value":302}," for the evidence types that establish control, and ",{"type":26,"tag":51,"props":304,"children":306},{"href":305},"\u002Fresources\u002Fself-custody-vs-custodial-wallets",[307],{"type":31,"value":308},"self-custody vs. custodial wallets",{"type":31,"value":310}," for how custody changes what records exist.",{"type":26,"tag":34,"props":312,"children":314},{"id":313},"interrogatories-and-rule-30b6-depositions-explain-the-system",[315],{"type":31,"value":316},"Interrogatories and Rule 30(b)(6) Depositions: Explain the System",{"type":26,"tag":27,"props":318,"children":319},{},[320],{"type":31,"value":321},"Interrogatories describe; native ESI proves. Use interrogatories (Rule 33) to ask the party to identify every exchange account, wallet address, device, application, and key-storage location, and to state whether any data was deleted or migrated during the relevant period. The answers become the roadmap for the RFP. They do not substitute for production: responsive records still must come out in usable form under Rule 34, and describing records is not producing them.",{"type":26,"tag":27,"props":323,"children":324},{},[325,327,333],{"type":31,"value":326},"Rule 30(b)(6) depositions fill the explanatory gap for organizational parties. The notice must describe the matters for examination with reasonable particularity, and the named organization must designate one or more people to testify about information known or reasonably available to it. Useful topics for an exchange include schema, export methodology, retention periods, KYC process, key custody, and API logging. For an individual party, use an ordinary Rule 30(b)(1) deposition to cover which devices and applications were used, how keys were stored, and what happened to the account during the dispute window. Depose after production so the deponent can be walked through the actual exports. For nonparties, the same explanation can be compelled with a deposition subpoena under ",{"type":26,"tag":51,"props":328,"children":330},{"href":53,"rel":329},[55],[331],{"type":31,"value":332},"Rule 45",{"type":31,"value":334},", which also permits designating the form of production.",{"type":26,"tag":34,"props":336,"children":338},{"id":337},"model-request-categories-and-proportionality-limits",[339],{"type":31,"value":340},"Model Request Categories and Proportionality Limits",{"type":26,"tag":27,"props":342,"children":343},{},[344],{"type":31,"value":345},"A defensible RFP structure for a digital asset matter:",{"type":26,"tag":347,"props":348,"children":349},"ol",{},[350,355,360,365],{"type":26,"tag":77,"props":351,"children":352},{},[353],{"type":31,"value":354},"Native exports with schemas and field definitions for account, trade, order, deposit, withdrawal, and transfer records, in the specified form.",{"type":26,"tag":77,"props":356,"children":357},{},[358],{"type":31,"value":359},"Account, authentication, API key, and support records as specified in the sections above.",{"type":26,"tag":77,"props":361,"children":362},{},[363],{"type":31,"value":364},"Device records: wallet applications, app data, extension storage, backups, seed and key material in any form, and device production for imaging where self-custody control is disputed.",{"type":26,"tag":77,"props":366,"children":367},{},[368],{"type":31,"value":369},"Explanatory records: written procedures, export documentation, and any tool used to generate the production.",{"type":26,"tag":27,"props":371,"children":372},{},[373],{"type":31,"value":374},"Handle proportionality in the drafting. Rule 26(b)(1) limits discovery to nonprivileged matter that is relevant to any party's claim or defense and proportional to the needs of the case. Scope time periods to the dispute, limit imaging to the custodians that matter, and stagger requests so account records come first and device production follows only if the dispute turns on self-custody control. The proposed discovery plan under Rule 26(f) must state the parties' views and proposals on ESI issues, including the form or forms in which ESI should be produced, and the scheduling order may include ESI preservation terms under Rule 16(b). Issue a litigation hold early: Rule 37(e) applies when ESI that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, so the preservation letter should name these categories rather than \"all records.\"",{"type":26,"tag":150,"props":376,"children":378},{"id":377},"practitioner-checklist",[379],{"type":31,"value":380},"Practitioner checklist",{"type":26,"tag":347,"props":382,"children":383},{},[384,389,394,399,404,409,414,419],{"type":26,"tag":77,"props":385,"children":386},{},[387],{"type":31,"value":388},"Build the proposition-to-source map with the expert before any RFP.",{"type":26,"tag":77,"props":390,"children":391},{},[392],{"type":31,"value":393},"Serve a preservation notice covering the categories above.",{"type":26,"tag":77,"props":395,"children":396},{},[397],{"type":31,"value":398},"Serve RFPs with explicit form specifications, schema demands, and date ranges.",{"type":26,"tag":77,"props":400,"children":401},{},[402],{"type":31,"value":403},"Serve interrogatories requiring identification of accounts, addresses, devices, applications, and deletions.",{"type":26,"tag":77,"props":405,"children":406},{},[407],{"type":31,"value":408},"Designate Rule 30(b)(6) topics against an organizational party and any custodial exchange.",{"type":26,"tag":77,"props":410,"children":411},{},[412],{"type":31,"value":413},"Coordinate nonparty subpoenas using produced identifiers, with party authorizations.",{"type":26,"tag":77,"props":415,"children":416},{},[417],{"type":31,"value":418},"Have the expert reconcile exchange exports against the blockchain and both against device evidence.",{"type":26,"tag":77,"props":420,"children":421},{},[422],{"type":31,"value":423},"If productions arrive without schemas or in unusable form, move to compel on the form specification.",{"type":26,"tag":34,"props":425,"children":427},{"id":426},"reconciling-productions-a-worked-hypothetical",[428],{"type":31,"value":429},"Reconciling Productions: A Worked Hypothetical",{"type":26,"tag":27,"props":431,"children":432},{},[433],{"type":31,"value":434},"Hypothetical example: In a business divorce, the company's exchange account shows a withdrawal of 40 ETH to a wallet address, and the other side claims the address belongs to an unrelated third party repaying a loan. The native export shows the withdrawal with a transaction hash, a UTC timestamp, and an address book entry the account holder added for that destination 11 days earlier. The exchange's Rule 30(b)(6) deponent confirms address book entries are added only through authenticated sessions. Blockchain data confirms the hash and the recipient's later activity. Device production from the company laptop shows a browser extension vault and a photo of a seed phrase, and the expert verifies the derived addresses match the recipient. Each layer checks against the others: exchange records tie the company to the withdrawal, the address book ties the destination to the holder's action, and the device evidence ties it to the party personally.",{"type":26,"tag":27,"props":436,"children":437},{},[438],{"type":31,"value":439},"Now the same case with a badly drafted production: a PDF statement with local times, dollar-converted amounts, and no hashes. The expert cannot match the withdrawal to the blockchain, the address connects to no one, and the gap becomes a factual fight. That outcome was decided when the RFP was drafted.",{"type":26,"tag":150,"props":441,"children":443},{"id":442},"limitations-what-discovery-cannot-fix",[444],{"type":31,"value":445},"Limitations: what discovery cannot fix",{"type":26,"tag":27,"props":447,"children":448},{},[449,451,457],{"type":31,"value":450},"Requests cannot manufacture records that never existed. Foreign and non-KYC platforms may sit beyond domestic process, decentralized protocols leave no record-holder to subpoena, retention windows may already have closed for login logs, and an encrypted device can block examination until the court addresses it. Shared keys and multisig arrangements complicate attribution even with perfect records. Where these limits bind, the case narrows to what the blockchain shows and what disclosure obligations require, which is one more reason to run ",{"type":26,"tag":51,"props":452,"children":454},{"href":453},"\u002Fservices#blockchain-tracing",[455],{"type":31,"value":456},"blockchain tracing",{"type":31,"value":458}," in parallel with discovery rather than waiting for productions.",{"type":26,"tag":34,"props":460,"children":462},{"id":461},"frequently-asked-questions",[463],{"type":31,"value":464},"Frequently Asked Questions",{"type":26,"tag":150,"props":466,"children":468},{"id":467},"q-can-i-compel-production-of-a-phone-computer-or-hardware-wallet-for-forensic-examination-in-civil-discovery",[469],{"type":31,"value":470},"Q: Can I compel production of a phone, computer, or hardware wallet for forensic examination in civil discovery?",{"type":26,"tag":27,"props":472,"children":473},{},[474,480],{"type":26,"tag":475,"props":476,"children":477},"strong",{},[478],{"type":31,"value":479},"A:",{"type":31,"value":481}," Devices are tangible things within the scope of Rule 34(a)(1), and the ESI on them is discoverable like any other electronically stored information, subject to relevance and proportionality under Rule 26(b)(1). Courts manage privacy and burden through protective orders, search protocols, special masters, or limits on custodians and timeframes. Because devices get replaced or wiped, request device production early and pair it with a preservation notice.",{"type":26,"tag":150,"props":483,"children":485},{"id":484},"q-what-if-the-exchange-produces-a-csv-with-no-field-definitions-or-timezone-information",[486],{"type":31,"value":487},"Q: What if the exchange produces a CSV with no field definitions or timezone information?",{"type":26,"tag":27,"props":489,"children":490},{},[491,495],{"type":26,"tag":475,"props":492,"children":493},{},[494],{"type":31,"value":479},{"type":31,"value":496}," If you specified a structured form, it may be the wrong form. Rule 34(b)(1)(C) lets the request name the form, for example a structured CSV or JSON rather than a PDF statement. If you requested schemas, documented timezones, and full identifiers as their own categories, assess any response or objection to those categories against the rules and the case-specific order. Have the expert document which fields are missing and why they cannot be joined to the blockchain or to other productions; that turns a format dispute into a concrete showing.",{"type":26,"tag":150,"props":498,"children":500},{"id":499},"q-are-interrogatory-answers-enough-to-establish-who-controlled-a-wallet",[501],{"type":31,"value":502},"Q: Are interrogatory answers enough to establish who controlled a wallet?",{"type":26,"tag":27,"props":504,"children":505},{},[506,510,512,518],{"type":26,"tag":475,"props":507,"children":508},{},[509],{"type":31,"value":479},{"type":31,"value":511}," No. Answers are useful evidence and can be used to impeach if contradicted, but they describe facts; they do not substitute for responsive records that must be produced in native, usable form under Rule 34. That form lets the expert verify addresses, hashes, and timestamps against the blockchain. Treat interrogatories as the map and the production as the territory. For how control is proven once records exist, see ",{"type":26,"tag":51,"props":513,"children":515},{"href":514},"\u002Fresources\u002Fblockchain-analyst-vs-expert-witness",[516],{"type":31,"value":517},"the difference between a blockchain analyst and an expert witness",{"type":31,"value":519},".",{"type":26,"tag":150,"props":521,"children":523},{"id":522},"q-when-should-i-bring-a-forensic-expert-into-the-discovery-process",[524],{"type":31,"value":525},"Q: When should I bring a forensic expert into the discovery process?",{"type":26,"tag":27,"props":527,"children":528},{},[529,533,535,541],{"type":26,"tag":475,"props":530,"children":531},{},[532],{"type":31,"value":479},{"type":31,"value":534}," At the drafting stage, not after the first production. The expert determines which fields an exchange export must contain, which records exist only internally, and what form the data needs to reconcile against the chain and device evidence. Early engagement converts vague requests into specific ones, shortens the meet-and-confer, and strengthens a motion to compel if the production still comes back unusable. For custody disputes over self-custody assets, an early ",{"type":26,"tag":51,"props":536,"children":538},{"href":537},"\u002Fservices#expert-witness",[539],{"type":31,"value":540},"expert witness consultation",{"type":31,"value":542}," also shapes the Rule 30(b)(6) topics before depositions are noticed.",{"type":26,"tag":27,"props":544,"children":545},{},[546,548,554,556,562],{"type":31,"value":547},"Rules differ by court and by state: Missouri's general provision governing discovery, for example, is in Rule 56.01, and federal districts impose their own ESI protocols. The right request set depends on the disputes and the exchanges and devices involved. If you are drafting discovery in a matter that touches wallets, exchanges, or devices, I am available to discuss the request categories and the ",{"type":26,"tag":51,"props":549,"children":551},{"href":550},"\u002Fmethodology",[552],{"type":31,"value":553},"ConsensusIntel methodology",{"type":31,"value":555}," for this kind of reconstruction. ",{"type":26,"tag":51,"props":557,"children":559},{"href":558},"\u002Fcontact",[560],{"type":31,"value":561},"Contact me",{"type":31,"value":563}," with the facts of your matter.",{"title":7,"searchDepth":565,"depth":565,"links":566},2,[567,568,569,573,579,584,585,588,591],{"id":36,"depth":565,"text":39},{"id":63,"depth":565,"text":66},{"id":112,"depth":565,"text":115,"children":570},[571],{"id":152,"depth":572,"text":155},3,{"id":163,"depth":565,"text":166,"children":574},[575,576,577,578],{"id":174,"depth":572,"text":177},{"id":185,"depth":572,"text":188},{"id":196,"depth":572,"text":199},{"id":207,"depth":572,"text":210},{"id":231,"depth":565,"text":234,"children":580},[581,582,583],{"id":250,"depth":572,"text":253},{"id":261,"depth":572,"text":264},{"id":272,"depth":572,"text":275},{"id":313,"depth":565,"text":316},{"id":337,"depth":565,"text":340,"children":586},[587],{"id":377,"depth":572,"text":380},{"id":426,"depth":565,"text":429,"children":589},[590],{"id":442,"depth":572,"text":445},{"id":461,"depth":565,"text":464,"children":592},[593,594,595,596],{"id":467,"depth":572,"text":470},{"id":484,"depth":572,"text":487},{"id":499,"depth":572,"text":502},{"id":522,"depth":572,"text":525},"markdown","content:articles:31-crypto-wallet-exchange-device-discovery.md","content","articles\u002F31-crypto-wallet-exchange-device-discovery.md","articles\u002F31-crypto-wallet-exchange-device-discovery","md",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"slug":10,"date":11,"lastUpdated":11,"author":12,"readingTime":13,"category":14,"tags":604,"ogImage":21,"featured":6,"body":605,"_type":597,"_id":598,"_source":599,"_file":600,"_stem":601,"_extension":602},[16,17,18,19,20],{"type":23,"children":606,"toc":1000},[607,611,615,619,629,633,637,656,665,669,673,692,696,700,704,708,712,716,720,724,728,732,736,740,744,753,757,767,771,775,779,783,787,791,811,815,819,829,833,837,856,860,864,899,903,907,911,915,924,928,932,940,944,952,956,969,973,986],{"type":26,"tag":27,"props":608,"children":609},{},[610],{"type":31,"value":32},{"type":26,"tag":34,"props":612,"children":613},{"id":36},[614],{"type":31,"value":39},{"type":26,"tag":27,"props":616,"children":617},{},[618],{"type":31,"value":44},{"type":26,"tag":27,"props":620,"children":621},{},[622,623,628],{"type":31,"value":49},{"type":26,"tag":51,"props":624,"children":626},{"href":53,"rel":625},[55],[627],{"type":31,"value":58},{"type":31,"value":60},{"type":26,"tag":34,"props":630,"children":631},{"id":63},[632],{"type":31,"value":66},{"type":26,"tag":27,"props":634,"children":635},{},[636],{"type":31,"value":71},{"type":26,"tag":73,"props":638,"children":639},{},[640,644,648,652],{"type":26,"tag":77,"props":641,"children":642},{},[643],{"type":31,"value":81},{"type":26,"tag":77,"props":645,"children":646},{},[647],{"type":31,"value":86},{"type":26,"tag":77,"props":649,"children":650},{},[651],{"type":31,"value":91},{"type":26,"tag":77,"props":653,"children":654},{},[655],{"type":31,"value":96},{"type":26,"tag":27,"props":657,"children":658},{},[659,660,664],{"type":31,"value":101},{"type":26,"tag":51,"props":661,"children":662},{"href":104},[663],{"type":31,"value":107},{"type":31,"value":109},{"type":26,"tag":34,"props":666,"children":667},{"id":112},[668],{"type":31,"value":115},{"type":26,"tag":27,"props":670,"children":671},{},[672],{"type":31,"value":120},{"type":26,"tag":73,"props":674,"children":675},{},[676,680,684,688],{"type":26,"tag":77,"props":677,"children":678},{},[679],{"type":31,"value":128},{"type":26,"tag":77,"props":681,"children":682},{},[683],{"type":31,"value":133},{"type":26,"tag":77,"props":685,"children":686},{},[687],{"type":31,"value":138},{"type":26,"tag":77,"props":689,"children":690},{},[691],{"type":31,"value":143},{"type":26,"tag":27,"props":693,"children":694},{},[695],{"type":31,"value":148},{"type":26,"tag":150,"props":697,"children":698},{"id":152},[699],{"type":31,"value":155},{"type":26,"tag":27,"props":701,"children":702},{},[703],{"type":31,"value":160},{"type":26,"tag":34,"props":705,"children":706},{"id":163},[707],{"type":31,"value":166},{"type":26,"tag":27,"props":709,"children":710},{},[711],{"type":31,"value":171},{"type":26,"tag":150,"props":713,"children":714},{"id":174},[715],{"type":31,"value":177},{"type":26,"tag":27,"props":717,"children":718},{},[719],{"type":31,"value":182},{"type":26,"tag":150,"props":721,"children":722},{"id":185},[723],{"type":31,"value":188},{"type":26,"tag":27,"props":725,"children":726},{},[727],{"type":31,"value":193},{"type":26,"tag":150,"props":729,"children":730},{"id":196},[731],{"type":31,"value":199},{"type":26,"tag":27,"props":733,"children":734},{},[735],{"type":31,"value":204},{"type":26,"tag":150,"props":737,"children":738},{"id":207},[739],{"type":31,"value":210},{"type":26,"tag":27,"props":741,"children":742},{},[743],{"type":31,"value":215},{"type":26,"tag":27,"props":745,"children":746},{},[747,748,752],{"type":31,"value":220},{"type":26,"tag":51,"props":749,"children":750},{"href":223},[751],{"type":31,"value":226},{"type":31,"value":228},{"type":26,"tag":34,"props":754,"children":755},{"id":231},[756],{"type":31,"value":234},{"type":26,"tag":27,"props":758,"children":759},{},[760,761,766],{"type":31,"value":239},{"type":26,"tag":51,"props":762,"children":764},{"href":53,"rel":763},[55],[765],{"type":31,"value":245},{"type":31,"value":247},{"type":26,"tag":150,"props":768,"children":769},{"id":250},[770],{"type":31,"value":253},{"type":26,"tag":27,"props":772,"children":773},{},[774],{"type":31,"value":258},{"type":26,"tag":150,"props":776,"children":777},{"id":261},[778],{"type":31,"value":264},{"type":26,"tag":27,"props":780,"children":781},{},[782],{"type":31,"value":269},{"type":26,"tag":150,"props":784,"children":785},{"id":272},[786],{"type":31,"value":275},{"type":26,"tag":27,"props":788,"children":789},{},[790],{"type":31,"value":280},{"type":26,"tag":27,"props":792,"children":793},{},[794,795,800,801,805,806,810],{"type":31,"value":285},{"type":26,"tag":51,"props":796,"children":798},{"href":288,"rel":797},[55],[799],{"type":31,"value":292},{"type":31,"value":294},{"type":26,"tag":51,"props":802,"children":803},{"href":297},[804],{"type":31,"value":300},{"type":31,"value":302},{"type":26,"tag":51,"props":807,"children":808},{"href":305},[809],{"type":31,"value":308},{"type":31,"value":310},{"type":26,"tag":34,"props":812,"children":813},{"id":313},[814],{"type":31,"value":316},{"type":26,"tag":27,"props":816,"children":817},{},[818],{"type":31,"value":321},{"type":26,"tag":27,"props":820,"children":821},{},[822,823,828],{"type":31,"value":326},{"type":26,"tag":51,"props":824,"children":826},{"href":53,"rel":825},[55],[827],{"type":31,"value":332},{"type":31,"value":334},{"type":26,"tag":34,"props":830,"children":831},{"id":337},[832],{"type":31,"value":340},{"type":26,"tag":27,"props":834,"children":835},{},[836],{"type":31,"value":345},{"type":26,"tag":347,"props":838,"children":839},{},[840,844,848,852],{"type":26,"tag":77,"props":841,"children":842},{},[843],{"type":31,"value":354},{"type":26,"tag":77,"props":845,"children":846},{},[847],{"type":31,"value":359},{"type":26,"tag":77,"props":849,"children":850},{},[851],{"type":31,"value":364},{"type":26,"tag":77,"props":853,"children":854},{},[855],{"type":31,"value":369},{"type":26,"tag":27,"props":857,"children":858},{},[859],{"type":31,"value":374},{"type":26,"tag":150,"props":861,"children":862},{"id":377},[863],{"type":31,"value":380},{"type":26,"tag":347,"props":865,"children":866},{},[867,871,875,879,883,887,891,895],{"type":26,"tag":77,"props":868,"children":869},{},[870],{"type":31,"value":388},{"type":26,"tag":77,"props":872,"children":873},{},[874],{"type":31,"value":393},{"type":26,"tag":77,"props":876,"children":877},{},[878],{"type":31,"value":398},{"type":26,"tag":77,"props":880,"children":881},{},[882],{"type":31,"value":403},{"type":26,"tag":77,"props":884,"children":885},{},[886],{"type":31,"value":408},{"type":26,"tag":77,"props":888,"children":889},{},[890],{"type":31,"value":413},{"type":26,"tag":77,"props":892,"children":893},{},[894],{"type":31,"value":418},{"type":26,"tag":77,"props":896,"children":897},{},[898],{"type":31,"value":423},{"type":26,"tag":34,"props":900,"children":901},{"id":426},[902],{"type":31,"value":429},{"type":26,"tag":27,"props":904,"children":905},{},[906],{"type":31,"value":434},{"type":26,"tag":27,"props":908,"children":909},{},[910],{"type":31,"value":439},{"type":26,"tag":150,"props":912,"children":913},{"id":442},[914],{"type":31,"value":445},{"type":26,"tag":27,"props":916,"children":917},{},[918,919,923],{"type":31,"value":450},{"type":26,"tag":51,"props":920,"children":921},{"href":453},[922],{"type":31,"value":456},{"type":31,"value":458},{"type":26,"tag":34,"props":925,"children":926},{"id":461},[927],{"type":31,"value":464},{"type":26,"tag":150,"props":929,"children":930},{"id":467},[931],{"type":31,"value":470},{"type":26,"tag":27,"props":933,"children":934},{},[935,939],{"type":26,"tag":475,"props":936,"children":937},{},[938],{"type":31,"value":479},{"type":31,"value":481},{"type":26,"tag":150,"props":941,"children":942},{"id":484},[943],{"type":31,"value":487},{"type":26,"tag":27,"props":945,"children":946},{},[947,951],{"type":26,"tag":475,"props":948,"children":949},{},[950],{"type":31,"value":479},{"type":31,"value":496},{"type":26,"tag":150,"props":953,"children":954},{"id":499},[955],{"type":31,"value":502},{"type":26,"tag":27,"props":957,"children":958},{},[959,963,964,968],{"type":26,"tag":475,"props":960,"children":961},{},[962],{"type":31,"value":479},{"type":31,"value":511},{"type":26,"tag":51,"props":965,"children":966},{"href":514},[967],{"type":31,"value":517},{"type":31,"value":519},{"type":26,"tag":150,"props":970,"children":971},{"id":522},[972],{"type":31,"value":525},{"type":26,"tag":27,"props":974,"children":975},{},[976,980,981,985],{"type":26,"tag":475,"props":977,"children":978},{},[979],{"type":31,"value":479},{"type":31,"value":534},{"type":26,"tag":51,"props":982,"children":983},{"href":537},[984],{"type":31,"value":540},{"type":31,"value":542},{"type":26,"tag":27,"props":987,"children":988},{},[989,990,994,995,999],{"type":31,"value":547},{"type":26,"tag":51,"props":991,"children":992},{"href":550},[993],{"type":31,"value":553},{"type":31,"value":555},{"type":26,"tag":51,"props":996,"children":997},{"href":558},[998],{"type":31,"value":561},{"type":31,"value":563},{"title":7,"searchDepth":565,"depth":565,"links":1001},[1002,1003,1004,1007,1013,1018,1019,1022,1025],{"id":36,"depth":565,"text":39},{"id":63,"depth":565,"text":66},{"id":112,"depth":565,"text":115,"children":1005},[1006],{"id":152,"depth":572,"text":155},{"id":163,"depth":565,"text":166,"children":1008},[1009,1010,1011,1012],{"id":174,"depth":572,"text":177},{"id":185,"depth":572,"text":188},{"id":196,"depth":572,"text":199},{"id":207,"depth":572,"text":210},{"id":231,"depth":565,"text":234,"children":1014},[1015,1016,1017],{"id":250,"depth":572,"text":253},{"id":261,"depth":572,"text":264},{"id":272,"depth":572,"text":275},{"id":313,"depth":565,"text":316},{"id":337,"depth":565,"text":340,"children":1020},[1021],{"id":377,"depth":572,"text":380},{"id":426,"depth":565,"text":429,"children":1023},[1024],{"id":442,"depth":572,"text":445},{"id":461,"depth":565,"text":464,"children":1026},[1027,1028,1029,1030],{"id":467,"depth":572,"text":470},{"id":484,"depth":572,"text":487},{"id":499,"depth":572,"text":502},{"id":522,"depth":572,"text":525},[1032,1810,2301],{"_path":1033,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":1034,"description":1035,"slug":1036,"date":1037,"lastUpdated":1037,"author":12,"readingTime":13,"category":14,"tags":1038,"ogImage":1043,"featured":6,"body":1044,"_type":597,"_id":1807,"_source":599,"_file":1808,"_stem":1809,"_extension":602},"\u002Farticles\u002F23-sanctions-blockchain-tracing-ofac-match-evidence","Sanctions and blockchain tracing: What an OFAC match proves","How attorneys should distinguish OFAC-listed addresses, vendor attributions, indirect transaction paths, ownership rules, and risk-score evidence.","sanctions-blockchain-tracing-ofac-match-evidence","2026-09-19",[1039,1040,1041,1042],"ofac","sanctions","blockchain-tracing","evidence","\u002Fog\u002Fsanctions-blockchain-tracing-ofac-match-evidence.png",{"type":23,"children":1045,"toc":1784},[1046,1051,1056,1062,1067,1090,1095,1109,1123,1129,1135,1149,1161,1175,1180,1186,1191,1203,1209,1232,1246,1251,1257,1262,1276,1288,1294,1299,1312,1318,1323,1366,1378,1391,1397,1402,1450,1463,1484,1490,1495,1500,1511,1517,1531,1536,1550,1563,1569,1574,1579,1584,1590,1693,1697,1703,1712,1718,1727,1733,1742,1748,1757,1763,1772],{"type":26,"tag":27,"props":1047,"children":1048},{},[1049],{"type":31,"value":1050},"A blockchain tracing report says a wallet is “connected to a sanctioned exchange.” That phrase may describe an exact address published by the U.S. Department of the Treasury's Office of Foreign Assets Control, a commercial attribution to a listed person, an indirect transaction path, or a vendor-generated risk score. Those findings are not interchangeable.",{"type":26,"tag":27,"props":1052,"children":1053},{},[1054],{"type":31,"value":1055},"A public blockchain can establish transactions between addresses. It does not, by itself, establish who controlled an address, who owned the property, what a party knew, which sanctions authority applied, or whether a transaction was prohibited. Counsel should begin with a narrower question: What exactly matched, on what date, under which authority, and based on what evidence?",{"type":26,"tag":34,"props":1057,"children":1059},{"id":1058},"why-is-an-ofac-designation-not-a-tracing-conclusion",[1060],{"type":31,"value":1061},"Why is an OFAC designation not a tracing conclusion?",{"type":26,"tag":27,"props":1063,"children":1064},{},[1065],{"type":31,"value":1066},"OFAC administers sanctions programs under different statutes, executive orders, and regulations. The legal effect of a match depends on the governing program, the parties and property involved, jurisdiction, ownership, and timing. A blockchain trace may supply relevant facts, but it does not determine which legal rule applies.",{"type":26,"tag":27,"props":1068,"children":1069},{},[1070,1072,1079,1081,1088],{"type":31,"value":1071},"The September 17, 2026 BitBank action illustrates the distinction. OFAC added BitBank, its developer Pishtaz Simorgh Electronic Trade Company, and three individuals to the Specially Designated Nationals and Blocked Persons List. Treasury described BitBank as a digital asset venture controlled by OFAC-designated Iranian financier Babak Zanjani and stated that Zanjani used it to facilitate transfers of hundreds of millions of dollars' worth of Bitcoin to the Islamic Revolutionary Guard Corps. Those are Treasury's administrative findings and allegations, not judicial findings. (",{"type":26,"tag":51,"props":1073,"children":1076},{"href":1074,"rel":1075},"https:\u002F\u002Fhome.treasury.gov\u002Fnews\u002Fpress-releases\u002Fsb0632",[55],[1077],{"type":31,"value":1078},"Treasury release",{"type":31,"value":1080},"; ",{"type":26,"tag":51,"props":1082,"children":1085},{"href":1083,"rel":1084},"https:\u002F\u002Fofac.treasury.gov\u002Frecent-actions\u002F20260917",[55],[1086],{"type":31,"value":1087},"OFAC list update",{"type":31,"value":1089},")",{"type":26,"tag":27,"props":1091,"children":1092},{},[1093],{"type":31,"value":1094},"The public entries issued with that action did not publish a digital currency address for BitBank. A later provider label connecting an address to BitBank would therefore be a third-party attribution unless OFAC separately published the address. Calling it an “OFAC-listed address” would overstate the official record.",{"type":26,"tag":27,"props":1096,"children":1097},{},[1098,1100,1107],{"type":31,"value":1099},"The designation date also is not necessarily the first date on which restrictions applied. ",{"type":26,"tag":51,"props":1101,"children":1104},{"href":1102,"rel":1103},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F1250",[55],[1105],{"type":31,"value":1106},"OFAC FAQ 1250",{"type":31,"value":1108}," states that Iranian digital asset exchanges meet the regulatory definition of an Iranian financial institution and are blocked under Executive Order 13599 and the Iranian Transactions and Sanctions Regulations regardless of whether they appear by name on the SDN List. Property and interests in property of those exchanges within U.S. jurisdiction or the possession or control of a U.S. person are blocked and must be reported.",{"type":26,"tag":27,"props":1110,"children":1111},{},[1112,1114,1121],{"type":31,"value":1113},"The analysis for non-U.S. persons is different. ",{"type":26,"tag":51,"props":1115,"children":1118},{"href":1116,"rel":1117},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F1257",[55],[1119],{"type":31,"value":1120},"OFAC FAQ 1257",{"type":31,"value":1122}," identifies separate potential consequences: designation of a person that materially assists or supports a designated exchange; correspondent or payable-through account restrictions on a foreign financial institution that knowingly conducts or facilitates a significant financial transaction for the exchange; and statutory sanctions involving significant transactions with designated Iranian financial institutions. Those authorities address different actors, conduct, and consequences.",{"type":26,"tag":34,"props":1124,"children":1126},{"id":1125},"what-are-the-five-findings-that-reports-often-collapse-into-one-match",[1127],{"type":31,"value":1128},"What are the five findings that reports often collapse into one match?",{"type":26,"tag":150,"props":1130,"children":1132},{"id":1131},"_1-an-exact-match-to-an-address-published-by-ofac",[1133],{"type":31,"value":1134},"1. An exact match to an address published by OFAC",{"type":26,"tag":27,"props":1136,"children":1137},{},[1138,1140,1147],{"type":31,"value":1139},"OFAC may add digital currency addresses to an SDN List entry as identifiers associated with a blocked person, although ",{"type":26,"tag":51,"props":1141,"children":1144},{"href":1142,"rel":1143},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F562",[55],[1145],{"type":31,"value":1146},"OFAC FAQ 562",{"type":31,"value":1148}," warns that published addresses are not likely to be exhaustive. The absence of an address from an entry does not prove that the listed person has no interest in it.",{"type":26,"tag":27,"props":1150,"children":1151},{},[1152,1159],{"type":26,"tag":51,"props":1153,"children":1156},{"href":1154,"rel":1155},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F594",[55],[1157],{"type":31,"value":1158},"OFAC FAQ 594",{"type":31,"value":1160}," directs users to enter a digital currency address in the Sanctions List Search tool's ID # field. That field does not use fuzzy logic, so it returns only exact matches. The search result should still be validated under the relevant network's parsing and canonicalization rules.",{"type":26,"tag":27,"props":1162,"children":1163},{},[1164,1166,1173],{"type":31,"value":1165},"Ethereum is an important example. An Ethereum address represents a 20-byte value, while mixed capitalization can encode an ",{"type":26,"tag":51,"props":1167,"children":1170},{"href":1168,"rel":1169},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-55",[55],[1171],{"type":31,"value":1172},"ERC-55 checksum",{"type":31,"value":1174},". A casing correction can therefore identify the same underlying address. A report should not claim that every visible character difference necessarily creates a different Ethereum address without first applying the network's rules.",{"type":26,"tag":27,"props":1176,"children":1177},{},[1178],{"type":31,"value":1179},"A network-validated exact match supports the statement that OFAC publicly associated the identifier with the listed person as of the applicable entry. It does not independently establish who controlled the address on every earlier date, who authorized a transaction, or what another party knew.",{"type":26,"tag":150,"props":1181,"children":1183},{"id":1182},"_2-a-third-party-attribution-to-a-listed-person-or-entity",[1184],{"type":31,"value":1185},"2. A third-party attribution to a listed person or entity",{"type":26,"tag":27,"props":1187,"children":1188},{},[1189],{"type":31,"value":1190},"A commercial analytics provider may attribute addresses that OFAC has not published. The report should identify the provider, product, query date, label, confidence or category, and disclosed basis. “The provider attributed this address to BitBank” accurately describes the evidence. “OFAC listed this address” does not, unless the official entry contains it.",{"type":26,"tag":27,"props":1192,"children":1193},{},[1194,1196,1201],{"type":31,"value":1195},"Attribution also does not necessarily resolve ownership. Exchange records, account data, device evidence, corporate records, signed messages, and testimony may be needed to connect an address to a person or entity. ",{"type":26,"tag":51,"props":1197,"children":1198},{"href":297},[1199],{"type":31,"value":1200},"Understanding wallet ownership evidence",{"type":31,"value":1202}," explains why control of keys, account ownership, and ownership of the assets are separate questions.",{"type":26,"tag":150,"props":1204,"children":1206},{"id":1205},"_3-an-unlisted-entity-blocked-under-the-50-percent-rule",[1207],{"type":31,"value":1208},"3. An unlisted entity blocked under the 50 Percent Rule",{"type":26,"tag":27,"props":1210,"children":1211},{},[1212,1214,1221,1223,1230],{"type":31,"value":1213},"An entity need not appear by name on the SDN List to be blocked. ",{"type":26,"tag":51,"props":1215,"children":1218},{"href":1216,"rel":1217},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F401",[55],[1219],{"type":31,"value":1220},"OFAC FAQ 401",{"type":31,"value":1222}," states that an entity directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is considered blocked. OFAC's ",{"type":26,"tag":51,"props":1224,"children":1227},{"href":1225,"rel":1226},"https:\u002F\u002Fofac.treasury.gov\u002Fmedia\u002F6186\u002Fdownload?inline",[55],[1228],{"type":31,"value":1229},"50 Percent Rule guidance",{"type":31,"value":1231}," explains that qualifying interests held by multiple blocked persons are aggregated.",{"type":26,"tag":27,"props":1233,"children":1234},{},[1235,1237,1244],{"type":31,"value":1236},"Control is a separate issue. ",{"type":26,"tag":51,"props":1238,"children":1241},{"href":1239,"rel":1240},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F398",[55],[1242],{"type":31,"value":1243},"OFAC FAQ 398",{"type":31,"value":1245}," states that an entity controlled by blocked persons, but not owned 50 percent or more in the aggregate, is not automatically blocked under the rule. OFAC may separately designate the entity and urges caution when blocked persons hold significant minority interests or exercise control.",{"type":26,"tag":27,"props":1247,"children":1248},{},[1249],{"type":31,"value":1250},"Blockchain activity rarely proves corporate ownership percentages by itself. Counsel may need shareholder records, beneficial-ownership information, formation documents, agreements, governance records, and testimony. Operational control of a wallet is not a substitute for the ownership analysis.",{"type":26,"tag":150,"props":1252,"children":1254},{"id":1253},"_4-an-indirect-transaction-path",[1255],{"type":31,"value":1256},"4. An indirect transaction path",{"type":26,"tag":27,"props":1258,"children":1259},{},[1260],{"type":31,"value":1261},"A transaction graph may show funds moving from a listed or attributed address through intermediaries to the wallet under review. That path is transaction history. It is not automatic proof that each downstream wallet is blocked, owned by the sanctioned party, or involved in evasion.",{"type":26,"tag":27,"props":1263,"children":1264},{},[1265,1267,1274],{"type":31,"value":1266},"OFAC's ",{"type":26,"tag":51,"props":1268,"children":1271},{"href":1269,"rel":1270},"https:\u002F\u002Fofac.treasury.gov\u002Fsystem\u002Ffiles\u002F126\u002Fvirtual_currency_guidance_brochure.pdf",[55],[1272],{"type":31,"value":1273},"Sanctions Compliance Guidance for the Virtual Currency Industry",{"type":31,"value":1275}," recommends a risk-based compliance program that may include address screening, transaction monitoring, investigation, and blockchain analytics. It does not establish a universal rule under which every wallet within a fixed number of hops acquires the legal status of the original listed address.",{"type":26,"tag":27,"props":1277,"children":1278},{},[1279,1281,1286],{"type":31,"value":1280},"Terms such as “direct,” “one hop,” and “indirect” should describe the transaction path. They should not silently substitute for an ownership, attribution, knowledge, or liability conclusion. A sound ",{"type":26,"tag":51,"props":1282,"children":1283},{"href":453},[1284],{"type":31,"value":1285},"blockchain tracing analysis",{"type":31,"value":1287}," separates ledger facts from the inferences drawn from them.",{"type":26,"tag":150,"props":1289,"children":1291},{"id":1290},"_5-a-vendor-generated-risk-score-or-alert",[1292],{"type":31,"value":1293},"5. A vendor-generated risk score or alert",{"type":26,"tag":27,"props":1295,"children":1296},{},[1297],{"type":31,"value":1298},"A risk score is an analytical output, not an OFAC determination. Counsel should obtain the transactions and attribution evidence behind it, including what triggered the alert, which addresses contributed, the exposure settings and time period, and when the provider applied or changed the label.",{"type":26,"tag":27,"props":1300,"children":1301},{},[1302,1304,1310],{"type":31,"value":1303},"A score may be useful for triage, but its meaning depends on the provider's methodology. ",{"type":26,"tag":51,"props":1305,"children":1307},{"href":1306},"\u002Fresources\u002Fwhy-blockchain-forensic-reports-fail-daubert",[1308],{"type":31,"value":1309},"Why most blockchain forensic reports fail Daubert scrutiny",{"type":31,"value":1311}," addresses the broader problems created when a dispositive conclusion rests on untested commercial labels or opaque rules.",{"type":26,"tag":34,"props":1313,"children":1315},{"id":1314},"how-should-counsel-build-the-sanctions-timeline",[1316],{"type":31,"value":1317},"How should counsel build the sanctions timeline?",{"type":26,"tag":27,"props":1319,"children":1320},{},[1321],{"type":31,"value":1322},"Chronology is often the difference between a useful trace and a misleading conclusion. Record at least:",{"type":26,"tag":347,"props":1324,"children":1325},{},[1326,1331,1336,1341,1346,1351,1356,1361],{"type":26,"tag":77,"props":1327,"children":1328},{},[1329],{"type":31,"value":1330},"the date and time of each relevant blockchain transaction;",{"type":26,"tag":77,"props":1332,"children":1333},{},[1334],{"type":31,"value":1335},"the block number and transaction hash;",{"type":26,"tag":77,"props":1337,"children":1338},{},[1339],{"type":31,"value":1340},"the date the person, entity, or address was listed;",{"type":26,"tag":77,"props":1342,"children":1343},{},[1344],{"type":31,"value":1345},"any earlier authority under which the person or property may already have been blocked;",{"type":26,"tag":77,"props":1347,"children":1348},{},[1349],{"type":31,"value":1350},"the date the analytics provider created, changed, or withdrew its attribution;",{"type":26,"tag":77,"props":1352,"children":1353},{},[1354],{"type":31,"value":1355},"the date the client or institution received the alert;",{"type":26,"tag":77,"props":1357,"children":1358},{},[1359],{"type":31,"value":1360},"any blocking, rejection, return, unblocking, or transfer date; and",{"type":26,"tag":77,"props":1362,"children":1363},{},[1364],{"type":31,"value":1365},"any report, license request, subpoena response, or OFAC communication date.",{"type":26,"tag":27,"props":1367,"children":1368},{},[1369,1376],{"type":26,"tag":51,"props":1370,"children":1373},{"href":1371,"rel":1372},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F5",[55],[1374],{"type":31,"value":1375},"OFAC FAQ 5",{"type":31,"value":1377}," recommends that organizations investigating a potential name match identify the list or sanctions program that generated the alert, review the complete entry, compare available identifiers, obtain additional information where necessary, and follow their sanctions procedures for likely matches. It does not say that every doubtful match must be reported to OFAC. OFAC also explains that it does not confirm potential matches or false positives for organizations and instead expects risk-based determinations.",{"type":26,"tag":27,"props":1379,"children":1380},{},[1381,1383,1390],{"type":31,"value":1382},"As an evidentiary practice, preserve the search result, list data, provider output, and analysis date so the decision can be reconstructed. That preservation recommendation is separate from FAQ 5. Questions about whether virtual currency must be blocked may be directed to OFAC's Compliance Hotline under ",{"type":26,"tag":51,"props":1384,"children":1387},{"href":1385,"rel":1386},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F646",[55],[1388],{"type":31,"value":1389},"FAQ 646",{"type":31,"value":519},{"type":26,"tag":34,"props":1392,"children":1394},{"id":1393},"what-should-a-reproducible-evidence-package-contain",[1395],{"type":31,"value":1396},"What should a reproducible evidence package contain?",{"type":26,"tag":27,"props":1398,"children":1399},{},[1400],{"type":31,"value":1401},"Preserve enough material for another qualified analyst to repeat the work:",{"type":26,"tag":73,"props":1403,"children":1404},{},[1405,1410,1415,1420,1425,1430,1435,1440,1445],{"type":26,"tag":77,"props":1406,"children":1407},{},[1408],{"type":31,"value":1409},"the complete address in plain text and the relevant blockchain or network;",{"type":26,"tag":77,"props":1411,"children":1412},{},[1413],{"type":31,"value":1414},"the canonical or checksum-validated form used for comparison;",{"type":26,"tag":77,"props":1416,"children":1417},{},[1418],{"type":31,"value":1419},"transaction hashes, block numbers, timestamps, asset type, and amount;",{"type":26,"tag":77,"props":1421,"children":1422},{},[1423],{"type":31,"value":1424},"raw transaction and receipt data where available;",{"type":26,"tag":77,"props":1426,"children":1427},{},[1428],{"type":31,"value":1429},"the dated OFAC entry or sanctions-list data;",{"type":26,"tag":77,"props":1431,"children":1432},{},[1433],{"type":31,"value":1434},"the provider, product, version, query date, report identifier, and settings;",{"type":26,"tag":77,"props":1436,"children":1437},{},[1438],{"type":31,"value":1439},"labels, confidence levels, exposure thresholds, hop settings, and the relied-upon path;",{"type":26,"tag":77,"props":1441,"children":1442},{},[1443],{"type":31,"value":1444},"analyst notes and any manual changes to automated output; and",{"type":26,"tag":77,"props":1446,"children":1447},{},[1448],{"type":31,"value":1449},"records showing when the alert was received, investigated, and resolved.",{"type":26,"tag":27,"props":1451,"children":1452},{},[1453,1455,1462],{"type":31,"value":1454},"The current recordkeeping rule generally requires full and accurate transaction records for at least ten years. Records of blocked property must be retained while the property remains blocked and for at least ten years after it is unblocked. (",{"type":26,"tag":51,"props":1456,"children":1459},{"href":1457,"rel":1458},"https:\u002F\u002Fwww.ecfr.gov\u002Fcurrent\u002Ftitle-31\u002Fsubtitle-B\u002Fchapter-V\u002Fpart-501\u002Fsubpart-C\u002Fsection-501.601",[55],[1460],{"type":31,"value":1461},"31 C.F.R. § 501.601",{"type":31,"value":1089},{"type":26,"tag":27,"props":1464,"children":1465},{},[1466,1468,1475,1476,1483],{"type":31,"value":1467},"OFAC's 2021 virtual currency guidance PDF still contains a five-year recordkeeping statement. That text predates the amendment that extended the regulatory period from five to ten years, effective in March 2025. The current regulation controls. (",{"type":26,"tag":51,"props":1469,"children":1472},{"href":1470,"rel":1471},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2024\u002F09\u002F13\u002F2024-20674\u002Freporting-recordkeeping-and-instructions-requirements-extension-of-recordkeeping-requirements",[55],[1473],{"type":31,"value":1474},"2024 interim final rule",{"type":31,"value":1080},{"type":26,"tag":51,"props":1477,"children":1480},{"href":1478,"rel":1479},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2025\u002F03\u002F21\u002F2025-04864\u002Freporting-recordkeeping-and-instructions-requirements-extension-of-recordkeeping-requirements",[55],[1481],{"type":31,"value":1482},"2025 final rule",{"type":31,"value":1089},{"type":26,"tag":34,"props":1485,"children":1487},{"id":1486},"what-discovery-is-most-useful",[1488],{"type":31,"value":1489},"What discovery is most useful?",{"type":26,"tag":27,"props":1491,"children":1492},{},[1493],{"type":31,"value":1494},"Discovery should connect an address to a person, account, property interest, or business process. For a custodian, requests may seek KYC materials, beneficial owners, assigned deposit addresses, ledgers, internal identifiers, login and device data, withdrawal approvals, communications, sanctions alerts, investigation notes, and OFAC reports.",{"type":26,"tag":27,"props":1496,"children":1497},{},[1498],{"type":31,"value":1499},"For an analytics provider or expert, seek the transaction set, source and date of each attribution, software and ruleset, exposure settings, overrides, validation procedures, limitations, and label history. A protective order may address proprietary material without preventing meaningful testing of a dispositive attribution.",{"type":26,"tag":27,"props":1501,"children":1502},{},[1503,1505,1510],{"type":31,"value":1504},"For a 50 Percent Rule issue, request evidence of direct and indirect equity interests, intermediary entities, nominee arrangements, and ownership changes over time. Do not infer aggregate corporate ownership from wallet activity alone. The same separation of source data, method, and conclusion should appear in the final report and is part of ConsensusIntel's ",{"type":26,"tag":51,"props":1506,"children":1507},{"href":550},[1508],{"type":31,"value":1509},"forensic methodology",{"type":31,"value":519},{"type":26,"tag":34,"props":1512,"children":1514},{"id":1513},"what-happens-when-property-must-be-blocked",[1515],{"type":31,"value":1516},"What happens when property must be blocked?",{"type":26,"tag":27,"props":1518,"children":1519},{},[1520,1522,1529],{"type":31,"value":1521},"Blocking freezes property; it does not transfer title to the government. ",{"type":26,"tag":51,"props":1523,"children":1526},{"href":1524,"rel":1525},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F9",[55],[1527],{"type":31,"value":1528},"OFAC FAQ 9",{"type":31,"value":1530}," states that title remains with the blocked person, while transfers and other exercises of ownership are prohibited without authorization.",{"type":26,"tag":27,"props":1532,"children":1533},{},[1534],{"type":31,"value":1535},"Once a U.S. person determines that it holds virtual currency required to be blocked, FAQ 646 requires denial of access, compliance with holding and reporting requirements, and risk-based controls. OFAC describes blocking each affected wallet or consolidating blocked virtual currency into another controlled wallet as permissible examples for a virtual currency company. It does not require every holder to move every blocked asset into a new wallet. Conversion to fiat currency is not required.",{"type":26,"tag":27,"props":1537,"children":1538},{},[1539,1541,1548],{"type":31,"value":1540},"The initial blocking report is due within ten business days, with annual reports required while the property remains blocked. ",{"type":26,"tag":51,"props":1542,"children":1545},{"href":1543,"rel":1544},"https:\u002F\u002Fwww.ecfr.gov\u002Fcurrent\u002Ftitle-31\u002Fsubtitle-B\u002Fchapter-V\u002Fpart-501\u002Fsubpart-C\u002Fsection-501.603",[55],[1546],{"type":31,"value":1547},"31 C.F.R. § 501.603",{"type":31,"value":1549}," assigns primary responsibility to the holder or other specified person and permits an attorney or agent to file on that person's behalf.",{"type":26,"tag":27,"props":1551,"children":1552},{},[1553,1555,1561],{"type":31,"value":1554},"Regulatory blocking is also different from a stablecoin issuer's technical ability to blacklist tokens at an address. ",{"type":26,"tag":51,"props":1556,"children":1558},{"href":1557},"\u002Fresources\u002Fstablecoins-freeze-option-usdt-usdc",[1559],{"type":31,"value":1560},"Stablecoins and the freeze option",{"type":31,"value":1562}," explains that separate mechanism.",{"type":26,"tag":34,"props":1564,"children":1566},{"id":1565},"how-does-the-framework-apply-to-a-transaction-path",[1567],{"type":31,"value":1568},"How does the framework apply to a transaction path?",{"type":26,"tag":27,"props":1570,"children":1571},{},[1572],{"type":31,"value":1573},"Hypothetical example: A client's wallet receives 12 ETH from Address B in June. In September, a tracing provider reports that Address B received funds two transactions earlier from an address the provider attributes to a newly designated exchange.",{"type":26,"tag":27,"props":1575,"children":1576},{},[1577],{"type":31,"value":1578},"The blockchain may establish the transaction path. The provider's records may establish that it applied the exchange label to the upstream address on a particular date. Neither fact alone establishes that Address B was controlled by the exchange, that the client's June receipt involved property in which the exchange had an interest, that the client knew of the upstream source, or that the September designation was the first restriction applicable to the exchange.",{"type":26,"tag":27,"props":1580,"children":1581},{},[1582],{"type":31,"value":1583},"A defensible analysis would verify the path, timing, any OFAC-published address, the governing authority, any earlier blocking status, ownership or control of Address B, available custodial records, and the client's jurisdictional status. The report should separate on-chain facts, third-party attribution, legal assumptions, and unresolved questions.",{"type":26,"tag":34,"props":1585,"children":1587},{"id":1586},"what-is-the-practical-response-to-an-ofac-related-alert",[1588],{"type":31,"value":1589},"What is the practical response to an OFAC-related alert?",{"type":26,"tag":347,"props":1591,"children":1592},{},[1593,1603,1613,1623,1633,1643,1653,1663,1673,1683],{"type":26,"tag":77,"props":1594,"children":1595},{},[1596,1601],{"type":26,"tag":475,"props":1597,"children":1598},{},[1599],{"type":31,"value":1600},"Preserve the exact result.",{"type":31,"value":1602}," Save the address, network, list entry, provider output, settings, date, and underlying transactions.",{"type":26,"tag":77,"props":1604,"children":1605},{},[1606,1611],{"type":26,"tag":475,"props":1607,"children":1608},{},[1609],{"type":31,"value":1610},"Validate the address correctly.",{"type":31,"value":1612}," Use the OFAC ID # field and apply the blockchain's canonicalization and checksum rules.",{"type":26,"tag":77,"props":1614,"children":1615},{},[1616,1621],{"type":26,"tag":475,"props":1617,"children":1618},{},[1619],{"type":31,"value":1620},"Identify what matched.",{"type":31,"value":1622}," Distinguish an OFAC-published address from a vendor attribution, ownership conclusion, indirect path, or score.",{"type":26,"tag":77,"props":1624,"children":1625},{},[1626,1631],{"type":26,"tag":475,"props":1627,"children":1628},{},[1629],{"type":31,"value":1630},"Identify the authority.",{"type":31,"value":1632}," Determine the sanctions program, executive order, regulation, and any earlier blocking rule.",{"type":26,"tag":77,"props":1634,"children":1635},{},[1636,1641],{"type":26,"tag":475,"props":1637,"children":1638},{},[1639],{"type":31,"value":1640},"Build the timeline.",{"type":31,"value":1642}," Separate transaction, designation, attribution, discovery, blocking, and reporting dates.",{"type":26,"tag":77,"props":1644,"children":1645},{},[1646,1651],{"type":26,"tag":475,"props":1647,"children":1648},{},[1649],{"type":31,"value":1650},"Determine jurisdiction and actor.",{"type":31,"value":1652}," Identify the relevant person, institution, holder, property, and conduct.",{"type":26,"tag":77,"props":1654,"children":1655},{},[1656,1661],{"type":26,"tag":475,"props":1657,"children":1658},{},[1659],{"type":31,"value":1660},"Investigate ownership and control.",{"type":31,"value":1662}," Apply the 50 Percent Rule to documented ownership, not wallet activity alone.",{"type":26,"tag":77,"props":1664,"children":1665},{},[1666,1671],{"type":26,"tag":475,"props":1667,"children":1668},{},[1669],{"type":31,"value":1670},"Separate fact from inference.",{"type":31,"value":1672}," State what the ledger records, what a provider attributes, and what counsel or the expert concludes.",{"type":26,"tag":77,"props":1674,"children":1675},{},[1676,1681],{"type":26,"tag":475,"props":1677,"children":1678},{},[1679],{"type":31,"value":1680},"Assess blocking and reporting duties promptly.",{"type":31,"value":1682}," Apply the governing authority rather than a generic “sanctions exposure” label.",{"type":26,"tag":77,"props":1684,"children":1685},{},[1686,1691],{"type":26,"tag":475,"props":1687,"children":1688},{},[1689],{"type":31,"value":1690},"Use program-specific legal advice.",{"type":31,"value":1692}," Blockchain expertise reconstructs transactions; it does not replace sanctions counsel.",{"type":26,"tag":34,"props":1694,"children":1695},{"id":461},[1696],{"type":31,"value":464},{"type":26,"tag":150,"props":1698,"children":1700},{"id":1699},"q-does-an-exact-match-to-an-ofac-published-address-prove-who-owned-the-wallet",[1701],{"type":31,"value":1702},"Q: Does an exact match to an OFAC-published address prove who owned the wallet?",{"type":26,"tag":27,"props":1704,"children":1705},{},[1706,1710],{"type":26,"tag":475,"props":1707,"children":1708},{},[1709],{"type":31,"value":479},{"type":31,"value":1711}," No. It proves that OFAC publicly associated that identifier with a listed person as of the relevant entry. Ownership or control on a particular date may require exchange records, account data, device evidence, corporate records, signed messages, or testimony.",{"type":26,"tag":150,"props":1713,"children":1715},{"id":1714},"q-does-a-one-hop-or-indirect-connection-make-the-receiving-wallet-sanctioned",[1716],{"type":31,"value":1717},"Q: Does a one-hop or indirect connection make the receiving wallet sanctioned?",{"type":26,"tag":27,"props":1719,"children":1720},{},[1721,1725],{"type":26,"tag":475,"props":1722,"children":1723},{},[1724],{"type":31,"value":479},{"type":31,"value":1726}," Not automatically. The path establishes transaction history. Counsel must separately analyze attribution, property interests, ownership, jurisdiction, timing, knowledge where relevant, and the governing sanctions authority.",{"type":26,"tag":150,"props":1728,"children":1730},{"id":1729},"q-can-an-entity-be-blocked-even-if-it-is-not-named-on-the-sdn-list",[1731],{"type":31,"value":1732},"Q: Can an entity be blocked even if it is not named on the SDN List?",{"type":26,"tag":27,"props":1734,"children":1735},{},[1736,1740],{"type":26,"tag":475,"props":1737,"children":1738},{},[1739],{"type":31,"value":479},{"type":31,"value":1741}," Yes. An entity directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is considered blocked under OFAC's 50 Percent Rule. Control without the required ownership percentage does not automatically produce that result.",{"type":26,"tag":150,"props":1743,"children":1745},{"id":1744},"q-how-long-should-sanctions-related-cryptocurrency-records-be-retained",[1746],{"type":31,"value":1747},"Q: How long should sanctions-related cryptocurrency records be retained?",{"type":26,"tag":27,"props":1749,"children":1750},{},[1751,1755],{"type":26,"tag":475,"props":1752,"children":1753},{},[1754],{"type":31,"value":479},{"type":31,"value":1756}," The current OFAC recordkeeping rule generally requires transaction records for at least ten years. Records of blocked property must be kept while the property remains blocked and for at least ten years after unblocking. Other litigation, regulatory, or contractual preservation duties may require longer retention.",{"type":26,"tag":150,"props":1758,"children":1760},{"id":1759},"q-what-should-counsel-request-from-a-blockchain-analytics-provider",[1761],{"type":31,"value":1762},"Q: What should counsel request from a blockchain analytics provider?",{"type":26,"tag":27,"props":1764,"children":1765},{},[1766,1770],{"type":26,"tag":475,"props":1767,"children":1768},{},[1769],{"type":31,"value":479},{"type":31,"value":1771}," Request the underlying transactions, attribution sources and dates, product and version, ruleset, exposure and hop settings, confidence categories, overrides, validation procedures, limitations, and label history. The goal is to make the reported conclusion testable rather than relying on a score alone.",{"type":26,"tag":27,"props":1773,"children":1774},{},[1775,1777,1782],{"type":31,"value":1776},"Every matter turns on its facts, the applicable sanctions program, and the evidence available. For a case-specific tracing or evidentiary question, ",{"type":26,"tag":51,"props":1778,"children":1779},{"href":558},[1780],{"type":31,"value":1781},"contact ConsensusIntel",{"type":31,"value":1783}," to discuss the record and the scope of analysis needed.",{"title":7,"searchDepth":565,"depth":565,"links":1785},[1786,1787,1794,1795,1796,1797,1798,1799,1800],{"id":1058,"depth":565,"text":1061},{"id":1125,"depth":565,"text":1128,"children":1788},[1789,1790,1791,1792,1793],{"id":1131,"depth":572,"text":1134},{"id":1182,"depth":572,"text":1185},{"id":1205,"depth":572,"text":1208},{"id":1253,"depth":572,"text":1256},{"id":1290,"depth":572,"text":1293},{"id":1314,"depth":565,"text":1317},{"id":1393,"depth":565,"text":1396},{"id":1486,"depth":565,"text":1489},{"id":1513,"depth":565,"text":1516},{"id":1565,"depth":565,"text":1568},{"id":1586,"depth":565,"text":1589},{"id":461,"depth":565,"text":464,"children":1801},[1802,1803,1804,1805,1806],{"id":1699,"depth":572,"text":1702},{"id":1714,"depth":572,"text":1717},{"id":1729,"depth":572,"text":1732},{"id":1744,"depth":572,"text":1747},{"id":1759,"depth":572,"text":1762},"content:articles:23-sanctions-blockchain-tracing-ofac-match-evidence.md","articles\u002F23-sanctions-blockchain-tracing-ofac-match-evidence.md","articles\u002F23-sanctions-blockchain-tracing-ofac-match-evidence",{"_path":1811,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":1812,"description":1813,"slug":1814,"date":1815,"lastUpdated":1815,"author":12,"readingTime":1816,"category":14,"tags":1817,"ogImage":1822,"featured":6,"body":1823,"_type":597,"_id":2298,"_source":599,"_file":2299,"_stem":2300,"_extension":602},"\u002Farticles\u002F36-wallet-attribution-rule-104b","Wallet attribution and proposed Rule 104(b): judge vs jury roles","How proposed Rule 104(b) would reshape conditional relevance for wallet attribution evidence: what stays with the judge and what goes to the jury.","wallet-attribution-rule-104b","2026-08-15",11,[1042,1818,1819,1820,1821],"admissibility","federal-rules","conditional-relevance","wallet-attribution","\u002Fog\u002Fwallet-attribution-rule-104b.png",{"type":23,"children":1824,"toc":2267},[1825,1830,1835,1841,1846,1851,1879,1885,1891,1905,1911,1916,1922,1927,1933,1939,1970,1976,1981,1987,1992,1997,2003,2008,2014,2019,2024,2030,2035,2041,2046,2052,2057,2063,2068,2074,2079,2084,2089,2095,2138,2144,2149,2153,2159,2168,2174,2183,2189,2198,2204,2213,2219,2228],{"type":26,"tag":27,"props":1826,"children":1827},{},[1828],{"type":31,"value":1829},"Wallet attribution is rarely a single fact. It is a chain: the address received funds, the address belongs to the defendant, and the defendant controlled the private key on the operative date. The blockchain proves only the first link. The rest rests on off-chain evidence: exchange records, device artifacts, signed messages, or admissions. At every link, the same question arises: is this a preliminary fact the judge decides, or a conditional fact the jury resolves?",{"type":26,"tag":27,"props":1831,"children":1832},{},[1833],{"type":31,"value":1834},"Federal Rule of Evidence 104 governs that line. On August 14, 2026, the Judicial Conference Committee on Rules of Practice and Procedure published proposed amendments to Rule 104 for public comment. The proposal is not law, binds no courtroom, and is projected to take effect December 1, 2028 if adopted and transmitted to Congress, absent congressional action. This article explains the judge-jury allocation under the December 1, 2024 rules in force today, what the proposal alters, and how to build an evidentiary foundation that works under either standard.",{"type":26,"tag":34,"props":1836,"children":1838},{"id":1837},"wallet-attribution-is-a-chain-of-conditional-facts",[1839],{"type":31,"value":1840},"Wallet Attribution Is a Chain of Conditional Facts",{"type":26,"tag":27,"props":1842,"children":1843},{},[1844],{"type":31,"value":1845},"A transaction record confirms that address X transferred value to address Y at a specific block height and timestamp, but does not identify who controlled either address. Attribution maps an address to an individual through external evidence: exchange withdrawal records, seed phrases on seized devices, cryptographic signatures, or party admissions.",{"type":26,"tag":27,"props":1847,"children":1848},{},[1849],{"type":31,"value":1850},"Each supporting fact is conditional. The relevance of an exchange record depends on whether account data connects the address to the defendant. The relevance of a recovery phrase depends on whether it reconstructs the target key. When relevance depends on whether another fact exists, Rule 104(b) governs and the court applies a screening standard rather than a finding standard.",{"type":26,"tag":27,"props":1852,"children":1853},{},[1854,1856,1861,1863,1869,1871,1877],{"type":31,"value":1855},"Related articles address neighboring questions: ",{"type":26,"tag":51,"props":1857,"children":1858},{"href":297},[1859],{"type":31,"value":1860},"Understanding Wallet Ownership Evidence",{"type":31,"value":1862}," catalogs evidence types, while ",{"type":26,"tag":51,"props":1864,"children":1866},{"href":1865},"\u002Fresources\u002Fblockchain-evidence-admissibility",[1867],{"type":31,"value":1868},"Blockchain Evidence in Litigation",{"type":31,"value":1870}," and ",{"type":26,"tag":51,"props":1872,"children":1874},{"href":1873},"\u002Fresources\u002Fblockchain-evidence-federal-missouri-rules",[1875],{"type":31,"value":1876},"What Makes Blockchain Evidence Admissible Under Federal and Missouri Rules",{"type":31,"value":1878}," examine authentication and expert standards. This article focuses on the division between judge-decided admissibility prerequisites and jury-decided conditional inferences.",{"type":26,"tag":34,"props":1880,"children":1882},{"id":1881},"current-rule-104-the-baseline-you-argue-today",[1883],{"type":31,"value":1884},"Current Rule 104: The Baseline You Argue Today",{"type":26,"tag":150,"props":1886,"children":1888},{"id":1887},"rule-104a-judge-decided-preliminary-questions",[1889],{"type":31,"value":1890},"Rule 104(a): Judge-decided preliminary questions",{"type":26,"tag":27,"props":1892,"children":1893},{},[1894,1896,1903],{"type":31,"value":1895},"Under the ",{"type":26,"tag":51,"props":1897,"children":1900},{"href":1898,"rel":1899},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002F2025-02\u002Ffederal-rules-of-evidence-dec-1-2024.pdf",[55],[1901],{"type":31,"value":1902},"Federal Rules of Evidence effective December 1, 2024",{"type":31,"value":1904},", Rule 104(a) requires the court to decide preliminary questions of qualification, privilege, or admissibility, unbound by evidence rules except privilege. Bourjaily v. United States, 483 U.S. 171, 175 (1987), established that preliminary facts must be proved by a preponderance of the evidence. In attribution disputes, judge-decided matters include expert qualification, Rule 702 reliability, hearsay, privilege, and Rule 902 certification compliance.",{"type":26,"tag":150,"props":1906,"children":1908},{"id":1907},"rule-104b-conditional-facts-that-go-to-the-jury",[1909],{"type":31,"value":1910},"Rule 104(b): Conditional facts that go to the jury",{"type":26,"tag":27,"props":1912,"children":1913},{},[1914],{"type":31,"value":1915},"Current Rule 104(b) provides: \"When the relevance of evidence depends on whether a fact exists, proof must be introduced sufficient to support a finding that the fact does exist. The court may admit the proposed evidence on the condition that the proof be introduced later.\" Under Huddleston v. United States, 485 U.S. 681, 687-690 (1988), the court does not weigh credibility or find facts; it decides only whether the jury could reasonably find the conditional fact by a preponderance of the evidence. Rule 104(e) preserves the jury's role regarding weight, while Rule 104(d) protects an accused testifying on preliminary matters from broader cross-examination.",{"type":26,"tag":150,"props":1917,"children":1919},{"id":1918},"where-rule-702-gatekeeping-fits",[1920],{"type":31,"value":1921},"Where Rule 702 gatekeeping fits",{"type":26,"tag":27,"props":1923,"children":1924},{},[1925],{"type":31,"value":1926},"Do not confuse Rule 104(b) with Rule 702 gatekeeping. Under Rule 104(a), the judge determines whether an expert's opinion rests on reliable methodology, codified as a preponderance standard in Rule 702 in 2023. Under Rule 104(b), contested predicate facts belong to the jury. An expert may explain transaction flows and clustering heuristics; whether the defendant controlled the wallet is for the jury unless no reasonable jury could so find.",{"type":26,"tag":34,"props":1928,"children":1930},{"id":1929},"what-the-august-2026-proposal-would-change",[1931],{"type":31,"value":1932},"What the August 2026 Proposal Would Change",{"type":26,"tag":150,"props":1934,"children":1936},{"id":1935},"status-proposed-not-law",[1937],{"type":31,"value":1938},"Status: proposed, not law",{"type":26,"tag":27,"props":1940,"children":1941},{},[1942,1944,1951,1952,1959,1961,1968],{"type":31,"value":1943},"The ",{"type":26,"tag":51,"props":1945,"children":1948},{"href":1946,"rel":1947},"https:\u002F\u002Fwww.uscourts.gov\u002Fforms-rules\u002Fproposed-amendments-published-public-comment",[55],[1949],{"type":31,"value":1950},"publication notice",{"type":31,"value":1870},{"type":26,"tag":51,"props":1953,"children":1956},{"href":1954,"rel":1955},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocument\u002Fpreliminary_draft_of_proposed_amendments_-_august_2026.pdf",[55],[1957],{"type":31,"value":1958},"Preliminary Draft of Proposed Amendments, dated August 2026",{"type":31,"value":1960},", set the timeline. Following late-2025 discussions, the Advisory Committee voted unanimously on May 7, 2026 to recommend publication, transmitting its ",{"type":26,"tag":51,"props":1962,"children":1965},{"href":1963,"rel":1964},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocument\u002Fadvisory_committee_on_evidence_rules_may_2026.pdf",[55],[1966],{"type":31,"value":1967},"May 17, 2026 report",{"type":31,"value":1969}," to the Standing Committee. The preliminary draft appeared on August 14, 2026, with comments due February 15, 2027. The package covers Rule 104 and Rule 902(1) (tribal public records), carrying a projected effective date of December 1, 2028 under the Rules Enabling Act.",{"type":26,"tag":150,"props":1971,"children":1973},{"id":1972},"proposed-104a-preponderance-in-the-text",[1974],{"type":31,"value":1975},"Proposed 104(a): preponderance in the text",{"type":26,"tag":27,"props":1977,"children":1978},{},[1979],{"type":31,"value":1980},"The proposal adds an explicit sentence to Rule 104(a): \"Unless these rules provide otherwise, the proponent must establish the existence of a preliminary fact by a preponderance of the evidence.\" That sentence codifies Bourjaily in the rule text, paralleling the 2023 amendment to Rule 702.",{"type":26,"tag":150,"props":1982,"children":1984},{"id":1983},"proposed-104b-conditional-relevance-goes-away",[1985],{"type":31,"value":1986},"Proposed 104(b): conditional relevance goes away",{"type":26,"tag":27,"props":1988,"children":1989},{},[1990],{"type":31,"value":1991},"The proposal deletes the \"proof sufficient to support a finding\" phrasing. The operative text reads: \"To establish that evidence is relevant, the proponent must demonstrate to the court that the trier of fact could reasonably find that the requirements of Rule 401 have been met.\" The court may consider the evidence itself, other evidence, and common knowledge and experience, and may admit the proposed evidence on the condition that further proof be introduced later.",{"type":26,"tag":27,"props":1993,"children":1994},{},[1995],{"type":31,"value":1996},"The Advisory Committee's May 17, 2026 report explains that the amendment eliminates the unhelpful concept of conditional relevance and the confusing phrase \"proof sufficient to support a finding.\" The committee note emphasizes that the revised standard is substantively identical to \"sufficient to support a finding\" under Huddleston, and that judicial screening may draw on common knowledge, contrasting a rural jury familiar with fertilizer hazards with an urban jury requiring proof. Citing Ronald Allen, The Myth of Conditional Relevance, 25 Loyola L. Rev. 871, 879 (1992), the note observes that because all relevance relies on intermediate premises, separating conditional relevance as a distinct category is analytically unsound.",{"type":26,"tag":150,"props":1998,"children":2000},{"id":1999},"what-does-not-change",[2001],{"type":31,"value":2002},"What does not change",{"type":26,"tag":27,"props":2004,"children":2005},{},[2006],{"type":31,"value":2007},"Conditional admission remains available under Rule 104(a) and (b). The package leaves Rule 901 authentication, Rule 902(13) and (14) electronic certifications, and Rule 702 expert standards intact. The division of responsibility persists: the judge screens threshold relevance, while the jury determines whether the defendant controlled the wallet.",{"type":26,"tag":34,"props":2009,"children":2011},{"id":2010},"the-judge-and-jury-map-for-attribution-evidence",[2012],{"type":31,"value":2013},"The Judge and Jury Map for Attribution Evidence",{"type":26,"tag":150,"props":2015,"children":2016},{"id":17},[2017],{"type":31,"value":2018},"Exchange records",{"type":26,"tag":27,"props":2020,"children":2021},{},[2022],{"type":31,"value":2023},"Exchange records connect account holders to addresses. Under Rule 901, the court screens whether evidence is sufficient to support a finding of authenticity, a jury-side standard. A qualifying Rule 902(13) certificate lets the proponent skip live authenticating testimony once the judge finds the certification requirements met under Rule 104(a); the opponent may still contest authenticity to the jury. Whether the verified account holder executed the withdrawal is a further Rule 104(b) question.",{"type":26,"tag":150,"props":2025,"children":2027},{"id":2026},"device-artifacts",[2028],{"type":31,"value":2029},"Device artifacts",{"type":26,"tag":27,"props":2031,"children":2032},{},[2033],{"type":31,"value":2034},"Forensic extractions link seized hardware to individuals. The judge screens extraction authenticity under Rule 901 or evaluates a Rule 902(14) data certificate under Rule 104(a). Whether the defendant possessed the device during operative periods, whether recovery phrases reconstruct target keys, and whether device access equated to control are conditional facts for the jury under Rule 104(b).",{"type":26,"tag":150,"props":2036,"children":2038},{"id":2037},"signed-messages",[2039],{"type":31,"value":2040},"Signed messages",{"type":26,"tag":27,"props":2042,"children":2043},{},[2044],{"type":31,"value":2045},"Cryptographic signatures establish key control. Under Rule 901, the judge screens whether the proof is sufficient to support a finding that the signature was generated by the target key. Genuineness is for the jury. Whether key control at signing also proves control on the contested transfer dates is a further Rule 104(b) question.",{"type":26,"tag":150,"props":2047,"children":2049},{"id":2048},"admissions",[2050],{"type":31,"value":2051},"Admissions",{"type":26,"tag":27,"props":2053,"children":2054},{},[2055],{"type":31,"value":2056},"A party's statements admitting wallet control bypass technical tracing. The judge resolves admissibility under Rule 104(a) by a preponderance of the evidence, including qualification under Rule 801(d)(2). The jury assesses the credibility, weight, and context of the admission.",{"type":26,"tag":150,"props":2058,"children":2060},{"id":2059},"transaction-patterns",[2061],{"type":31,"value":2062},"Transaction patterns",{"type":26,"tag":27,"props":2064,"children":2065},{},[2066],{"type":31,"value":2067},"Clustering heuristics represent circumstantial attribution. The judge evaluates expert methodology under Rule 702 and Rule 104(a) for reliability. Whether clustered addresses share common control, and whether that controller is the defendant, are conditional relevance issues for the jury under Rule 104(b).",{"type":26,"tag":34,"props":2069,"children":2071},{"id":2070},"a-worked-hypothetical-the-withdrawal-that-names-the-defendant",[2072],{"type":31,"value":2073},"A Worked Hypothetical: The Withdrawal That Names the Defendant",{"type":26,"tag":27,"props":2075,"children":2076},{},[2077],{"type":31,"value":2078},"Hypothetical example: Defendant is sued for diverting corporate funds. Plaintiff's expert links address 1A2b...c3 to $250,000 withdrawn from Defendant's verified account at Exchange Co., tracing three transfers to a hardware wallet whose seed phrase was found in a password manager on Defendant's phone. Defendant argues KYC records do not prove who initiated withdrawals, clustering can misattribute addresses, and family members accessed the phone.",{"type":26,"tag":27,"props":2080,"children":2081},{},[2082],{"type":31,"value":2083},"The court admits exchange records without live testimony based on a Rule 902(13) certification, an admissibility question resolved under Rule 104(a). Threshold authenticity of the phone extraction under Rule 901 survives judicial screening because proof supports a reasonable finding of authenticity. The clustering opinion survives Rule 702 scrutiny because the methodology is validated, an issue resolved by a preponderance under Rule 104(a). The attribution links are conditional facts under Rule 104(b): the court admits each because a reasonable jury could find control, instructing under Rule 105: \"You may consider the exchange records and tracing evidence only for the purpose of deciding whether Defendant controlled the addresses. If you find he did not, you must disregard them on that question.\"",{"type":26,"tag":27,"props":2085,"children":2086},{},[2087],{"type":31,"value":2088},"Under the proposed amendment, the substantive result is identical. The revision removes the conditional-relevance label and ties the screening test to Rule 401. Under either version, links no reasonable jury could credit are excluded, making foundation decisive regardless of terminology.",{"type":26,"tag":34,"props":2090,"children":2092},{"id":2091},"foundation-checklist-for-attribution-evidence",[2093],{"type":31,"value":2094},"Foundation Checklist for Attribution Evidence",{"type":26,"tag":347,"props":2096,"children":2097},{},[2098,2103,2108,2113,2118,2123,2128,2133],{"type":26,"tag":77,"props":2099,"children":2100},{},[2101],{"type":31,"value":2102},"Map the chain: categorize each link as a Rule 104(a) preliminary question, a Rule 104(b) conditional fact, a Rule 901 authenticity screen, or a Rule 702 methodology review.",{"type":26,"tag":77,"props":2104,"children":2105},{},[2106],{"type":31,"value":2107},"Offer conditional links subject to connecting proof under Rule 104(b), identifying evidence supplying the predicate.",{"type":26,"tag":77,"props":2109,"children":2110},{},[2111],{"type":31,"value":2112},"Authenticate electronic records efficiently. Certifications under Rule 902(13) and (14) satisfy threshold authenticity without live testimony once the court confirms compliance under Rule 104(a).",{"type":26,"tag":77,"props":2114,"children":2115},{},[2116],{"type":31,"value":2117},"Restrict expert testimony to forensic observations. Testifying that records associate an address with an account survives scrutiny; whether the defendant controlled the wallet is a Rule 104(b) question for the jury.",{"type":26,"tag":77,"props":2119,"children":2120},{},[2121],{"type":31,"value":2122},"Request limiting instructions under Rule 105 when conditional evidence is received, defining the restricted purpose on the record.",{"type":26,"tag":77,"props":2124,"children":2125},{},[2126],{"type":31,"value":2127},"Anticipate sufficiency challenges on each link, especially temporal gaps between exchange transactions, device seizures, and disputed transfers.",{"type":26,"tag":77,"props":2129,"children":2130},{},[2131],{"type":31,"value":2132},"Protect criminal defendants under Rule 104(d), avoiding cross-examination beyond preliminary matters when testifying on foundation.",{"type":26,"tag":77,"props":2134,"children":2135},{},[2136],{"type":31,"value":2137},"Monitor the rulemaking docket. Argue the December 1, 2024 text in active cases while tracking the proposed amendment toward its projected December 1, 2028 effective date.",{"type":26,"tag":34,"props":2139,"children":2141},{"id":2140},"limitations",[2142],{"type":31,"value":2143},"Limitations",{"type":26,"tag":27,"props":2145,"children":2146},{},[2147],{"type":31,"value":2148},"This article addresses evidentiary screening standards and judge-jury allocations under the Federal Rules of Evidence; it does not evaluate ultimate burdens of proof or displace comprehensive hearsay, authentication, and Daubert analyses. Proposed amendments remain subject to revision during public comment. State courts, including Missouri courts applying rules modeled on federal practice, are not bound by federal amendments and must be analyzed under local authority. Case outcomes turn on specific records and judicial practices. Nothing here constitutes legal advice.",{"type":26,"tag":34,"props":2150,"children":2151},{"id":461},[2152],{"type":31,"value":464},{"type":26,"tag":150,"props":2154,"children":2156},{"id":2155},"q-if-rule-104b-is-amended-will-the-jury-decide-wallet-ownership",[2157],{"type":31,"value":2158},"Q: If Rule 104(b) is amended, will the jury decide wallet ownership?",{"type":26,"tag":27,"props":2160,"children":2161},{},[2162,2166],{"type":26,"tag":475,"props":2163,"children":2164},{},[2165],{"type":31,"value":479},{"type":31,"value":2167}," Yes. Under both current Rule 104(b) and the proposed revision, the judge decides only whether a reasonable jury could find the conditional fact, such as key control. The proposal eliminates conditional-relevance terminology, but the Advisory Committee note confirms the revised standard is substantively identical under Huddleston. The judge-jury allocation remains unchanged.",{"type":26,"tag":150,"props":2169,"children":2171},{"id":2170},"q-what-is-the-difference-between-rule-104a-and-rule-702-for-blockchain-experts",[2172],{"type":31,"value":2173},"Q: What is the difference between Rule 104(a) and Rule 702 for blockchain experts?",{"type":26,"tag":27,"props":2175,"children":2176},{},[2177,2181],{"type":26,"tag":475,"props":2178,"children":2179},{},[2180],{"type":31,"value":479},{"type":31,"value":2182}," Rule 104(a) provides the general standard for preliminary questions of admissibility, qualification, and privilege under a preponderance standard. Rule 702 governs expert testimony specifically, requiring proof of reliability by a preponderance. Expert qualifications and methodology are judge questions under Rules 104(a) and 702; whether the defendant controlled the wallet is a conditional fact for the jury under Rule 104(b).",{"type":26,"tag":150,"props":2184,"children":2186},{"id":2185},"q-when-will-the-proposed-rule-104-amendment-take-effect",[2187],{"type":31,"value":2188},"Q: When will the proposed Rule 104 amendment take effect?",{"type":26,"tag":27,"props":2190,"children":2191},{},[2192,2196],{"type":26,"tag":475,"props":2193,"children":2194},{},[2195],{"type":31,"value":479},{"type":31,"value":2197}," The amendment remains a proposal open for comment through February 15, 2027. If the Standing Committee, the Judicial Conference, and the Supreme Court approve it and it is transmitted to Congress by May 1, 2028, it is projected to take effect December 1, 2028, absent congressional action. Federal practice remains governed by the December 1, 2024 rules.",{"type":26,"tag":150,"props":2199,"children":2201},{"id":2200},"q-does-the-proposal-change-how-blockchain-records-are-authenticated",[2202],{"type":31,"value":2203},"Q: Does the proposal change how blockchain records are authenticated?",{"type":26,"tag":27,"props":2205,"children":2206},{},[2207,2211],{"type":26,"tag":475,"props":2208,"children":2209},{},[2210],{"type":31,"value":479},{"type":31,"value":2212}," No. The August 2026 preliminary draft addresses Rule 104 and Rule 902(1). It leaves Rule 901 authentication, Rule 902(13) and (14) electronic certifications, and Rule 702 intact. Rule 901 continues to require evidence sufficient to support a finding of authenticity, which the judge screens under the 104(b) standard before the jury evaluates genuineness.",{"type":26,"tag":150,"props":2214,"children":2216},{"id":2215},"q-what-should-litigators-do-now-when-preparing-wallet-attribution-evidence",[2217],{"type":31,"value":2218},"Q: What should litigators do now when preparing wallet attribution evidence?",{"type":26,"tag":27,"props":2220,"children":2221},{},[2222,2226],{"type":26,"tag":475,"props":2223,"children":2224},{},[2225],{"type":31,"value":479},{"type":31,"value":2227}," Litigators should build foundations under current rules while structuring chains to satisfy either standard: map each link, separate Rule 104(a) legal determinations from Rule 104(b) jury questions, secure Rule 902(13) and (14) certifications for digital records, and confine expert opinions to forensic findings rather than ownership conclusions.",{"type":26,"tag":27,"props":2229,"children":2230},{},[2231,2233,2237,2239,2244,2246,2251,2253,2258,2260,2265],{"type":31,"value":2232},"Every case turns on its own evidentiary chain, and consultation on specific records is essential. We provide ",{"type":26,"tag":51,"props":2234,"children":2235},{"href":453},[2236],{"type":31,"value":456},{"type":31,"value":2238},", ",{"type":26,"tag":51,"props":2240,"children":2241},{"href":104},[2242],{"type":31,"value":2243},"evidence review",{"type":31,"value":2245},", and ",{"type":26,"tag":51,"props":2247,"children":2248},{"href":537},[2249],{"type":31,"value":2250},"expert witness services",{"type":31,"value":2252}," for complex digital asset litigation. Review ",{"type":26,"tag":51,"props":2254,"children":2255},{"href":550},[2256],{"type":31,"value":2257},"our methodology",{"type":31,"value":2259}," to learn how analyses are documented for courtroom presentation, or ",{"type":26,"tag":51,"props":2261,"children":2262},{"href":558},[2263],{"type":31,"value":2264},"contact us",{"type":31,"value":2266}," to discuss a pending matter.",{"title":7,"searchDepth":565,"depth":565,"links":2268},[2269,2270,2275,2281,2288,2289,2290,2291],{"id":1837,"depth":565,"text":1840},{"id":1881,"depth":565,"text":1884,"children":2271},[2272,2273,2274],{"id":1887,"depth":572,"text":1890},{"id":1907,"depth":572,"text":1910},{"id":1918,"depth":572,"text":1921},{"id":1929,"depth":565,"text":1932,"children":2276},[2277,2278,2279,2280],{"id":1935,"depth":572,"text":1938},{"id":1972,"depth":572,"text":1975},{"id":1983,"depth":572,"text":1986},{"id":1999,"depth":572,"text":2002},{"id":2010,"depth":565,"text":2013,"children":2282},[2283,2284,2285,2286,2287],{"id":17,"depth":572,"text":2018},{"id":2026,"depth":572,"text":2029},{"id":2037,"depth":572,"text":2040},{"id":2048,"depth":572,"text":2051},{"id":2059,"depth":572,"text":2062},{"id":2070,"depth":565,"text":2073},{"id":2091,"depth":565,"text":2094},{"id":2140,"depth":565,"text":2143},{"id":461,"depth":565,"text":464,"children":2292},[2293,2294,2295,2296,2297],{"id":2155,"depth":572,"text":2158},{"id":2170,"depth":572,"text":2173},{"id":2185,"depth":572,"text":2188},{"id":2200,"depth":572,"text":2203},{"id":2215,"depth":572,"text":2218},"content:articles:36-wallet-attribution-rule-104b.md","articles\u002F36-wallet-attribution-rule-104b.md","articles\u002F36-wallet-attribution-rule-104b",{"_path":2302,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":2303,"description":2304,"slug":2305,"date":2306,"lastUpdated":2306,"author":12,"readingTime":13,"category":14,"tags":2307,"ogImage":2313,"featured":6,"body":2314,"_type":597,"_id":2690,"_source":599,"_file":2691,"_stem":2692,"_extension":602},"\u002Farticles\u002F35-ucc-article-12-digital-asset-control","Control is not ownership: UCC Article 12 and digital assets","How UCC Article 12 treats wallet and ledger control: what it proves, what it does not, qualifying purchasers, priority, and state-by-state enactment.","ucc-article-12-digital-asset-control","2026-08-08",[2308,2309,2310,2311,2312],"ucc","digital-assets","secured-transactions","priority","control","\u002Fog\u002Fucc-article-12-digital-asset-control.png",{"type":23,"children":2315,"toc":2671},[2316,2333,2339,2344,2349,2354,2360,2374,2388,2394,2399,2405,2410,2416,2421,2444,2449,2455,2468,2485,2491,2496,2502,2507,2526,2532,2552,2575,2580,2584,2590,2599,2605,2614,2620,2629,2635,2644,2650,2659],{"type":26,"tag":27,"props":2317,"children":2318},{},[2319,2321,2326,2327,2331],{"type":31,"value":2320},"A wallet can be controlled without being owned, and owned without being controlled by the owner. When a lender, a buyer, a bankruptcy trustee, and a theft victim all claim the same cryptocurrency, the question is rarely who holds the private key. It is who has which right, created by which transaction, and whether a later taker took free of the others. UCC Article 12, the 2022 amendments' framework for \"controllable electronic records,\" makes control a legally operative fact, but it stops short of collapsing possession, title, and priority into one fact. The adjacent articles on ",{"type":26,"tag":51,"props":2322,"children":2323},{"href":297},[2324],{"type":31,"value":2325},"wallet ownership evidence",{"type":31,"value":1870},{"type":26,"tag":51,"props":2328,"children":2329},{"href":305},[2330],{"type":31,"value":308},{"type":31,"value":2332}," address factual attribution and custody architecture; this one addresses the commercial-law contest among competing claimants.",{"type":26,"tag":34,"props":2334,"children":2336},{"id":2335},"why-technical-control-is-not-legal-ownership",[2337],{"type":31,"value":2338},"Why Technical Control Is Not Legal Ownership",{"type":26,"tag":27,"props":2340,"children":2341},{},[2342],{"type":31,"value":2343},"The person who holds the private key can sign transactions and move the asset. That is factual dominion. The legal question is which rights that fact creates, and the answer comes from the transaction that put the key in the holder's hands, not from the key itself.",{"type":26,"tag":27,"props":2345,"children":2346},{},[2347],{"type":31,"value":2348},"Illustrative scenario: an employee signs a company wallet's transactions under a written instruction from the CEO; a spouse holds the seed phrase to an account opened before marriage; an exchange holds custody keys while crediting thousands of user balances. In each case the keyholder is factually dominant, but the property analysis is different: agency, marital property, and custody are governed by other law. Control is evidence of those arrangements; it is not a substitute for the analysis.",{"type":26,"tag":27,"props":2350,"children":2351},{},[2352],{"type":31,"value":2353},"Article 9 distinguishes possession from title. A secured party's possession can perfect a security interest, but possession alone does not resolve ownership. Article 12 similarly makes control relevant to perfection and priority while other law determines what right was acquired.",{"type":26,"tag":34,"props":2355,"children":2357},{"id":2356},"what-article-12-actually-is",[2358],{"type":31,"value":2359},"What Article 12 Actually Is",{"type":26,"tag":27,"props":2361,"children":2362},{},[2363,2365,2372],{"type":31,"value":2364},"Article 12 (Controllable Electronic Records) was part of the amendments the Uniform Law Commission approved in July 2022. The ",{"type":26,"tag":51,"props":2366,"children":2369},{"href":2367,"rel":2368},"https:\u002F\u002Fwww.uniformlaws.org\u002Fcommittees\u002Fcommunity-home?CommunityKey=1457c422-ddb7-40b0-8c76-39a1991651ac",[55],[2370],{"type":31,"value":2371},"ULC project page",{"type":31,"value":2373}," carries the drafting and enactment materials. The amendments are model law: they become binding only when a state enacts its own version, and enacted versions differ in numbering and detail, so the governing text is always the enacting state's statute.",{"type":26,"tag":27,"props":2375,"children":2376},{},[2377,2379,2386],{"type":31,"value":2378},"A \"controllable electronic record\" is a record stored in an electronic medium that can be subjected to control under the statute's functional test. The definition excludes assets that already have a UCC home: deposit accounts, an electronic copy of a record evidencing chattel paper, electronic documents of title, investment property, transferable records, and a government-authorized electronic medium of exchange that did not exist as a medium of exchange before that authorization. The ULC's example is virtual currency. Whether a particular token or NFT is a controllable electronic record turns on the statute and the system that records it. The ",{"type":26,"tag":51,"props":2380,"children":2383},{"href":2381,"rel":2382},"https:\u002F\u002Flegislature.maine.gov\u002Fstatutes\u002F11\u002Ftitle11ch12.pdf",[55],[2384],{"type":31,"value":2385},"Maine enacted text",{"type":31,"value":2387}," (Me. Rev. Stat. tit. 11, Art. 12) is a clean, freely readable enactment for reference.",{"type":26,"tag":150,"props":2389,"children":2391},{"id":2390},"the-functional-control-test",[2392],{"type":31,"value":2393},"The Functional Control Test",{"type":26,"tag":27,"props":2395,"children":2396},{},[2397],{"type":31,"value":2398},"Section 12-105 sets out what control requires. The electronic record, a record attached or logically associated with it, or the system in which it is recorded must give the person power to avail itself of substantially all the benefit from the record and, subject to subsection (2), exclusive power both to prevent others from doing the same and to transfer control to another person or to cause another person to obtain control of another controllable electronic record as a result of the transfer. The same record or system must also enable the person readily to identify itself as having those powers, including by name, identifying number, cryptographic key, office, or account number. The identification element must be tested against the record and system, not assumed from the ability to sign a transaction. Control is measured at a point in time: how the keys, wallet software, multisig, and any custodian arrangement actually operated on that date. Subsection (5) recognizes control through another person, typically a custodian, who has control and acknowledges that it has control, or will obtain control, on behalf of the claimant, so long as that other person is not the transferor of the interest. Subsections (2) and (3) address shared power. A multisig arrangement can satisfy exclusivity, but the answer depends on each signer's powers and the transferor's role.",{"type":26,"tag":150,"props":2400,"children":2402},{"id":2401},"what-control-does-not-mean",[2403],{"type":31,"value":2404},"What Control Does Not Mean",{"type":26,"tag":27,"props":2406,"children":2407},{},[2408],{"type":31,"value":2409},"The enacted texts are explicit that other law decides the rest. Maine's section 12-104(3), tracking the uniform text, provides that except as otherwise provided, other law determines whether a person acquires a right in a controllable electronic record and what right the person acquires. The take-free rule protects a qualifying purchaser against claims of a property right in the record itself; it does not resolve trademark, copyright, tax, securities, or trust questions that attach through other law. Courts have applied ordinary trademark law to NFT-linked art; see Hermès Int'l v. Rothschild, 654 F. Supp. 3d 268 (S.D.N.Y. 2023) (No. 1:22-cv-00384-JSR).",{"type":26,"tag":34,"props":2411,"children":2413},{"id":2412},"qualifying-purchasers-and-priority",[2414],{"type":31,"value":2415},"Qualifying Purchasers and Priority",{"type":26,"tag":27,"props":2417,"children":2418},{},[2419],{"type":31,"value":2420},"Article 12's reward for control is negotiability-like protection for the \"qualifying purchaser\": a purchaser of a controllable electronic record, or of an interest in one, that obtains control for value, in good faith, and without notice of a claim of a property right in the record. \"Value\" tracks Article 3, which is narrower than the value needed for a security interest to attach; an unperformed promise to pay later may attach a lien, but it does not make a qualifying purchaser. Filing a financing statement is not itself notice of a property-right claim. A qualifying purchaser takes free of a claim of a property right in the record. The same take-free rule extends to a controllable account or controllable payment intangible evidenced by the record. For other rights to payment or performance, or other property the record is said to evidence, the qualifying purchaser takes subject to those claims unless other law provides otherwise.",{"type":26,"tag":27,"props":2422,"children":2423},{},[2424,2426,2433,2435,2442],{"type":31,"value":2425},"The 2022 amendments also rewired Article 9. Security interests in controllable electronic records, controllable accounts, and controllable payment intangibles can be perfected by filing or by control, and a secured party with control generally outranks one that perfected only by filing. Acknowledgment by a custodian is a path to control under section 12-105(5), not a third perfection method. Electronic money is treated separately: if it is not credited to a deposit account, a security interest in it may be perfected only by control. A buyer of a controllable electronic record who gives value and obtains control without knowledge of a security interest and before it is perfected takes free of it. A buyer, other than a secured party, of a controllable account or controllable payment intangible takes free on the same conditions. The ",{"type":26,"tag":51,"props":2427,"children":2430},{"href":2428,"rel":2429},"https:\u002F\u002Fapps.legislature.ky.gov\u002FCommitteeDocuments\u002F75\u002F28796\u002F2.%20SB%20155%20-%20UCC%20Amendments%20(2022)%20Summary.pdf",[55],[2431],{"type":31,"value":2432},"ULC's official summary of the 2022 amendments",{"type":31,"value":2434}," describes the architecture; ",{"type":26,"tag":51,"props":2436,"children":2439},{"href":2437,"rel":2438},"https:\u002F\u002Fwww.wsgr.com\u002Fen\u002Finsights\u002Fenhanced-protection-for-defi-lenders-buyers-and-investors-under-recent-and-new-ucc-amendments.html",[55],[2440],{"type":31,"value":2441},"Wilson Sonsini's analysis",{"type":31,"value":2443}," works through the qualifying-purchaser and buyer-versus-secured-party rules.",{"type":26,"tag":27,"props":2445,"children":2446},{},[2447],{"type":31,"value":2448},"If a digital asset is held by a securities intermediary as a financial asset credited to a securities account, the transaction stays in Article 8. Determine at the threshold whether the asset is held directly (Article 12) or through an intermediary (Article 8).",{"type":26,"tag":34,"props":2450,"children":2452},{"id":2451},"control-in-the-disputes-that-actually-arise",[2453],{"type":31,"value":2454},"Control in the Disputes That Actually Arise",{"type":26,"tag":27,"props":2456,"children":2457},{},[2458,2460,2466],{"type":31,"value":2459},"When an exchange holds the keys and credits user balances, it may have control. That does not make the exchange the owner of user assets. Contract, jurisdiction, and segregation practices govern who owns what between the parties; against third parties, perfection depends on control or filing under the state's enacted Article 9. On platform insolvency, the customer-versus-estate contest is a contract and property-law argument with control evidence on both sides, which is why ",{"type":26,"tag":51,"props":2461,"children":2463},{"href":2462},"\u002Fresources\u002Fcryptocurrency-bankruptcy-trustee-checklist",[2464],{"type":31,"value":2465},"our bankruptcy checklist",{"type":31,"value":2467}," treats custody documentation as a first-class evidence category.",{"type":26,"tag":27,"props":2469,"children":2470},{},[2471,2473,2477,2479,2483],{"type":31,"value":2472},"A 2-of-3 arrangement in which a debtor, a lender, and a custodian each hold one key makes the same point. No single party can move funds. In that arrangement, the lender does not have control merely by holding its key: it can act only with another signer, and either other signer can act without the lender. A different allocation of signing power or an acknowledgment by a qualifying custodian may produce a different result. Who owns what is a question of the multisig agreement and the loan documents. A thief who steals a seed phrase gains factual control and no ownership right: the thief is not a purchaser for value in good faith without notice. A later qualifying purchaser can take the record free of the victim's claim. The victim's practical route is tracing the asset and attacking the transfer under other law, which is where ",{"type":26,"tag":51,"props":2474,"children":2475},{"href":453},[2476],{"type":31,"value":456},{"type":31,"value":2478}," becomes the operative work product and where timing, price, and notice must be reconstructed under ",{"type":26,"tag":51,"props":2480,"children":2481},{"href":550},[2482],{"type":31,"value":2257},{"type":31,"value":2484},". An agent with signing authority over a corporate wallet creates a visible control fact; whether the company owns the underlying rights, and whether the agent misused authority, depend on agency and fiduciary law.",{"type":26,"tag":34,"props":2486,"children":2488},{"id":2487},"the-insolvency-interaction",[2489],{"type":31,"value":2490},"The Insolvency Interaction",{"type":26,"tag":27,"props":2492,"children":2493},{},[2494],{"type":31,"value":2495},"Bankruptcy respects state-law property rights. Under Butner v. United States, 440 U.S. 48 (1979), property interests are created and defined by state law. Section 541 reaches the debtor's legal or equitable interests in property as of the petition date. Control of a wallet starts that inquiry; it does not, without more, make the coins estate property. The interest may be full ownership, a security interest, or a bare possessory or custodial right. For a secured creditor, perfection by control and its timing can affect priority and avoidance analysis, alongside attachment and the other applicable requirements. State-law take-free protection does not by itself defeat a federal avoidance action, and good-faith transferees for value may have defenses under the Bankruptcy Code itself, for example 11 U.S.C. § 548(c).",{"type":26,"tag":34,"props":2497,"children":2499},{"id":2498},"the-forensic-facts-counsel-needs",[2500],{"type":31,"value":2501},"The Forensic Facts Counsel Needs",{"type":26,"tag":27,"props":2503,"children":2504},{},[2505],{"type":31,"value":2506},"Proving or disputing control at a specific date requires a date-stamped record. Assemble key-custody artifacts against the transaction date; custody agreements naming who holds keys and on whose behalf; permission history; a signed message or transaction from the disputed address at or near the critical date; and a single timeline of the financing-statement filing, the control date, the purchase date, and the value paid. Continuity evidence often decides the abandoned-or-transferred argument.",{"type":26,"tag":27,"props":2508,"children":2509},{},[2510,2512,2517,2519,2525],{"type":31,"value":2511},"The gap between technical capability and legal right is where an ",{"type":26,"tag":51,"props":2513,"children":2514},{"href":537},[2515],{"type":31,"value":2516},"expert witness",{"type":31,"value":2518}," has to explain the mechanics without overstating what they determine. Attribution and legal property questions in digital tokens are examined further in ",{"type":26,"tag":51,"props":2520,"children":2522},{"href":2521},"\u002Fresources\u002Fnft-ownership-disputes-evidence",[2523],{"type":31,"value":2524},"NFT ownership disputes and evidence",{"type":31,"value":519},{"type":26,"tag":34,"props":2527,"children":2529},{"id":2528},"check-the-state-before-you-opine",[2530],{"type":31,"value":2531},"Check the State Before You Opine",{"type":26,"tag":27,"props":2533,"children":2534},{},[2535,2537,2543,2545,2550],{"type":31,"value":2536},"The 2022 amendments are not in force everywhere. As of October 2025, ",{"type":26,"tag":51,"props":2538,"children":2540},{"href":2437,"rel":2539},[55],[2541],{"type":31,"value":2542},"Wilson Sonsini reported",{"type":31,"value":2544}," that 31 states and the District of Columbia had enacted them. The ",{"type":26,"tag":51,"props":2546,"children":2548},{"href":2367,"rel":2547},[55],[2549],{"type":31,"value":2371},{"type":31,"value":2551}," carries drafting and enactment materials. Neither is an authoritative registry. Confirm the governing state's statute and session law.",{"type":26,"tag":27,"props":2553,"children":2554},{},[2555,2557,2564,2566,2573],{"type":31,"value":2556},"Two dates matter in every enacting state. The effective date starts the new rules. The \"adjustment date,\" described in the amendments and in ",{"type":26,"tag":51,"props":2558,"children":2561},{"href":2559,"rel":2560},"https:\u002F\u002Fwww.duanemorris.com\u002Falerts\u002Fcountdown_new_digital_asset_ucc_rules_is_your_state_on_board_0724.html",[55],[2562],{"type":31,"value":2563},"Duane Morris's summary",{"type":31,"value":2565},", is the later of a uniform fixed date (July 1, 2025 in the model) or one year after the state's effective date, and is when priority adjustments for pre-existing security interests take effect. Maine used an effective date of July 1, 2025 and a fixed adjustment date of July 1, 2026, as set in the ",{"type":26,"tag":51,"props":2567,"children":2570},{"href":2568,"rel":2569},"https:\u002F\u002Flldc.mainelegislature.org\u002FOpen\u002FLaws\u002F2023\u002F2023_PL_c669.pdf",[55],[2571],{"type":31,"value":2572},"2023 session law",{"type":31,"value":2574},". Section 12-107 looks to the local law of the record's jurisdiction, determined by a statutory waterfall that often defaults to the District of Columbia when the record and the system do not designate a jurisdiction. Purchaser and qualifying-purchaser rights under section 12-104 are tested under that law as of the time of purchase.",{"type":26,"tag":27,"props":2576,"children":2577},{},[2578],{"type":31,"value":2579},"There is little appellate interpretation of Article 12 in the states that have enacted it. Treat the statutory text and its official summary as the authority, and any secondary analysis, including this one, as a map of the questions.",{"type":26,"tag":34,"props":2581,"children":2582},{"id":461},[2583],{"type":31,"value":464},{"type":26,"tag":150,"props":2585,"children":2587},{"id":2586},"q-does-controlling-a-wallet-make-the-controller-its-legal-owner",[2588],{"type":31,"value":2589},"Q: Does controlling a wallet make the controller its legal owner?",{"type":26,"tag":27,"props":2591,"children":2592},{},[2593,2597],{"type":26,"tag":475,"props":2594,"children":2595},{},[2596],{"type":31,"value":479},{"type":31,"value":2598}," No. Control under section 12-105 is the power to avail itself of substantially all the benefit of the record, exclusive power to prevent others from doing so and to transfer control or to cause another person to obtain control of another record as a result of the transfer, and the ability to be readily identified as the person with those powers. Whether the controller owns the record, holds it for another, or holds a security interest is decided by the transaction that created the relationship and by other law.",{"type":26,"tag":150,"props":2600,"children":2602},{"id":2601},"q-what-is-a-qualifying-purchaser-and-why-does-it-matter",[2603],{"type":31,"value":2604},"Q: What is a qualifying purchaser, and why does it matter?",{"type":26,"tag":27,"props":2606,"children":2607},{},[2608,2612],{"type":26,"tag":475,"props":2609,"children":2610},{},[2611],{"type":31,"value":479},{"type":31,"value":2613}," A qualifying purchaser of a controllable electronic record, or of an interest in one, obtains control for value, in good faith, and without notice of a claim of a property right in the record. The Article 12 take-free rule lets that purchaser acquire its rights free of claims of a property right in the record. Value is the narrower Article 3 standard, so an unperformed promise to pay is not enough, and a filed financing statement is not notice of a claim.",{"type":26,"tag":150,"props":2615,"children":2617},{"id":2616},"q-how-does-a-lender-perfect-a-security-interest-in-cryptocurrency-or-other-digital-assets",[2618],{"type":31,"value":2619},"Q: How does a lender perfect a security interest in cryptocurrency or other digital assets?",{"type":26,"tag":27,"props":2621,"children":2622},{},[2623,2627],{"type":26,"tag":475,"props":2624,"children":2625},{},[2626],{"type":31,"value":479},{"type":31,"value":2628}," Under the 2022 amendments as enacted, a security interest in a controllable electronic record, controllable account, or controllable payment intangible can be perfected by filing or by control, including by a custodian's acknowledgment of control. Control generally has priority over filing. A security interest in electronic money that is not credited to a deposit account may be perfected only by control. Check the state's enacted Article 9 and its effective and adjustment dates before relying on a particular method.",{"type":26,"tag":150,"props":2630,"children":2632},{"id":2631},"q-is-ucc-article-12-in-effect-everywhere-in-the-united-states",[2633],{"type":31,"value":2634},"Q: Is UCC Article 12 in effect everywhere in the United States?",{"type":26,"tag":27,"props":2636,"children":2637},{},[2638,2642],{"type":26,"tag":475,"props":2639,"children":2640},{},[2641],{"type":31,"value":479},{"type":31,"value":2643}," No. The amendments are model law approved by the Uniform Law Commission in July 2022. Each state must enact its own version. An October 2025 advisory reported that 31 states and the District of Columbia had enacted the amendments. Verify the governing state's enactment, effective date, adjustment date, and transition rules.",{"type":26,"tag":150,"props":2645,"children":2647},{"id":2646},"q-if-a-thief-controls-a-stolen-wallet-does-a-later-buyer-keep-the-coins",[2648],{"type":31,"value":2649},"Q: If a thief controls a stolen wallet, does a later buyer keep the coins?",{"type":26,"tag":27,"props":2651,"children":2652},{},[2653,2657],{"type":26,"tag":475,"props":2654,"children":2655},{},[2656],{"type":31,"value":479},{"type":31,"value":2658}," Possibly, if the buyer qualifies. The thief gains factual control but no ownership right, and is not a purchaser for value in good faith without notice. A later buyer who obtains control for value, in good faith, and without notice of the victim's claim can take free under Article 12 as enacted. The victim's remedies then run through tracing the asset and attacking the transfer under other law. The outcome depends on the facts and the state's enacted text.",{"type":26,"tag":27,"props":2660,"children":2661},{},[2662,2664,2669],{"type":31,"value":2663},"If a matter turns on who controlled a wallet, when, and with what right, the evidence must be assembled before the legal conclusion is drawn. ",{"type":26,"tag":51,"props":2665,"children":2666},{"href":558},[2667],{"type":31,"value":2668},"Contact ConsensusIntel",{"type":31,"value":2670}," to discuss the specific fact pattern.",{"title":7,"searchDepth":565,"depth":565,"links":2672},[2673,2674,2678,2679,2680,2681,2682,2683],{"id":2335,"depth":565,"text":2338},{"id":2356,"depth":565,"text":2359,"children":2675},[2676,2677],{"id":2390,"depth":572,"text":2393},{"id":2401,"depth":572,"text":2404},{"id":2412,"depth":565,"text":2415},{"id":2451,"depth":565,"text":2454},{"id":2487,"depth":565,"text":2490},{"id":2498,"depth":565,"text":2501},{"id":2528,"depth":565,"text":2531},{"id":461,"depth":565,"text":464,"children":2684},[2685,2686,2687,2688,2689],{"id":2586,"depth":572,"text":2589},{"id":2601,"depth":572,"text":2604},{"id":2616,"depth":572,"text":2619},{"id":2631,"depth":572,"text":2634},{"id":2646,"depth":572,"text":2649},"content:articles:35-ucc-article-12-digital-asset-control.md","articles\u002F35-ucc-article-12-digital-asset-control.md","articles\u002F35-ucc-article-12-digital-asset-control",1790145013677]