Escalation Decision Matrix and Triggers
framework
Core idea
Escalation fails in two directions: too late, after the money has moved past any practical preservation window, and too vague, arriving at the wrong desk with a package nobody can act on. Fix both by pre-defining the trigger, the destination and the contents. The trigger is a condition you check rather than a judgement you make under pressure, and the package is assembled before you need it.
Components
Seven triggers. Any one of them starts the clock.
- Funds are actively moving, or have recently reached a hosted service.
- A centralised exchange, payment processor, fintech or crypto ATM operator may hold records.
- Ransomware, extortion, threats or public leak activity is involved.
- Sanctions, terrorist financing, child exploitation, narcotics or national-security indicators appear.
- Multiple victims or large aggregate losses are identified.
- Evidence is volatile: live domains, chats, dashboards, social channels.
- A potential insider or employee is implicated.
Trigger to path to package.
| Trigger | Escalate to | Package must include |
|---|---|---|
| Funds moving toward exchange exposure | Supervisor, counsel or compliance, exchange preservation contact, law enforcement where appropriate | Case ID, full transaction hashes, full addresses, chain, timestamps, loss amount, screenshots, urgency statement |
| Sanctions or terrorist-financing concern | Compliance leadership, sanctions team, FIU or law-enforcement channel, counsel | Screening source and date, wallet or service exposure, confidence level, limitations, related transactions |
| Ransomware or extortion deadline | Incident-response lead, law enforcement, insurer and counsel as applicable | Demand note, payment address, timeline, victim impact, communication evidence, preservation status |
| Multiple victims or an aggregation wallet | Fraud leadership, law enforcement referral, exchange and platform contacts | Victim list, aggregate loss, shared wallet evidence, convergence timeline, platform indicators |
| Potential insider or employee misconduct | Legal, HR or investigations leadership, access-control owner | Access logs, wallet evidence, policy basis, preservation requirements, confidentiality controls |
Make the preservation request specific. Name the records to preserve and the blockchain activity that justifies the request. Volatile categories matter most: login IPs, device fingerprints, communications, support tickets, internal risk notes. Where legal process is required for disclosure, preservation still holds the records in place while that process is prepared.
When to use
At intake, to set the triggers for the case, and at every trace review afterwards. Check the triggers rather than recall them.
Avoid when
Do not delay escalation until attribution is settled. Preservation and naming a suspect are separate steps with separate evidentiary bars, and the preservation window closes first.
Example
A trace reaches an exchange-linked deposit address at 09:40. Trigger one is live, so the package goes to the supervisor and the exchange preservation contact the same morning with full hashes, chain, timestamps and an urgency statement. Account-holder identity is recorded as unknown pending records, which does not hold up the request.
Related
Common Crypto Investigation Failure Modes · Preserve Before You Attribute · Exchange Tiers and the Escalation Clock · Freezing Funds with an Exchange Email · Compelling VASP Disclosure: The Legal-Process Ladder · VASP Records: What to Request and What Exists · The First 24 Hours of a Crypto Theft · Time-Decay of Crypto Evidence · Screening Addresses Against OFAC Sanctions