Case Opening Procedure

workflow

Core idea

Eight steps between accepting a matter and starting investigative work, in an order that puts scope and preservation ahead of analysis. Errors made here propagate: an objective that was never defined cannot be met, and a referral that was never preserved cannot be produced later. Budget 20 to 45 minutes.

Components

Receive the case. Record date received, time received, source of referral, receiving investigator, and method of receipt (email, portal, telephone, internal system).
Create the case file. Assign or verify a unique case identifier. Record case number, investigator, supervisor, date opened, status, and priority.
Conduct an initial review. Read everything available without forming conclusions. Identify the nature of the allegation, suspected offences, known participants, known victims, known assets, known wallet addresses, known transaction hashes, and available supporting evidence.
Define the investigation. Document the primary objective, secondary objectives, known limitations, required resources, and legal or jurisdictional considerations. Do not expand scope beyond the facts you actually have.
Preserve initial evidence. Before any detailed analysis: preserve the original complaint or referral, preserve wallet addresses and transaction hashes exactly as received, preserve source URLs, save supporting files per policy, and open an evidence inventory.
Establish initial investigative tasks. Build the first task list (verify addresses, identify networks, identify exchanges or VASPs, review available chain data, preliminary OSINT, records needed) and prioritise by investigative value and urgency.
Document the initial assessment. A short factual summary: allegation, current known facts, evidence received, objectives, immediate priorities, outstanding information gaps. Keep observation and assumption visibly separate.
Transition to active investigation. Begin work, and keep documenting investigative actions for the rest of the case lifecycle.

When to use

Immediately after a matter has been accepted, before any blockchain analysis. It runs alongside the first-hour checklist rather than instead of it: this is the record-creation procedure, that is the control-and-triage pass.

Avoid when

Do not open a case without a defined objective, and do not treat step 5 as optional because the referral is “just an email”. If information is uncertain, write it down as unverified rather than resolving it with an assumption. The recurring pitfalls are: no objective, unpreserved referral, observation blended with opinion in the initial summary, jurisdiction ignored, and documentation deferred until after the work.

Example

A victim report arrives with two addresses and a screenshot. Steps 1 and 2 create the record. Step 3 notes the allegation and both addresses without deciding what happened. Step 4 sets the objective as identifying the exchange holding the downstream deposits, not recovering the funds, because only the first is investigable from what is on hand. Step 5 saves the email intact and copies both addresses in full into the inventory. Step 7 lists the reported loss amount as reported, not as fact.

First Hour Case Control Checklist · The Six Operational Phases of the Cryptocurrency Investigation Methodology · Intake Triage Checklist · The Scope Triangle · Translate Stakeholder Wants into Investigable Questions · Five Intake Red Flags · Evidence Preservation Procedure · Pre-Investigation Readiness Checklist