Asset tracing: how investigators follow the money, and what the courts can order

When money has been stolen, diverted or hidden from a creditor, the first questions are where it went and whether it can be reached. Asset tracing is the work that answers the first question, and it decides most of the second. This guide explains how investigators do that work, the records they rely on in the United Kingdom, the United States and the European Union, the court orders available in England and Wales, the United States and the European Union, and what recovery realistically looks like. It is written for general counsel, insolvency practitioners, family offices and the victims of fraud, and it reflects the law as of October 2026.

Asset searching, asset tracing and asset recovery

The three terms are often used interchangeably, but they describe different tasks. An asset search establishes what a person or company owns or controls now, and where, from registers, records and open sources. Asset tracing starts from a known point, such as a stolen payment or a diverted sale price, and follows the value through each transaction and holder that came after it. Asset recovery is the legal and practical process of securing those assets, establishing a claim to them and enforcing it.

The World Bank and UNODC's Asset Recovery Handbook treats tracing as the first of five stages, followed by securing the assets, the court process, enforcement and return. A search can be done at any time, but tracing is what connects a loss to an asset a court can act on.

In English law, tracing also has a narrower technical meaning. Lord Millett explained in Foskett v McKeown [2001] 1 AC 102 that following is pursuing the same asset as it passes from hand to hand, while tracing identifies a new asset as the substitute for the old one. Tracing is neither a claim nor a remedy in itself. It is the process by which a claimant shows what happened to their property, which may then support a personal claim or a proprietary one. Tracing through a mixed account can be limited by the lowest intermediate balance rule, although linked transactions can permit backward tracing; the result depends on the facts. The Privy Council held in Federal Republic of Brazil v Durant International Corporation [2015] UKPC 35 that a court should not let a camouflage of interconnected transactions obscure the true overall purpose and effect of a coordinated scheme.

How assets are hidden

Most concealment relies on ordinary legal structures rather than secrecy. A 2018 FATF and Egmont Group study of more than 100 cases found that companies, especially limited liability companies, were easy to form. They were used to build complex ownership chains, often with shell companies, nominee directors and nominee shareholders between the owner and the money. Trust and company service providers frequently set those structures up. The World Bank's earlier review of some 150 grand corruption cases found a corporate vehicle used to hide the money trail in the vast majority of them.

Value can also move without any payment that looks unusual. In trade-based laundering, proceeds travel inside the price of goods through over-invoicing, under-invoicing or shipments that never existed, which John Cassara's work examines in detail. Crypto assets add speed and fragmentation: stolen funds are often split across many wallets, swapped between tokens and chains, and sometimes passed through mixers before reaching an exchange. Our reviews of Cassara, Madinger and Lilley cover the trade-based, shell-company and nominee methods.

Where investigators look

Company and ownership registers

In the United Kingdom, Companies House records directors, shareholders and people with significant control, broadly anyone holding more than 25% of the shares or votes or able to control the board. Identity verification for directors and people with significant control became a legal requirement on 18 November 2025, with a 12-month transition for existing directors and people with significant control. Companies House still states that it does not check the accuracy of what is filed, and verification of a named person does not reveal a nominee arrangement behind them.

The Register of Overseas Entities, in force since 1 August 2022, requires overseas entities that own UK land to disclose their beneficial owners, and HM Land Registry links those entities to the titles they hold. Title registers for property in England and Wales can be bought online for £7 and usually show the owner.

Elsewhere, access is narrower: the Court of Justice of the European Union ruled on 22 November 2022 that unrestricted public access to beneficial ownership registers was invalid. EU law now requires Member States to give access to people who can show a legitimate interest in the prevention of money laundering and its predicate offenses. Member States were required to implement the detailed access rules by 10 July 2026. In the United States, a FinCEN rule effective on 14 August 2026 exempts US companies and US persons from beneficial ownership reporting. The federal database was never open to the public, or to private litigants and investigators, in any case. For US entities, investigators work from state corporate filings, property records, lien filings and court records.

Court, property and transport records

Litigation is one of the richest sources. In England and Wales, a non-party can usually obtain statements of case and judgments from the court record, and US federal court filings are available through PACER at modest cost. Aircraft registers in the United States and the United Kingdom can be searched publicly, and property, insolvency and enforcement records add a picture of a subject's history with creditors.

Open sources and blockchain analytics

Open-source research, interviews and observation need no court authorization, though they stay subject to the limits below, and the Asset Recovery Handbook treats open sources and witness interviews as core inputs. For crypto assets, analytics tools can follow funds across public blockchains with considerable precision, but the trail usually stops at an exchange. In LMN v Bitflyer Holdings [2022] EWHC 2954 (Comm), the claimant's expert traced hacked funds to 26 addresses at several exchanges and could go no further, because crediting a customer happens off-chain in pooled wallets. At that point, only the exchange can say who received the money.

What investigators must not do

Lawful inquiry has firm limits, and evidence gathered outside them can damage the case it was meant to support. In the United Kingdom, knowingly or recklessly obtaining personal data without the consent of the controller is an offense under section 170 of the Data Protection Act 2018, subject to narrow defenses. Unauthorized access to a computer is an offense under the Computer Misuse Act 1990. In the United States, obtaining a customer's information from a financial institution by false pretenses is prohibited by the Gramm-Leach-Bliley Act, and asking someone else to do it is prohibited too. Paying insiders for information can engage the Bribery Act 2010 and, where foreign officials are involved, the US Foreign Corrupt Practices Act. Bank records, telephone records and the identity behind an exchange account are obtained through the courts, not around them.

What the courts can order

Investigators supply the trace and the evidence; applications to court are made by the client's lawyers or, in an insolvency, by the office-holder. The orders below are the ones that most often turn a trace into a recovery.

England and Wales

• Freezing injunctions. Under section 37 of the Senior Courts Act 1981 the High Court can restrain a party from dealing with assets in England and Wales or worldwide. The rules were rewritten from 6 April 2025 and now sit in CPR Part 25, which also provides for orders requiring a respondent to disclose their assets. The court's model order describes a freezing injunction as an exceptional form of relief.
• Without notice, with full and frank disclosure. Because warning a respondent defeats the purpose, freezing applications are usually made without notice. The applicant must then disclose every material fact, including those against them, and give an undertaking to pay any damages the order wrongly causes; a failure of disclosure can lead to the order being discharged.
• Norwich Pharmacal and Bankers Trust orders. A bank, exchange or other party that has become mixed up in a wrong, even innocently, can be ordered to disclose the wrongdoer's identity or what has become of the claimant's property. Since 1 October 2022 a gateway in Practice Direction 6B allows the court to give permission for these applications to be served on respondents outside the jurisdiction, and the Commercial Court used it in LMN v Bitflyer to obtain orders against overseas exchanges.
• Crypto assets. In AA v Persons Unknown [2019] EWHC 3556 (Comm) the High Court treated Bitcoin as property capable of supporting a proprietary injunction. The Property (Digital Assets etc) Act 2025 has since provided that a digital or electronic thing is not prevented from being the object of personal property rights merely because it is neither a thing in possession nor a thing in action.
• Insolvency powers. Section 236 of the Insolvency Act 1986 lets an office-holder compel people who hold company property or information to produce it. Section 423 allows the court to reverse transactions made to put assets beyond the reach of creditors.
• After judgment. A judgment creditor can have the debtor questioned on oath about their means under CPR Part 71.

Two well-known tools are not available to private parties. Unexplained wealth orders and account freezing orders can be sought only by law enforcement and prosecuting authorities, such as the National Crime Agency, HMRC and the Serious Fraud Office.

United States

• Discovery in aid of foreign proceedings. Under 28 U.S.C. § 1782 a federal court can order a person in its district to give evidence for use in a foreign proceeding. The Supreme Court held in ZF Automotive v Luxshare (2022) that this covers governmental tribunals but not private commercial arbitration.
• Limited pre-judgment freezes. In Grupo Mexicano v Alliance Bond Fund (1999) the Supreme Court held that federal courts cannot freeze a defendant's assets before judgment in a claim for money damages where no lien or equitable interest in the assets is claimed. Claimants instead rely on state attachment remedies, such as New York's, which federal courts can apply, or on proprietary claims to specific property.
• After judgment. A judgment creditor can take discovery from the debtor and from third parties to find assets.

European Union

• European Account Preservation Order. Available since January 2017 under Regulation 655/2014, it freezes funds in bank accounts in another Member State without notice to the debtor. It applies in every Member State except Denmark, covers bank accounts only, and is not available from United Kingdom courts or for accounts held in the United Kingdom.
• National interim measures. Courts can grant protective measures under their own law even where another Member State's courts decide the case, but under the Regulation the effect of such a measure is confined to that State. A protective measure ordered by the court that has jurisdiction over the substance can be enforced in other Member States, but not if it was ordered without notice, unless it has been served on the defendant before enforcement.

For recovery that crosses jurisdictions, the order of steps matters as much as the steps themselves. The Asset Recovery Handbook notes that some authorities wait for a domestic conviction and confiscation order before tracing and securing assets abroad. The results are often frustrating and adverse, such as when the delay gives the target time to move funds to uncooperative jurisdictions.

Why speed decides most cases

Money can often be moved instantly, while tracing and recovery by law enforcement and prosecutors may take months or years, a point the Asset Recovery Handbook makes directly. The theft of about $1.5bn from the Bybit exchange in February 2025 showed the gap at its widest. Within two hours the stolen funds had been split across some 50 wallets, according to Elliptic, and Lookonchain reported that about 54% had been laundered by 28 February, a week after the theft. Early freezes by exchanges and token issuers covered only a small part, and our account of what that theft shows about asset recovery sets out the first steps that matter most.

In England and Wales an urgent without-notice application can be heard within hours of the papers being filed, and the order is then reviewed at a return date, usually a week or two later. The practical delay is less the hearing than the time it takes to identify the right intermediaries, prepare the evidence and serve the order. That is why the tracing work needs to start before the legal team is ready to apply.

What recovery realistically looks like

The honest starting point is that authorities seize and confiscate only a small share of criminal proceeds. Europol estimated that between 2010 and 2014 EU authorities provisionally seized or froze about 2.2% of criminal proceeds in the EU and finally confiscated 1.1%. UNODC estimated in 2011 that less than 1% of the proceeds of crime laundered through the financial system are seized and frozen. The Association of Certified Fraud Examiners measured something different, recovery by the victim organization: its 2026 report found that in occupational fraud cases 56% of victim organizations recovered nothing, 29% recovered part of their losses and 15% recovered all of them.

Those figures describe the average, not a particular case. Recovery is more likely when the loss is identified early, the money passed through regulated institutions in cooperative jurisdictions, and the claimant can show a clear trace from the loss to an identifiable asset. The decision to pursue should rest on a realistic view of what is recoverable, from where and at what cost, which is the first question our asset searches and recovery support work answers.

A practical sequence

1. Secure what you already know. Preserve payment records, correspondence and system logs, and record the dates, amounts and accounts involved before anyone alters them.
2. Map the known flows. Build the first steps of the trace from your own records and the counterparties' details, and identify every bank, exchange or service provider the money touched.
3. Alert intermediaries quickly. Banks and exchanges can sometimes hold funds on their own initiative when given precise information early.
4. Search and trace. Establish ownership, control and current location through registers, records and open sources, and test the explanations the other side has given.
5. Bring in counsel for court orders. Freezing, disclosure and information orders turn a trace into leverage, and the evidence assembled in the previous steps supports the application.
6. Plan the cross-border route early. Decide which jurisdictions matter, what each can order and in what sequence, rather than waiting for a judgment at home.
7. Enforce and keep tracing. Assets continue to move after judgment, and the trace usually has to be kept current until the money is recovered.

How Falcone helps

Our asset searches and recovery support covers the search, the trace and the evidence that the client’s counsel, or counsel we recommend, needs to seek and enforce court orders, together with an assessment of whether pursuit is worth its cost. Where the loss came from inside an organization, the work begins as a financial investigation, and where proceedings are under way, our litigation support works alongside the client's lawyers.

Frequently asked questions

What is asset tracing?

Asset tracing is the process of following value from a known starting point, such as a stolen payment or diverted funds, through each later transaction and holder to where it sits now. It is usually the first stage of asset recovery, followed by securing the assets, court proceedings and enforcement.

What is the difference between an asset search and asset tracing?

An asset search establishes what a person or company owns or controls at a point in time, from registers, records and open sources. Asset tracing follows specific value from a loss through later transactions, which is what links the loss to an asset a court can act on.

Can private investigators get someone's bank records?

Not directly. Obtaining bank or customer information by deception is an offense in the United Kingdom and the United States. Bank records are obtained through court orders, such as Norwich Pharmacal or Bankers Trust orders in England and Wales, or through disclosure in proceedings, which the client's lawyers apply for using the evidence investigators assemble.

What is a freezing injunction?

A freezing injunction is a court order that stops a party from dealing with or moving assets, in England and Wales under section 37 of the Senior Courts Act 1981 and CPR Part 25. It can cover assets worldwide and is often combined with an order to disclose assets. Because it is usually sought without notice, the applicant must make full and frank disclosure and undertake to pay damages if the order proves wrong.

Can stolen cryptocurrency be traced and recovered?

It can usually be traced, because public blockchains record every transfer, but recovery is harder. The trail typically stops at an exchange, which then has to be asked or ordered to identify the account holder and freeze the funds. English courts treat crypto assets as property capable of supporting freezing and proprietary injunctions.

How much stolen money is usually recovered?

The available figures measure different things. Europol estimated that EU authorities confiscated about 1.1% of criminal proceeds between 2010 and 2014, which is state confiscation, not recovery by victims. For victims, the ACFE's 2026 report found that 56% of organizations hit by occupational fraud recovered nothing, 29% recovered part of their losses and 15% recovered all of them. Individual cases vary widely, and speed, the jurisdictions involved and the quality of the trace all affect the outcome.