An on-chain investigation export should let another authorized reviewer understand what was observed, what was inferred and why a decision followed. Preserve source references and provider responses rather than exporting only a score. This guide focuses on reproducible case evidence. The triage guide covers incoming alerts and queue management.
Start with a case manifest
Give the export a case identifier and record the scope of the investigation. List the networks, starting transactions or addresses, time range, query parameters and assessment timestamp. Include provider or response version where available. A manifest should explain what was examined and what remained outside the available coverage.
Preserve raw results alongside a readable path
Retain the original tracing response and an accessible summary of the relevant transfers. Every transfer in the summary should point back to chain evidence. Keep entity labels separate from observed movements and identify the source of attribution when supplied. A readable graph is useful only when the reviewer can locate the evidence behind it.
Record policy and reviewer decisions
Store the policy version, decision owner, action and rationale with the case. Distinguish the provider’s risk signals from the organization’s conclusion. Record contradictory evidence and unresolved questions. This makes it possible to explain a past decision even when a later provider assessment changes.
Make limits visible in the export
Mark truncated traversals, unsupported assets, missing historical periods and unverified cross-chain links. A graph returned up to a query limit should not look like a complete path of all funds. Explain how the provider’s model interprets exposure, and preserve uncertainty instead of converting an incomplete relationship into an ownership claim.
Keep later assessments as separate evidence
A second query can return different attribution, risk categories or coverage. Treat it as a new assessment and compare it with the original snapshot. Do not overwrite the evidence used for a prior decision. Apply the retention and access controls appropriate to your process, including authorization to view or export case material.
Verify the export with another reviewer
Ask an authorized reviewer to follow the source references and reproduce the stated reasoning. Check that timestamps, network identifiers and amount units are unambiguous. Confirm that the raw response and summary agree. Evaluate Crypto Chief AML Intelligence against the evidence fields your case workflow requires, rather than assuming an API response is already an investigation report.
Frequently Asked Questions
Is a tracing score enough for an investigation export?
A score lacks the transaction path, source context and decision rationale needed to understand an investigation. Preserve those supporting records and the limits of the assessment.
Should a later provider result replace the original?
Keep it as a separate assessment. Labels and models can change, while the original snapshot explains the evidence available for the earlier decision.
Can an export establish who owns an address?
An export can preserve attribution evidence and observed transfers. It should not turn a provider label or inferred relationship into an unsupported identity conclusion.