Expert reports and courtroom testimony · Lesson 1 of 5
The expert's role and duties
8 min read
A trace that took months can be lost in an afternoon if the court decides the person presenting it is not independent, is speaking outside their field, or used a method nobody can test. Courts in almost every system let specialists give opinions that ordinary witnesses may not, and in return they demand impartiality, competence and a method that can be checked. This lesson sets out what an expert is, what duties come with the role, and the admission criteria shared by most legal systems, applied to crypto tracing.
Witness of fact or expert
A witness of fact tells the court what they saw or did: "I exported the exchange records on 4 March and hashed the file." An expert witness gives an opinion on a matter that needs specialist knowledge the court does not have: "In my opinion, the 2.95 BTC reached deposit addresses controlled by Exchange K."
Crypto cases blur the line. The investigator who ran the trace often knows it best and is asked to explain it, which makes them a witness of fact for what they did and an expert for what it means. That dual role is allowed in many systems but attracts challenge, because the person who built the case is not obviously neutral about its conclusions. Units reduce the risk by having a second examiner re-perform key findings, by separating the case investigator from the reporting expert in serious cases, and by making the report say which parts are personal observation and which are opinion.
Legal systems organize expert evidence differently, with parties usually instructing their own experts in many common-law systems and the court usually appointing them in many civil-law systems, but the duties in this lesson apply in both.
The overriding duty to the court
Whoever pays or instructs the expert, the expert's first duty is to the court: to give objective, unbiased opinions within their expertise, and to help the court understand the evidence, not to win the case. The forensic standard on reporting, ISO 21043-5:2025 (Forensic sciences, Part 5: Reporting), expresses the same aim when it requires reports to be accurate, clear, transparent, complete, unambiguous and impartial.
In practice the duty shows up under pressure:
| Pressure | What the duty requires |
|---|---|
| The instructing party asks you to leave out a finding that hurts its case | Keep it; a report that omits adverse findings is misleading |
| Your fee would rise if the case succeeds | Refuse; fees must not depend on the outcome |
| New records arrive after the report that weaken a link | Tell the instructing party and the court; issue an amended report |
| You are asked for an opinion on the defendant's intent | Decline; it is outside expertise and is the court's question |
| The opposing expert makes a valid point | Accept it, in writing and in testimony |
Independence means the opinion would be the same whichever side had asked for it. A useful self-test: if the other party had instructed you with the same material, would any sentence of the report change?
Staying within expertise
An expert may only give opinions on matters within their expertise, which comes from training, experience and a track record that can be shown. A crypto forensic examiner is usually competent to speak about on-chain data, tracing methods, clustering heuristics, the behavior of services, and what tool outputs mean. They are usually not competent to say whether conduct amounts to an offense, whether funds are "proceeds of crime" in the legal sense, what a person intended, or whether a witness is telling the truth.
A helpful way to stay inside the line is a simplified hierarchy of propositions, adapted from forensic science, where the European Network of Forensic Science Institutes (ENFSI) guideline on evaluative reporting (2015) distinguishes source, activity and offense levels:
| Level | Crypto example | Who addresses it |
|---|---|---|
| Source | The 2.95 BTC at bc1q…k8p0 derives from the theft transaction c7d2…e815 | The expert |
| Activity | The wallet on the seized laptop signed the transaction that moved it | The expert, with device evidence |
| Offense | The defendant laundered the stolen funds | The court |
The offense level is the ultimate issue. Many systems allow experts to touch it in some circumstances, but a forensic report gains nothing by doing so and risks being discounted for overreach. Write "the funds moved through 14 addresses in 37 minutes before deposit", not "the funds were laundered".
Criteria common to most systems
Courts differ in the tests they apply and the moment they apply them: some screen expert evidence before admitting it, others admit it and then weigh it. But the questions they ask are remarkably similar. The five indicators in the middle of the table together make up the reliability of the method.
| Criterion | Question the court asks | Crypto-tracing example |
|---|---|---|
| Relevance and helpfulness | Does the opinion bear on an issue, and help the court beyond what it could work out itself? | Where the stolen BTC went, not general crypto risk |
| Qualification | Is this person competent in this specific field, as shown by training, experience, proficiency testing and prior work? | Training, casework and proficiency tests in tracing |
| Testability | Can the method be tested, and has it been? | Another examiner re-traces the funds from raw node data |
| Known or potential error | Is the error rate known, or at least the failure modes? | The common-input heuristic fails on CoinJoin |
| Peer review and publication | Has the method been examined by others? | Published heuristics and studies of their accuracy |
| Standards and controls | Are there documented procedures, validation and quality management? | Validated procedures, accreditation, review records |
| Acceptance | Is the method accepted in the relevant professional community? | Clustering and tracing methods used across the field |
| Proper application | Was a reliable method applied correctly to these facts, with the data the conclusion needs? | Exceptions checked for each link, cut-off stated |
| Independence and impartiality | Is the expert free of conflicts and willing to state limits? | Context managed, limits stated in the report |
Applying the criteria to crypto tracing
A typical tracing report contains findings of different kinds, and they do not score the same against the criteria. Grading them separately, as the lesson Tracing to an evidential standard requires, is what lets the report survive scrutiny of its weakest part.
| Finding type | Example | How reliability is shown | What to disclose |
|---|---|---|---|
| Deterministic | Transaction c7d2…e815 sent 0.95 BTC to bc1q…k8p0 in block 941,203 | Anyone can re-verify it from a node | Data source, block hash, cut-off |
| Heuristic | Ten addresses are one wallet by the common-input heuristic | Published logic, known exceptions, tested against ground truth | Heuristic used, exceptions checked (CoinJoin, PayJoin), error research |
| Label-based | The cluster is Exchange K | Corroboration from the service's own records or self-published addresses | Label source, date, tool and version, conflicts between sources |
| Inference by matching | A bridge release matches the deposit by amount and time | Candidate count in a stated window | Window, tolerance, number of candidates |
The weakest finding is often a label from a commercial analytics tool whose method is not published. Opacity does not make it wrong, but it fails the testability indicator on its own. The fix is corroboration: exchange records obtained by legal process, the service's own published addresses, or an independent re-trace from raw data (see the lessons Attribution sources and their reliability and Tooling, reproducibility and validation). The criteria also explain why units invest in validation and accreditation (see Quality management in the forensic unit): documented procedures and proficiency results are what a court looks for when it asks about standards and controls.
Independence in practice: managing context
Most failures of independence are not dishonesty but contextual bias: knowing what the investigation hopes to find shapes what the examiner looks for and how ambiguous data is read. An examiner who is told "the suspect has an account at Exchange K" before tracing is more likely to resolve an uncertain change output toward Exchange K.
Forensic science answers this with context management. The best-known approach, linear sequential unmasking (Dror and colleagues, 2015), has the examiner analyze the evidence and record conclusions before seeing task-irrelevant information, and document anything learned later that changed the analysis. For a tracing unit this means:
- record in the case notes what case information you received, and when;
- write down the trace and confidence grades before reading the suspect's account list;
- have a second examiner re-perform critical links without being told the expected answer;
- record and explain any change of opinion.
The lesson Ethics, privacy and investigator safety covers bias and tunnel vision in investigations generally; what the court-facing layer adds is that the record of how context was managed becomes part of what the expert must be able to show.
Exam focus: the difference between a witness of fact and an expert, and the risks of the dual role; the overriding duty to the court and what it requires under pressure (adverse findings, contingent fees, new evidence, valid opposing points); staying within expertise and leaving the offense level (the ultimate issue) to the court; the criteria common to most systems (relevance, qualification, testability, known error, peer review, standards, acceptance, proper application, independence); grading deterministic, heuristic, label-based and matching findings against those criteria; corroborating opaque tool labels; contextual bias and linear sequential unmasking.