The expert's role, duties and working with lawyers and courts

A trace that took months can be lost in an afternoon if the court decides the person presenting it is not independent, is speaking outside their field, or used a method nobody can test. Courts in almost every system let specialists give opinions that ordinary witnesses may not, and in return demand impartiality, competence and a checkable method. Much of that test is passed or failed away from the courtroom: in the instructions, the discussion of drafts with lawyers, the disclosure of conflicts and the meeting with the other side's expert. This lesson covers the expert's role and duties, the admission criteria most systems share, and how to work with lawyers and courts.

Witness of fact or expert

A witness of fact tells the court what they saw or did: "I exported the exchange records on 4 March and hashed the file." An expert witness gives an opinion on a matter that needs specialist knowledge the court does not have: "In my opinion, the 2.95 BTC reached deposit addresses controlled by Exchange K."

Crypto cases blur the line. The investigator who ran the trace is often asked to explain it, becoming a witness of fact for what they did and an expert for what it means. That dual role is allowed in many systems but attracts challenge, because the person who built the case is not obviously neutral. Units reduce the risk by having a second examiner re-perform key findings, separating investigator and reporting expert in serious cases, and marking in the report what is personal observation and what is opinion. In many common-law systems the parties instruct their own experts; in many civil-law systems the court appoints them. The duties below apply in both.

The overriding duty to the court

Whoever pays or instructs the expert, the expert's first duty is to the court: to give objective, unbiased opinions within their expertise and to help the court understand the evidence, not to win the case. ISO 21043-5:2025 (Forensic sciences, Part 5: Reporting) expresses the same aim when it requires reports to be accurate, clear, transparent, complete, unambiguous and impartial.

Independence means the opinion would be the same whichever side had asked for it. A useful self-test: if the other party had instructed you with the same material, would any sentence of the report change?

Staying within expertise

Expertise comes from training, experience and a track record that can be shown. A crypto forensic examiner is usually competent on on-chain data, tracing methods, clustering heuristics, the behavior of services and what tool outputs mean; usually not on whether conduct is an offense, whether funds are "proceeds of crime" in the legal sense, what a person intended, or whether a witness is truthful. A simplified hierarchy of propositions helps, adapted from the source, activity and offense levels in the European Network of Forensic Science Institutes (ENFSI) guideline on evaluative reporting (2015):

The offense level is the ultimate issue. Many systems allow experts to touch it in some circumstances, but a forensic report gains nothing by doing so and risks being discounted for overreach. Write "the funds moved through 14 addresses in 37 minutes before deposit", not "the funds were laundered".

Criteria common to most systems

Some courts screen expert evidence before admitting it, others admit it and then weigh it, but the questions are remarkably similar. The five indicators from testability to acceptance make up the reliability of the method.

Applying the criteria to a tracing report

A tracing report contains findings of different kinds, and they do not score the same. Grading them separately, as Lesson 3.2 requires, lets the report survive scrutiny of its weakest part.

The weakest finding is often a commercial tool's label with an unpublished method. Opacity does not make it wrong, but alone it fails testability. The fix is corroboration: exchange records obtained by legal process, the service's own published addresses, or an independent re-trace from raw data (Lessons 4.6 and 3.6); without any of these, the limit goes in the report and the grade comes down. The criteria also explain why units invest in validation and accreditation (Lesson 8.3).

Managing context

Most failures of independence are not dishonesty but contextual bias: an examiner told "the suspect has an account at Exchange K" before tracing is more likely to resolve an uncertain change output toward Exchange K. Linear sequential unmasking (Lesson 1.5) has the examiner record conclusions before seeing task-irrelevant information. For the court-facing expert, the record of how context was managed must be shown: what case information was received and when, the trace and grades written before reading the suspect's account list, critical links re-performed by a second examiner not told the expected answer, and any change of opinion explained.

Instructions and scope

Every engagement starts with written instructions that the expert has read, questioned and accepted: who instructs, for whom and in which proceedings; answerable questions ("trace the funds" is not one; "Did any of the 41.6 BTC stolen in transaction 2a6f…b93c reach addresses controlled by Exchange K before block 941,350, and if so how much?" is); the materials, with a way to verify them such as hashes; the authority under which data was obtained, since evidence gathered without it may be unusable (Lesson 1.3); deadlines and fees, fixed by time or task and never by outcome; and confidentiality and data protection terms.

Push back on questions the evidence cannot answer or that fall outside expertise. "Identify the owner of the wallet" usually cannot be answered on chain; propose what can be, such as "which service received the funds, and what records would identify the account holder". Get scope changes in writing and record every substantive communication; ISO/IEC 17025:2017 clause 7.8.7.3 requires accredited laboratories to keep a record when opinions are communicated by dialogue.

{
  "case_id": "CASE-2026-031",
  "entry": 7,
  "date_utc": "2026-05-12T09:40:00Z",
  "type": "instruction_change",
  "from": "instructing lawyer",
  "summary": "Added question 4: amount reaching Exchange L",
  "expert_response": "Accepted; needs Exchange L records not yet provided",
  "materials_received": [],
  "affects_findings": ["new F6"],
  "recorded_by": "Examiner 2"
}

If the scope or the report is later challenged, this log shows that changes came from documented instructions or new evidence.

Conflicts of interest

Check for conflicts before accepting and whenever new parties appear. Typical crypto conflicts: previous work for a party or for the exchange, issuer or service at the center of the trace; a commercial relationship with the analytics provider whose labels are relied on or challenged; holding the asset or a position the case could affect; public statements about the case; and an investigative role incompatible with independent opinion. Disclose anything a reasonable observer might see as relevant, in the report itself; if disclosure cannot manage it, decline.

Working with the instructing lawyer

Lawyers may legitimately point out unclear passages, ask whether a question has been fully answered, flag material the expert has not seen and comment on format. They may not change the substance: a request to remove an adverse finding, soften a limitation or strengthen a grade without new evidence is a request to breach the duty to the court. Reply in writing, explain why the finding stays and record the exchange; if pressure continues, the expert may have to withdraw, and in some systems must tell the court why. Assume drafts may later be seen: in many systems the instructions and materials relied on can be disclosed, and a draft with a firmer conclusion than the final report will be put to the expert in cross-examination.

Privilege varies widely. Some systems extend lawyer-client protection to experts advising a party, often narrowing or ending it once the party relies on that expert's evidence in court. Do not decide privilege yourself: ask the instructing lawyer, or the court in a court appointment, keep privileged material marked and separate, and write every note as if the court may read it.

Joint expert meetings and joint statements

When experts disagree, courts in many systems direct them to meet without the lawyers to narrow the issues. It is not a negotiation: neither needs the instructing party's permission to agree a point, and neither should concede what they do not believe. Prepare by listing every difference and the evidence that would resolve it, agree an agenda, exchange data or queries the other has not seen, and check that both reports use the same data cut-off: many apparent disagreements turn out to be readings at different block heights or with label sets of different dates. The outcome is a signed joint statement:

A good joint statement often shows the dispute is narrower than the reports suggested, and separates questions of fact for the experts from questions of method or law for the court (Lesson 3.3 covers allocation methods).

Single joint and court-appointed experts

A single joint expert is instructed by all parties together: every communication goes to all, with no private contact with one side. A court-appointed expert receives questions from the court, often including questions the parties proposed, and reports to it. Typically, though systems vary, the parties may appoint technical advisers to attend the examination and file observations; access to evidence runs through the court; the expert may be challenged and must step aside for a conflict; and supplementary questions may follow in writing or at a hearing.

Court appointments in crypto cases often arrive with questions that cannot be answered as framed, such as "determine the owner of the wallet" or "confirm the funds are proceeds of the fraud". Answer what the evidence allows, explain why the rest cannot be answered on chain or falls to the court, and say what records or legal process would close the gap. Lesson 9.4 covers testimony, and Lesson 10.5 follows a report through a full case.

Exam focus: expect scenarios testing the duty to the court under pressure (adverse findings, contingent fees, new evidence, a valid opposing point, a lawyer asking to soften a finding). Know witness of fact versus expert and the dual-role risk; source, activity and offense levels and the ultimate issue; the common admission criteria and how each finding type scores; corroborating opaque labels; managing context; written instructions and reframing unanswerable questions; recording oral opinions; conflicts; privilege as system-dependent; joint meetings, checking the cut-off, and joint statements; and how single joint and court-appointed experts communicate.