Europol ¦ SIRIUS Electronic Evidence Situation Report 2025

The digital evidence bottleneck in money laundering investigations

Money laundering investigations increasingly depend on data held by private technology companies. Transaction records, account-registration details, connection logs, IP addresses, telephone numbers, device information and communications can help investigators identify the people controlling accounts, trace the movement of criminal proceeds and connect financial activity to a wider criminal network.

This is particularly important where the predicate offense is cyber-enabled or where the laundering operation relies on digital infrastructure. Fraud, ransomware, drug trafficking, corruption, human trafficking and the sale of illicit goods can all generate proceeds that are moved through cryptocurrency exchanges, fintech platforms, messaging applications, social media and online marketplaces. Electronic evidence may provide the link between the underlying crime, the proceeds and the person who ultimately controls or benefits from them.

The scale of the challenge is reflected in the growing volume of requests submitted by EU authorities to selected online service providers. In 2024, these providers received 303,289 requests, approximately 3.5 times the volume recorded in 2018. Google and Meta accounted for 82% of the requests in the sample. Emergency disclosure requests increased by 32% compared with 2023, reaching 28,608 requests.

For financial crime investigators, the message is clear: digital evidence is no longer an auxiliary source. It is often an essential part of proving both the predicate offense and the laundering conduct.

Cryptocurrency and fintech data are now investigative priorities

Cryptocurrency exchanges were identified as one of the three most relevant categories of online service for criminal investigations, alongside social media platforms and messaging applications. Fintech companies also entered the top five categories identified by law enforcement.

This development reflects the changing structure of laundering schemes. Criminal proceeds may pass through conventional bank accounts, payment platforms, cryptocurrency wallets, peer-to-peer services, online brokerage accounts and prepaid instruments. Investigators therefore need to reconstruct value flows across several types of provider rather than focus on a single financial institution.

Data obtained from cryptocurrency service providers can be particularly valuable. Account information may identify the user behind a wallet or exchange account. Login records and IP addresses can connect activity to a device or location. Transaction records can help identify the sender and recipient of funds, while timestamps and account histories can establish the sequence of events. When combined with blockchain analysis, this information may help link pseudonymous transactions to real-world individuals.

These records also support the investigation of the predicate offense. A cryptocurrency transfer may reveal the payment of a ransom, the purchase of narcotics, the proceeds of fraud or the distribution of funds among members of an organised criminal group. The same dataset may therefore establish the origin of the proceeds, the movement of the money and the involvement of particular suspects.

Bastian Schwind-Wagner _Follow

"Electronic evidence has become essential to money laundering investigations, particularly where criminal proceeds move through cryptocurrency exchanges, fintech platforms, messaging applications and social media. Account records, IP addresses, connection logs and transaction data can help link the predicate offense to the movement and concealment of illicit funds.

The main obstacles are slow cross-border procedures, inconsistent data retention rules and uneven knowledge of available legal tools. The EU Electronic Evidence framework may improve speed and legal certainty, but its success will depend on operational readiness, precise requests and close cooperation between authorities and service providers."

The most valuable data is often non-content information

Connection logs, telephone numbers and IP addresses used during registration were identified as the three most important categories of data requested by EU law enforcement in 2024. These data types may appear less significant than message content or stored files, but they can be decisive in financial crime cases.

Connection logs can place a user behind a particular account at a relevant time. A telephone number can connect an online service account to a wider identity profile, including accounts held with payment providers or cryptocurrency exchanges. An IP address used at registration may provide an early attribution lead, particularly when combined with subscriber data obtained from an internet service provider.

Such information can help investigators establish common control over apparently separate accounts. This is relevant where a laundering network uses multiple accounts, nominee identities or layered transfers to conceal the beneficial owner of assets. Metadata can also identify links between a suspected fraud operation and the subsequent movement of funds through digital payment services.

The evidential value depends on precision. Requests must identify the relevant user, account, data categories and timeframe. Broad requests for a complete data dump are more likely to be refused or delayed, and may raise concerns about necessity and proportionality. A focused request is more likely to produce usable evidence and withstand later scrutiny in court.

Voluntary cooperation remains useful but legally uneven

Direct requests to service providers under voluntary cooperation remained the principal method used by EU law enforcement. Judicial authorities continued to rely primarily on European Investigation Orders and Mutual Legal Assistance requests, although direct voluntary cooperation was also widely used, particularly for non-content data.

The attraction of voluntary cooperation is speed. It can provide an investigative lead before formal judicial cooperation procedures are completed. This may be critical where criminal proceeds are being moved rapidly between accounts or where an online service is likely to delete or overwrite relevant information.

Its limitations are equally significant. National laws differ on whether authorities may directly contact a foreign provider, whether the provider may disclose the requested information and whether the resulting evidence will be admissible in court. In several EU Member States, the legal position is not expressly settled. Provider policies also differ, and a company may agree to disclose one category of data while requiring an EIO or MLA request for another.

For money laundering investigations, voluntary cooperation should therefore be treated as a legally assessed investigative channel rather than an automatic substitute for formal cooperation. Investigators must consider the location of the provider, the type of data sought, the applicable domestic law, the provider’s policy and the requirements for authenticating and admitting the evidence.

Mutual Legal Assistance is still too slow for digital proceeds

Judicial authorities identified procedural delay as one of the leading obstacles to obtaining electronic evidence. For requests involving non-EU countries, 73% of EU judicial respondents said that the MLA procedure took too long. Delays were also a major concern in cooperation between EU Member States.

The problem is acute in laundering cases because digital proceeds can move within minutes. A request that takes months may arrive after accounts have been emptied, assets transferred across several jurisdictions or relevant data deleted under ordinary business retention policies. Delays may also weaken the link between the proceeds and the predicate offense, particularly where investigators need contemporaneous account records, login data or communications.

Partial responses create a further difficulty. A provider or foreign authority may supply basic subscriber information but not connection logs, transaction records or associated account data. That may identify an account without establishing who controlled it during the relevant period or how it was used to receive and transfer criminal proceeds.

The forthcoming EU Electronic Evidence framework is intended to address some of these weaknesses through European Production Orders and European Preservation Orders. The framework introduces mandatory procedures, designated legal representatives or establishments within the EU and defined response periods of ten days for standard requests and eight hours for emergency cases. Its practical value will depend on effective national implementation, reliable technical systems and sufficient familiarity among investigators and prosecutors.

Data preservation must precede the formal request

Data retention was identified as a persistent weakness across jurisdictions. Forty-one percent of EU judicial authorities reported that requested data held abroad was no longer available when the request was submitted. Among those authorities, 34% said that the loss of data significantly affected the investigation or proceedings, while 54% reported delays or complications.

The risk is especially serious in money laundering cases involving online accounts and payment services. Providers may retain information for different periods, depending on the data type, the service involved and the provider’s commercial or legal obligations. Registration details may remain available while connection records have already been deleted. Transaction records may exist in one system but not in a related account-management system.

A preservation request can therefore be as important as a production request. Investigators should identify potentially relevant accounts and data at the earliest stage, assess the risk of deletion and use the available legal mechanism to preserve the information before seeking its disclosure. Preservation does not establish the evidential value of the data, but it protects the possibility of obtaining and analysing it later.

The absence of a harmonised European retention framework remains a major structural problem. Faster production procedures cannot retrieve information that a provider no longer holds.

The predicate offense cannot be separated from the laundering analysis

Electronic evidence should not be collected only to prove that money moved. The investigation must also address why the funds are believed to be criminal property and how the suspect knew, or is alleged to have known, their origin.

Data from social media and messaging services may identify the recruitment of money mules, instructions to open accounts or communications between fraudsters and intermediaries. Data from cryptocurrency exchanges may connect a wallet to an individual and show the movement of proceeds. Fintech records may identify transfers, recipients and account relationships. IP and device data may show that apparently unrelated accounts were controlled from the same location or equipment.

This evidence can support several elements of a laundering case. It may help establish the predicate conduct, trace the proceeds, demonstrate concealment or disguise, identify the person exercising control and show coordination between participants. It can also challenge explanations based on mistaken identity, unauthorised account use or legitimate commercial activity.

The strongest cases usually combine electronic evidence with traditional financial intelligence, bank records, company information, tax data, customs records, witness testimony and blockchain analysis. Digital records should be preserved with their provenance and context, including information about how they were obtained, the relevant account identifiers, timestamps and any transformations made during analysis.

Request quality directly affects investigative outcomes

The average success rate for EU requests in the selected provider sample reached 76% in 2024, the highest level recorded in the series. That still means that nearly one in four requests did not successfully obtain the sought data.

Providers identified recurring reasons for refusal or delay. These included addressing the wrong legal entity or data controller, failing to state a valid legal basis, omitting required identifiers, disregarding provider policies and making requests that were too broad. Delays also arose where identifiers were not unique, the justification was weak or the user was outside the relevant jurisdiction.

These problems are avoidable in many cases. A request concerning a suspected laundering account should use the account identifier recognised by the provider, specify the precise period under investigation and distinguish clearly between subscriber, traffic, transactional and content data. It should explain the suspected offense, the relevance of the requested data and the legal basis for obtaining it without disclosing unnecessary investigative detail.

Single Points of Contact can improve this process. Eighty percent of law enforcement respondents who used a SPoC were satisfied or more than satisfied with the process. The average success rate in countries with a SPoC was 77%, compared with 73% in countries without one, although the figures should be interpreted cautiously because of the limited provider sample.

Training is a financial crime control issue

Knowledge gaps are not merely administrative weaknesses. They can lead to lost evidence, delayed asset tracing and weaker prosecutions.

Only 8% of surveyed EU law enforcement officers said they were very familiar with the EU Electronic Evidence legislative package, while 40% said they were not familiar with it at all. Among judicial authorities, 45% said they were not sufficiently familiar with existing cross-border data acquisition methods. Seventeen percent reported never having received training on obtaining electronic evidence across borders.

Training should be linked to practical financial crime scenarios. Investigators need to understand how to request exchange records, identify relevant account data, preserve information quickly and distinguish between data types. Prosecutors and judges need to understand the legal basis, proportionality requirements, authentication issues and the relationship between direct requests, formal cooperation and the new European orders.

The same applies to the predicate offense. A request should explain how the data relates to the suspected fraud, corruption, cybercrime, trafficking or other underlying conduct and how it may establish the movement or concealment of the resulting proceeds. A request framed only as a search for financial information may fail to convey the investigative relevance of the digital evidence.

The August 2026 transition requires operational readiness

The EU Electronic Evidence framework became applicable on 18 August 2026, introducing a partial shift from voluntary cooperation to mandatory orders. This change affects law enforcement agencies, prosecutors, judicial authorities and service providers.

Authorities need tested internal workflows, clear responsibility for issuing and validating orders, reliable access to the decentralised IT system and procedures for urgent preservation and production. Service providers need systems capable of handling increased request volumes, verifying authorities, meeting response deadlines and managing conflicts between applicable legal regimes.

Voluntary cooperation will not disappear entirely. It remains relevant for matters outside the scope of the new framework and for interactions with providers or jurisdictions not covered by it. During the transition, unclear procedures or a premature abandonment of established cooperation channels could create additional risks for investigations.

Financial crime teams should review their evidence-acquisition procedures as part of their broader asset-tracing and proceeds-of-crime strategy. The question is not only whether an account can be identified, but whether the evidence required to prove the predicate offense, trace the proceeds and establish the laundering conduct will still be available when formal proceedings begin.

Digital evidence must support a complete proceeds narrative

The central lesson for financial crime enforcement is that electronic evidence should be integrated into the investigation from the outset. It can identify suspects, connect accounts, reveal communications, trace cryptocurrency and establish the timing of transfers. It can also expose the operational structure behind predicate offenses that generate criminal proceeds.

However, its value depends on speed, precision and legal discipline. Investigators must act before data disappears, select the correct cooperation channel, formulate requests narrowly and preserve the information needed to demonstrate authenticity and continuity. Prosecutors must connect the digital records to the elements of both the predicate offense and the laundering charge.

The growth in requests, the increasing role of cryptocurrency and fintech providers and the approaching regulatory transition all point in the same direction. Effective anti-money laundering enforcement will depend not only on following the money, but also on securing the digital evidence that explains where the money came from, who controlled it and how it was made to appear legitimate.

Dive deeper

• Europol ¦ SIRIUS Electronic Evidence Situation Report 2025 ¦ Link