"Follow the money" is one of the most quoted lines in investigative journalism and one of the least understood. It suggests a clean trail from a crime to a bank account to a culprit. Real financial investigations are messier: multiple entities, ordinary transactions mixed with suspicious ones, jurisdictions that do not share records and a legal standard that has to be met one document at a time.
The work is closer to accounting than to action film. It involves statements, ledgers, corporate filings, property records and interviews, assembled into a narrative that a court or a regulator can test.
Start with a question, not a spreadsheet
A financial investigation usually begins with a hypothesis: this company may be billing for services it did not provide; this official may have an interest in a supplier; this charity may be moving funds to a connected entity. The hypothesis directs the records request. Without one, a bank statement is just a long list of numbers.
Investigators then test the hypothesis against documents. Does the invoice have a matching purchase order, delivery record and payment? Is the supplier registered at an address that also appears in the director's other companies? Does the timing of a payment match a decision?
Records are not the same as evidence
A bank transfer shows that money moved. It does not show why, whether it was legitimate or who controlled the account. That context comes from contracts, emails, meeting notes, corporate registries and witness accounts. The transfer is a fact; the interpretation is the case.
This is why financial investigations take so long. Each document has to be authenticated, placed in sequence and checked against other sources. A single anomaly is a lead. A pattern of anomalies, each with an explanation ruled out, is an argument.
Beneficial ownership is the hard part
Companies can be owned by other companies, which are owned by trusts, which are managed in another jurisdiction. The name on the filing may be a nominee. Finding the person who actually benefits from the arrangement can require corporate records from several countries, each with different disclosure rules.
Public beneficial ownership registers have improved the picture in some places. They are incomplete, sometimes inaccurate and not universally accessible. Investigators still rely on leaks, court filings, property records and old-fashioned reporting to connect the layers.
Suspicious activity is not proof
Banks file suspicious activity reports when a transaction does not fit the expected pattern. These reports are valuable intelligence and poor evidence on their own. A report may reflect a cautious compliance officer, a legitimate but unusual business or a genuine concern. It does not establish wrongdoing.
The same caution applies to media leaks and databases of leaked records. They can point to a story, but they must be verified against primary documents before publication or prosecution. A leaked spreadsheet with no context is a rumour with formatting.
The money trail is not the story. The story is what the documents can prove about the people who moved it.
Asset tracing and recovery
Finding the money is only half the task. Recovering it requires freezing orders, cooperation between jurisdictions and proof that an asset was bought with the proceeds of a crime. Assets are often held through family members, trusts or companies, and may have been sold or moved before anyone notices.
Recovery rates are low in many cases, which is why prevention and early detection matter. A case that takes five years to build may recover a fraction of the loss.
The human side of the ledger
Financial crime is often described as victimless. It is not. Fraud can wipe out savings, close small businesses and fund other harm. The documents represent people who trusted a contract, a charity or a pension scheme.
That is also why reporting matters. A single unusual payment may look trivial. Combined with other reports, it can reveal a pattern that no individual victim could see.
The bottom line
Following the money is a discipline of documents, context and verification. A transfer is not a motive, a suspicious report is not a conviction and a leaked file is not a case. The work is slow because the standard is high, and that standard is what protects the innocent as well as the guilty.
How a cold case gets reopened looks at the evidence review that happens when the trail has gone quiet.
