How to build a crypto proof of origin file your bank accepts

What does a step-by-step crypto proof of origin file for your bank involve?

A proof of origin file is an ordered set of documents with which a bank can establish for itself how crypto assets were built up, from the first deposit to the current balance. It is not a statement and not a summary, but a chain of events in which every amount has an identifiable origin. The bank does not assess whether you come across as honest, but whether the figures add up.

That requirement does not come out of nowhere. Banks fall under the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft) and have to know their customer and monitor transactions. For larger deposits or unusual movements they ask for additional substantiation of the origin of assets. If the doubt is not taken away, an account can be frozen, the relationship can be ended and a report to the Financial Intelligence Unit can follow. This is standard control work and does not mean that anyone has done anything wrong.

The practical problem is almost never that someone has nothing. The problem is that the documents are spread across four exchanges, two old phones, a bank statement from 2017 and a memory that gets the years wrong.

Which six steps do you work through to build a proof of origin file?

You build a proof of origin file in six steps: defining the scope, collecting, reconstructing, explaining, verifying and bundling. Each step has its own checklist and each step produces something the next step needs. Do not skip any of them, because a file always falls over on the part that was skipped.

1. Defining the scope. Determine exactly which question you have to answer and over which period.
2. Collecting. Retrieve all source data from exchanges, banks and wallets.
3. Reconstructing. Put the transactions in chronological order into a line that adds up.
4. Explaining. Link every inflow to an identifiable source of money.
5. Verifying. Have the chain tested independently against the public blockchain data.
6. Bundling. Submit everything as a searchable whole with cross-references.

Step 1: defining the scope, which question are you actually answering?

Start with the bank’s exact question, taken literally from the letter or the email. A bank asking about the origin of a deposit of 60,000 euros in March wants to know something different from a bank that wants to see how your entire assets were built up. Checklist for this step: the letter or the request for information itself, the amounts and dates mentioned, the deadline set, and the name and department of the person who made the request.

Without a defined scope you supply too much or too little. Too much is just as damaging as too little, because every extra transaction you submit can raise a new question that you then have to answer as well.

Step 2: collecting, which data do you retrieve?

Collect a complete and unfiltered export per source instead of loose screenshots. Almost every exchange offers a download function for the full transaction history and an annual overview per calendar year. Checklist for this step: a full transaction export per exchange in CSV, annual overviews per year, deposit and withdrawal history including bank account numbers, bank statements covering the same period, and a list of all wallet addresses you have used.

Note for each address whether it is yours and why you know that. An address without an explanation cannot be distinguished by an outsider from the address of a third party.

Step 3: reconstructing, how do you turn it into a line that adds up?

Put all movements in chronological order and check whether the opening balance plus all changes arrives at the closing balance. Work with a reference date, because without one every balance is a snapshot that nobody can recalculate. Checklist for this step: a timeline per year, per transaction the date, the amount, the currency and the transaction hash, and a reconciliation between the exchange records and the movements on the blockchain.

This is where most self-made files come unstuck. A gap of a few thousand euros remains, usually because of a forgotten transfer between two of your own wallets, and that gap is precisely what the bank points at.

Step 4: explaining, where did the money come from?

Link every inflow to an identifiable source outside crypto, such as salary, savings, a sale, a gift or an inheritance. Crypto that comes from crypto is not an explanation, only a movement. Checklist for this step: payslips or annual income statements, bank statements on which the payment to the exchange is visible, purchase agreements or notarial documents in the case of a gift or an estate, and for business income the annual accounts or the tax return.

With older purchases documentation is often missing. That is not fatal, provided you name it instead of leaving it out. A gap described honestly is workable, a concealed gap is not.

Step 5: verifying, who tests it independently?

Independent verification means that a party with no interest in the outcome recalculates the chain against the public blockchain data. That is the final piece, because a bank by definition assesses your own reconstruction as the reconstruction of an interested party. We check transaction by transaction whether the records supplied match what is actually on the chain, and we state explicitly where that is not the case.

Paucitas uses no automated analysis software, in any role. Every transaction and every transaction hash is verified individually before it is included in a report. Checklist for this step: all addresses and hashes from step 3, the reconciliations from step 4, and an overview of the points you have doubts about yourself.

Step 6: bundling, how do you submit it?

Submit the file as a whole with a table of contents, continuous numbering and a reference from every conclusion to the underlying document. A bank that needs three clicks to find an amount will ask a follow-up question. Checklist for this step: a covering summary of no more than one page, the investigation report, the annexes in the same order in which they are mentioned, and a contact person for technical questions.

My bank asks about a specific transaction, how do I account for it?

When a question is asked about a specific transaction, you supply the complete route of that one amount, not your entire history. Look up the transaction hash, show which address the amount came from, which steps it went through beforehand and which underlying payment lay at the origin of it. A traceable transaction account consists of three things: the amount, the path and the piece of evidence at the beginning of that path.

If you supply only a screenshot of your exchange balance, you have shown that you have the amount, not where it comes from. That is exactly the distinction the question was about.

My exchange asks where my money comes from, what do I need to supply?

In enhanced due diligence an exchange asks in practice for the same substantiation as a bank, only in a different format and with a shorter deadline. Exchanges fall under the same Wwft framework and have to ask for additional substantiation for larger deposits. If that is not forthcoming, an account can be frozen and the relationship can be ended.

You supply it using the same six steps, with the emphasis on step 4. What an exchange wants to see is the KYC and AML substantiation of the inflow: which bank account number, which payment, which income was behind it. We do not write a statement on your behalf and we do not correspond with the compliance department; what you receive is an independent report that you submit yourself.

What is KYC and what does enhanced due diligence involve?

KYC, or know your customer, is the legal obligation of banks and exchanges to establish who their customer is and where that customer’s money comes from. Enhanced due diligence is the heavier variant that is applied when the assessed risk is higher, for example with large amounts or unusual patterns. In that heavier variant a statement is not enough and documentation is requested.

What is expected of you then is an audit trail: a trail of records with which an outsider can redo your route. That is exactly what a proof of origin file is.

What can a proof of origin file not solve?

A proof of origin file makes the facts traceable, but it does not force an outcome. These limits apply without exception:

• Paucitas makes no promise about the outcome of an investigation.
• A report by Paucitas is limited to factual observations and the analysis of those observations.
• Transactions outside the blockchain, such as cash payments or internal bookings within an exchange, are not visible in blockchain data. They are only included if underlying documents are available.
• Paucitas gives no tax or legal advice.
• Whether a bank considers the file sufficient is for the bank to decide. There is no quality mark that guarantees acceptance.

What can you do yourself and when is that not enough?

Steps one to four you can carry out yourself, and that saves both time and cost. Collecting and ordering is work that nobody can do better than the owner of the records, because you know which phone broke in 2019 and which account belonged to which email address.

Doing it yourself is no longer enough as soon as there is something to be assessed. Think of a gap in the history, an exchange that no longer exists, an address you cannot place, or a bank that has already rejected your first submission. At that moment the question is no longer whether you can explain it, but whether a third party can check it. A second attempt of your own rarely produces a different verdict from the first.

What is in the report?

The report follows a fixed structure: background and description of the assignment, the questions to be answered, scope, starting points, data supplied, sources consulted, method in outline, verification and quality assurance, reservations and limitations, findings per section, chronological overview, analysis and coherence, conclusion, declaration of independence, and annexes. Not every report contains all sections and the structure is tailored to the purpose of the report.

For a bank the declaration of independence is often the section that makes the difference, because it records that the author has no interest in the outcome. See also what asset verification involves and how verifying the origin of assets towards a bank works in practice.

How long does it take and what does it cost?

An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases the same day. A regular investigation is usually ready within three working days. For files with many transactions, several wallets or missing history the turnaround time increases to around two weeks. A surcharge applies to urgent assignments.

Depending on the nature and size of the case, Paucitas works with a fixed fee or an hourly rate. Which form applies is determined in advance and confirmed in writing. No investigation is started before the costs have been discussed and agreed.

Data can be supplied digitally or at the office. A list of required items is provided per case, setting out which data are needed. Where necessary, Paucitas guides the collection and submission of those data.

Which bodies play a role and where does the work of Paucitas begin?

The Dutch Tax Administration assesses your tax return and can send a request for information about crypto holdings in box 3 on its own initiative. The bank carries out the customer due diligence and decides on the relationship. The Financial Intelligence Unit Netherlands receives reports of unusual transactions and investigates those itself. None of these parties establishes the chain for you; they assess what you submit.

That is where the work begins. We record the facts and verify the origin of assets, so that there is something those parties can assess. If your situation is stuck because the account has already been blocked, then what to do when your bank blocks your account over crypto is the logical next step.

What is the most common mistake in a self-built file?

The most common mistake is supplying balances instead of movements. A balance says what is there, a movement says how it got there, and only the second answers the question. The second mistake is selective submission: only the transactions that look good, so that the overview no longer adds up and the bank becomes suspicious about precisely the part left out.

If you want to know whether your situation lends itself to this step-by-step approach, we will look at it with you during a free intake. You will then hear which steps you can take yourself and at which point independent verification is worthwhile.