Asset Recovery Overview
Asset recovery is the ultimate goal of many financial crime investigations - returning stolen funds to victims or confiscating proceeds of crime. In the digital age, this requires understanding both traditional and cryptocurrency-specific mechanisms.
Asset Recovery Framework
Freezing/Restraint
Preventing movement of assets during investigation. Immediate priority to preserve funds before dissipation.
Identification
Locating and documenting all assets connected to the crime - bank accounts, crypto wallets, property, vehicles.
Seizure/Attachment
Legal process to take control of identified assets. Requires court orders or statutory powers.
Confiscation/Forfeiture
Final legal order permanently depriving criminal of proceeds. Enables restoration to victims.
Legal Authorities for Asset Recovery
| Authority | Governing Law | Scope |
|---|---|---|
| Police/Cyber Cell | CrPC Section 102 | Seizure of property during investigation |
| Court | CrPC Section 451, 452 | Custody, disposal of seized property |
| Enforcement Directorate | PMLA Section 5, 8 | Attachment of proceeds of crime |
| IT Act | Section 76 | Confiscation of computer, data |
Bank Account Freezing
Quick bank account freezing is critical for preserving funds. Multiple mechanisms exist depending on urgency and stage of investigation.
Freezing Mechanisms
1930 Helpline (Immediate - Within Hours)
Call 1930 with transaction details. Lien marked on beneficiary account through CFCFRMS system. Temporary hold preventing withdrawals. Follow up required within 24-48 hours.
Police Request to Bank (1-7 Days)
Formal letter from IO to bank nodal officer citing FIR number, requesting freeze pending investigation. Bank typically complies but may require court order for extended freeze.
Court Order (Interim) (7-30 Days)
Application to court under CrPC Section 91 or 105. Court issues interim order for freeze. More robust than police request, banks must comply.
Attachment (PMLA) (If ED Involved)
ED can provisionally attach property under Section 5 PMLA. Requires reason to believe property is proceeds of crime. Valid for 180 days, then confirmed by Adjudicating Authority.
Practical Considerations
- Speed is Critical: Funds can be withdrawn within minutes of deposit. Immediate action through 1930 is essential.
- Multiple Accounts: Trace and freeze all accounts in the chain simultaneously. Coordinate with multiple banks.
- Documentation: Maintain detailed records of all freeze requests, acknowledgments, and bank responses.
- Freeze vs. Debit Freeze: Clarify whether only outgoing transactions are blocked or entire account is frozen.
- Third-Party Rights: Be aware that account holder may challenge freeze; ensure proper legal basis.
Maintain updated contact list of bank nodal officers, especially for major banks involved in cyber fraud. The 1930 helpline coordinates with banks through the I4C Citizen Financial Cyber Frauds Reporting and Management System (CFCFRMS).
Cryptocurrency Seizure
Seizing cryptocurrency presents unique challenges as it exists on decentralized networks. Seizure requires either cooperation from custodians or access to private keys.
Cryptocurrency Seizure Methods
Exchange Freeze
Request exchange to freeze account/wallet. Most cooperative method. Requires identifying exchange where funds are held.
Private Key Seizure
Obtain private keys or seed phrase from suspect/devices. Provides complete control over non-custodial wallets.
Device Seizure
Seize devices containing wallet software. May require forensic extraction of keys. Court order under Section 76 IT Act.
Hardware Wallet Seizure
Physical seizure of hardware wallets (Ledger, Trezor). Still requires PIN/passphrase for access.
Exchange Cooperation Process
| Exchange Type | Process | Timeline |
|---|---|---|
| Indian Exchanges (WazirX, CoinDCX) | Direct request to nodal officer with FIR copy | 1-7 days for freeze, 7-14 days for data |
| International Exchanges (Binance) | Request through LEA portal or formal legal process | 7-30 days depending on jurisdiction |
| DEX/Non-Custodial | Not possible - no central operator | N/A - require private key |
Securing Seized Cryptocurrency
Once cryptocurrency is seized, proper handling is essential:
- Government Wallet: Transfer to secure wallet controlled by investigation agency. Some agencies maintain dedicated cold wallets.
- Multi-Signature: Consider multi-sig wallets requiring multiple authorizations for any transaction.
- Documentation: Record all wallet addresses, transaction hashes, and balances with timestamps.
- Preservation: Do not convert to fiat immediately unless required. Crypto value may change; document value at seizure.
- Chain of Custody: Maintain detailed records equivalent to physical evidence custody.
CRYPTOCURRENCY SEIZURE RECORD
============================
Date & Time: [DD/MM/YYYY HH:MM]
FIR No.: [XXX/2026]
Investigating Officer: [Name, Rank, Unit]
Source Wallet(s):
- Address: [Full wallet address]
- Blockchain: [Bitcoin/Ethereum/etc.]
- Balance at seizure: [Amount + USD/INR equivalent]
Seizure Method:
[ ] Exchange freeze (Exchange: _________)
[ ] Private key obtained from: __________
[ ] Device seizure (Device ID: _________)
[ ] Hardware wallet (Make/Model: _________)
Transfer to Government Custody:
- Government Wallet Address: [Address]
- Transfer Transaction Hash: [TXID]
- Amount Transferred: [Amount]
- Timestamp: [Date/Time]
Witnesses:
1. [Name, ID]
2. [Name, ID]
IO Signature: _________________ Date: __________
Court Orders and Legal Process
Types of Court Orders for Asset Recovery
| Order Type | Legal Basis | Purpose |
|---|---|---|
| Interim Freeze Order | CrPC Section 91/105, inherent powers | Temporary freeze during investigation |
| Attachment Order | PMLA Section 5/8 | Attach proceeds of crime (ED) |
| Confiscation Order | PMLA Section 8(5), IT Act 76 | Final forfeiture to government |
| Restoration Order | CrPC Section 452/457 | Return property to rightful owner |
Obtaining Court Orders
Prepare Application
Draft application stating facts, legal grounds, and specific relief sought. Include supporting documents - FIR, investigation notes, transaction records, blockchain evidence.
File Before Appropriate Court
Usually the court having jurisdiction over the offense. For PMLA matters, Adjudicating Authority. For urgent matters, can seek ex-parte interim orders.
Serve and Execute
Serve order on banks/exchanges. For crypto, may need to specify wallet addresses in order. Follow up to confirm compliance.
International Cooperation
Cross-border asset recovery requires international cooperation mechanisms as criminals often move funds across jurisdictions.
International Mechanisms
MLAT (Mutual Legal Assistance Treaty)
Formal government-to-government requests. India has MLATs with many countries. Used for evidence and asset recovery requests.
INTERPOL Channels
INTERPOL notices and channels for international coordination. Can request asset freezes through partner countries.
Direct LEA Cooperation
Many exchanges have global LEA portals. Direct requests may yield faster results for initial freeze than MLAT.
Foreign Court Orders
May need to obtain orders in foreign jurisdiction where assets are located. Requires local legal assistance.
MLAT Process
The MLAT process typically involves:
- Request prepared by investigating agency
- Forwarded through Ministry of Home Affairs (MHA) / Ministry of External Affairs (MEA)
- Transmitted to Central Authority of foreign country
- Executed by foreign law enforcement
- Response returned through same channel
MLAT requests can take 6-18 months. For time-sensitive matters, explore direct cooperation with foreign exchanges (many will honor Indian LEA requests) while MLAT is pending. The 24/7 network through National Central Bureau (INTERPOL) can provide faster initial response.
Practical Recovery Techniques
Step-by-Step Recovery Process
Immediate Freezing (Day 1)
Use 1930 helpline for bank accounts. Contact known exchanges directly for crypto. Document all actions with timestamps.
Comprehensive Tracing (Week 1)
Complete fund flow analysis. Identify all accounts/wallets involved. Request data from all identified financial institutions.
Formal Legal Process (Week 2-4)
Obtain court orders for continued freeze/attachment. File applications with supporting evidence. Serve orders on all institutions.
International Coordination (If Needed)
Initiate MLAT requests for foreign assets. Work with INTERPOL if required. Coordinate with foreign exchange LEA teams.
Confiscation and Restoration
Upon conviction, seek confiscation orders. Apply for restoration of property to victims. Execute court orders for fund transfer.
Victim Restoration
Legal Framework for Restoration
Returning recovered assets to victims is the ultimate goal. Legal provisions include:
- CrPC Section 452: Court can order delivery of property to person entitled
- CrPC Section 457: Procedure when no order made under Section 452
- PMLA Section 8(8): Restoration of confiscated property to rightful owners
- Victim Compensation Schemes: State-level schemes for compensation
Practical Restoration Process
- Establish Ownership: Victim must prove the frozen/seized assets represent their stolen funds
- Application to Court: Victim or IO files application for release/restoration
- Court Order: Court orders release to victim after verification
- Execution: Bank transfers funds or exchange releases crypto to victim
- For Crypto: May need to convert to fiat for restoration, or transfer to victim's wallet
Maintain detailed documentation linking specific frozen funds to specific victims from the beginning. This significantly simplifies the restoration process after confiscation orders are obtained.
- Asset recovery follows a progression: freeze, identify, seize/attach, confiscate, restore
- Bank account freezing should start within hours through 1930 helpline, followed by formal police/court orders
- Cryptocurrency seizure requires either exchange cooperation or access to private keys
- Document all seized crypto with addresses, amounts, transaction hashes, and chain of custody
- Court orders under CrPC and PMLA provide legal authority for asset freezing and confiscation
- International cooperation through MLAT and INTERPOL is essential for cross-border assets
- Direct exchange cooperation can be faster than MLAT for initial freeze
- Victim restoration is the ultimate goal - maintain clear documentation linking frozen assets to victims
- Speed is critical - every hour of delay reduces recovery probability