Description
The CSI Linux Certified Financial Crime Analyst (CSIL-CFCA) course and certification is designed to develop investigators who can recognize, preserve, analyze, trace, and explain financial activity as part of a real investigation. The course begins with the investigator’s role, ethics, lawful authority, jurisdiction, evidence handling, and defensible practice before moving into financial systems, payment rails, accounting, financial intelligence, and the identification of financial evidence.
Students then learn how to take a financial complaint, scope a case, secure records, follow the money, build financial timelines, conduct link and flow-of-funds analysis, incorporate OSINT and digital forensics, and connect transactions to people, accounts, devices, organizations, and other evidence. The purpose is not simply to identify suspicious transactions. It is to teach investigators how to determine what happened, identify what the available evidence actually proves, recognize what remains uncertain, and develop the additional evidence necessary to build a defensible case.
The course applies this investigative methodology across consumer scams, business fraud, account takeover, extortion, money laundering, mule networks, beneficial ownership, trade-based schemes, corruption, healthcare and benefits fraud, real-estate fraud, investment fraud, cryptocurrency, blockchain tracing, and decentralized finance. It concludes with the operational end of the investigation: restraint and preservation of assets, development of the case file, preparation of prosecutor or legal-support packages, reporting, affidavits, and testimony.
The CSIL-CFCA is built around a central investigative principle: the records may show movement, but the investigator must build the case. A bank transfer does not prove intent. An account name does not necessarily identify the person controlling the money. A blockchain address does not identify a human being. A suspicious pattern is a lead until it is supported by records, attribution, communications, devices, witnesses, and other corroborating evidence.
- Law Enforcement Investigators
- Financial Crime Investigators
- Financial Intelligence Analysts
- Fraud Investigators
- AML and Compliance Professionals
- Digital Forensics (DFIR) Analysts
- Cybercrime Investigators
- Intelligence Personnel
- Auditors and Internal Investigators
- Private Investigators
- Prosecutors and Legal Support Personnel
- Investigative Journalists and Researchers
- Self-paced training and quizzes
- Online testing
- 85 questions (Multiple Choice)
- 2 hours
- A minimum passing score of 85%
- Cost: $385
- The First Dollar – How Financial Investigations Begin:
Introduces the financial investigator’s mindset and explains how apparently ordinary transactions become the starting point for an investigation. - Ethics, Rights, Privacy, and the Investigator’s Duty:
Addresses privacy, proportionality, minimization, victim protection, ethical decision-making, and responsible investigative conduct. - Laws, Authority, and the Financial Investigator’s Legal Problem:
Explains how lawful authority, consent, subpoenas, warrants, provider process, financial crime statutes, and international considerations affect evidence collection. - Jurisdiction, Standards, and Defensible Practice:
Builds the foundation for evidence integrity, chain of custody, reproducibility, documentation, and court-ready investigative practice.
- Financial Systems and Payment Rails 101:
Explains how money moves through cash, banks, ACH, wires, cards, payment processors, payroll systems, P2P platforms, remittance services, digital wallets, stored value, and cryptocurrency. - Accounting 101 for Investigators:
Provides practical investigator-level accounting knowledge for understanding ledgers, subledgers, journal entries, accounts payable, payroll, procurement, reconciliation, and financial irregularities. - Identifying Financial Evidence:
Teaches investigators to recognize records, transaction data, communications, logs, account information, forensic artifacts, and business documents that may become evidence. - Sources of Financial Evidence:
Examines evidence available through financial institutions, payment providers, OSINT, digital forensics, business systems, public records, devices, cloud services, and lawful legal process. - Financial Intelligence Analysis and Red-Flag Development:
Teaches how to identify suspicious patterns while distinguishing indicators and analytical leads from proof. - Documentation, Chain of Custody, and Case Management:
Develops disciplined methods for managing evidence, analyst notes, working files, custody records, provider communications, derivatives, exhibits, and investigative decisions.
- Complaint Intake, Triage, and Financial Case Scoping:
Teaches investigators how to organize the first hours of a financial case, identify immediate risk, define scope, preserve volatile evidence, and avoid premature conclusions. - Following the Money – Core Financial Tracing Methodology:
Provides a repeatable process for tracing value across accounts, institutions, intermediaries, payment systems, and changing financial rails. - Financial Timelines, Link Analysis, and Flow-of-Funds Visualization:
Shows how to reconstruct events, map entities and relationships, visualize transaction movement, distinguish confirmed from inferred links, and produce defensible analytical products. - Financial Intelligence, Attribution, and OSINT:
Uses public records, corporate data, sanctions information, domains, litigation records, property records, social media, geolocation, and other sources to develop attribution. - Digital Forensics in Financial Crime Cases:
Connects computers, mobile devices, cloud accounts, emails, browser artifacts, spreadsheets, accounting data, credentials, communications, and system logs to financial activity. - Interviewing, Victim Handling, and Witness Development:
Develops interviewing strategies for victims, witnesses, employees, bankers, compliance personnel, accountants, IT staff, and suspects while preserving timelines and distinguishing observation from assumption.
- Social Engineering and Consumer Scams:
Examines phishing, impersonation, romance scams, investment scams, advance-fee schemes, tech-support fraud, elder exploitation, and related fraud models. - Business, Institutional, and Internal Theft:
Covers business email compromise, vendor fraud, invoice manipulation, payroll diversion, procurement fraud, embezzlement, skimming, ghost employees, and internal accounting abuse. - Carding, Identity Theft, and Account Takeover:
Examines payment-card abuse, stolen credentials, synthetic identities, unauthorized account access, transaction evidence, and attribution challenges. - Extortion, Sextortion, Ransom, and Virtual Kidnapping:
Explores financially motivated coercion and the communications, payment, attribution, and preservation evidence associated with these schemes. - Money Laundering, Mules, Layering, and Beneficial Ownership:
Examines placement, layering, integration, mule networks, pass-through accounts, shell entities, beneficial ownership, and methods used to disguise control of criminal proceeds. - Trade-Based, Cross-Border, and Informal Value Transfer Systems:
Covers international movement of value, trade-based laundering concepts, informal transfer systems, jurisdictional complexity, intermediaries, and cross-border evidence. - Public Corruption, Procurement Fraud, and Abuse of Position:
Examines kickbacks, bribery, sham vendors, procurement manipulation, conflicts of interest, false contracting, and abuse of authority. - Insurance, Healthcare, and Benefits Fraud:
Explores claims manipulation, billing abuse, false beneficiaries, provider records, payment evidence, and institutional fraud indicators. - Real Estate, Escrow, and Closing Fraud:
Covers wire diversion, title and escrow fraud, ownership concealment, property records, transaction timing, and laundering through real-estate activity. - Securities, Investment, and Affinity Fraud:
Examines fake investment platforms, Ponzi-style structures, false advisors, fabricated statements, affinity exploitation, offshore funnels, and recovery scams.
- Cryptocurrency and Blockchain for Financial Investigators:
Introduces blockchains, wallets, exchanges, public ledgers, stablecoins, addresses, transaction identifiers, and the role of cryptocurrency in broader financial crime investigations. - Cryptocurrency Tracing and Evidence Development:
Covers tracing, transaction analysis, clustering concepts, exchange touchpoints, wallet addresses, transaction hashes, preservation requests, screenshots, attribution, and corroboration with non-blockchain evidence. - DeFi, Smart Contracts, and Emerging Financial Risks:
Introduces self-custody, token swaps, bridges, liquidity pools, smart contracts, protocol interactions, rug pulls, governance abuse, and the evidentiary challenges created by decentralized financial systems.
- Seizure, Restraint, Freezing, and Preservation of Financial Assets:
Examines time-sensitive investigative actions involving bank accounts, providers, exchanges, financial records, devices, preservation requests, restraint, freezing, seizure, and coordination with institutions. - Building the Case File – From Analyst Notes to Prosecutor Package:
Teaches investigators to organize evidence, legal process, financial records, forensic artifacts, communications, analysis, interviews, exhibits, and unresolved issues into a coherent and reviewable case package. - Reporting, Affidavits, and Testimony:
Focuses on converting investigative findings into clear reports, properly sourced analytical conclusions, affidavits, courtroom exhibits, prosecutor support, and testimony that accurately reflects both the strength and limitations of the evidence.
- Identify and prioritize financial evidence
- Understand major payment rails and financial systems
- Read accounting and transaction records from an investigator’s perspective
- Triage financial crime complaints and define investigative scope
- Follow money across financial institutions and payment platforms
- Build timelines, link charts, and flow-of-funds visualizations
- Use OSINT and digital forensic evidence to strengthen attribution
- Recognize common fraud, laundering, corruption, and financial crime typologies
- Investigate cryptocurrency and DeFi activity without treating blockchain analysis as proof of identity
- Identify opportunities for preservation, restraint, freezing, and asset recovery
- Maintain defensible documentation and chain of custody
- Separate facts, indicators, analytical conclusions, and unresolved questions
- Build court-ready investigative reports and case files
- Communicate findings to investigators, prosecutors, regulators, management, and courts
Financial investigations are not just about finding where the money went. They are about connecting transactions to people, systems, communications, authority, intent, and evidence. The CSIL-CFCA teaches investigators how to follow that path from the first suspicious transaction through preservation, attribution, analysis, case development, reporting, and testimony.






