Review evidence quality
Check whether key dates, payment references, messages and platform details are available. Identify which documents would materially improve the understanding of the incident.
Consider practical constraints
Assess the age of the incident, platform access, available transaction records and cross-border complexity. Explain what can be reviewed and where cooperation from a provider may be required.
Set realistic expectations
Define an appropriate scope and the remaining uncertainty. Suitability for further investigation does not mean that funds can be recovered or that an enforcement action will follow.