Financial crime investigations rarely start at the beginning of the activity they are investigating. They start when someone notices something unusual, files a report, or makes a referral. By that point, the accounts that moved the money, the phone numbers that coordinated the scheme, and the corporate entities that held the proceeds have often been closed, ported, dissolved, or handed off. The evidence window has passed. The investigation has not.
This is the standard condition for most serious financial crime work, and it is one that most investigation frameworks are not explicitly designed for. The tools and workflows built around live records assume that the thing you are looking for still exists in a form you can pull. When it does not, the team has to work backward through secondary evidence to reconstruct what the primary records would have shown.
Why retroactive reconstruction is harder than it looks
The obvious challenge is legal: retention periods are finite, and institutions that held the accounts may no longer have the records you need. A bank account closed eighteen months ago may have transaction data only up to its closure date if the institution's policy is to purge records at twelve months. A mobile number that was ported or terminated may have CDR data for a narrower window than a live account. A corporate entity that was dissolved may have filed a final return but left no forwarding address for the beneficial ownership documentation.
The less obvious challenge is interpretive. When you pull records for a live account, you have a full picture of activity over whatever window you can legally obtain. When you pull records for a closed account, you often get a partial picture that ends abruptly and requires inference to connect to the rest of the case. The transaction that explains where the money went is in the window after the account was closed. The counterparty that links the subject to a known entity shows up in a record that no longer exists at the source institution.
Investigators learn quickly that the shape of the gap tells them almost as much as the data that survived it.
How secondary evidence fills the primary record gap
The practical answer to missing primary records is lateral corroboration. When a bank account's transaction history is unavailable, the account's counterparties are often still there. The receiving accounts, the corporate entities that sent funds, the individuals who had signatory authority — those identifiers survive the closure of the account they touched. Building backward from known counterparties into the missing record is the standard methodology, and it works in proportion to how well the investigator can navigate between evidence sources.
Device extractions, platform takeouts, and email archives become primary evidence when financial records are incomplete. A closed bank account with no surviving transaction data may still appear in email correspondence, in a messaging app archive, or in a note on a device extracted from a subject. The account number, the counterparty name, the transaction date — these identifiers exist in multiple places. The investigation reconstructs the record from the fragments that are still accessible.
CDR analysis plays a similar role. Contact patterns between a subject and a counterparty during the period of interest establish a relationship even when the financial records that should document that relationship no longer exist. Timing and volume of communications do not prove a transaction, but they establish context that supports the inference. When the primary record is gone, context is what the case is built on.
Where the reconstruction workflow breaks down
The failure mode in retroactive reconstruction is not usually a single gap. It is the cumulative effect of multiple partial gaps across different evidence types. The bank records end at month twelve. The CDRs from the primary carrier go back eighteen months but have a two-month window where a device was on a different SIM. The platform takeout was requested through legal process that took six weeks, during which the account was deleted and only partial data was preserved by the platform. The corporate filing that would have identified the beneficial owner was for a jurisdiction where the registry was not yet public at the time.
Each of those gaps individually is manageable. Together, they produce a case file where the connections the team is most confident about are the ones least documented in retrievable records. The investigation is solid. The file does not fully support it.
Teams that do this work consistently build a habit of documenting their reconstruction methodology as explicitly as they document the records themselves. When a conclusion is drawn from secondary evidence because the primary record is unavailable, that conclusion needs to show exactly what secondary evidence was used and why it is sufficient. That documentation is what allows the case to survive a defense challenge to the gaps, and what allows a prosecutor to understand the case without the investigator in the room to explain it.
What a well-structured retroactive case looks like
The cases that hold up under scrutiny are the ones where the investigator treated the gap as a structural element of the case, not a weakness to minimize. Every closed account, terminated number, and dissolved entity is documented: when it was closed, what records were requested, what was available, and what the absence of that record means for the specific finding it would have supported.
The reconstruction methodology — what secondary sources were used to fill each gap and why — sits alongside the underlying evidence. When a record could not be obtained, the file says so explicitly and explains what corroboration was used instead. That structure gives a prosecutor a defensible position when a defense attorney asks about the missing records, because the methodology for working around them is already in the file.
The goal is not to hide the gaps. It is to show that the team understood them, accounted for them, and built the case to hold up despite them.