Author: Adrian Ramdat (Director of Training & Consultancy)
September 2025
Cryptocurrency has introduced both opportunity and complexity for law enforcement and regulators. While digital assets offer innovative ways to move and store money, they’ve also become a vehicle for fraud, money laundering, and organised crime.
For investigators, one important question is whether examining cryptocurrency use requires directed surveillance authorisation under the Regulation of Investigatory Powers Act 2000 (RIPA) or the Scottish equivalent, RIPSA, whether it falls under different legal powers entirely or it can be done without any form of authorisation.
When we deliver RIPA or RIPSA training, we’re hearing more and more questions about cryptocurrency, particularly around whether monitoring crypto activity amounts to directed surveillance. It’s a sign of the growing role that digital assets play in investigations, and of the uncertainty many practitioners feel about how established powers apply.
This article offers a straightforward look at the issue. It focuses on general principles and typical scenarios, but it can´t cover every eventuality. My advice has to be that where the circumstances are more complex or unclear, advice should always be sought.
What Do We Mean by Directed Surveillance?
Under RIPA (or RIPSA in Scotland), directed surveillance is defined:
- Covert but not intrusive surveillance (which means it´s not being done inside someone’s residential premises or in the private vehicles, such as through the deployment of devices there to conduct surveillance).
- Is being carried out for a specific investigation or operation.
- Likely to result in gathering private information about a person and
- Not a response to immediate events.
Directed surveillance requires authorisation, usually from an Authorising Officer within a public authority, and in the case of a local authority, judicial approval from a magistrate (or in Scotland a sheriff).
Examining Cryptocurrency: Is It Directed Surveillance?
In many scenarios, investigating cryptocurrency does not require directed surveillance authority, especially where the data being examined is publicly available or anonymised.
For example:
Public blockchains such as Bitcoin, Ethereum, and others record all transactions on open ledgers. These can be searched and analysed using blockchain explorers without any covert surveillance activity.
Commercial tools such as Chainalysis or Elliptic allow investigators to follow the flow of funds between wallets and exchanges without directly accessing private information.
Passive monitoring of wallet addresses or cryptocurrency movements, where no individual has been identified or targeted, typically does not meet the threshold for directed surveillance.
In these cases, the activity is overt, not targeted, nor does it intrude into private life of a person and therefore falls outside the definition of directed surveillance.
However, investigators have to be aware that if the know who the person holding the currency is through other investigative means then this could easily bring this activity into the remit of directed surveillance.
CCTV Analogy: When Does Crypto Analysis Become Surveillance?
Using tools like Chainalysis is like reviewing CCTV from a public street. You can see general patterns, for example, how people move around, what time they pass through, without focusing on anyone in particular.
This kind of open-source blockchain analysis doesn’t usually require authorisation but if you start pointing a covert camera at someone’s front door to see who they meet and when they leave, you're now observing their private life. Similarly, if crypto tools are used to covertly monitor a specific, person or group of people, especially when combined with other intelligence, then the activity may cross the threshold into directed surveillance and require an authorisation for directed surveillance.
When Directed Surveillance May Be Needed
There are scenarios where cryptocurrency-related investigations could meet the threshold for directed surveillance, including:
Covert Monitoring of a Known Suspect:
If investigators are observing a specific individual’s behaviour, movements, or patterns of life to infer cryptocurrency use and this surveillance is covert and planned, it is likely to qualify as directed surveillance.
Combining Crypto Monitoring with Other Surveillance:
If crypto-related data is one part of a wider surveillance operation on a suspect or a group and the whole activity amounts to building a intelligence picture of private life, covertly, then a directed surveillance authorisation is likely to be required.
In both cases, authorisation must meet the tests of necessity and proportionality, and must be formally authorised.
Activities That Are Not Directed Surveillance But Still Require a Different Authority
There are more intrusive techniques sometimes used in crypto investigations that do not fall under directed surveillance but do require legal authorisation under different powers:
Accessing Private Crypto Accounts or Devices Covertly:
If law enforcement intends to access someone’s exchange account, wallet, mobile phone, or computer without their knowledge, for example, to extract private keys or transaction data then this is not directed surveillance. Instead, it may constitute Equipment interference under the Investigatory Powers Act 2016 (IPA), depending on the level and method of intrusion.
Proportionality and Oversight Still Matter
Even where directed surveillance is not required, investigators must still act lawfully and ethically. The principles of necessity, proportionality, and minimisation of collateral intrusion apply across all covert tactics.
Investigators should ensure the chosen power, if a power is being used, is lawful and appropriate for the method being used and it is often prudent to document their rationale clearly, in case a challenge comes at court or a tribunal.
Conclusion
Cryptocurrency investigations often rely on data that is open-source or pseudonymous, and in most cases, analysing blockchain activity will not require directed surveillance authority. However, if investigators use that data to covertly monitor a specific individual or group of individuals, especially when combined with other sources to build a picture of their private life, authorisation for directed surveillance may be necessary.
Remember, think of it like CCTV: watching the street is lawful and open. Pointing the camera at someone’s house without their knowledge is surveillance and must be authorised. Crypto tools follow the same logic.
Need Clarity on RIPA or RIPSA?
At The Signature Brand Training & Consultancy, we specialise in working with organisations across the spectrum to navigate the complexities of covert surveillance legislation.
- Our Bitesized RIPA/RIPSA sessions are delivered over Microsoft Teams, take just an hour or so, and are perfect for CPD.
- We offer full RIPA/RIPSA training, from basic awareness to advanced practitioner sessions.
- Need help with documentation? We can review your policies to ensure they remain compliant and up to date or draft a new policy from scratch.
- We also provide bespoke consultancy and advice to support live operations or policy implementation.
Whether you’re tackling cryptocurrency investigations or want to make sure your authorisations are watertight, we’re here to help.
Find out more on our website www.thesignaturebrand.co.uk or get in touch to discuss how we can support your team, without any obligation at info@thesignaturebrand.co.uk