FCIBT study plan

Describe how a UTXO is created and spent, and explain why change outputs exist

Explain the account-based model and nonce behavior well enough to predict transaction ordering outcomes

Trace a simple two-hop transaction by hand from raw input/output data without software

Identify the fields of a raw transaction (version, inputs, outputs, locktime) and state what each conveys

Compute a transaction's fee from inputs minus outputs and explain fee-rate implications for confirmation

Apply the common-input-ownership heuristic to a set of transactions and state when it fails

Distinguish change-address heuristics from co-spend heuristics and list the false-positive conditions for each

Build a manual cluster map linking at least five addresses to two suspected entities

Explain how peel chains and round-number transfers reveal cash-out behavior

Evaluate the confidence level of a cluster and justify downgrading or upgrading it

Trace funds across a bridge by matching deposit and withdrawal events and documenting the time gap

Explain how a mixer pool breaks direct links and what residual linkage remains

Identify CoinJoin-style equal-output patterns and describe why post-mix tracing is probabilistic

Describe privacy coins and privacy-enhancing techniques at a conceptual level without overstating traceability

Diagram a laundering flow that combines a swap, a mixer, and a cross-chain hop

Classify at least ten cryptoassets by function (payment, utility, security-like, stablecoin, privacy) and justify each label

Map typology-specific illicit risks (ransomware, pig butchering, darknet, NFT wash trading) to observable on-chain patterns

Outline the due-diligence questions to ask a VASP about licensing, KYC, and transaction monitoring

Explain how a fiat on-ramp converts cash to crypto and where the audit trail begins and ends

Compare custodial and non-custodial on-ramps for evidentiary value

Summarize FATF Recommendation 16 Travel Rule obligations for originating and beneficiary institutions

Explain how sanctions screening applies to wallet addresses and what a false-positive match looks like

Distinguish risk-based approach requirements from prescriptive rules using concrete examples

Describe the elements of a suspicious transaction report and what triggers one

Identify typology red flags for mule accounts and structured deposits at exchanges

Attribute an address to an entity using public statements, service tags, and behavioral evidence, and rate confidence

Explain how exchange deposit-address reuse and hot-wallet behavior support attribution

Describe limits of attribution when addresses are shared by a custodian

Analyze a mixer or privacy-tool case and state what can and cannot be proven

Draft an attribution statement that separates fact from inference

Capture on-chain evidence with hash-linked screenshots and timestamped notes that survive challenge

Explain chain of custody for digital evidence from collection through storage and handoff

Write a tracing narrative that a non-technical reader can follow from source of funds to cash-out

Structure a case file with exhibits, index, and methodology section

Identify common documentation gaps that undermine admissibility or credibility

Complete a timed 60-question mixed-domain practice set and score it by domain

Review every missed question and write the underlying rule or concept it tested

Re-explain the five weakest concepts aloud in under two minutes each

Reconcile conflicting notes and update your reference sheet

Simulate a report-writing task under time pressure