# Chain of Custody for Financial Records

- Author: PreciseBankFlow (https://www.precisebankflow.com)
- Published: 2026-01-18
- Updated: 2026-01-18
- Category: Fraud and forensic review
- Canonical: https://www.precisebankflow.com/blog/chain-of-custody-for-financial-records

> How to keep chain of custody for financial records: logging receipt, hashing PDFs, working on copies and showing nothing changed after collection.
Chain of custody for financial records is a written trail showing where each statement, ledger or check image came from, who has held it since, and that it has not changed. Log every item when it arrives, compute a hash of each file, analyze only copies, and re-hash the originals before you rely on them in a report.

## What does chain of custody for financial records prove?

Chain of custody for financial records proves three things about each document: where it came from, who handled it, and that its contents are the same as when it was collected. Without that record, the other side in a dispute can suggest that a statement was edited during the engagement, and you have nothing to answer with.

US federal courts require a party offering a document to show it is what the party claims it is. [Federal Rule of Evidence 901 on authenticating evidence](https://www.law.cornell.edu/rules/fre/rule_901) lists ways to do that, including testimony from a witness with knowledge and evidence describing a process or system that produces an accurate result. A custody log and file hashes are that kind of evidence for a stack of bank PDFs.

The same discipline pays off outside court. A lender, an insurer or a board will ask the same question in plainer words: how do we know this is the real statement?

## Logging the receipt of each financial record

Logging receipt means writing one entry for each item at the moment it arrives, before anyone opens or renames it. The entry names the item, the source, the person who received it, the date and time, the delivery method and the file's hash value. Paper records get the same entry, with a description instead of a hash.

Here is an example custody log. The names and values are invented, and the hash values are shortened for display.

| No. | Item | Source | Received by | Date and time | Method | SHA-256 (first 12) |
| --- | --- | --- | --- | --- | --- | --- |
| 001 | Checking ending 2207, Jan to Dec 2025, 12 PDFs | Bank portal, downloaded by reviewer with client present | M. Ortiz | 2026-04-02 10:14 | Direct download | 3f9a0c71b2e4 (per file, see list) |
| 002 | General ledger export, FY2025 | Client controller | M. Ortiz | 2026-04-02 15:40 | Encrypted email | a81d55e0c39f |
| 003 | Check images, 41 items | Bank, records request | R. Chen | 2026-04-19 09:05 | Secure file transfer | 6c02e9b74d18 (per file, see list) |

Each later transfer gets its own line: who passed the item to whom, when and why. Keep the log in a file that only the custodian edits.

## Hashing statement PDFs when they are collected

Hashing a statement PDF means running it through an algorithm that produces a fixed-length fingerprint, called a digest. Change one character in the file and the digest changes completely. The [FIPS 180-4 Secure Hash Standard from NIST](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) says these digests are used to detect whether messages have been changed since the digests were generated.

SHA-256 is the usual choice, and every major operating system can compute it without extra software:

- **Windows PowerShell:** `Get-FileHash .\statement-2025-03.pdf -Algorithm SHA256`
- **macOS:** `shasum -a 256 statement-2025-03.pdf`
- **Linux:** `sha256sum statement-2025-03.pdf`

Save the output for every file into a text list next to the log, and record the list's own hash in the log. That one value then protects the whole set.

## Working copies of financial records, originals left untouched

Working copies are duplicates you analyze, while the originals sit in a folder nobody edits. Copy the original set once, hash the copies to confirm they match, then mark the original folder read-only or move it to write-once storage. Every extraction, annotation and spreadsheet starts from the copy.

This matters because ordinary tools change files. A viewer that saves a comment, a converter that rewrites the PDF, or an upload to an analysis service can all produce a file that no longer matches the hash. If you run statements through reconciliation or extraction software, including [AI bank reconciliation tools](/blog/ai-bank-reconciliation), upload the working copy and note in the log which file went where.

Analysis builds on this foundation. The transaction databases described in [forensic data analytics for bank records](/blog/forensic-data-analytics) and the reconstructions in [the net worth method in forensic accounting](/blog/net-worth-method-in-forensic-accounting) are only as credible as the documents they start from.

## Can you show a financial record has not changed since collection?

You can show a financial record has not changed by computing its hash again and comparing it with the value logged at collection. If the two match, the file is identical, bit for bit. Do this before you issue a report and again before testimony, and record each check in the log.

A matching hash proves the file has not changed since you received it. It does not prove the file was genuine when you received it. That is a separate question, answered by obtaining records directly from the bank and by the document tests in [fraud detection techniques in forensic accounting](/blog/fraud-detection-techniques-in-forensic-accounting).

PreciseBankFlow keeps each uploaded statement in the engagement it belongs to and ties every exception to the source line, which gives you a clear trail from the working copy to the finding. The custody log and hashes remain your own records. You can [ask for early access](/get-started).

## Custody gaps in financial records that weaken a finding

Custody gaps are periods when nobody can say who held a record or what was done to it. Each gap is an opening for a challenge. Most come from ordinary habits rather than bad faith, which makes them easy to prevent.

Watch for these:

- **Renaming before logging.** The log should show the name the file arrived with. Rename only working copies.
- **Forwarding by email without a note.** Each forward is a transfer and needs a log line.
- **Accepting records from the subject.** A statement supplied by the person under review should be logged as such and confirmed with the bank.
- **Printing and rescanning.** A rescanned page is a new document with a new hash. Log it as derived from the original, not as the original.
- **Shared folders with edit rights.** If ten people can edit the evidence folder, nobody can say it was untouched.