- Here, CDCI means Certified Digital Currency Investigator, issued through McAfee Institute, not any other credential sharing the acronym.
- The exam is three hours, remotely proctored, closed book, with a published passing threshold of at least 70%.
- Exam-only registration costs USD 450 and includes one attempt within a one-year exam license.
- Nine public learning objectives define preparation scope, but no official weighted exam blueprint has been verified.
What the Acronym Spells Out
CDCI stands for Certified Digital Currency Investigator. Each word narrows the meaning: the credential is certified by an examination, it concerns digital currency (cryptocurrencies and related digital assets), and its holder is expected to function as an investigator, someone who traces, documents, and reports rather than simply trades or speculates.
That distinction matters because the same four letters appear in other contexts, including other professional credentials, and a search for the acronym can surface unrelated material. On this site the term always refers to the investigator certification discussed here. If you want the short-form answer in different phrasing, our pages on what CDCI stands for and what CDCI certification is cover the same ground from other angles.
Who Issues the Credential
The CDCI is offered through the McAfee Institute. The institute publishes two relevant pages: one describing the training program and credential, and one describing the board examination. According to the current exam page, the examination assesses competencies, standards, and applied knowledge covered throughout the program.
There are two routes to the exam. One is an exam-only purchase. The other is a training-and-exam package built around an optional 50-hour, 19-module course. Training purchase is not mandatory for the exam-only route, so the credential is not locked behind the course. For a full look at how the options compare, see our CDCI certification cost breakdown.
What Each Word in the Title Implies
Digital Currency
The scope is broader than a single coin. The published curriculum narrative moves from cryptocurrency, blockchain, encryption, anonymization networks, wallets, and transactions into investigative methodology. Expect the material to treat digital currency as an ecosystem: networks, exchanges, wallets, tokens, smart contracts, decentralized finance, and the criminal markets that use them.
Investigator
The word signals an applied, evidence-oriented orientation. The published performance objectives describe three outcomes: describing digital currency ecosystems, transaction structures, and investigative considerations; identifying and analyzing illicit digital currency activity, including laundering typologies; and producing investigative documentation addressing digital currency misuse and financial crime indicators. Notice the last one. Writing a clear, defensible report is part of the job description, not an afterthought.
Certified
Certification here means passing a proctored board examination and then maintaining the credential. The published final-exam threshold is 70%. An important caution runs through the public material: tracing supports attributed findings only within documented evidentiary and legal limits, and course outcomes do not guarantee identifying every wallet owner or recovering stolen assets. The credential signals structured competence, not omniscience.
The Nine Published Learning Objectives
The institute publishes nine learning objectives. They are the best public indication of what the program teaches, and we treat them here as unweighted preparation categories. They are not an official weighted exam blueprint, and no highest-weighted domain can be stated. The advertised 19 modules should likewise not be mistaken for 19 exam domains. For a deeper walk through each area, see our complete guide to the CDCI exam domains.
Domain 1: Blockchain & Cryptocurrency Fundamentals
Build a solid understanding of how blockchain networks work, how transactions are created and confirmed, and how major cryptocurrencies and digital assets function in real-world investigations.
- Everything later builds on this, so weak fundamentals will undermine tracing questions.
Domain 2: Cryptocurrency Transaction Tracing
Develop practical expertise in following funds across wallets, exchanges, and decentralized networks to map the money trail and identify points of attribution.
- Focus on where attribution realistically becomes possible, such as exchange touchpoints.
Domain 3: Obfuscation & Evasion Tactics
Learn how criminals try to hide activity through mixers, tumblers, chain hopping, bridges, and layering techniques, and how investigators can still recover the narrative behind the transactions.
Domain 4: Wallets, Keys, and Digital Evidence Recovery
Understand custodial versus non-custodial wallets, hardware and software wallets, seed phrases, and encryption concepts, plus the forensic approach to identifying, preserving, and analyzing wallet-related evidence.
Domain 5: Smart Contracts, Tokens, and DeFi Investigations
Examine how tokens and smart contracts operate, how DeFi platforms are used legitimately and abused illegally, and how to identify fraud patterns, rug pulls, and exploit-driven transactions.
Domain 6: Dark Web & Illicit Cryptocurrency Ecosystems
Explore how crypto is used in dark web marketplaces and anonymized environments, and learn investigative techniques to connect transactions to criminal activity and operational infrastructure.
Domain 7: AML Indicators & Financial Crime Patterns
Strengthen your ability to recognize crypto-specific money laundering typologies, red flags, and behavioral patterns tied to fraud, theft, extortion, and illicit finance.
Domain 8: Seizure, Securing Assets, and Case-Ready Reporting
Learn how to protect and secure digital assets when lawful authority exists, maintain chain of custody, and produce clear, prosecutable documentation that holds up under scrutiny.
Domain 9: Applying Anti-Money Laundering (AML) Techniques to Digital Currencies
Gain expertise in AML strategies as they apply to cryptocurrency and digital currency, including compliance measures, red flags for money laundering schemes, and how to apply AML protocols in cryptocurrency investigations.
How the Exam Works
The published terms describe a single-sitting, closed-book, remotely proctored examination. The general published format is multiple-choice, true/false, and scenario-based questions, which fits an investigator credential: expect some items that test definitions and others that ask you to reason through a described situation.
| Exam Element | What Is Published |
|---|---|
| Delivery | Online, remotely proctored; ID, webcam, and microphone required |
| Time limit | 3 hours |
| Format | Multiple-choice, true/false, and scenario-based |
| Passing threshold | At least 70% |
| Attempts | One attempt per exam license, usable for one year |
| Question count | Not publicly verified for the CDCI specifically |
| Scored/unscored split | Undisclosed |
| Topic weights | No official weighted blueprint verified |
| Calculator and adaptive rules | Undisclosed |
One point deserves care. An institute-wide page references approximately 200 questions, but that is not an exact CDCI count, so you should not plan around it. Confirm details directly when you register. Likewise, ProctorU is named in the FAQ alongside AI-proctoring wording, so verify the actual proctoring workflow before test day.
Proctoring Restrictions
The remote environment has rules. Extra monitors, VPNs, proxies, and virtual machines are restricted. That is worth taking seriously for a candidate in this field, because investigators often work with virtualized or privacy-oriented tooling day to day. Do your exam on a clean, ordinary machine and set up your testing space in advance.
For a candid look at difficulty given these unknowns, see how hard the CDCI exam is.
Eligibility, Fees, and Renewal
Professional Eligibility
The credential is aimed at working professionals. Published eligibility pathways combine education and experience:
- A bachelor's degree plus 4 years of relevant experience
- An associate degree plus 6 years of relevant experience
- A high-school diploma or equivalent plus 7 years of relevant experience
Relevant experience involves investigations, intelligence, law enforcement, criminal justice, military, or comparable responsibilities. Conduct screening also applies. No verified reference count is published. Our CDCI requirements guide goes deeper on qualifying.
Fees
| Item | Published Amount |
|---|---|
| Exam only (one attempt, one-year license) | USD 450 |
| Another attempt | USD 450 |
| Training-and-exam package | USD 2,997 |
| Self-pay scholarship rendering of the package | USD 1,199, conditional rather than the universal exam fee |
| Renewal every 2 years | USD 125 plus proof of CPE |
There is no published member/non-member price split. The USD 1,199 figure applies only to a conditional scholarship rendering and should not be treated as the standard price.
Renewal and the Meaning of "Lifetime"
The certification renews every two years for USD 125 with proof of continuing professional education. The exact required CPE or ethics credits are not publicly verified. Also keep two ideas separate: lifetime access to training materials is not lifetime certification. The credential itself must be renewed. Training hours and CPE credits are also not exam time or topic weights.
Who Uses This Credential
The eligibility language itself points to the intended audience: people with backgrounds in investigations, intelligence, law enforcement, criminal justice, and military work. In practice, the subject matter overlaps with several kinds of roles:
- Law enforcement and criminal justice investigators handling fraud, theft, extortion, and cases where payment trails run through digital assets.
- Intelligence and military analysts following illicit finance and anonymized-network activity.
- Financial crime and compliance professionals who need crypto-specific AML typologies and red flags.
- Private-sector investigators supporting recovery and reporting work where documentation quality matters.
We do not publish invented salary or hiring statistics here. If you want a qualitative view of the job market and how the credential fits into it, see our pages on CDCI jobs, the CDCI salary guide, and the analysis of whether the certification is worth it.
Sequencing Your Preparation
Because there is no weighted blueprint, a sensible plan gives every domain real attention rather than guessing which one dominates. The order below follows the logic of the curriculum: concepts first, then tracing and evasion, then evidence and ecosystems, then crime patterns and case-ready documentation. This is an editorial suggestion, not an official schedule.
Foundations and Tracing (Domains 1-2)
- Review how transactions are created, confirmed, and recorded.
- Practice describing how funds move between wallets and exchanges, and where attribution points arise.
Evasion and Evidence (Domains 3-4)
- Study mixers, tumblers, chain hopping, bridges, and layering, plus what each leaves behind.
- Compare custodial and non-custodial wallets and how seed phrases and encryption affect evidence handling.
Ecosystems (Domains 5-6)
- Work through rug pulls, exploit-driven transactions, and legitimate versus abusive DeFi use.
- Review dark web marketplace patterns and the infrastructure connecting transactions to activity.
Crime Patterns, AML, and Reporting (Domains 7-9)
- Pair laundering typologies with AML techniques so each reinforces the other.
- Rehearse chain of custody and write short case-ready summaries as practice.
For a fuller plan, our CDCI study guide expands on this, and the CDCI cheat sheet offers a one-page recap of key facts. When you are ready to test yourself on scenario-style items, try the practice questions on our main practice test site.
Key Takeaway
Treat the nine learning objectives as equally important until the institute publishes weights. Spend extra time on scenario reasoning, since the exam format includes scenario-based questions, and on documentation and chain of custody, since case-ready reporting is explicitly part of the program.
Frequently Asked Questions
CDCI means Certified Digital Currency Investigator. It is a professional certification offered through McAfee Institute for people who investigate criminal activity involving cryptocurrency and other digital currency.
No. Several unrelated credentials share these letters. On this site, CDCI always refers specifically to the Certified Digital Currency Investigator, and the facts in this article apply only to that credential.
The published time limit is three hours, delivered online with remote proctoring. The published final-exam threshold is at least 70%. The exact question count and scored/unscored split are not publicly verified.
No. Training purchase is not mandatory for the exam-only route, which costs USD 450 for one attempt within a one-year exam license. The optional course is 50 hours across 19 modules and is sold in a separate package.
No. It renews every two years for USD 125 plus proof of continuing professional education. Lifetime access to training materials is a separate matter and does not mean lifetime certification.
If you want a plain-language overview of the credential, our pages on what CDCI is and the broader CDCI certification topic are good next stops, and the exam dates guide covers scheduling. Verify all fees, timing, and proctoring details with McAfee Institute before you register, since terms can change.