IRM 9.5.3 — Criminal Investigation Strategies

# Part 9. Criminal Investigation

Chapter 5. Investigative Process Section 3. Criminal Investigation Strategies 9.5.3 Criminal Investigation Strategies Manual Transmittal July 08, 2024 Purpose (1) This transmits revised IRM 9.5.3, Criminal Investigation Strategies. Material Changes (1) Updated Internal Controls to add Director, Refund Fraud & Investigative Services (RFIS). (2) Subsection 9.5.3.2.4.1(4)(a) changed SDC to RFIS. (3) Subsection 9.5.3.2.5.1.1.1(1), removed "sending an email to *CI-HQ-RC-SDC-Leads" and added "accessing the RFIS SharePoint site". (4) Subsection 9.5.3.2.6.6(5) removed "Refund Crimes" and added "Refund Fraud & Investigative Support". (5) Subsection 9.5.3.3.12(2), changed "The SDC" to "RFIS". (6) Additional revisions, deletions, and grammatical changes were made throughout the section, that did not result in substantive changes but contributed to procedural clarity of the subject matter. Effect on Other Documents This IRM supersedes IRM 9.5.3, dated November 9, 2023. Audience Criminal Investigation (CI) Effective Date (07-08-2024) Shea C. Jones Acting Deputy Chief, Criminal Investigation for Guy A. Ficco Chief, Criminal Investigation

# Program Scope and Objectives

9.5.3.1 (07-08-2024) Program Scope and Objectives Criminal Investigation has Operational and Investigative Strategies. Criminal Investigation's strategies are classified in terms of: Initiatives in which CI participates Priorities within the program area Schemes encountered in the program areas Other situations to which the special agent should be sensitive when conducting an investigation Audience: All CI employees. Policy Owner: Director, Global Financial Crimes & Policy and Director, Refund Fraud & Investigative Support. Program Owner: Director, Global Financial Crimes & Policy and Director, Refund Fraud & Investigative Support. Primary Stakeholders: All CI employees. Contact Information: To recommend changes to this IRM section email CIHQIRM@ci.irs.gov. Goal: Instruct CI employees on the authorized techniques for each of CI's sources of investigations.

# Background

9.5.3.1.1 (11-09-2023) Background Criminal Investigation has Operational and Investigative Strategies. Criminal Investigation's strategies are classified in terms of: Initiatives in which CI participates. Priorities within the program area. Schemes encountered in the program areas. Other situations to which the special agent should be sensitive when conducting an investigation. CI's Operational strategies consist of three distinct strategies: Business, Enforcement, and Communication, which directly link to the goals delineated in the IRS Strategic Plan. CI's Investigative strategies consist of Compliance, International, Money Laundering, and Terrorism. The Money Laundering and Terrorism strategies are also introduced in this section. Tax crimes are those which are in violation of the criminal statutes of Title 26, Title 18 and/or Title 31 of the Code of Federal Regulations as applicable to Title 26. Although violations of narcotics, money laundering or currency statutes usually have tax ramifications, those types of violations, will be discussed in separate sections.

# Authority

9.5.3.1.2 (11-09-2023) Authority See IRM 9.1.2, Authority for the delegated authority relating to 9.5.3, Criminal Investigation Strategies.

# Roles and Responsibilities

9.5.3.1.3 (07-08-2024) Roles and Responsibilities The Director, Global Financial Crimes & Policy and Director, Refund Fraud & Investigative Support are responsible for developing, maintaining, and overseeing this IRM and ensuring compliance with current policies and procedures.

# Program Management and Review

9.5.3.1.4 (07-08-2024) Program Management and Review The Director, Global Financial Crimes & Policy and Director, Refund Fraud & Investigative Support will: Review the IRM annually. Update the IRM when content is no longer accurate and reliable to ensure employees correctly complete their work assignments and for consistent administration of the tax laws. Incorporate all interim content into the next revision of the IRM section prior to the expiration date.

# Program Controls

9.5.3.1.5 (11-09-2023) Program Controls The Director, Global Financial Crimes & Policy will review the instructions and guidelines relating to the investigation of tax returns and other IRS documents for procedural, operational, and editorial changes.

# Acronyms

9.5.3.1.6 (11-09-2023) Acronyms The table lists commonly used acronyms and their definitions: Acronym Definition ABP Annual Business Plan ACS Automated Case Support AI Associate Identities ATF Bureau of Alcohol, Tobacco, Firearms and Explosives BSA Bank Secrecy Act CI Criminal Investigation CIP CI Program CIMIS Criminal Investigation Management Information System CT Criminal Tax DOJ Department of Justice DOL Department of Labor EDIMS Electronic Disclosure Information Management System EIN Employer's Identification Number EITC Earned Income Tax Credit ERO Electronic Return Originator FBI Federal Bureau of Investigation FOIA Freedom of Information Act FRP Frivolous Return Program FTC Federal Trade Commission FUTA Federal Unemployment Taxes Act GI General Investigation HCFA Health Care Financing Administration HIDTA High Intensity Drug Trafficking Area HMO Health Maintenance Organization HUD Housing & Urban Development IBC International Business Companies IRC Internal Revenue Code ISP Internet Service Provider ITIN Individual Taxpayer Identification Number JTTF Joint Terrorism Task Force LEM Law Enforcement Manual LLC Limited Liability Companies LLP Limited Liability Partnership NAIC National Association of Insurance Commissioner NMLS National Money Laundering Strategy OCC Office of the Comptroller of Currency OCDETF Organized Crime Drug Enforcement Task Force OFP Organization, Function, and Program OIG Office of Inspector General ONDCP Office of National Drug Control Policy OPR Office of Professional Responsibility PACER Payment, Claims, and Enhanced Reconciliation PAC Program Action Case PI Primary Investigation QRP Questionable Refund Program RAC Resident Agent in Charge RAL Tax refund anticipation loan RAR Revenue Agent's Reports RFIS Refund Fraud and Investigative Support RPP Return Preparer Program RRA Restructuring and Reform Act SAC Special Agent In Charge SB/SE Small Business/Self Employed SCI Subject Criminal Investigation SOC Sub Object Code SSA Social Security Administration SSA Supervisory Special Agent SSN Social Security Number SUA Specified Unlawful Activity TEGE Tax Exempt and Government Entities TCIS Treasury Check Information System TIGTA Treasury Inspector General for Tax Administration USAO US Attorney's Office USC United States Code USDA Department of Agriculture VA Veteran's Administration WIC Women with Infant Children

# Related Resources

9.5.3.1.7 (11-09-2023) Related Resources IRM 1.2.2, Delegation Order 9-2 (formerly DO-158, Rev. 2). IRM 1.2.2, Delegation Order 25-5 (formerly DO-143 Rev. 6). IRM 4.19, Liability Determination. IRM 9.1.3, Criminal Statutory Provisions and Common Law. IRM 9.3.1, Disclosure. IRM 9.4.1, Investigation Initiation. IRM 9.4.4, Requests for Information. IRM 9.4.9, Search Warrant, Evidence and Chain of Custody. IRM 9.4.11, Investigative Services. IRM 9.4.12, Arrest. IRM 9.4.13, Financial Investigative Task Forces. IRM 9.5.11, Other Investigations. IRM 9.5.13, Civil Considerations. IRM 9.5.14, Closing Procedures. IRM 9.6.3, Pre-Trial Procedures. IRM 9.7.13, Title 26 Seizures for Forfeitures. IRM 9.9.4, Criminal Investigation Management Information System Data Fields. IRM 11.3.2, Disclosure to Persons with a Material Interest. IRM 25.1, Fraud Handbook. IRM 25.1.3, Criminal Referrals. LEM 9.14.1, Criminal Investigation Official Use Only Procedures. LEM 9.14.4, ADP Controls.

# Compliance Strategy

9.5.3.2 (02-09-2005) Compliance Strategy Criminal Investigation's Compliance strategy is comprised of the following programs: Legal Source Income, Illegal Source Income, Narcotics.

# Legal Source Income Program

9.5.3.2.1 (08-18-2020) Legal Source Income Program The prosecution of legal source income program investigations is essential to promoting voluntary compliance with the tax laws. Criminal Investigation's primary resource commitment is to develop and investigate legal source income investigations. Legal source income investigations involve legal industries and legal occupations, and more specifically, legally earned income. The primary motive or purpose of the illegal activity is the violation of tax statutes. Criminal Investigation is solely responsible for investigating these violations. The legal source income program includes those investigations that threaten the tax system, such as the QRP, unscrupulous RPP and frivolous filers/non-filers investigations. Excise tax and employment tax investigations are also important components of the legal source income program. The legal source income program addresses tax investigations involving: Legal occupations and industries, Title 26 violations, Title 18 USC 286, 18 USC 287, and 18 USC 371 (Klein conspiracy) violations. Within the legal source income program are the following initiatives, which are all part of the overall IRS Strategic and Program Plan or an ongoing commitment by the IRS: Income Tax — investigations relating to income from businesses, investments, or other legal activities and industries. Employment Tax — investigations relating to unreported, underreported, unpaid, or underpaid employment tax obligations. Excise Tax – investigations involving violations of the excise tax laws. Abusive Tax Schemes – investigations involving abusive and/or fraudulent schemes to evade taxes which encompass violations of Title 26 and related statutes where multiple flow-through entities are used as an integral part of the schemes. Such schemes are characterized by the use of trusts, LLCs, LLPs, IBCs, foreign financial accounts, offshore credit/debit cards, and other similar instruments. Gaming — investigations relating to the income generated from the legal gaming industry. QRP — investigations involving fraudulent tax refund schemes. RPP — investigations involving preparers of false and/or fraudulent tax returns. Frivolous Filer/Non-filers — investigations involving the most egregious non-filers. The CI Annual memorandum determines the investigatory emphasis on these priorities.

# Income Tax Investigations

9.5.3.2.1.1 (02-09-2005) Income Tax Investigations Legal source tax crimes encompass many types of investigations. The majority of these investigations involve individuals who earn income from legal industries. General tax fraud investigations are the main component of CI's effort to foster voluntary compliance. These investigations encompass the broadest base of taxpayers and involve individuals from all facets of our economy.

# Employment Taxes

9.5.3.2.1.2 (02-09-2005) Employment Taxes Employment tax investigations seek to identify those individuals who evade or fail to report and pay employment taxes.

# Employment Tax Schemes

9.5.3.2.1.2.1 (08-18-2020) Employment Tax Schemes The emergence of employee leasing companies (commonly referred to as professional employer organizations or PEOs) that fail to pay over taxes withheld from employees is an area of growing concern. Employee leasing is an industry where companies contract with a business to handle administrative duties, hire all of the company's employees, and lease the employees back to the original company. Another concern in the employment tax area is businesses that "pyramid" employment taxes. "Pyramiding" of employment taxes is a fraudulent practice where a business withholds taxes from its employees but intentionally fails to remit them to the IRS. Businesses involved in pyramiding frequently file for bankruptcy to discharge the liabilities accrued and then start a new business under a different name and begin a new scheme. Indications of employment tax fraud are typically discovered by the other operating divisions and then referred to CI. (See IRM 25.1, Fraud Handbook.)

# Employment Tax Investigations

9.5.3.2.1.2.2 (11-09-2023) Employment Tax Investigations Title 26 USC 7512 and 26 USC 7215 are criminal provisions that may be useful in the employment tax area, especially in bankruptcy related tax crimes. (See IRM 9.1.3, Criminal Statutory Provisions and Common Law.) The penalty provided by 26 USC 7215 is not limited to the "willful" failure investigations, to which these other penalties are applicable. Title 26 USC 7215 (b) of the new code provides that the penalty provided by 26 USC §7215 (a), is not applicable in two types of situations: The penalty is not applicable if the person in question shows that there is reasonable doubt as to whether the law required the collection of the tax or that he/she was the one who was required by law to collect the tax. For example, in an investigation involving employment taxes, the target may show that there was reasonable doubt as to whether he/she was an employer or was simply engaged in a contract with an independent contractor. Another example where the penalty would not be applicable is when the individual in question can show that there is reasonable doubt as to who is the proper collection agent. The penalty in 26 USC 7215 (a) is not applicable when the target of the investigation can show that his/her failure to collect, deposit and/or keep the taxes in a separate account was due to circumstances beyond his/her control. For this purpose, however, a lack of funds immediately after the payment of wages (whether or not resulting from the payment of the wages) is not to be considered circumstances beyond the individual's control. This can be illustrated by an employer subject to the requirement of 26 USC 7512, who has gross payroll requirements of $1,000, with respect to which he/she is required to withhold $100 of income taxes. If the employer had on hand only $900 and used this entire amount to pay his/her employees' salaries, withholding no employment taxes, he/she would not be relieved of the penalty imposed by 26 USC 7215(a). A lack of funds occurring after the payment of wages (so long as it was not immediately after) would, however, qualify under this exception if it were due to circumstances beyond the person's control. Examples of such circumstances are theft, embezzlement, destruction of the business as the result of fire, flood, or other casualty, or the failure of a bank in which the person had deposited the funds prior to transferring them to the trust account for the government. However, lack of funds arising after payment of wages, resulting, for example, from the payment of creditors will not be considered circumstances beyond the person's control. An appropriate investigation will be made in each situation to determine whether the statutory exceptions set forth above are applicable, and the final report will set forth the results of such investigation. Title 26 USC 7202 is another criminal provision that may be pursued for potential violations of employment tax. This code section discusses the willful failure to collect or pay over tax.

# Balancing the Criminal and Civil Aspects of Employment Tax Investigations

9.5.3.2.1.2.3 (08-18-2020) Balancing the Criminal and Civil Aspects of Employment Tax Investigations Once a criminal investigation is initiated, the other operating divisions will not contact the subject, his/her representative, or employees about the collection of the amounts due under the notice or take any other action to enforce collection of those amounts, without the prior concurrence of the SAC. No partial payment or installment agreements covering prior delinquencies will be entered into with the subject after the referral to CI. Voluntary payments by the subject after the referral will be reported to the SAC. This does not preclude the issuance of collection first notices, acceptance of voluntary payments, or the filing of notices of lien, if required to adequately protect the government's interests. Enforced collection action may be taken on delinquencies for periods prior to the time the subject received the notice. In some instances, such action will include the filing of proof of claim in a pending insolvency proceeding because the subject's assets or at least some portion thereof, will be under the jurisdiction of a court and will not be subject to levy. However, the SAC will be informed of any proposed enforcement action to ensure that it does not jeopardize a potential criminal investigation. The SAC may concur with the proposed enforced collection action relating to the amounts due under a referred notice when it appears that such action will result in substantially full payment of the liability covered by such notice. Concurrence will not be given if the proposed action will result in only a small partial payment. The probable effect of a proposed action that will likely result in obtaining more than a small partial payment, but less than full payment of the liability, will be determined based on its likelihood of jeopardizing successful prosecution. Proposed enforced collection action involving participation in an insolvency proceeding will be considered to likely result in obtaining more than a small partial payment of the liability but less than full payment.

# Employment Tax Investigations

9.5.3.2.1.2.4 (08-18-2020) Employment Tax Investigations Trust fund penalty investigations are referred directly to the USAO by the SAC. The CT Counsel should be consulted early in the investigation for advice on potential strengths and weaknesses. Concurrence of a proposed enforced collection action which is related to the liability due under the notice will not be given by the SAC in those instances when the investigation was transmitted to the local USAO without the approval of said USAO. Concurrence requests may be oral or written from the other operating divisions in a proposed enforced collection action which relates to liabilities due under a referred notice. The SAC may also reply orally; however, his/her response should be confirmed in writing as soon as practicable. Reporting procedures will be followed for ″Discontinued Investigations″ returned to the Collection function (see IRM 9.5.14, Closing Procedures). Information concerning payments made by a subject after the criminal investigation was referred to the attorney for the government, or for any enforced collection action related to prior delinquencies, will be transmitted to the attorney for the government. Trust fund penalty investigations will be processed in accordance with established procedures. The SAC will notify the other operating divisions promptly of the disposition of the criminal aspects of an investigation (see IRM 9.5.14, Closing Procedures). The SAC may furnish suggestions to the other operating divisions for future collection action in: Any referral which was declined by CI. An investigation in which CI declined prosecution but where the taxpayer's actions might result in more favorable circumstances for a prosecution recommendation at a later date.

# Excise Tax

9.5.3.2.1.3 (08-18-2020) Excise Tax An excise tax is a duty levied upon the manufacture or sale of goods and services, upon certain occupations, and upon certain activities of non-profit organizations. While income taxes are based on net income or net profits and are graduated, excise taxes are not. Excise taxes can be based upon any of the following factors: Selling price of merchandise or facilities, Services sold or used, Number of units manufactured, etc., Weight, Volume of units sold, Nature of occupation. Civil excise taxes investigations cannot be appealed to the US Tax Court. All appeals by excise tax litigants must be made to either the US Court of Claims or to the US District Court, and then only upon prepayment of the taxes. Certain excise tax returns are required to be filed on either a fiscal-year or calendar-year basis. In general, excise tax returns are filed on a calendar quarter-year basis. The excise tax categories of most frequent interest to CI include: Manufacturers' excise taxes: automotive and related items (gasoline, gasohol sales, gasoline sales used for gasohol, and tires); coal from underground mines and from surface mines; recreational equipment such as firearms (pistols, revolvers, other firearms, shells and cartridges); and sporting goods (fishing equipment, hunting, and related equipment). Occupational taxes: wagering; brewers; retail liquor dealers; retail dealers in beer; wholesale liquor dealers; wholesale dealers in beer; and other limited retail dealers. Facilities and services: communications (local and toll telephone service and teletypewriter service) and transportation (transportation of persons by air, inland waterway users) fuel and transportation of property. Heavy trucks and trailers retailers' taxes: truck parts and accessory installations; truck chassis or body; truck trailer or semi-trailer chassis or body. Miscellaneous excise taxes: seabed mining; environmental taxes; highway motor vehicle use tax; foreign insurance policies; wagering taxes; liquor taxes; and tobacco taxes. Information concerning the investigation of these types of excise taxes can be found in IRM 9.5.11, Other Investigations. Note: The preceding excise taxes on alcohol, tobacco, and firearms are not under the jurisdiction of CI. Those items are taxed under Subtitle E of Title 26. Responsibility for the enforcement of excise taxes on alcohol, tobacco, machine guns and certain other firearms is vested exclusively with the DOJ-ATF.

# Fuel Excise Tax

9.5.3.2.1.3.1 (02-09-2005) Fuel Excise Tax Since the mid-1980s, organized criminal elements have devised elaborate schemes to steal Federal and state motor fuel excise tax revenue. The impact of these evasion schemes went far beyond the substantial revenue loss. These criminal enterprises adversely affected the fuel industry, as well as, eroding the market share of legitimate dealers and forcing some out of business. Since 1991, CI has made a concerted effort to disrupt those organized criminal elements responsible for perpetrating motor fuel evasion schemes across the country. These enforcement efforts provided the impetus for the enactment of important legislative changes to reduce evasion, and materially contributed to dramatic and sustained increases in Federal and state motor fuel tax revenue.

# Wagering Excise Tax

9.5.3.2.1.3.2 (08-18-2020) Wagering Excise Tax A wagering excise tax is imposed on wagers and is a percentage of the wager. The tax is assessed on the individual who accepts wagers. A special wagering tax also exists and is a flat fee to be paid by each person who is engaged in receiving wagers or employed by such person. Wagering tax investigations are often joint efforts with other agencies. These joint investigations would then become part of the illegal source income program area. For additional information concerning CI's involvement in the enforcement of the wagering taxes see IRM 9.5.11, Other Investigations. There are special disclosure restrictions regarding wagering investigations (See IRM 9.3.1, Disclosure).

# Abusive Tax Schemes

9.5.3.2.1.4 (08-18-2020) Abusive Tax Schemes Abusive tax promotions have increased in recent years, creating a significant threat to the nation's revenue. Promoters and return preparers have grown increasingly bold and sophisticated. The internet gives promoters instantaneous and relatively inexpensive access to a wide audience. This has allowed tax schemes and scams to grow at phenomenal rates, often faster than the IRS is able to investigate and stop them. Effective early action against promoters and preparers is needed to reverse this disturbing trend. Criminal Investigation plays an active role in combating abusive tax schemes by targeting the promoters and egregious clients of these schemes. Criminal Investigation and Small Business/Self Employed (SB/SE) are cooperating in an effort to utilize all of the civil and criminal remedies available to stop the proliferation of abusive tax schemes. Abusive tax scheme investigations encompass violations of Title 26 and related statutes where multiple flow-through entities are used as an integral part of the taxpayer's scheme to evade taxes. These schemes are characterized by the use of trusts, LLCs, LLPs, IBCs, foreign financial accounts, offshore credit/debit cards and other similar instruments. The schemes are usually complex, involving multi-layer transactions for the purpose of concealing the true nature and ownership of the taxable income and/or assets. Abusive tax scheme investigations will often involve the use of parallel proceedings to effectively stop an abusive promotion and protect the revenue of the Treasury (see IRM 9.5.13, Civil Considerations). Parallel proceedings are not joint proceedings; rather, they are distinct separate civil and criminal investigations. Criminal Investigation, SB/SE, and DOJ have developed the methods and means to implement both the civil and criminal statutes available in a coordinated strategy. The benefits of using parallel proceedings against promoters of abusive tax schemes are: An injunction usually stops the promotion much earlier than possible through criminal enforcement alone. Filing an injunction, accompanied by a press release, quickly publicizes the government's position on a promoter or promotion. Parallel investigations enable civil and criminal agents and attorneys for the government to share information where appropriate, thus enhancing efficient use of government resources.

# Gaming

9.5.3.2.1.5 (08-18-2020) Gaming During recent years, there has been unprecedented growth in the legalized gaming industry. Criminal Investigation has increased its attention to this industry as it relates to the enforcement of tax, money laundering, currency and other criminal statutes within CI's jurisdiction. Criminal Investigation also recognizes that traditional gaming investigations involving illegal bookmaking and numbers operations remain areas of concern. The gaming initiative consists of two primary activities: Traditional investigative efforts directed at persons suspected of violating laws within CI's jurisdiction. Important liaison activity in cooperation with Federal and state gaming boards, commissions, and other regulators (includes participation in writing state gaming regulations, assisting in licensing activities, and developing investigations). To address concerns regarding the rapid expansion of domestic gaming, Congress passed the National Gaming Impact Study Commission Act, Public Law 104–169, which requires a comprehensive legal and factual study of the social and economic impacts of gambling in the United States upon: Federal, state, local, and Native American tribal governments, Communities and social institutions. Regulations implementing the BSA Title 31 were amended to include casinos operated by or on behalf of Native American tribes within the definition of a financial institution as set forth in those regulations. The amendments extend the reporting and record-keeping requirements and anti-money laundering safeguards of the BSA to tribal casinos.

# Gaming Investigations

9.5.3.2.1.5.1 (08-18-2020) Gaming Investigations Gaming investigations differ from wagering excise tax investigations. In a gaming investigation, a subject is typically under investigation for income tax, money laundering, or currency violations. Similar to wagering tax investigations, gaming investigations can be joint efforts with other agencies. These joint investigations would then become part of the illegal source income program. Title 18 USC 1955 (Prohibition of Illegal Gambling Businesses) is no longer one of the charges for which CI can recommend prosecution; however, it is one of the specified unlawful activities set forth in 18 USC 1956, Laundering of Monetary Instruments.

# Information Available From State Regulatory Agencies on Gaming

9.5.3.2.1.5.2 (08-18-2020) Information Available From State Regulatory Agencies on Gaming A number of states gather and maintain substantial information relating to individuals and/or entities associated with the gaming industry. Much of the information is readily available to law enforcement and may be helpful when conducting an investigation. As an example of the type of information available from local or state regulatory agencies, the State of New Jersey, Department of Law and Public Safety, Division of Gaming Enforcement, completes a financial investigation on all individuals associated with casino operations (See IRM 9.4.4, Requests for Information).

# Refund Fraud Investigations

9.5.3.2.2 (08-18-2020) Refund Fraud Investigations Fraudulent refund schemes fall within two categories: QRP - These investigations generally consist of one or more tax returns that are determined to be false and involve violations of 18 USC 286 and 18 USC 287. The returns appear to be prepared by the same individual or group of individuals based on similar return characteristics or the same "modus operandi." RPP - These investigations are generally perpetrated by unscrupulous return preparers who knowingly add false expenses, deductions, credits, or exemptions to a client's tax returns to decrease that client's tax liability, resulting in a larger refund or significantly less tax due and owing. The investigations generally involve violations of 26 USC 7206(1) and 26 USC 7206(2).

# Refund Fraud and Investigative Support

9.5.3.2.2.1 (11-09-2023) Refund Fraud and Investigative Support The Refund Fraud and Investigative Support (RFIS), formerly known as the Scheme Development Center (SDC), is responsible for detecting, developing and referring information involving QRPs and unscrupulous RPPs to the appropriate field office. Therefore, all information relative to QRP and RPP schemes is to be sent to RFIS. RFIS will work with field offices to select, evaluate, develop and number as PIs, QRP and RPP investigations. RFIS will assign a fraud scheme code to each QRP/RPP investigation (see IRM 9.9.4, Criminal Investigation Management Information System Data Fields).

# Sources of Refund Fraud Investigations

9.5.3.2.2.2 (11-09-2023) Sources of Refund Fraud Investigations Refund fraud investigations can originate from a variety of sources, including: Information forwarded to RFIS by the IRS Campus regarding multiple returns filed by the same taxpayer. Fraud referrals from the other operating divisions that were secured during collection activity or involve a nonexistent address, taxpayer, employer, or excessive deductions. Information provided by the US Postal Service regarding delivery of numerous government checks to an address or a person showing unusual interest in the mail. Information regarding an excessive number of mail-forwarding requests. Information provided by an informant regarding an individual boasting about the amount of refunds received or a suspicious return preparer. Information provided by a private-sector return preparer who suspects return information submitted is false. Information provided by financial institutions relative to unusual deposit amounts either from electronic transfers or paper checks. Information provided by internet providers relative to numerous returns from the same IP address. Returns identified by RFIS that are linked by similar characteristics to returns identified as false as to a material item(s) and/or profiled based on similar schemes and then proven to be false as to a material item(s). Information provided by prison officials regarding the delivery of numerous government checks, correspondence and/or suspicious activity involving inmates. Information provided by state and local authorities or other Federal agencies.

# Potential Violations

9.5.3.2.2.2.1 (08-18-2020) Potential Violations When conducting refund fraud investigations, the following violations may be applicable (See IRM 9.1.3, Criminal Statutory Provisions and Common Law): 18 USC 287, 18 USC 286, 26 USC 7206(1), 26 USC 7206(2), 18 USC 371, 18 USC 1028, 18 USC 2. If there are any indications of substantive tax violations, i.e., the preparation, filing, or assisting in the preparation or filing of false documents or returns by an IRS employee, the Office of the TIGTA is to be notified immediately and the investigation will be conducted jointly by CI and TIGTA. Investigations involving counterfeiting and forgery statutes are the jurisdiction of the US Secret Service (see IRM 9.3.1, Disclosure). Investigations involving the use of the mail to defraud the Federal government are within the jurisdiction of the US Postal Service (See IRM 9.3.1, Disclosure). Early detection of refund fraud enables the IRS to stop the issuance and delivery of refund checks to fraudulent claimants.

# False Claims Violations

9.5.3.2.2.2.2 (11-09-2023) False Claims Violations A violation of 18 USC 287 involves making a false or, fictitious, fraudulent claim to a department of the United States. In the context of tax cases, it occurs upon the filing of a fabricated Federal income tax return wherein a false representation is made that the tax has been overpaid and there is a claim made for a refund of the overpayment. Special agents should understand the provisions of 18 USC 287 and 18 USC 286 and be prepared to coordinate their investigative activities with investigations conducted by the US Secret Service, the US Postal Service and/or another government agency. It is not unusual for individuals involved in refund fraud investigations to be involved in violations of other Federal statutes. There are circumstances when grand jury authorization for violations of 18 USC 287 and 18 USC 286 can be directly referred to the attorney for the government. See DOJ, Tax Division Directive No 96. Criminal Tax Counsel should be consulted. False claim investigations involving false claims submitted to the IRS are considered tax related investigations and are subject to 26 USC 6103 disclosure restrictions and the DOJ, Tax Division, must approve prosecution recommendations. Presentation of a claim is more than an intention to make a claim. The claim must be presented actually and physically, and thereby made to the government.

# Identity Fraud Violations

9.5.3.2.2.2.3 (02-09-2005) Identity Fraud Violations In the context of tax violations, 18 USC 1028 could be applicable where a subject steals another person's identity for the purpose of falsely representing his/her identity to the IRS. In such investigation(s), the individuals who steal the identities may be different from the individual(s) who actually file the tax return and ultimately obtain the false refund. Identity fraud must have a direct link to the substantive tax or conspiracy violation which is the focus of the criminal investigation. These are tax-related investigations and must be referred to DOJ, Tax Division, for authorization.

# Potential Forfeiture Provision

9.5.3.2.3 (02-09-2005) Potential Forfeiture Provision 26 USC 7302, 18 USC 981, 18 USC 982.

# Title 18 Forfeitures in Tax or Tax-Related Investigations

9.5.3.2.3.1 (08-18-2020) Title 18 Forfeitures in Tax or Tax-Related Investigations It is the general practice of CI that Title 18 seizure/forfeiture authority will not be used in tax or tax-related investigations. However, there may be instances where Title 18 seizure/forfeiture provisions are appropriate in tax or tax-related investigations. Additionally, the use of such forfeitures in tax and tax-related investigations may require approval by the DOJ, Tax Division pursuant to the provisions of Tax Division Directive 128, Charging Mail Fraud, Wire Fraud, or Bank Fraud Alone or as Predicate Offenses in Cases Involving Tax Administration. The use of Title 18 seizure/forfeiture authority in tax or tax-related investigations will be limited to egregious situations where no reasonable alternative is available. These situations typically arise in, but are not limited to, refund fraud investigations. Seizures for forfeiture in tax or tax-related investigations must be reviewed by Area Counsel have the concurrence of the Director, Field Operations, and be approved by the Chief, CI. If approved, the Chief, CI will then refer the matter to the requesting SAC. If a judicial case, the field office will prepare a transmittal memorandum and forward the request to Tax Division for authorization to pursue a judicial forfeiture action pursuant to Directive 128 (see IRM 9.7.13, Title 26 Seizures for Forfeitures).

# Indicators of Refund Fraud

9.5.3.2.3.2 (08-18-2020) Indicators of Refund Fraud Refund fraud investigations may be confined to a single field office or may extend to multiple field offices. The following are indicators of refund fraud: The name used on a fraudulent return(s) may be an alias, a fictitious name, a deceased person, a stolen identity or a variation of a preparer or filer's name. The tax return utilizes the EITC or some other refundable tax credit to generate a refund on multiple tax returns with similar characteristics. Form(s) W-2 (sometimes handwritten) are fabricated and false showing fictitious employer(s), false or inflated salary, and/or false or inflated tax withheld. The name of the employer shown on the Form(s) W-2 may or may not be an existing firm or person. Returns filed with false Schedule C(s). A substantial refund is claimed solely on the basis of the number of exemptions listed. An unrealistic amount is shown as tax withheld. Absence of or unrealistic social security information reflected on the Form(s) W-2. Unless an exempt occupation, such as state government employment is involved, the percent and maximum amounts of Social Security taxes withheld should agree with the law for the year involved. Absence of or unrealistic Employer's Identification Number shown on Form(s) W-2. Similarity of information, format, or writing on several returns. Frequently, investigations involving numerous false returns being filed by one person or group of persons can be detected by his/her continued use of similar names as to taxpayers, employers, exemptions, and types of deductions claimed; or similarity in the arrangement of the information and the printing, handwriting or typewriting appearing on the returns. In instances where the taxpayer plans to receive the refund check at an address other than the one listed on the return, the scheme may be to file a change of address with the US Postal Service prior to delivery of the check. The scheme may also be to recover the check after it has been returned to the IRS by later providing forwarding instructions. Multiple refunds are going to the same bank account as direct deposits and/or refund transfers. These accounts may or may not be associated with a return preparer. Refunds are being deposited onto prepaid debit cards. The identity theft victims may link back to a payroll data compromise or a data breach at a tax preparation firm.

# Characteristics of Taxpayer Identification Numbers

9.5.3.2.3.2.1 (08-18-2020) Characteristics of Taxpayer Identification Numbers Characteristics of SSNs are: The SSN should appear 000-45-6789. The SSN always begin with a number 0 to 7; never begin with an 8 or a 9. Prior to January 1966, the middle two digits had to be odd if the number was under ten (01, 03, 05, 07 or 09) and even for higher numbers (10, 12, 14, etc.). Presently, as each area exhausts their sequence of numbers in the odd and even categories, they will start using the even numbers under ten then the odd numbers above ten. The first three digits of SSNs issued prior to June 2011 identify the geographical location where the SSN was issued. For SSNs issued after June 2011 this is no longer true. The SSA changed the way SSNs are issued on June 25, 2011. This change is referred to as "randomization." The SSA developed this new method to help protect the integrity of the SSN (see http://www.socialsecurity.gov/employer.) The EIN shown on Form(s) W-2 should always appear 00-0XX1234 with the first two digits being the code number of the IRS field office. For example, a Tennessee Employer's Identification Number should ordinarily begin 62- and the following 7 digits should be within the limits of the numbers assigned thus far. An Individual Taxpayer Identification Number is a tax processing number issued by the IRS. It is a nine-digit number that always begins with the number 9 and has a 7 or 8 in the fourth digit, example 9XX-7X-XXXX. IRS issues ITINs to individuals who are required to have a US taxpayer identification number, but who do not have and are not eligible to obtain a SSN from the SSA. The ITINs are issued regardless of immigration status because both resident and nonresident aliens may have US tax return and payment responsibilities under the IRC. Individuals must have a filing requirement and file a valid Federal income tax return to receive an ITIN, unless they meet an exception. The ITINs are for Federal tax reporting only and are not intended to serve any other purpose. An ITIN does not authorize the individual to work in the United States or provide eligibility for Social Security benefits or the EITC. The ITINs are not valid identification outside the tax system. IRS issues ITINs to help individuals comply with the US tax laws, and to provide a means to efficiently process and account for tax returns and payments for those not eligible for SSNs.

# Characteristics of Schedule C Schemes

9.5.3.2.3.2.2 (08-18-2020) Characteristics of Schedule C Schemes The following are characteristics of questionable Schedule Cs: Returns with zero or minimal/similar expense deductions on Schedule C claiming 90% or more of maximum EITC; and One or more of the following items: • Multiple returns at the same addresses some of which may be non-existent • Multiple years filed at the same time • Multiple returns with the same direct deposit bank account • First time filer • Filers under the age of 15 or over the age of 65

# Refund Fraud Investigations

9.5.3.2.4 (02-09-2005) Refund Fraud Investigations In refund fraud investigations, the investigation is directed towards ascertaining: The authenticity of return(s) and supporting document(s). The responsibility of the return preparer(s) and filer.

# Investigative Techniques for Refund Fraud Investigations

9.5.3.2.4.1 (07-08-2024) Investigative Techniques for Refund Fraud Investigations Criminal Investigation may make limited third-party contacts at the GI and PI stage of QRP/RPP investigations under the exception provided in 26 USC 7602(c)(3) (See IRM 9.4.1, Investigation Initiation). Title 26 USC 7602(c)(3)(C) exempts contacts made with respect to a pending criminal investigation from the notice requirement. These inquiries may only be made for the purpose of determining the criminal potential of the investigation and to identify persons responsible for the scheme. Once these determinations are made, third party contacts must immediately cease until a SCI is initiated. General investigation authorized information gathering techniques are listed in IRM 9.4.1, Investigation Initiation. Primary investigation authorized information gathering techniques are listed in IRM 9.4.1, Investigation Initiation. Additional investigative responsibilities for refund fraud investigations may include the following: Special agents must analyze false documents to determine if a specific scheme or technique is being used and if there are any additional false returns. Computer generated extracts of refund information are available to help special agents identify additional returns having similar characteristics to those already discovered. These extracts (routines) are described in Document 12846, LEM 9.14.2, Questionable Refund Program. Coordination with RFIS is necessary for the development of schemes and the identification of the full scope of returns involved. It is also a vital step in CI's responsibility to reduce the loss to the government by blocking refunds and identifying similar and/or related schemes in a timely manner. Special agents must be familiar with surveillance techniques (see IRM 9.4.6, Surveillance and Non-Consensual Monitoring) to identify and locate perpetrators. Special agents must understand the meaning of Probable Cause and be acquainted with IRM 9.4.12, Arrest; IRM 9.4.9, Search Warrant, Evidence and Chain of Custody; and 9.6.3, Pre-Trial Procedures. Search warrants, arrest warrants and complaints are obtained through the USAO. A complaint should be used only in extraordinary circumstances. Special agents may ask the postmaster or US Postal Inspector for a description of the renter of each postal box and, with the postmaster's cooperation, arrange a surveillance of the postal box. The US Postal Inspection Service will make equipment available that gives a signal when the postal box is opened. Special agents should discuss with their SSA and CT Counsel whether they should arrest the person opening the box and picking up the check, or delay the arrest until an arrest warrant can be obtained. Special agents should utilize the services of the Office of Forensic Science and Support for handwriting and typewriting comparisons. Special agents should be acquainted with the procedures prescribed in IRM 9.4.11, Investigative Services. Special agents must determine if employers' names correspond with those on Form(s) W-2 and tax returns filed. These employers should be contacted to determine if the persons listed on the returns were on their payroll. Special agents should contact the State Unemployment Compensation office to verify information on the Form(s) W-2. The State Unemployment Compensation office maintains records pertaining to FUTA tax information on employers and their insured employees. This office can determine if an employer, employee, or SSN listed on a tax return exists in that state. This state office can also supply, by telephone, all information shown on the application for the social security number.

# Identification of Handwriting and Typewriting

9.5.3.2.4.1.1 (11-09-2023) Identification of Handwriting and Typewriting To identify and compare the subject's handwriting and typewriting to the returns filed, special agents should: Obtain copies of refund checks which may have been cashed; have hand- writing analyses made of the endorsements; and follow through with inquiries. Such inquiries may lead to the identification of the negotiator of the checks by disclosing the name of the person or firm that cashed or deposited the checks. The Treasury Check Information System (TCIS) program will produce a copy of the front and back of a cancelled IRS refund check. This will provide the special agent with information regarding who signed the check, where the check was cashed, the account the check was deposited into, and whether the check cashing institution has imaged the driver's license of the person cashing the check onto the back of the refund check. Original refund checks must be requested from the US Secret Service (see IRM 9.4.4, Requests for Information). Examine all post office records where the boxes are rented in order to obtain a specimen of the renter's handwriting. Identify references given by the renter applying for a box and determine, in the investigation of fake references, how the renter arranged to intercept and reply to the postal authorities' inquiry. Obtain printed, typewritten, and handwritten examples in order to have an expert compare these specimens with the handwriting, printing, and typewriting on tax returns, check endorsements, and forwarding instructions. Obtain prior and subsequent years' returns, if any.

# Decoy Refund Check Procedures

9.5.3.2.4.1.2 (02-09-2005) Decoy Refund Check Procedures A decoy refund check is a check made in the name of an individual identified in a refund fraud scheme. The check is used to gather evidence regarding an individual's participation in a false refund scheme.

# Decoy Check Request

9.5.3.2.4.1.2.1 (08-18-2020) Decoy Check Request A request for decoy refund checks is initiated and processed as follows: A memorandum from the SAC or RAC will be forwarded to Director, Administrative Service Center, PO Box E, M:CFO:F:B, Beckley, WV 25802, and will include the following information: • Name, Address and SSN to be placed on the check: • Amount of the refund; • Accounting string; • FY, Appr, OFP, Office, Activity and SOC; and • Any special instructions.

# Unclaimed Decoy Checks

9.5.3.2.4.1.2.2 (08-18-2020) Unclaimed Decoy Checks Decoy refund checks will be forwarded to Beckley for cancellation within 30-days of issuance. If circumstances warrant, and an extension of the 30-day period is granted, the SAC or RAC will advise Beckley of the check's status at the end of each subsequent 30-day period, until the check, along with cancellation memorandum, is forwarded to Beckley for cancellation. A decoy check will not be retained beyond 90-days from the date of issue.

# Decoy Checks as Evidence

9.5.3.2.4.1.2.3 (08-18-2020) Decoy Checks as Evidence When a decoy check is recovered and is to be held as evidence, the SAC or RAC will forward a memorandum to Beckley reflecting the payee's name, address, check amount, check number and date. The memorandum will also specify the need for the check to be used as evidence and request that a stop payment be placed on the check. There is no need to return the check.

# Funding of Checks

9.5.3.2.4.1.2.4 (08-18-2020) Funding of Checks When Beckley issues a decoy refund check, the check is prepared and the amount is charged against the funds of the requesting field office, SOC 2505. When the check is returned or when a stop payment request is forwarded to Beckley, the amount of the check is returned to the field office's funds. If the check remains outstanding more than one year without a stop payment request being forwarded, it is cancelled by Treasury and the funds are returned to Beckley. Funds which remain outstanding for over one year may be lost to the field office because of the difference in appropriated funds between fiscal years.

# Investigations Involving Refund Checks

9.5.3.2.4.2 (08-18-2020) Investigations Involving Refund Checks Once a check is deposited into a filer's mailbox, CI cannot retrieve the check without a search warrant. Copies of the refund check can be obtained by utilizing TCIS or IDRS Command Code IMFOLC.

# Investigations Involving Direct Deposit Refunds

9.5.3.2.4.3 (11-09-2023) Investigations Involving Direct Deposit Refunds A tax refund anticipation loan (RAL) is a separate business transaction between the filer and a lending institution. If the RAL has not been issued, in most instances, the bank will return the refund to the IRS electronically. The full amount is refunded to the IRS, as the lending institution is not entitled to deduct any fees from the refund. If the RAL has been issued, the refund will generally not be returned to the IRS. If a RAL is not involved, the filer is in control of the refund once the direct deposit is made and financial institutions will generally not return the refund to the IRS. However, some financial institutions will return the funds if IRS provides a letter requesting the return of the refund.

# Investigation Involving Electronic Returns

9.5.3.2.4.4 (11-09-2023) Investigation Involving Electronic Returns IRS is not legally authorized to seize RAL checks unless they are part of a search warrant related to an open SCI. Neither RFIS nor field office personnel should provide instruction to an ERO regarding transmission or non-transmission of a return (valid or false). RFIS management personnel should be the designated contact points for EROs who has information concerning false electronically filed returns. However, the information can be furnished to the field office QRP Coordinator or other special agent. Issues regarding the actual return cannot be discussed with the ERO due to disclosure restrictions (26 USC 6103). If the false information involves false Form(s) W-2, a request for copies of the Form(s) W-2 can be requested through CI professional staff and IDRS printout of wage information.

# Multiple Refund Identification by Electronic Fraud Detection System (EFDS)

9.5.3.2.4.5 (11-09-2023) Multiple Refund Identification by Electronic Fraud Detection System (EFDS) One of the abilities of EFDS is to assist in identifying returns filed by individuals filing multiple false claims for refund and returns prepared by unscrupulous tax practitioners (refund mills).

# Assistance of the United States Postal Service in Multiple Refund Schemes

9.5.3.2.4.5.1 (08-18-2020) Assistance of the United States Postal Service in Multiple Refund Schemes The US Postal Service Administrative Support Manual (ASM) Section 225 instructs postal employees to report to their Inspection Service suspicious activities engaged in by the holders of post office boxes. Should an employee note such suspicious activity, i.e., a quantity of Federal tax refund checks directed to a post office box in the normal course of his/her duties and volunteer this information to a US Postal Inspector, the information would be made available to the IRS, if apparently indicative of criminal activity. The situation in (1) above is to be distinguished from the process of systematically scanning or watching incoming mail for the purpose of identifying alleged violators of the IRC and notifying the IRS of the names of the alleged violators. This was determined to sufficiently satisfy the definition of a mail cover and, therefore, local US Postal officials should not be requested to have employees institute such a watch on the mail without an official mail cover (see IRM 9.4.10, Miscellaneous Investigative Techniques regarding mail cover request). The special agent will make a request to the local US Postal Inspector for delivery of a refund check to a specific address. The US Postal Inspector will arrange to have an employee of the US Postal Service put the refund check in the post office box or deliver the check to a residence address in a regular delivery. The US Postal Inspector will notify CI of the approximate time the check will be delivered to the desired address.

# Prisoner Multiple Refund Schemes

9.5.3.2.4.5.2 (11-09-2023) Prisoner Multiple Refund Schemes It has been determined by the Legal Liaison Officer, Chief Inspector's Office, US Postal Service, that a prison mail room is not part of the US Postal system. Consequently, prison officials can make additions to addresses without violating postal regulations. In this regard, it is possible to request from prison officials that all of a prisoner's mail going to the IRS be directed to the RAC at RFIS of the appropriate IRS Campus. The SAC makes the request to the prison executive. As appropriate, CI should coordinate with the RAC and the local prison officials concerning assistance in redirecting any mail leaving the prison.

# Electronic On-Line Filing Fraud

9.5.3.2.4.5.3 (11-09-2023) Electronic On-Line Filing Fraud Electronic on-line filing fraud can be either a QRP or an RPP Investigation. It is necessary for the special agent to work these on-line investigations expeditiously. It is crucial to timely coordinate with the field office and RFIS. Upon identification of an on-line fraud scheme, it is the RAC's responsibility to initiate a preservation letter for the ISP to maintain ISP address records. The initial request allows the records to be maintained for 90-days. One extension can be granted for an additional 90-day period. Careful attention must be paid to the expiration date of the preservation letter and a summons or subpoena should be issued prior to the expiration date or the information may be lost. The extension letter can be authorized by either the RAC or special agent. Internet services providers are not considered third party record keepers and, therefore, do not require notice.

# Questionable Refund Program (QRP)

9.5.3.2.5 (11-09-2023) Questionable Refund Program (QRP) The purpose of a QRP is to detect and stop fraudulent and fictitious claims for refunds on income tax returns. These investigations often involve returns filed with fictitious or stolen identities. The goal of the QRP is to investigate and prosecute promoters and conspirators to foster confidence in the tax system and enhance voluntary compliance. Investigative priorities are the responsibility of the SAC based upon the local prosecution standards. Emphasis should be given to investigations with the greatest potential for preventing continued loss. Special agents, working in conjunction with RFIS personnel at the appropriate IRS Campus, should take reasonable steps to ascertain the magnitude of the scheme and the number of participants involved. Investigative steps should include the following: Contacting the preparer or transmitter, Identifying the person controlling the refund address, Determining the existence of mail forwarding instructions, Contacting lending institutions and establishing the falsity of wage and income documents.

# Procedures for Refund Fraud and Investigative Support Identified QRP

9.5.3.2.5.1 (11-09-2023) Procedures for Refund Fraud and Investigative Support Identified QRP All QRP schemes referred to a field office will be input as PIs into the CIMIS database by personnel in RFIS at the IRS Campuses. See IRM 9.9.4, CIMIS Data Fields for full information on how to enter QRP schemes into CIMIS as PIs.

# Field Office Procedures for IRS Campus Identified QRP Schemes

9.5.3.2.5.1.1 (08-18-2020) Field Office Procedures for IRS Campus Identified QRP Schemes Upon receipt of the QRP scheme referral from RFIS, the receiving field office will promptly assign a special agent to evaluate the referral. The due date is 90-days from the receipt of the referral by the field office. The name of the PI is the scheme number and should not be changed. If a SCI is initiated as a result of the evaluation of the QRP PI, the SCI should reflect the name of the subject of the investigation. This will not be consistent with the name on the PI. Even though they are not consistent, the PI will still be linked to all SCIs initiated. During the course of the investigation, identities identified as part of the QRP scheme should be linked to the PI in CIMIS as AI. The field office is responsible for closing QRP PIs, as well as any SCI initiated as a result of the evaluation of the QRP scheme referral. These investigations should be closed in a manner consistent with all other PI and SCI investigations (see IRM 9.5.14, Closing Procedures). At the conclusion of the criminal aspects of a QRP investigation, the SAC will forward a Criminal Investigation Closing Report with attachments to the RAC. This process is the same for declined or discontinued investigations (see IRM 9.5.14, Closing Procedures).

# Procedures for Field Office Identified QRP Schemes

9.5.3.2.5.1.1.1 (08-18-2020) Procedures for Field Office Identified QRP Schemes In the event the field office, rather than RFIS, opens a QRP PI, the special agent will contact the QRP field office coordinator. The QRP field office coordinator will request RFIS assistance by accessing the RFIS SharePoint site. The request should include the PI number. RFIS will provide assistance for the QRP investigation and link a scheme number to the PI in CIMIS. This will help to prevent duplicating open PIs on schemes RFIS is already tracking. The field office is responsible for closing all QRP PI and SCI investigations in a manner consistent with all other PI and SCI investigations (see IRM 9.5.14, Closing Procedures). The PI initiated by the field office is not to be associated with the national GI for QRP investigations.

# Return Preparer Program (RPP)

9.5.3.2.6 (08-18-2020) Return Preparer Program (RPP) RPP involves claims on Federal income tax returns prepared by un-scrupulous return preparers who knowingly claim excessive deductions and exemptions on returns prepared for clients. The clients may or may not have knowledge of the excessive deductions and exemptions claimed. These preparers may have one or more of the following characteristics: The preparer develops a large clientele through a reputation for saving clients' money. The preparer often charges exorbitant fees. The fee may be based on a percentage of the refund. The refund check is mailed to the preparer's office or deposited into the preparers account. Note: In legitimate RAL processes, the client often receives a check from the preparer for the refund he/she is entitled to less preparation and processing fees. The IRS refund is then automatically deposited into an account specifically set up to receive refunds. Some fraudulent preparers, however, submit a return to IRS with inflated figures that the client is unaware of in order to receive a significantly larger refund. Some even prepare and file amended returns and keep the refunds from prior years as well. The preparer forges the endorsement and negotiates the refund check without the client's knowledge. The preparer fails to sign the return as the preparer. Investigations in this group originate from a variety of sources, such as: Letters of complaint from the public and information from informants concerning return preparers. Complaints from ethical practitioners and professional societies. Screening of returns by IRS Campus personnel. Identification of suspect preparers by CI and other IRS personnel.

# Procedures for IRS Campus Identified RPP Schemes

9.5.3.2.6.1 (11-09-2023) Procedures for IRS Campus Identified RPP Schemes All RPP schemes referred to a field office will be inputted as PIs into the CIMIS database by personnel in RFIS at the IRS Campuses.

# Field Office Procedures for RPP Scheme Referrals

9.5.3.2.6.1.1 (11-09-2023) Field Office Procedures for RPP Scheme Referrals Upon receipt of the RPP scheme referral from RFIS, the receiving field office will promptly assign a special agent to evaluate the referral, and he/she will update CIMIS to reflect the investigation assignment and the due date of the evaluation of the referral. The due date is 90-days from the receipt of the referral by the field office. The name of the PI should not be changed. If a PI is elevated to an SCI as a result of the evaluation of the RPP PI, the SCI should reflect the name of the subject of the investigation in CIMIS. This may not be consistent with the name on the PI. Even though the names may not be consistent, the PI will still be linked to all SCIs initiated. The field office is responsible for closing RPP PIs, as well as any SCIs which are initiated as a result of the evaluation of the RPP scheme referral. These investigations should be closed in a manner consistent with all other PI and SCI investigations (see IRM 9.5.14, Closing Procedures). During the course of the investigation, returns identified as part of the RPP scheme should be updated to show an association with the PI in CIMIS as AI. At the conclusion of the criminal aspects of a false refund investigation, the SAC will forward a Criminal Investigation Closing Report with attachments to the RAC. The RAC will forward the Closing Report to the Territory Manager, Technical Services, for notification and initiation of civil action. This process is the same for declined or discontinued investigations (see IRM 9.5.14, Closing Procedures).

# Procedures for Field Office Identified RPP Schemes

9.5.3.2.6.1.1.1 (08-18-2020) Procedures for Field Office Identified RPP Schemes In the event the field office, rather than RFIS opens a RPP PI, the special agent will contact the RPP field office coordinator. The RPP field office coordinator will call RFIS at the appropriate IRS Campus to request a scheme number. This will help to prevent duplicating open PIs on schemes RFIS is already tracking. The field office is responsible for closing all RPP PI and SCI investigations in a manner consistent with all other PI and SCI investigations (see IRM 9.5.14, Closing Procedures). The PI initiated by the field office is not to be associated with the national GI for RPP investigations.

# Controls for Return Preparer Investigations

9.5.3.2.6.2 (08-18-2020) Controls for Return Preparer Investigations Controls should be placed on client returns that are part of the criminal investigation (see Document 12848, LEM 9.14.4, ADP Controls). Controls should be placed on the preparer's accounts while the criminal investigation is being conducted (see LEM 9.14.4).

# RPP Investigative Techniques

9.5.3.2.6.3 (08-18-2020) RPP Investigative Techniques The investigative techniques used in RPP investigations are different from those used in QRP investigations. RPP investigations are directed toward: Determining the responsibility for the overstatement of the deductions and exemptions claimed Establishing whether such overstatements were made with corrupt intent

# Investigation of Multiple Fraudulent Returns

9.5.3.2.6.3.1 (08-18-2020) Investigation of Multiple Fraudulent Returns The returns in this group of investigations usually report income of authentic origin but are fraudulent because of overstated deductions or exemptions. Some of the most flagrant violations are committed by unscrupulous return preparers who have vulnerable and uneducated clientele. Occasionally, it is established that a preparer has conspired with the client to file a false and fraudulent return.

# Developing the Return Preparer Investigation

9.5.3.2.6.4 (08-18-2020) Developing the Return Preparer Investigation Consideration should be given to using an undercover operation to learn the practitioner's modus operandi and obtain evidence. Keep in mind that if the practitioner prepares a correct return for the undercover agent it does not necessarily mean he/she is an honest preparer. Unless there is a good reason not to, the special agent should contact the civil return preparer coordinator. The return preparer coordinator can assist the special agent in determining what audit path is best for the particular preparer. Client audit results can be used to identify witnesses in the criminal investigation. Great care should be taken to avoid even the appearance that the special agent is directing aspects of the civil audit function other than referring the preparer. Multiple refund investigations involving unscrupulous preparers are developed by patient and painstaking interviews of the clientele to determine responsibility for fraudulent returns. If the client interview discloses information or records material to the investigation, consideration should be given to obtaining a sworn affidavit from the client. The investigation should establish if the fraud is attributable to the preparer, the client, or both. An interview will, therefore, be designed to ascertain: The name of the person that recommended the preparer and the identity of others known to have used the preparer's services. It is advisable to obtain prior years' returns filed by the client. Prior year returns not prepared by the subject can be used for comparison. Information and records used in the preparation of the return. Any memorandum or notes the preparer made of information furnished. Any discussion between the preparer and client regarding the amount of deductions and exemptions to be claimed. Any suggestions made by the preparer that more deductions should be claimed. These suggestions should be fully explained. If each deduction claimed is the same amount furnished to the preparer by the client, obtain documents and statements concerning the amounts claimed. If the amount claimed is different than that which was furnished to the preparer, obtain the client's explanation. If the client knew that an excessive amount was claimed, determine why he/she permitted it, and if the client was unaware of the actual amount claimed, how it escaped his/her attention. The circumstances surrounding the client's execution of the return, include: was the return signed before or after it was completed; if the return was completed before the client signed it, did the client review the contents, and how did excessive amounts escape him/her. Did the client know a refund was claimed? If so, how much was the refund? (Some preparers have claimed significantly higher refunds and kept the difference without the client's knowledge.) Why the client believed he/she was to receive a refund. The client's literacy, knowledge, or training in tax matters. The amount of the preparer's fee and whether the fee was based on the amount of the refund to be obtained. Where the refund check was to be mailed/deposited; if to the preparer's address/account, why? Did the client cash the refund check? Obtain a full statement (who, what, where, etc.) relative to the cashing of the check. If it was cashed by the preparer, determine if the preparer took a fee from the proceeds and if possession of the check by the preparer was used to coerce payment of an exorbitant fee? Did the preparer endorse the client's name to the check? If so, did the client authorize it? The items above should assist in the preparation of an outline for preparer and client interviews. Other pertinent questions may be necessary to meet the facts of each case and follow-up questions may arise as the interview proceeds. If possible, during the preparer interview, obtain copies of: Any memorandums or notes made during interviews with clients, Any memorandums, documents, and data furnished to the preparer by the client for use in preparing the client's return, Any list of fees charged, list of clients, retained copies of returns filed, or other pertinent material that the preparer maintains. The preparer's employees should be interviewed to establish procedures for the preparation of returns. The outline for the interview of the subject preparer should also be used for all employees preparing returns. Special agents may use IRS Letter 6014 - Notice to Witness in Criminal Investigation of a Return Preparer during subject criminal investigations of a return preparer. IRS Letter 6014 is designed for the precise purpose of contacting client/witnesses. Under no circumstances should the name of the return preparer under investigation be included on the letter. No edits of any kind to the pre-printed language on the Letter 6014 are permitted. Letter 6014 is authorized for use during Return Preparer Program investigations only. Letter 6014 must be approved and issued by the SAC. Special agents should not use possibly legitimate deductions as evidence. Special agents should keep in mind that the clients might be as culpable as the practitioner. Client culpability should be resolved as soon as possible.

# Embezzlement of the Client's Tax Payment

9.5.3.2.6.5 (08-18-2020) Embezzlement of the Client's Tax Payment These are investigations in which the unscrupulous preparer accepts payment for the tax liability of the client at the time the return is prepared but does not file the return or pay the tax. In these investigations, it is recommended that 26 USC 7201 be explored as a possible charge against the preparer. In US vs. Mesheski the court held that such acts involve only the crime of embezzlement under state law and do not come within the definition of attempt to evade or defeat tax. Other courts have disagreed with the US vs. Mesheski conclusion and have found that the defendant intended to cheat not only his/her clients by embezzling their money but also the government by evading the clients' taxes (see US vs. Charles L. O. Edwards).

# Coordination of Criminal Investigations Requiring Compliance Support

9.5.3.2.6.6 (07-08-2024) Coordination of Criminal Investigations Requiring Compliance Support Full development of a refund fraud investigation often requires that audits be conducted on the questionable returns. The civil operating divisions conduct the audits. The PAC Audit program is designed to assist in the identification of witnesses and to determine harm to the government based on client audit results in RPP investigations. SB/SE conducts PAC Audits that include up to 30 face-to-face client audits. Tax Compliance Officers (TCOs) will generally be assigned to conduct the PAC Audits unless the complexity of the issues requires a Revenue Agent (RA) assignment. PAC Audit requests can be submitted for open and discontinued subject investigations and closed primary investigations. If PAC Audits have been requested or initiated during an open criminal investigation, the SA should promptly notify the SB/SE Return Preparer Coordinator if the investigation will be discontinued. The Return Preparer's own returns should not be examined under the umbrella of the PAC. Refund Fraud & Investigative Support also oversees the administration of correspondence audits for return preparer investigations. The primary goals of correspondence audits are to protect IRS tax revenue and assist in the establishment of relevant conduct for the sentencing phase of a criminal investigation. Often, a combination of face to face PAC audits to determine a pattern followed by correspondence audits is effective and will provide optimal use of resources. Criminal Investigation is prohibited from giving advice or direction to the other operating divisions regarding a specific case under examination. It is imperative that special agents not specifically direct the other operating division concerning the selection of taxpayers for civil examination or the degree of substantiation to be required from these individuals. Any such actions could be regarded as overreaching and manipulative and could potentially jeopardize the success of the investigation. These restrictions, however, do not constrain special agents or the attorney for the government from sharing relevant non-grand jury information with the other operating divisions. Further, these restrictions do not preclude CI from providing the other operating divisions with general (non-case specific) criteria for determining which examinations might be criminally referred as long as the purpose is not to influence the civil examination. Special agents or the attorney for the government should not have a role determining what civil penalties are asserted against abusive preparers and/or their clients. In the case of a grand jury investigation, Rule 6(e) of the Federal Rules of Criminal Procedure severely limits the exchange of information derived from the grand jury investigation. The attorney for the government should be consulted for specific guidance. It is permissible for the other operating divisions to share return information and completed RAR with special agents conducting both administrative and grand jury investigations. These civil examinations may identify additional individuals who could become witnesses or subjects. The identification of these individuals may be legally shared with special agents by the other operating divisions. The other operating divisions should only turn over reports once a civil examination is completed. This will avoid the appearance that the special agent is either interfering with or directing the civil examination. In order to enhance compliance in these investigations, it is critical that both civil and criminal remedies be fully pursued. This includes the examination of clients, as well as, criminal prosecution recommendations against promoters, preparers, and clients when warranted. When the individual under audit may be culpable in the refund crime, CT Counsel should be consulted.

# Protection of Civil Statutes

9.5.3.2.6.7 (11-09-2023) Protection of Civil Statutes A determination must be made regarding the protection of the civil statute on QRP/RPP returns where the civil assessment statute is due to expire within the next ten months (see LEM 9.14.4): Controls should be placed on all related returns. On a quarterly basis, RFIS will notify the field office of all returns with approaching assessment statute expirations. Appropriate controls must be established for notification to occur.

# Notification of the Office of Professional Responsibility

9.5.3.2.7 (08-18-2020) Notification of the Office of Professional Responsibility If a return preparer investigation involves attorneys, CPAs or enrolled agents, the OPR is to be notified regarding the misconduct as soon as practical without compromising the criminal investigation or prosecution (see IRM 9.5.13, Civil Considerations).

# Notification of the Office of the Treasury Inspector General for Tax Administration (TIGTA)

9.5.3.2.8 (08-18-2020) Notification of the Office of the Treasury Inspector General for Tax Administration (TIGTA) If information is developed which involves allegations of employee misconduct or an attempt to corrupt an employee, CI personnel are required to immediately report the matter to the nearest Treasury Inspector General for TIGTA office. The TIGTA office will be responsible for providing the information to OPR.

# Frivolous Filer/Non-Filer Initiative

9.5.3.2.9 (11-09-2023) Frivolous Filer/Non-Filer Initiative Criminal Investigation is an active participant in national projects aimed at identifying and prosecuting the most flagrant frivolous filers/non-filers. These projects include individuals who object or refuse to file returns, pay income taxes, and/or withhold employment taxes. Criminal Investigation pursues the most egregious, high profile, high impact frivolous filers/non-filers. Areas to consider when numbering an investigation are: Education, Level of sophistication, Reasonableness of the subject's beliefs, Professional advice received. Criminal Investigation is also active in the development of criteria for identifying potential fraud referrals from the Repeat Non-filers Project. This initiative examines the specific market segments of repeat non-filers and establishes a tracking system to better evaluate subsequent compliance efforts. In every frivolous filer/non-filer investigation, it is important to determine if the subject has corresponded with the IRS and what response, if any, they received. The following actions should be taken: Interview the referring agent/officer to determine if frivolous correspondence was received and if a response was issued. Contact the program analyst in charge of the program at the Frivolous Filer Refund Crimes Unit, Ogden RFIS office. Contact the local disclosure officer and request the EDMIS be queried for FOIA requests filed by the subject. The EDMIS will contain a record of all FOIA request and where the requests was filed. If frivolous correspondence is received subsequent to the initiation of a criminal investigation and the frivolous correspondence unit of disclosure has not previously responded, it is the field office's decision as to whether a response is appropriate. CT Counsel should be contacted when drafting responses to frivolous correspondence. Per IRS RRA of 1998, Section 3707, officers and employees of the IRS are prohibited from utilizing designations that might stigmatize an individual.

# Ogden Compliance Campus

9.5.3.2.9.1 (11-09-2023) Ogden Compliance Campus IRS has centralized its frivolous return program at the Ogden Compliance Campus. All frivolous correspondence is being forwarded to Ogden for processing in accordance with the procedures set forth in IRM 4.19, Liability Determination. Generally, upon receipt of frivolous correspondence, the Frivolous Return Program (FRP) Unit will send Letter 3175 (SC) (2-1999). The unit will also include Publication 2105, Why Do I Have To Pay Taxes?. The letter and publication explain the basis for the individual's duty to file returns and pay taxes and warn of the criminal and civil sanctions that can result from failing to comply with the tax laws. If the individual fails to heed this advice, no further L 3175 letters are sent. When an individual files a frivolous return, the FRP Unit will send the individual letter 3176 (SC) (08-2007) admonishing the individual that the information they have sent is frivolous and their position has no basis in law. The letter also warns the individual that a civil penalty of $5000 will be assessed if a corrected return is not filed or the filer fails to rescind their position within 30-days. A copy of Publication 2105, Why Do I Have To Pay Taxes? is also provided. In corresponding with frivolous filers/non-filers, the IRS has adopted the approach of giving the individual fair warning that their actions are illegal, but refusing to engage in an "ongoing dialogue with the individual about the legality of the tax system." The centralization of the FRP Unit at the Ogden Compliance Campus did not occur until FY 2001; therefore, the handling of frivolous correspondence may not have been consistent during the IRS reorganization. The FRP Unit generally does not maintain copies of most frivolous correspondence received, due to the sheer volume of documents. The FRP Unit will scan the first piece of mail received to substantiate the L3175. If frivolous correspondence is received regarding Bonds, Forms 1096/1099, Accepted for Value, Form 56, Bill of Exchange, Money Order, or Promissory Note, the FRP will input them into the FRP Master Database and send originals to the Data Processing Center. All other frivolous correspondence will be added to the FRP Database and the original will be destroyed. Inquiries should be made to the program analyst in charge of the program at the Refund Crimes Unit, Ogden RFIS office.

# Illegal Source Income Program

9.5.3.3 (08-18-2020) Illegal Source Income Program The illegal source income program encompasses a broad range of illegal activity, exclusive of those investigations meeting the criteria of the narcotics program. These investigations are often conducted in conjunction with other Federal, state, and/or local enforcement agencies. These priority areas include: Bankruptcy -- investigations involving embezzlement, abuse, misappropriation, or deception in bankruptcy proceedings. Financial Institution Fraud -- investigations involving fraud against or related to a bank, credit union, savings bank, check cashing business, thrift, stockbroker, or related regulatory agency. Entitlement and Subsidy Fraud -- investigations involving embezzlement, abuse, misappropriation, or deception in various government sponsored programs. Health Care Fraud -- investigations involving embezzlement, abuse, misappropriation, or deception by or from the health care industry (provider, supplier, or broker). Insurance Fraud -- investigations involving embezzlement, abuse, misappropriation, or deception against the insurance industry that is not related to health care insurance. Pension Fraud -- investigations of embezzlement or abuse of pension funds. Public Corruption -- investigations involving violations of the public trust by government officials or employee. Telemarketing Fraud -- investigations involving the use of telephonic or wire communications to fraudulently promote, solicit, or market products or services. Organized Crime/Strike Force -- investigations involving specific organized crime elements. These investigations may be investigated as part of an organized crime strike force (see IRM 9.4.13, Financial Investigative Task Forces). Identity Theft – CI investigates and recommends prosecution under 18 USC 1028 in tandem with the investigation of substantive tax and money laundering violations emanating from refund fraud and money laundering schemes. Identity theft violations should only be utilized when it enhances the overall investigative strategy. Fictitious Obligations – To the extent the investigative activity involves violations relating to Title 26, CI can investigate and recommend prosecution under Title 18 USC 514. Investigations may involve violations of any or all of the criminal statutes within the jurisdiction of CI, including money laundering and currency crimes.

# Bankruptcy

9.5.3.3.1 (08-18-2020) Bankruptcy The criminal provisions relating to bankruptcy fraud were enacted to preserve honest administration in bankruptcy proceedings and ensure the distribution to creditors of as much of the bankrupt's estate as possible. As IRS may be a major creditor in a bankruptcy proceeding, field offices are authorized to use bankruptcy fraud statutes (18 USC 152, Concealment of Assets, and 18 USC 157, Bankruptcy Fraud) to investigate tax crimes involving bankruptcy. There are special disclosure provisions for a bankruptcy investigation (see IRM 11.3.2, Disclosure to Persons with a Material Interest). The goals of the bankruptcy fraud program are to: Increase voluntary compliance with Federal tax laws through the prosecution of those committing significant tax crimes involving bankruptcy fraud. Enhance the IRS' presence among bankruptcy fraud professionals and practitioners for the dual purpose of increasing compliance and providing contact points to report allegations of criminal conduct. Foster closer cooperation between CI and the other operating divisions in attaining mutual compliance goals. Preferably, bankruptcy fraud will be charged in conjunction with violations of the tax, money laundering, or currency statutes within CI's statutory jurisdiction. In instances where prosecution of these offenses is not practicable, prosecution can be recommended for bankruptcy fraud alone. Bankruptcy fraud prosecutions will be considered tax-related offenses and are subject to review by CT Counsel and DOJ, Tax Division.

# Bankruptcy Investigation Selection

9.5.3.3.1.1 (08-18-2020) Bankruptcy Investigation Selection Investigation selection is critical in accomplishing program goals. The following should be carefully weighed in selecting bankruptcy investigations: Investigations should have a strong tax nexus: the IRS being a major creditor. IRS generated fraud referrals should receive priority (a successful fraud referral program is essential to meeting mutual compliance goals). Employment tax related bankruptcy fraud investigations should be vigorously pursued. Emphasis should be placed on egregious high impact investigations; the estimated tax liability should materially exceed the LEM criteria (see Document 12845, LEM 9.14.1, Criminal Investigation Official Use Only Procedures). The estimated loss due to bankruptcy fraud should equal or exceed a base offense level 14 of the US Sentencing Guidelines. The investigations selected should further the goals of CI's bankruptcy fraud program, the employment tax initiative, and the fraud referral program. Note: In bankruptcy fraud investigations, collection function records should be re- searched for potentially false Forms 433A, Forms 433B, or offers in compromise. If assets were concealed in the bankruptcy, it is very likely that the same assets were omitted from Forms 433A and/or 433B (resulting in potential 26 USC 7206 (1) charges).

# Financial Institution Fraud

9.5.3.3.2 (08-18-2020) Financial Institution Fraud Criminal Investigation's compliance effort in financial institution fraud is designed to address criminal violations involving fraud relative to banks, savings and loan associations, credit unions, and other financial institutions such as check-cashing businesses, stockbrokers, and thrifts. Criminal tax, money laundering and currency investigations make major contributions to the Federal government's effort to combat the various fraudulent schemes being committed against financial institutions. For CI, these investigations focus on unreported income or the illegal laundering of income obtained by violators operating inside and outside the financial institution. See IRM 1.2.2, Del Order 9-2 (formerly DO-158, Rev. 2) and IRM 1.2.2, Del Order 25-5 (formerly DO-143 Rev. 6) for authority to initiate investigations of financial institutions.

# Entitlement Fraud

9.5.3.3.3 (08-18-2020) Entitlement Fraud Entitlement is a legal right to benefits, income, or property, which may not be abridged without due process. In some instances, in order to establish the entitlement, citizenship is not required, only residency in the United States. Various Federal agencies manage entitlement programs, which may be administered through corresponding or related state agencies. The respective Federal agencies have been empowered through legislation to establish rules and regulations concerning the methodology and procedures for setting qualifying and/or quantifying eligibility standards in order to provide recipients economic assistance or relief with financial hardships. The applicant bears the burden of proving his/her entitlement to a subsidy. The applicant must usually comply with any procedural restrictions or qualifications. The award of assistance is not discretionary. It is a matter of entitlement once the applicant has demonstrated his/her eligibility for economic subsidy or assistance. Accordingly, proof of entitlement to an economic benefit does not include proving the validity of the doctrines or beliefs of the applicant. Most Federal agencies have their own OIG, which oversees and investigates civil misuse and criminal abuse of their respective entitlement programs. Criminal Investigation's involvement in entitlement fraud is based on fraudulent undue economic enrichment from these programs. Tax and/or money laundering charges may be applicable. Criminal Investigation may investigate these economic crimes with or without the respective OIG's assistance. The respective agency's OIG can provide valuable information regarding their entitlement program requirements and qualifications. A few of the larger, non-health care, entitlement programs are listed below: USDA - Usually administered through state welfare agencies, USDA funds Food Stamp, WIC and other programs for economically disadvantaged individuals and families. HUD - Guaranteed loans and low income housing programs. SBA - Business related loans. The SBA and the IRS entered into an agreement to ensure that IRS enforcement action will not unnecessarily reduce SBA's potential recovery. The agreement is limited to FICA and withholding tax liabilities and covers all types of SBA loans: Direct, Participation, and Guaranteed. SSA - Social Security & Disability benefits, along with identity fraud related misuse of Social Security Cards. VA - Guaranteed loans, services and benefits.

# Health Care Fraud

9.5.3.3.4 (08-18-2020) Health Care Fraud The cost of health care, especially Medicare and Medicaid, has focused attention on the fraud and abuse taking place in the health care industry. Many health care insurers operate independently without compatible data processing systems. This limits cooperative efforts among insurers and contributes to the problem of health care fraud. So, a fraudulent scheme discovered in one jurisdiction may well continue to operate undetected in other jurisdictions. While most health care fraud is investigated by the FBI, Health and Human Services, and the US Postal Service as mail fraud violations, CI frequently investigates them as income tax or money laundering violations. Headquarters keeps apprised of changes in the health care industry and of significant investigations through participation in the National Health Care Anti- Fraud Association and various fraud working groups. At the field office level, many investigations are developed through participation in the DOJ mandated Health Care Task Forces.

# Issues in Health Care Fraud

9.5.3.3.5 (08-18-2020) Issues in Health Care Fraud Traditionally, processing health care claims and disbursing funds to health care providers is cumbersome and paper intensive. Innovative methods to process and pay claims electronically to reduce costs and increase productivity at the Federal, state, and private insurance levels have facilitated fraud, making it difficult for Federal officials to detect. During the course of an investigation involving health care, patient records are often sought by special agents. While there is no recognized privilege in this area, the physician-patient privilege must be addressed. This also applies to patient records for psychotherapy-related matters. The privilege is determined on a case-by-case basis, depending on the judicial district and circuit involved. CT Counsel advice should be sought when patient records are to be requested. The use of the money laundering and forfeiture statutes in health care fraud prosecutions presents unique issues, because health care fraud investigations often involve health care providers that conduct a substantial amount of legitimate business. In such investigations, the legitimate and illegitimate funds are often deposited into the same account. While it is permissible to charge a transaction where proceeds from a specified unlawful activity have been commingled with legitimate funds (18 USC 1956 (a) (1)), special agents should consult with CT Counsel. Special agents do not need to trace the origin of all funds deposited into a bank account to determine exactly which funds were used for what transaction. However, every effort should be made to trace the flow of illegal funds in financial transactions as closely as possible. The Asset Forfeiture Money Laundering Section of the Criminal Division, DOJ, guideline for charging an 18 USC 1956 violation is that more than 50 percent of the money in the commingled account is SUA proceeds. If less than 50 percent of the money in the account is SUA proceeds, then care should be exercised in charging an 18 USC 1956 violation. In such investigations, the special agent should make an effort to carefully trace the flow of the SUA proceeds in the proposed money laundering transactions. The Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191, 110 Stat. 1936, contains a definition of "federal health care offense" in 18 USC 24 and provides for criminal forfeiture under 18 USC 982 for violations of (and conspiracies to commit) such health care fraud offenses. Civil recovery of health care fraud proceeds must generally be accomplished under the money laundering forfeiture statute, 18 USC 981(a) (1) (A).

# Types of Health Care and Insurance Programs

9.5.3.3.5.1 (02-09-2005) Types of Health Care and Insurance Programs Health care expenses are generally paid by: Government entitlement programs, Insurance plans such as plans sponsored by employers through private insurance companies or plans purchased by individuals.

# Health Care Entitlement Programs

9.5.3.3.5.2 (08-18-2020) Health Care Entitlement Programs Medicare and Medicaid account for nearly one-third of the nation's health care spending. Medicare is the federally funded program designed to provide health care insurance to the aged, blind, and disabled. Medicaid is a joint Federal and state-funded health care program that provides subsidized payments for medical services for persons unable to afford them. The states administer the Medicaid program, even though it is funded on a 50-50 basis between the Federal government and the states. Oversight of Medicare and the federally funded portion of Medicaid come within the jurisdiction of the HCFA, which is an agency within the Department of Health and Human Services.

# Fee-For-Service and Capitated Plans

9.5.3.3.5.3 (08-18-2020) Fee-For-Service and Capitated Plans Medical insurance plans make payments to medical providers on a fee-for- service basis, a capitated basis, or a blend of fee-for-service and capitated basis. The major difference between a fee-for-service and a capitated plan (managed care usually by an HMO) is the delivery of and payment for services. In a fee-for-service, profits increase with increased submission of billings for services. Capitated payments are based on a per-patient rate. The medical provider in a capitated HMO plan reaps profits if the cost of services for a patient is less than the allocated payment per patient. The underutilization of services is a significant consideration in the capitated system, while over utilization of services (i.e. over billings) is a concern in the fee-for-service system. There has been a trend toward managed care, or HMOs, in the health care industry. Healthy patients are selecting less costly HMOs versus the traditional fee-for-service plans. Investigators have to concentrate on vulnerable areas of fraud, particularly with the knowledge that the underutilization of services is a concern in this particular industry and provides the opportunity for kickbacks to keep referrals for service to a minimum.

# Insurance Fraud

9.5.3.3.6 (08-18-2020) Insurance Fraud Criminal Investigation's Insurance Fraud Program addresses criminal tax and money laundering violations relative to insurance claims and other frauds perpetrated against insurance companies (exclusive of medical or health care fraud investigations.) Specifically, investigations in this program involve property or casualty insurance, staged or caused accident insurance claims, reinsurance, premium diversion (including Multiple Employer Welfare Arrangements), and worker's compensation insurance. The McCarran-Ferguson Act of 1945 reserves regulation of the insurance industry to the states. As a result, the Federal oversight role of the insurance industry is limited. Regulation of solvency requirements; licensing of insurance companies, agents and brokers; setting policy forms and rates; resolving consumer complaints; and imposing administrative sanctions are just some of the responsibilities of the state authority in the insurance industry. These are generally handled by a state insurance commissioner or department that may have limited resources or lack jurisdiction to effectively confront and prosecute some of the sophisticated fraudulent schemes that have multi-state or international offshore operations. There have been reports by Congress, private organizations, and industry groups that over the last few years insurance company insolvencies are a growing threat to the health of the industry and that fraud is a contributing factor. As there are essentially no Federal agencies or laws regulating the insurance industry, CI plays a role in the investigation of tax and money laundering violations associated with insurance fraud. The primary Federal statutes available to prosecutors to combat insurance fraud are mail and wire fraud and violations of the interstate transportation, money laundering, and tax statutes. As regulated by the states, there are requirements for reserves of assets that are actually determined to ensure that funds are available to cover the claims that occur relative to the types of policies written. Once policies are written that encumber the current level of reserves, additional policies can only be written if additional reserves are obtained through operating profits, returns on investments, or the amount of liability against current reserves is reduced. As a result, the reinsurance industry has emerged as a method for insurance companies to write more insurance policies when current reserves have reached their limit. Reinsurance treaties are simply insurance policies taken out by an insurance company that will pay the principal insurance company for a certain type of claim. Also, some unscrupulous reinsurance companies have used phony letters of credit or other fraudulent assets to qualify for business. Foreign reinsurers have, for the most part, been beyond the reach of state regulators, especially if the reinsurers are domiciled in countries where regulation is weak. Reinsurance frauds are surfacing in many parts of the country and have grown significantly. Frauds involving reinsurance usually have international implications and often involve foreign and domestic trusts. Note: Criminal Investigation can utilize the database of the NAIC as a source of information in fraud investigations.

# Pension and Exempt Organization Fraud

9.5.3.3.7 (08-18-2020) Pension and Exempt Organization Fraud The large amount of money involved in employee plan trust funds and tax exempt organizations provides both a temptation and an opportunity for fraud. The traditional criminal and civil provisions of Title 26 will apply to violations in these areas. The only significant difference may be that instead of a tax deficiency, the element of damage to the government may be established by showing a tax benefit, such as attempting to make taxable income non-taxable or taxable contributions tax deductible. While the DOL is primarily responsible for the Employee Retirement Income Security Act enforcement, the IRS has significant involvement, since qualified employee plans receive favored tax treatment via the deduction of the contribution by the employer, tax exemption for the related trust, and the deferral of income by the employee. These tax advantages can be used in criminal investigations to meet the requirements that a tax be due and owing as described in 26 USC 7201 (Attempt to Evade or Defeat Tax) and that financial damage is attributed to the government as described in 26 USC 7206 (Fraud and False Statements). The Tax Reform Act of 1969 and other tax laws subsequently enacted establish new and more stringent requirements: For recognition as an exempt organization, Expanded information reporting and annual reports, Imposed a new series of excise taxes, Placed substantial restrictions on the permissible activities of an exempt organization. Title 26 USC 6033 requires that every exempt organization, with some exceptions, file an annual return stating specifically the items of gross income, receipts and disbursements and such other information as may be prescribed by the Secretary or appropriate delegate. In addition, 26 USC 6011 requires the filing of certain taxable returns by exempt organizations. These information reports and returns are used to determine whether the submitting organization continues to qualify for favored tax treatment and to report any taxes for which it may be liable. Like the application forms, these reports and returns are subscribed under the penalty of perjury. If an organization ceases to qualify under the provisions of 26 USC 501 or 26 USC 521 for which exemption was granted, its exempt status will be revoked.

# Pension and Exempt Organization Criminal Investigation Selection

9.5.3.3.7.1 (08-18-2020) Pension and Exempt Organization Criminal Investigation Selection Indications of fraud in this program area are typically discovered by the other operating division's examiners or officers and are referred to CI and evaluated in accordance with the IRM 25.1.3, Criminal Referrals.

# Pension or Exempt Organization Allegations

9.5.3.3.7.2 (08-18-2020) Pension or Exempt Organization Allegations When a special agent learns that the subject of an information item or PI is also the subject of an open case in the TEGE, CI will immediately evaluate the information and if warranted, number a SCI. If not, the information item or PI will be closed and all applicable information will be forwarded to the appropriate operating division in accordance with established procedures (see IRM 9.4.1, Investigation Initiation and IRM 9.5.14, Closing Procedures). The Form 3949 Information Report Referral, along with all pertinent information regarding the subject, will be transmitted to Refund Crimes HQ. Criminal Investigation's transmittal memorandum to the other operating division with the open case will advise the operating division that information CI obtained is being referred for association with their open case. No suggestions, guidance, or direction is to be provided by CI as to actions to be taken by the receiving operating division. This is a precaution against the use, or perceived use, of this provision for developing a criminal investigation under the guise of a civil proceeding.

# Pension Fraud Schemes

9.5.3.3.7.3 (02-09-2005) Pension Fraud Schemes Some of the more common fraudulent schemes and devices used in employee plan investigations are: Backdating of applications and related documents, Diversion of funds by officials of exempt organizations or by trustees of employee plans, Payment of improper expenses of exempt organization and trust officials, Loans of trust funds disguised as purchases or allowable deductions, Intentional failure to keep proper or accurate financial records, Disguising taxable receipts (interest and dividends) as non-taxable receipts, Making false statements on applications, Providing false receipts to donors by exempt organizations, Willful and intentional failure to implement and comply with those plan amendments which were agreed to during the review of the determination letter application, Placing friends, relatives, or associates on a company payroll when they perform no duties, Failure to pay over or deposit payroll deductions or the employer contributions to pension plans, Under funding pension plans or obtaining minimum funding waivers, Excessive tax deductions for pension plan contributions.

# Pension Fraud Investigation

9.5.3.3.7.4 (02-09-2005) Pension Fraud Investigation Title 26 USC 7206(1), Declaration under Penalties of Perjury, is the criminal provision which will probably be the most useful in the employee plans and exempt organizations area. This section makes it a felony for anyone to willfully subscribe to a return or other document made subject to penalties of perjury, which is not believed to be true and correct as to every material matter. This provision also applies to documents other than tax returns, and a prima facie violation of 26 USC 7206(1) can be proven even in the absence of a tax deficiency. Forms filed with the IRS in connection with employee plans and exempt organizations contain a declaration that they are made subject to the penalties of perjury. Additionally, the declaration includes a statement that supporting documents are certified as being true and correct and this certification is subject to the same penalty. Thus, filing an application for a determination letter containing false statements, submitting falsified documents in support of such an application, or submitting a falsified annual return for an employee plan or exempt organization would give rise to a potential 26 USC 7206(1) prosecution if the falsifications are shown to be willful and material. Filing of a false application for a determination letter, minimum funding waiver, annual return, or registration statement can also be an affirmative act leading to tax evasion proscribed by 26 USC 7201 (Attempt to Evade or Defeat Tax). To prove tax evasion, the government must show a tax deficiency, affirmative acts to evade assessment or payment of tax, and willfulness. Willful failure to file annual returns, registration statements, or actuarial statements can be a criminal violation of 26 USC 7203 (Willful Failure to File Return, Supply Information, or Pay Tax).

# Public Corruption

9.5.3.3.8 (02-09-2005) Public Corruption Criminal Investigation participates in numerous investigations involving individuals who have violated the public trust. The subjects of these investigations are persons from all levels of government - local, county, state, Federal, and foreign. Public corruption investigations involve a variety of offenses including bribery, extortion, embezzlement, kickbacks, money laundering, and tax fraud. Criminal Investigation generally investigates the tax and money laundering aspects in conjunction with other law enforcement agencies.

# Telemarketing Fraud

9.5.3.3.9 (08-18-2020) Telemarketing Fraud Telemarketing fraud is one of the largest segments of consumer fraud. The development of advanced telecommunication networks expanded the abilities of telemarketers, and a corresponding increase in complaints alleging fraudulent schemes has been reported in all 50 states. Statistical data from the Federal Trade Commission and American Association of Retired Persons shows that 56 percent of telemarketing victims surveyed were age 50 or older. Criminal Investigation is combating telemarketing fraud by conducting investigations of the major schemes in conjunction with multi-agency task forces. Criminal Investigation brings a financial expertise to these investigations that are critical to their success. Criminal Investigation has been granted access to the FTC fraudulent complaint system via Consumer Sentinel Network. Consumer Sentinel is an investigative cyber tool that provides members of the Consumer Sentinel Network with access to millions of consumer complaints. Consumer Sentinel includes complaints about: Identity Theft; Do-Not-Call Registry violations; Computers, the Internet, and Online Auctions; Telemarketing Scams; Advance-fee Loans and Credit Scams; Immigration Services; Sweepstakes, Lotteries, and Prizes; Business Opportunities and Work-at-Home Schemes; Health and Weight Loss Products; and Debt Collection, Credit Reports, and Financial Matters. IRS-CI employees may request access to FTC Consumer Sentinel through the Refund Crimes Organizational Administrator. Details' regarding registration to the FTC Sentinel Network is located in CI's Document Manager, which includes IRS-CI's current organizational contact for the application, and questions surrounding access. Sometimes, 26 USC 7211 proves to be an effective tool in plea bargain negotiations to obtain the cooperation of minor players in illegal telemarketing operations. This statute may be utilized where a prize is promised upon payment of the related tax and makes it a crime for anyone to solicit payment for the sale or lease of an article and falsely state, orally or in writing, that any part of the payment, both sale or lease, is to pay Federal tax.

# Organized Crime

9.5.3.3.10 (11-09-2023) Organized Crime Organized crime refers to self-perpetuating, structured, and disciplined associations of individuals who combine for the purpose of obtaining monetary or commercial gains or profits, either wholly or in part, by illegal means. These groups traditionally have a strong leader to whom group members and associates owe loyalty and to whom they pay a percentage of their profits. These groups generally engage in illegal enterprises such as drug trafficking, gambling, loan sharking, extortion, theft, arson, labor racketeering, pornography, prostitution, white collar crimes of all descriptions, and money laundering. They usually employ extortion, bribery corruption and violence to achieve their objectives. IRS:CI, in conjunction with other Federal, state and local law enforcement agencies, pursues tax, currency, and money laundering investigations of organized crime groups. For additional information see IRM 9.4.13, Financial Investigative Task Forces. Transnational Organized Crime (TOC) is defined as a self-perpetuating association of individuals who operate transnationally for the purpose of obtaining power, influence, monetary and/or commercial gains, wholly or in part by illegal means. TOCs protect their activities through a pattern of corruption and/or violence, or through a transnational organizational structure and the exploitation of transnational commerce or communication mechanisms. Moreover, terrorists and insurgents increasingly are turning to TOC to generate funding and acquire logistical support to carry out their violent acts. Transnational Criminal Organization (TCO) is defined as groups of persons that a) include one or more foreign persons; b) threaten the national security, foreign policy, or economy of the United States; and c) engage in an ongoing pattern of serious criminal activity involving the jurisdictions of at least two foreign states, or one foreign state and the United States.

# Identity Fraud

9.5.3.3.11 (02-09-2005) Identity Fraud Title 18 USC 1028 can be investigated in conjunction with refund fraud and money laundering investigations. Identity theft should only be utilized when it enhances the overall investigative strategy. Title 18 USC 1028 violation is not intended to stand alone.

# Tax Investigations Involving Identity Theft

9.5.3.3.11.1 (08-18-2020) Tax Investigations Involving Identity Theft An identity fraud violation could be applicable where a subject steals another person's identity for the purpose of falsely representing their identity to the IRS. The issue is most likely to occur in the QRP area where individual identities are stolen with the intent to file false tax returns claiming tax refunds. In such investigations, the individuals who steal the identities may be different from the individuals who actually file the tax returns and ultimately obtain the false refunds. In some instances, the investigation may be unable to develop sufficient evidence to sustain a criminal prosecution for substantive tax or conspiracy charges against the supplier of the false identities. In these instance, Title 18 USC 1028 could be charged against those individuals when the evidence of substantive tax or conspiracy violations falls short of the required threshold to sustain a criminal prosecution. The identity fraud must have a direct link to the substantive tax or the related conspiracy violation that is the focus of the criminal investigation. Therefore, it should be a rare exception that identity theft is charged without a companion substantive tax or related conspiracy violation. Per DOJ Directive 128, Charging Mail Fraud, Wire Fraud, or Bank Fraud Alone or as Predicate Offenses In Cases Involving Tax Administration, criminal and civil forfeiture provisions are not applicable when 18 USC 1028 violations are directly linked to the investigation of a substantive tax charge, absent extraordinary and compelling circumstances. The special agent should seek the advice of CT Counsel if forfeiture is being considered. If directly linked to substantive tax violations, prosecution recommendations will be reviewed in the same manner as traditional tax investigations to assure appropriate application and favorable prosecution potential.

# Money Laundering Investigations Involving Identity Theft

9.5.3.3.11.2 (08-18-2020) Money Laundering Investigations Involving Identity Theft Title 18 USC 1028 also impacts CI's investigative jurisdiction under the money laundering laws. IRS has explicit jurisdiction with regard to 18 USC 1956 and 1957. Title 18 USC 1956(e) and 1957(e) specifically grants investigative jurisdiction to "such components of the Department of the Treasury as the Secretary of the Treasury may direct." IRS jurisdiction is further set forth in a Memorandum of Understanding between the Attorney General, Secretary of the Treasury, and Postmaster General dated August 1990 and revised in 1994. The money laundering laws criminalize activity involving the transacting of proceeds derived from "specified unlawful activity" in a subsequent financial transaction. Title 18 USC 1956(c) (7) (A) defines the term "specified unlawful activity" (SUA) as any act or activity constituting an offense listed in 18 USC 1961(1). Title 18 USC 1961(1) defines racketeering activity and includes 18 USC 1028. Note: Converting a pure tax administrative investigation to a money laundering investigation is contrary to DOJ policy. Title 18 USC 1028 violations can be charged in conjunction with money laundering violations or separately if there is insufficient evidence to support a money laundering charge. For example, when investigating potential money laundering violations involving a health care fraud scheme, if evidence of an 18 USC 1028 violation is developed, an 18 USC 1028 charge may be brought in conjunction with the substantive money laundering violation. However, if money laundering violations cannot be proven, it does not preclude 18 USC 1028 from being recommended against the supplier of the fraudulent identities when no financial nexus exists to the underlying fraud scheme. Civil and criminal forfeiture provisions may be applicable in money laundering violations involving 18 USC 1028.

# Fictitious Obligations

9.5.3.3.12 (07-08-2024) Fictitious Obligations Schemes involving the submission of sight drafts, bills of exchange and other fictitious financial instruments to the IRS and other government agencies are a continuing problem. To the extent the criminal activity involves violations relating to Title 26, CI can investigate and recommend prosecution under 18 USC 514 (Fictitious Obligations). RFIS, in cooperation with the Frivolous Return Processing sections at the campuses and the OCC, issue fraud alerts when schemes are detected. Fictitious obligations prosecution recommendations will be reviewed in the same manner as a traditional tax investigation to ensure appropriate application and favorable prosecution potential.

# Narcotics Strategy

9.5.3.4 (11-09-2023) Narcotics Strategy IRS:CI investigates leaders and other top echelon members of high-level drug trafficking organizations, including business and financial associates, and the orchestration of financial activities directing the transportation, distribution, and laundering of illegal drug proceeds. Narcotics investigations include the pursuit of criminal tax, currency, and/or money laundering charges. Within the narcotics program, there are five sub-programs: OCDETF — Investigations involving members of high-level drug trafficking organizations authorized by a regional multi-agency OCDETF committee. The OCDETF designated standards and criteria are set forth in LEM 9.4.13. HIDTA — Co-located multi-agency investigations involving organizations or individuals involved in narcotics trafficking or narcotics money laundering (worked through the HIDTA program of the ONDCP). HIDTA/OCDETF — Investigations worked jointly through OCDETF. Narcotics Other — Investigations involving financial activities of significant individuals or entities who direct the transportation, distribution, and laundering of illegal drug proceeds. Terrorism/OCDETF – OCDETF investigation with ties to terrorism. Narcotics investigations are often investigated through joint investigative task forces such as OCDETF and HIDTA. (See IRM 9.4.13, Financial Investigative Task Force.) Money laundering and currency violations are discussed in IRM 9.5.5, Money Laundering and Currency Crimes. Schemes are also detailed in subsection 9.5.3.3.

# Money Laundering Strategy

9.5.3.4.1 (11-09-2023) Money Laundering Strategy IRS:CI plays an active role in the implementation of the National Money Laundering Strategy (NMLS). The NMLS is the blueprint for the Federal government's comprehensive effort to aggressively combat money laundering. Money laundering techniques are not only employed by criminals to divert illicit funds into legitimate enterprises but are often used to facilitate tax evasion by making possible the movement of untaxed funds through the world's financial systems. Money laundering and currency crimes are discussed in IRM 9.5.5, Money Laundering and Currency Crimes. IRS:CI's mission is to identify and prosecute the most significant tax, currency, and money laundering offenders and to pursue the assets of those offenders both domestically and internationally. Investigative efforts are designed to use the broad authority of the statutes (criminal, tax, and forfeiture) within IRS:CI's investigative jurisdiction. Investigations may be developed and investigated through joint task force efforts (see IRM 9.4.13, Financial Investigative Task Force).

# International Strategy

9.5.3.4.2 (11-09-2023) International Strategy In order to accomplish its mission, IRS:CI has developed an international strategy. International efforts include: Assignment of special agents to strategic foreign posts to facilitate the development and use of information obtained in host foreign nations. Coordination of requests from information from foreign countries. Coordinate foreign travel requests. Coordinate Simultaneous Criminal Investigation Program; (see IRM 9.4.2, Sources of Information).

# National Security Strategy

9.5.3.4.3 (11-09-2023) National Security Strategy IRS:CI, in the effort to combat national security threats, provides financial investigative and devoted resources in support of counterintelligence task forces, Counterterrorism taskforces and other national security demands. IRS:CI utilizes all violations within its jurisdiction to combat national security threats. These violations include, tax, money laundering and currency violations. IRS:CI also assists the Treasury Secretary in conducting a global financial war on terrorism, protecting the integrity of the financial system, fighting financial crime, enforcing economic sanctions programs, locating assets for blocking, forfeiture and/or seizure, assisting in the implementation of Executive Orders, and otherwise providing financial investigative expertise as needed by the Secretary, through Treasury's Executive Office for Terrorist Financing and Financial Crimes. In accordance with 18 USC 2332b (f), the Attorney General is the lead investigative authority for counterterrorism investigations. The FBI, as the Attorney General's investigative arm, conducts terrorism investigations through JTTFs. IRS:CI special agents assigned to the JTTF utilize their unique financial investigative skills to investigate terrorist financing and combat international terrorism (see IRM 9.4.13, Financial Investigative Task Force). IRS:CI signed a national Memorandum of Understanding (MOU) with the Federal Bureau of Investigation (FBI) to participate in the National Counterintelligence Task Force (NCITF). Under this MOU IRS:CI will coordinate with member agencies to develop disruption strategies which employ IRS:CI's unique skills and advanced analytical tools to prosecute foreign agents, seize their illicit proceeds, and remove the economic benefits of sanctions evasion and economic piracy through forfeiture. Every Counter Terrorism and Counterintelligence investigation must be classified under the CI Program (CIP) "Terrorism/National Security" or "Terrorism/OCDETF". In addition to the CIP, each case must be further classified under either Fraud Scheme Code (FSC) "Counterintelligence" or "Terrorism". Every JTTF investigation must contain a multi‐agency code "Joint Terrorism Task Force" in addition, to all other multi‐agency codes. Title 18 USC 2339A (Providing Material Support to Terrorist), 18 USC 2339B (Providing Material Support or Resources to Designated Foreign Terrorist Organizations), and 18 USC 2339C (Prohibitions Against the Financing of Terrorism) can be recommended in investigations of terrorism related financial transactions. The authority to recommend prosecution for 18 USC 2339A, 18 USC 2339B, and 18 USC 2339C is intended to support not supplant CI's primary statutory jurisdictions of tax, money laundering and bank secrecy act violations. The USA Patriot Act: (a) amended the Right to Financial Privacy Act, allowing CI to obtain financial institution information and records relative to terrorism in certain circumstances by a "Special Procedures Request" as opposed to obtaining them via subpoena or court order, and (b) created a Patriot Act Section 314 request for obtaining account and transaction information relating to terrorism or money laundering (see IRM 9.4.4, Requests for Information). Sentinel is the FBI's automated system of electronic case files (see IRM 9.4.2, Sources of Information). Sentinel contains investigative information including memoranda of interviews and other records. Sentinel provides for an electronic marking tool that allows for information to be designated as protected by IRC 6103. IRS employees must mark any IRC 6103 material accordingly for proper handling.

# Cyber OCDETF Strategy

9.5.3.4.4 (11-09-2023) Cyber OCDETF Strategy The Cyber‐OCDETF program is a comprehensive strategy to develop Special Agents to investigate, specifically narcotics related investigations attributed to darknet vendors and administrators. Various tools and resources are available through Narcotics and National Security Section, Special Investigative Techniques, and Cyber HQ to assist in the investigative processes. The cyber‐OCDETF strategy will focus on the following threats: Vendors transacting in virtual currency related to the sale or purchase of narcotics. Darknet administrators who knowingly facilitate and profit from online narcotics sales. PTOC or 3PML cases where the subject has been identified as a financial facilitator trading in digital assets as an unlicensed money service business. In June 2021, IRS:CI signed an MOU with the FBI led Joint Criminal Opioid Darknet Enforcement (JCODE) initiative, joining our law enforcement partners focused on targeting organized crime taking place via internet marketplaces. The JCODE team brings together Investigators, Intelligence, Military, U.S.G. contractors, and prosecutors all focused on disrupting and dismantling transnational criminal enterprises operating online. Every investigation related to or coordinated by the JCODE taskforce must utilize the CIMIS Special Purpose Code entitled "JCODE (Joint Criminal Opioid Darknet Enforcement).