9.4.1 Investigation Initiation

Manual Transmittal

July 31, 2020


(1) This transmits revised IRM 9.4.1, Investigation Initiation.

Material Changes

(1) Subsection was added to address the newly created procedures for processing Bank Secrecy Act (BSA) Prime Lead Memorandums (PLM) upon receipt by CI. The subsection further provides guidance for Headquarters (HQ), Financial Crimes to provide quarterly reports to SB/SE to track investigations sourced from BSA-PLMs.

Effect on Other Documents

This IRM supersedes IRM 9.4.1, dated September 26, 2018, Interim Guidance Memorandum for Specialty Examination-BSA, Fraud Policy and Operations and Criminal Investigation Managers and Employees, dated July 26, 1999 and Interim Guidance for Processing Bank Secrecy Act, Prime Lead Memorandums, dated August 21, 2019.



Effective Date


James C. Lee FOR
Don Fort
Chief, Criminal Investigation

Program Scope and Objectives

  1. This section describes the authorized techniques for each of Criminal Investigation’s (CI) types of information collecting activities.


  1. The table lists commonly used acronyms and their definitions:

    Acronyms Definitions
    ASAC Assistant Special Agent in Charge
    BOD Business Operating Division
    BSA Bank Secrecy Act
    CI Criminal Investigation
    CIMIS Criminal Investigation Management Information System
    CTR Currency Transaction Record
    DO Delegation Orders
    ERO Electronic Return Originator
    FEA Fraud Enforcement Advisor
    FIRM Fraudulent Intent Referral Memorandum
    FOIA Freedom of Information Act
    FTA Fraud Technical Advisor
    FTC Foreign Tax Credit
    GI General Investigation
    HIDTA High Intensity Drug Trafficking Area
    HQ Headquarter
    HIFCA High Intensity Financial Crimes Area
    IDRS Integrated Data Retrieval System
    JTTF Joint Terrorism Task Forces
    LEM Law Enforcement Manual
    OFE Office of Fraud Enforcement
    PI Primary Investigation
    PLM Prime Lead Memorandum
    POD Post of Duty
    PSP Planning and Special Programs
    QRP Questionable Refund Program
    RPP Return Preparer Program
    SA Special Agent
    SAC Special Agent in Charge
    SAR Suspicious Activity Report
    SB/SE Small Business/Self-Employed
    SCI Subject Criminal Investigation
    SDC Scheme Development Center
    SSA Supervisory Special Agent
    TC Transition Code
    TIMS Total Inventory Management System
    WO Whistleblower Office


  1. Treasury Order 150–10 delegates the authority to administer and enforce the Internal Revenue laws to the Commissioner of the IRS. Since compliance with the Internal Revenue laws cannot be determined by relying solely upon the information contained on returns and documents filed with the IRS, the IRS will obtain information from other sources. However, only the information necessary for the enforcement and administration of the tax laws which the IRS is authorized and directed to enforce will be sought (see IRS Policy Statement P–1–1).

  2. In order to protect the public from unnecessary intrusion into their private and financial affairs, the IRS has authorized the use of a wide variety of investigative activities and techniques. The circumstances of each investigation will determine which investigative activities or techniques shall be employed.

Activities Not Requiring Authorized Investigations

  1. The following actions may be undertaken to identify an individual or entity, to determine the viability of the information received, without initiating an investigation:

    1. obtaining leads and information from news media (electronic, radio, print, and/or the web)

    2. accessing IRS and other government agency databases

    3. maintaining liaison affiliations with other law enforcement agencies

    4. viewing tax information through the IDRS

    5. interviewing informants

    6. observing a home, office, real estate, or personal property

    7. recording the results of any activity in items a through f


    Special agents working alone or with a multi-agency task force to evaluate financial information for potential money laundering or other non-tax crimes may scrutinize tax return information only after an ex parte order is obtained or a related statute determination is made by the SAC.

  2. In the event that an investigative lead meets the definition of "Agent Generated" , the SA must forward the lead to his/her immediate supervisor for consideration and reassignment. See subsection for the definition of an "Agent Generated" sourced investigation.

  3. As soon as an individual or entity is identified as one who requires further evaluation for potential criminal activity, a PI must be initiated.

General Investigations

  1. A GI is a study, survey, canvassing, or coordination activity related to a group, an activity, or a CI program/sub-program to identify possible noncompliance with the laws enforced by the IRS. General investigations are also used to track SAs time in regard to specialized activities and investigative imprest funds.

  2. A GI normally involves areas of non-compliance for a specific occupation, industry or CI program/sub-program. When the focus shifts from the group to the potential criminal activity of an identified individual or entity, a PI will be initiated. If the information obtained during the PI supports the allegation and the existence of viable prosecution potential, a determination must be made regarding the initiation of a SCI.

  3. If a PI is generated from information developed in a GI, the investigation must be associated in the CIMIS to the GI under which it was developed.

  4. Generally, if a PI is developed independently of the GI, it should not be linked to the GI, even though it may pertain to the same instance(s) of non-compliance being addressed by the GI.

  5. A PI should never be linked to an imprest fund GI or to a GI initiated to track specialized activities.

Ownership of a General Investigation

  1. General Investigation ownership will always be in the field office initiating the investigation.

Initiating a General Investigation

  1. A special agent will initiate a GI to:

    1. Investigate alleged non-compliance within a specific category of individuals. The purpose of investigative GIs is to determine if the allegation warrants investigation of specific individuals and to develop investigative leads to determine which individuals should be investigated.

    2. Coordinate a specific program, sub-program, or enforcement activity. Examples may include QRP/RPP, JTTF, HIDTA, HIFCA, or specialized areas as approved and determined by the SAC.

    3. Monitor and track time allocated obtaining, disbursing, securing, and recording investigative imprest fund related activity. Investigative imprest funds may be used for certain activities related to the investigations. Examples include undercover agent maintenance activities, storefront cover agent and cover team maintenance activities, and special use vehicles such as surveillance vans.

  2. To initiate a GI, the SA must secure approval from the SAC using the appropriate approval chain of command. The SA must submit a memorandum requesting approval and detailing the purpose and scope of the proposed GI. In addition, the SA will enter the required information into the CIMIS database.

  3. A national GI number, 1000284396, for HQ-SIT National Security Cover Agent, will track all activities related to establishing a covert identity for security cover agents and storefront cover agents. Any activity that falls outside of general cover agent activity will be attributed to a related case investigation number.

Purpose of the General Investigation
  1. The purpose of establishing the GI should be stated clearly and should include the allegations, indications of non-compliance, and the overall objectives of the GI.

Effective Management of General Investigations
  1. Field offices need to ensure PIs resulting from a GI are appropriately linked in CIMIS.

  2. Effective management of GIs is vital to field office efficiency. Non-productive GIs drain valuable resources. Field offices will periodically review and evaluate the results and effectiveness of GIs during the investigation review process and close non-productive GIs to free resources for more productive activities.

  3. In evaluating the effectiveness of GIs, the following factors should be considered:

    1. Are the activities commensurate and appropriate with the amount of time being charged?

    2. Were the investigative development activities successful?

    3. Were the objectives of the GI articulated in the opening memorandum achieved?

    4. Are the SAs familiar with the GI’s activity?

    5. Is the GI properly coded (e. g., if the GI involves legal source tax investigations, is the GI coded as a legal income GI)?

    6. Are PIs resulting from the GI? If yes, are the PIs initiated in a timely manner once the subject has been identified?

    7. Are the PIs developed through the GI linked to the GI on CIMIS?

    8. Does the GI duplicate the activities or objectives of other GIs?

    9. Is there still a need for the GI or should it be closed?

  4. The CIMIS database is the primary mechanism for documenting activities conducted under a GI; CIMIS should be utilized to track the progress of and timely evaluation of all GIs.

  5. All GIs will be renewed yearly by the SAC or HQ Director:

    1. A memo will be required at fiscal year-end summarizing the activity and projecting future activity. This will not include specialized GIs, for example, imprest funds.

    2. This review will ensure GIs do not exceed the scope of the original approved opening memo.

Scope of the General Investigation
  1. The scope of the GI should include the following:

    1. an explanation of the types of contacts anticipated outside the IRS as authorized for a GI

    2. a description of the types of information to be gathered, and

    3. the availability of the information/records to be gathered

Approving a General Investigation

  1. The SAC will approve GIs that relate exclusively to his/her field office and involve investigative or coordination activities.

  2. The SAC will approve specialized GIs for imprest funds used to establish and maintain cover identities and cover documents.

  3. The Director, Operations Policy and Support, will approve any GI that is national in scope.

Expansion of an Approved General Investigation

  1. If the original purpose or scope of an approved GI is expanded, the expansion must be in writing and signed by the approving official.

Authorized General Investigation Techniques

  1. In making investigative inquiries that are authorized under a GI, a SA is allowed to disclose the name of an individual associated with a particular group for identification purposes, to the extent necessary to secure information that is relevant and necessary to the investigation. Investigative inquiries are limited in a GI.

Techniques Relating to General Investigations
  1. Additional techniques permitted for investigative GIs include:

    1. Searches within existing IRS records and databases.

    2. Inquiries of Federal, state, and local governmental agencies, including state and local tax authorities.

    3. Contact with the original informant and other informants who are believed to possess pertinent information.

    4. Contact with foreign (tax treaty and other nations) government bodies similar to (b) above. These contacts must be coordinated through HQ with the Director, International Operations.

    5. Surveillance.

    6. Contacts with sources outside the government in a limited capacity, including the name of an individual associated with a particular group for identification purposes only, and only to the extent necessary to secure information that is relevant and necessary to the investigation. All inquiries must be relevant to the investigation.

    7. Form letters, pattern letters, or letters to third parties (formerly circular letters), to persons outside the IRS for information on individuals or entities as long as no individual or entity name is disclosed. (The Paperwork Reduction Act of 1980 may apply to certain letters of this matter.)

Additional Techniques Permitted in Liaison and Sub-Program General Investigations
  1. In addition to the techniques listed above for investigative GIs, certain other techniques are allowed in specific liaison and sub-program GIs. Those techniques are discussed below.

Additional Techniques Relating to Pure Money Laundering General Investigations
  1. Pure money laundering GIs will most likely involve HIFCA task forces and SAR Review Teams, but may also relate to other Financial Investigative Task forces. Internal Revenue Manual (IRM) 9.4.13, Financial Investigative Task Force has more information regarding SAR-Review Teams.

  2. Special agents may contact the participants and institutions identified in a currency report to identify the source, disposition, and nature of the currency transaction.

  3. If a subpoena is used, the subpoena is limited to documents, records, and testimony relating to the scope of the transactions that generated the CTR or SAR. A subpoena should not be used as a means to examine financial transactions beyond the scope of the reported suspicious activity. To subpoena information or records outside the scope of the transaction (i.e., entire account records), the SA must elevate the investigation to SCI status.


    Special agents working alone or with a multi-agency task force to evaluate financial information for potential money laundering, structuring or other non-tax crimes may scrutinize tax return information only after an ex parte order is obtained or a related statute determination is made by the SAC.

Additional Techniques Relating to Questionable Refund Program and Return Preparer Program General Investigations
  1. Each field office maintains a GI related to questionable refund and return preparer schemes (QRP/RPP). The QRP coordinator will be the primary person who charges time to the GI; however, other SAs may also conduct activities relating to the GI.

  2. The SDC reviews and analyzes returns to detect fraudulent refund schemes.

    1. Special agents may respond to requests for assistance from a SDC to provide expeditious support in identifying fraudulent refund schemes. Investigative assistance may include:

      1) Verifying suspicious refund addresses through the use of drive-bys or visual inspection of a potential subject’s home, office, place of employment, post office box, etc.
      2) Determining the validity of the earnings and withholdings reported on the potentially fraudulent returns by contacting employers.
      3) Contacting the United States Postal Service to intercept fraudulent refund checks.
  3. Regarding QRP/RPP GIs, field offices may charge time for the following:

    1. Participation in any activity that fosters voluntary compliance in the QRP/RPP area and encourages return preparers, transmitters or others to contact CI to report a potentially fraudulent scheme. For example, a SA may attend meetings with preparers/EROs to educate them on how to identify suspicious returns.

    2. Meetings with other operating divisions to discuss and coordinate the QRP/RPP programs.

    3. Special agents may interview informants and accept information relating to fraudulent schemes.

  4. Interviews may involve taxpayers, return preparers or EROs who contact the service regarding an individual(s) or business that allegedly files or transmits questionable returns if:

    1. Additional information is needed to confirm the existence of the alleged illegal refund scheme, after the initial contact with the informant, preparer/ERO, the SA may seek additional information necessary to determine whether a fraudulent refund scheme exists.

    2. Firm indications of a fraudulent refund scheme are uncovered, the SA should immediately seek approval to number a PI and follow the guidelines set forth regarding contacts permissible during a PI.

  5. As noted above, under a GI, SAs may make limited third party inquiries about potential QRP/RPP schemes; however, the inquires may only be made to determine criminal potential and to identify persons responsible for the scheme. As soon as these determinations are made, third party contacts must cease until an SCI is initiated.

Techniques Relating to Organized Crime and Drug Enforcement Task Force General Investigations
  1. The IRS receives appropriated funds each year to fund CI participation in OCDETF cases. As a result, SAs should carefully monitor and record all time spent conducting OCDETF activities.

  2. Activities chargeable to an OCDETF GI include liaison and information gathering to determine the potential to join and/or co-sponsor an OCDETF investigation proposal. When such potential exists, a PI or an SCI should be initiated to fully develop the allegation, draft the proposal or conduct investigative activities.

  3. The use of a GI to evaluate proposed OCDETF investigations or to develop the financial component of a specific OCDETF investigation for CI involvement is outside the scope of the OCDETF guidelines. Such activities should occur in a PI or SCI, as appropriate. Accordingly, a GI number is not to be supplied as the IRS case number on OCDETF investigation initiation forms.

Techniques and Activities Relating to High Intensity Drug Trafficking Area General Investigations
  1. The SAC may appoint a coordinator to act as a liaison to the local HIDTA or may assign SAs and/or a SSA to work in a HIDTA initiative. The following activities may be charged to the HIDTA-GI:

    1. liaison activities which ensure appropriate levels of cooperation between CI and the other agencies in the local HIDTA

    2. assisting with open HIDTA investigations and/or prosecutions when CI does not have an open investigation

    3. evaluation and information gathering related to an open non-CI HIDTA investigation being considered as a PI or an SCI

    4. coordinators time spent on general HIDTA duties

Techniques and Activities Relating to Strike Force General Investigations
  1. Field offices where the United States Attorney’s Office is active in the Strike Force/Racketeer program will initiate GIs to track time spent in this area. The program looks for individuals who derive substantial income from illegal activities, and SAs will use the same techniques authorized for an investigative GI.

Lead Development Center

Primary Investigations

  1. A PI is an evaluation of an allegation that an individual or entity is in noncompliance with the laws enforced by IRS and the viability of criminal prosecution.

  2. A PI may also relate to a group of individuals involved in a coordinated scheme whereby the individuals are alleged to be in noncompliance with the laws enforced by the IRS.

  3. A PI can be the parent of more than one SCI. It can also be closed without ever generating an SCI.

Sources of Primary Investigations

  1. Primary investigations may be derived from many sources, including but not limited to:

    1. Information Items and Whistleblowers

    2. Scheme Development Centers

    3. Criminal Fraud Referrals

    4. Grand Jury Evaluation Requests

  2. Special agents and/or other investigative employees may not initiate an investigation and/or investigate any subject(s) he/she has identified as falling within the definition of an "Agent Generated" source:

    1. "Agent Generated" source is defined as information originated as a result of an agent’s direct observation of potential illegal activity. This includes any indication of illegal activity obtained by an agent through a review of public records or through the agent’s observations, which is covered under the Plain View Doctrine. The goal of these procedures is to eliminate any conflicts, actual or apparent, between the agent and the potential subject/target where a direct/indirect relationship could exist.

    2. After the agent and his/her immediate supervisor have decided the investigation falls within the definition of "Agent Generated" , the SAC will be notified.

    3. If the SAC affirms the determination, the SAC will reassign the investigation to another post of duty (POD), before it is opened. If the investigation cannot be reassigned to another POD, due to geographic or other reasons, Director, Field Operations approval will be required for the investigation to remain within the POD.

    4. The originating agent may not assist the investigative team during search warrants, surveillance, or other investigative activities, unless the Director, Field Operations approves such assistance. The Director, Field Operations may consider the lack of personnel in the geographic area in his/her analysis.

Information Items and Whistleblowers
  1. Information which comes to the attention of a CI employee in the field office is typically recorded on a Form 3949, Information Report Referral. See other subsections in IRM Part 9 Chapter 4, Investigative Techniques; IRM Part 9 Chapter 5, The Investigative Process, and IRM Part 9 Chapter 8, Criminal Investigation Scheme Development, for more information concerning information items.

  2. A Form 3949 which has a Form 211, Application for Reward for Original Information, associated with it must be reviewed by the field office within 90 days to decide whether a PI is warranted. If a PI is warranted, it must be numbered within 90 days and linked to the Whistleblower GI# 1000232527 if domestic or GI# 1000259017 if international and Special Purpose Code “Form 211 - Application for Reward for Original Information” must be entered in CIMIS for tracking purposes. Regardless, within 30 working days of receipt, original Forms 211 and copies of forms 3949 or other statements of the alleged violation(s), as well as copies of any related documents provided by the whistleblower, must be mailed to:

    Internal Revenue Service
    Whistleblower Office - ICE
    1973 N. Rulon White Blvd.
    M/S 4110
    Ogden, UT 84404
  3. Information received and associated with a signed Form 211, Application for Reward for Original Information is considered to be whistleblower information. Criminal Investigation’s role in whistleblower cases is to evaluate allegations and ultimately present information that may be used by the IRS-WO in consideration of reward determinations.

  4. Upon receipt of whistleblower information in the field, the following steps should be taken:

    1. Interview the whistleblower using normal procedures and memorialize the contact.

    2. Secure the Form 211 which must contain the whistleblower’s original signature. The WO has to receive the Form 211 prior to the IRS taking action on the information for the whistleblower to be considered for an award under IRC 7623. Special Agents cannot guarantee payment of award.

    3. If the information does not have criminal potential, prepare Form 11369 and Transmittal Closing Memo and forward with attachments to the WOs at the address above, within 90 days of receipt of Form 211. Agents should not under any circumstances refer the information to other civil divisions or prepare a Prime Lead.

    4. If the information does have criminal potential, initiate a PI, within 90 days of receipt of Form 211. The PI should be related to GI# 1000232527 if domestic or GI# 1000259017 if international, and utilize SPC “Form 211 Application for Reward for Original Information”.


      Special agents, who intend to initiate an investigation based on the information provided, must treat whistleblowers as CI and follow the procedures as outlined in IRM

  5. If the PI information warrants elevation to an SCI, investigate allegations.


    Special agents should segregate whistleblower related information within the case file for tracking and evaluation at case conclusion.

  6. At the conclusion of a whistleblower related SCI, using the Whistleblower Transmittal Case Closing Memorandum, forward the SAR or Discontinuance Report, case file (excludingGrand Jury information, criminal histories, and special investigative techniques related information), Forms 11369, 13308, 14104, indictment, plea agreement, J&C, and any documents received from the whistleblower to the WO.

  7. Information items received by a field office deemed to have criminal prosecution potential will be developed by the field office with available resources.

  8. Information items deemed not to have criminal prosecution potential will be marked as such and mailed to the Fresno Campus at:

    Internal Revenue Service
    5045 East Butler Ave.
    Stop C3008
    Fresno, CA 93888.
Scheme Development Center Initiated Primaries
  1. The SDC will initiate refund scheme PIs when the QRP or RPP scheme warrants additional investigation. The RAC approves the PI. Once approved, a copy of the CIMIS “Investigation Profile Report” pertaining to the scheme will be retained in the scheme’s file at the SDC. Upon initiating and approving a PI in CIMIS, the PI will be transferred to the appropriate field office’s SAC office. Notification will be sent to the field office QRP/RPP coordinator. The field office should generally decide within 90 days of receiving a QRP scheme or an RPP scheme whether to elevate the PI to SCI status or to return the scheme to the SDC.

  2. If the SDC identifies accounts related to a scheme, the individuals and/or entities are to be entered into the CIMIS system as associate identities. The field office will be responsible for adding associate identities into the CIMIS system after receipt of the investigation in the field office.

  3. Closed QRP information items or investigations are sent to the field office’s SDC. Closed RPP investigations (both primary and subject) will be forwarded to the SDC.

Criminal Fraud Referrals
  1. Criminal Investigation receives criminal fraud referrals from compliance employees via the Form 2797, Referral Report of Potential Criminal Fraud Cases. A criminal fraud referral is information acquired during a civil examination or a collection proceeding that is provided to CI from another IRS-BOD after affirmative acts (firm indications) of fraud are established and criminal criteria is met. Firm indications are defined in IRM 25.1.1 (see subsection, Indicators of Fraud vs. Affirmative Acts of Fraud).

  2. Criminal fraud referrals fall into two categories, international and domestic.

  3. A criminal fraud referral is considered an international fraud referral if it meets one or more of the following criteria:

    1. A United States taxpayer who resides in a foreign jurisdiction, or is physically present in a foreign country or countries for at least 330 full days during any 12 month consecutive period.

    2. A United States taxpayer (includes individuals, corporations, nonresident aliens) whose business affairs and/or financial transactions substantially occur offshore.

    3. Any taxpayer (includes individuals, corporations, nonresidents aliens) who claims a FTC on a tax return where the credit is directly attributable to suspected tax fraud.

    4. A foreign taxpayer (includes individuals and corporations) engaged in a trade or business in the United States.

    5. Abusive offshore tax transactions in which the promoter or client resides in a foreign jurisdiction. For example, unreported income skimmed from closely held entities or other income streams placed offshore or domestically in nominee names domiciled offshore.

  4. All other fraud referrals not meeting the definition above are considered domestic criminal fraud referrals.

  5. The following items are not criminal fraud referrals:

    1. Armed escort information received from a compliance employee.

    2. Cases under audit at the time CI independently initiates an investigation based on information from another source. These audits will be placed in suspense, but do not qualify as referrals.

  6. The FTA group manager assigns a Management Control Number to each referral and annotates it in the upper right hand corner on the Form 2797. The number is comprised of eight digits. The first digit represents the originating FTA group followed by two digits indicating the fiscal year, a three-digit sequential number (001 will represent the first referral submitted to CI at the start of each fiscal year) and a two digit number representing the civil BOD making the referral.

  7. When there is a common set of facts involving two or more individuals or entities (such as a husband and wife or corporate officer and employees), Compliance will forward one fraud referral with one Management Control Number to CI. Criminal Investigation will number one PI for each Form 2797 regardless of the number of entities discussed in the referral. The SAC or the Director, International Operations approval may grant an exception.

  8. Referrals received without a Management Control Number must be returned to the FTA manager. See the SB/SE web page for names and locations of fraud referral specialist managers.

  9. In order to facilitate consistency, each field office will designate an employee to be responsible for receipt and tracking of both international and domestic fraud referrals (Fraud Referral Coordinator). This employee will be responsible for:

    1. maintaining a record of the status of fraud referrals received by the field office

    2. ensuring primary numbers are obtained timely and that the Management Control Number and referring BOD are properly entered into CIMIS

    3. assisting the SAC in tracking due dates and extensions

    4. ensuring SCI numbers are obtained timely for accepted referrals

    5. maintaining the field office TIMS folders for documents relating to the fraud referral program including all Forms 2797, Referral Declination Memorandums and Requests for Extensions

    6. tracking fraud awareness presentations

Fraud Referral Processing
  1. Domestic Fraud Referrals: The FTA Managers send Domestic Fraud Referrals via email to the appropriate CI field office for evaluation. Upon receipt, the SA will immediately initiate a PI. In doing so, the SA will ensure that the investigation is properly coded as a fraud referral and that CIMIS correctly reflects the Management Control Number and the BOD source of the referral. The Management Control Number and source are both listed on the Form 2797. Special agents should only code items received through the FTA manager via a Form 2797 as a fraud referral.

  2. International Fraud Referrals: International fraud referrals conversely are sent to Criminal Investigation, International Operations. Upon receipt, International Operations will initiate a PI and review for criminal potential prior to assigning and disseminating the referral to a field office for evaluation. International Operations is responsible for preliminary analysis and research to assist field offices in their evaluation of international fraud referrals. Within five (5) business days of receipt from the referring business operating division, International Operations will forward international fraud referrals with criminal potential to the appropriate field office, along with relevant research. International Operations will follow the same procedures outlined above when initiating a PI.

10-Day Conference
  1. Domestic Fraud Referrals: The SA will arrange the initial conference with the referring compliance employee to discuss the merits of the criminal fraud. The initial conference must be scheduled and occur within 10 business days from the field office’s receipt of the referral. The conference attendees should include the SA, SSA, referring compliance employee, his/her immediate supervisor, and FTA (if available).

  2. International Fraud Referrals: International Operations will arrange the initial conference for international fraud referrals, with the referring compliance employee to discuss the merits of the international criminal fraud referral. The initial conference must be scheduled and occur within 10 business days from the field office’s receipt of the referral. The conference attendees should include the SA, SSA, referring compliance employee, his/her immediate supervisor, FTA (if available), a member of International Operations, and the appropriate attaché (if available).

  3. During the 10-day conference, the compliance employee will discuss the referral and related tax returns, evidence gathered in support of the alleged offense, criminal tax computations, etc. The conference should also include a discussion of the following issues:

    1. Whether:
      i. Returns were solicited,
      ii. Attempts were made to resolve the civil issues, or
      iii. IRS took prior actions involving the alleged offense or similar/past offense.

    2. Observations regarding Taxpayers’:
      I. Age
      ii. Health (mental and physical)
      iii. Education
      iv. Occupation

    3. Availability of records (domestic and international)

Evaluation Period
  1. It is imperative that SAs give immediate attention to all fraud referrals. The field office must decide whether to elevate the fraud referral PI to a SCI or to decline the referral and return it to the originating BOD within thirty(30) business days of receipt of domestic fraud referrals or sixty (60) business days for international fraud referrals. Since international investigations typically involve complex issues, SAs are given an additional 30 days to evaluate an international fraud referral.

  2. Special agents can request an extension of the evaluation period. Extensions must be made by written agreement between the field office and the designated Territory manager. The agreement should specify the reason for the request (such as a delay in receiving tax returns or an opinion from Counsel) and the date the referring office may expect a final determination. If an extension is granted, the extension must be annotated in the comment section of the CIMIS section entitled, Plan of Significant Actions. The comments should include relevant information such as the extension request date, approval date, the length of extension and the reason for the extension. In addition, the due date in CIMIS must be updated.

Accepted Fraud Referral Processing
  1. If CI accepts the referral, the PI will be elevated to an SCI. Criminal Investigation will provide feedback to compliance by completing sections 1c, 9, 10, 11a, 11b, 11c, and 11d on the Form 2797 and return it to the FTA manager.

  2. The SA will place TC 914 controls in the Master File.

  3. The SA will promptly meet with the referring compliance employee to devise a plan of action and to determine:

    1. the need for a cooperating compliance employee,

    2. which tax returns are to be transferred to CI, and

    3. whether detailed memoranda are required from the referring BOD concerning contacts with the taxpayer(s) under criminal investigation, his/her/their representative(s) or the preparer(s) of the related tax returns

Declined Fraud Referral Processing
  1. If CI declines the referral, the SA will complete a memorandum to the referring BOD listing the reasons for declination. The SA will complete sections 9, 10, 11a, 11b, 11c, and 11d of the Form 2797, return it to the FTA manager with the declination memorandum, and arrange for a disposition conference. The conference attendees should include the SA, SSA, referring compliance employee, his/her immediate supervisor, FTA (if available), a member of International Operations (if necessary), and Criminal Tax Counsel (if warranted to explain any legal impediments).

  2. If International Operations deems the international fraud referral lacks criminal potential, International Operations will complete the declination memorandum in lieu of forwarding the fraud referral to the field office.

  3. Under certain circumstances, the referring BOD may request an appeal of a declined fraud referral as outlined in IRM 25.1.3 (see subsection, Declined Criminal Referrals). Criminal Investigation must be able to justify and clearly articulate the reasons for a referral’s declination.

Grand Jury Evaluation Requests
  1. Requests from the US Attorney’s Office for IRS participation in grand jury investigations will be numbered as PIs.

Direct Referrals - Prime Leads
  1. An information item or group of information items received in CI that lack criminal potential may be referred to the other operating divisions, with the exception of information items that involve a Form 211 (Whistleblowers). Whistleblower information cannot be forwarded to other operating divisions. If the information involves a whistleblower and lacks criminal potential, the information must be returned to the WO.

    Internal Revenue Service
    Whistleblower Office – ICE
    1973 N. Rulon White Blvd.
    M/S 4110
    Ogden, UT 84404
  2. When there is a firm indication of substantial civil tax potential, the field office will recommend a direct referral to the other operating divisions in the form of a prime lead. The completed and approved prime lead referral form will be sent from the field office to their local SB/SE Division’s PSP office. Each field office will send the prime leads to the PSP office indicated in the PSP chart listed below. Each field office will also designate an individual to ensure that CIMIS and IDRS databases have been checked on all prime leads before they are forwarded. The CIMIS will be checked to ensure that CI activities were closed and IDRS will be checked to ensure that account controls (e.g., TCs 914) have been removed. Only items that have previously been numbered as a primary will be sent as a prime lead. Criminal Investigation will send all the information used to evaluate the referral after redacting any grand jury information, SARs, records of criminal history, or other restricted material.


    Primary investigations on return preparers should not be designated as prime leads and should be sent to the area return preparer coordinator through the SDC.

    Planning and Special Programs
    New York,
    North Atlantic
    (Connecticut, Maine, Massachusetts, New Hampshire, New Jersey,
    New York, Rhode Island, Vermont)
    Internal Revenue Service
    PSP, Stop 41175
    15 New Sudbury St.
    Boston, MA 02203
    Baltimore, Cincinnati, Detroit, Philadelphia, Pittsburgh Nashville – (Kentucky) Nashville - (Arkansas, Tennessee) Central
    (Delaware, District of Columbia, Indiana, Kentucky, Maryland, Ohio, Pennsylvania, Tennessee, West Virginia)
    Internal Revenue Service
    PSP, RM 5226
    600 Arch Street
    Philadelphia, PA 19106
    South Atlantic
    (Florida, Georgia,
    North Carolina,
    South Carolina, Virginia)
    Internal Revenue Service Room 310, Stop 4010
    7850 SW 6th Court Plantation, FL 33324
    St. Louis,
    St. Paul
    (Illinois, Iowa, Kansas, Michigan, Minnesota, Missouri, Nebraska, North Dakota, South Dakota, Wisconsin)
    Internal Revenue Service
    Attn: PSP, Stop 4032-
    30 East 7th Street
    Wells Fargo Place
    St. Paul, MN 55101
    New Orleans,
    San Antonio
    Gulf States
    (Alabama, Arkansas, Louisiana, Mississippi, Oklahoma, Texas)
    Internal Revenue Service
    PSP, Stop 43
    801 Broadway
    Nashville, TN 37203
    Las Vegas,
    (Alaska, Northern California, Colorado, Hawaii, Idaho, Montana, Nevada, Oregon, Utah, Washington, Wyoming)
    Internal Revenue Service
    PSP, MS: 4031DEN
    600 17th Street
    Denver, CO 80202
    Los Angeles California
    (Arizona, New Mexico, Southern California)
    Internal Revenue Service
    PSP, Mail Stop 4000
    300 N. Los Angeles St.
    Los Angeles, CA 90012
Bank Secrecy Act - Prime Lead Memorandums
  1. A Prime Lead Memorandum is used on a Bank Secrecy Act examination when a criminal fraud referral to CI is not warranted. This may occur but is not limited to instances when indicators of fraud do not meet the LEM criteria or local prosecutorial priorities. In these instances, a PLM is required to transmit evidence of willful violations of BSA laws to CI for evaluation. A PLM is transmitted to CI via the Form 15221, BSA Prime Lead Memorandum to either the SAC or designee (i.e. Fraud Referral Coordinator).

  2. Upon receipt of a PLM, the CI Field Office must adhere to the following actions:

    1. CI will have 30 calendar days to review the PLM, supporting documents, and schedule a meeting with the referring BSA examiner, BSA manager, and the FEA to discuss the merits of the PLM.

    2. CI’s SSA can request an extension to the 30-day review period in writing to the BSA Territory Manager. Together they will decide if an extension is warranted and determine an acceptable extension date. The FEA manager should be copied on all extension requests.

    3. CI may take the following actions after reviewing the PLM: accept, decline, or hold for future use.

    4. If CI initiates a criminal investigation from any information in the PLM, CI must assign the source code “SBSE BSA Prime Lead” within CIMIS. Any additional “spinoff” investigations should also be coded using the same source code.

  3. CI-HQ, Financial Crimes will provide a quarterly report to SB/SE Office of Fraud Enforcement (OFE) to track all criminal investigations sourced from PLMs.

  4. Additional information regarding PLMs can be found in the Fraud Handbook at IRM 25.1.12 (BSA leads to CI in section

Timing of Opening a Primary Investigation
  1. Primary investigations related to individuals or entities may emerge, at any time, during the GI evaluation process. A PI should always be numbered when it appears that an identified individual or entity may have prosecution potential.

Ownership of a Primary Investigation

  1. Primary investigations can be transferred, as needed, between field offices with the approval of both SACs.

Initiating a Primary Investigation

  1. To initiate a PI certain information is required to be entered into the CIMIS database by the SA initiating the investigation. The information will then be reviewed and approved by the appropriate management official(s) prior to the investigation being considered “approved for work”. If needed, IRM Part 9 Chapter 9, CIMIS and/or CI Connections can be consulted for instructions regarding the specific information required in order to initiate a PI.

  2. For narcotics cases, a PI will be initiated in the name of an OCDETF operation to either evaluate joining an OCDETF proposal or to develop the financial component of a specific OCDETF operation. Each such PI must contain the OCDETF-issued investigation number when initiated in CIMIS. Instructions for proper formatting of the OCDETF-issued investigation number are found in CI Connections.

  3. If the subject of the PI resides in another field office’s territory, concurrence of the SAC for the territory in which the subject resides is necessary before the PI can be initiated.

Approving a Primary Investigation

  1. The SAC and ASAC have approval authority through CIMIS within his/her field office to initiate all PIs. The authority to approve the initiation of PIs within field offices, except for PIs involving violations of 18 USC §1956, §1957, §1960,§371M (associated with a Title 18 violation), §371T (associated with a Title 31 violation) and/or any Title 31 investigations may be delegated within the field office through local DOs to the SSA level.

  2. The authority to approve the initiation of PIs involving violations of 18 USC Sections 1956, 1957, 1960, and 371M (associated with a Title 18 violation), and Section 371T (associated with a Title 31 violation) and/or any Title 31 investigations may be delegated within the field office through local DOs to the ASAC.

  3. The RAC will input the appropriate entry into the CIMIS database to initiate PIs on QRP/RRP schemes identified in the SDC.

  4. The SSA of the LDC approves the initiation of PIs in the LDC. The LDC SSA has the authority to approve PIs involving Title 26, 18 USC §1956, §1957, §1960, §371T and/or any Title 31 investigations.

  5. Investigations of banks and brokers or dealers in securities for possible criminal violations of 31 CFR Chapter X (except 31 CFR 1010.340) must be authorized by the Chief, CI. See IRM 1.2.52 (subsection, DO 25-5 (formerly DO-143, Rev. 6)).

Associate Identities

  1. An associate identity to a PI is an individual or entity that has a nexus to the scheme of alleged non-compliance identified in the PI, but whose role in the scheme has yet to be fully determined. If controls (TCs 910 and/or TCs 914) are placed on an individual and/or entity, an associate identity must be entered into CIMIS.

  2. All associated individuals and/or entities will be associated with the PI by completing an entry into CIMIS.

  3. The associate identity screen will enable each field office to identify if an individual or entity is tied to an investigation anywhere in the country. It will also assist in FOIA requests and immunity clearance requests from the attorney for the government.

  4. Witnesses are not to be entered as associate identities. Per Department of the Treasury Directive 55-01, a witness is defined as a person who has information or evidence concerning a crime and provides such information or evidence to a law enforcement agency. Where the witness is a minor, the term witness includes an appropriate family member or legal guardian. The term witness does not include defense witnesses or those individuals involved in the crime as perpetrators or accomplices. The term witness does not include confidential informants.

  5. If an individual is entered in CIMIS as an associate identity, but is later determined to be a witness, the associate identity record for the individual will be removed from CIMIS.

Authorized Primary Investigative Techniques

  1. The following additional techniques and activities are approved for PIs:

    1. Assist other agencies in the execution of a search warrant, including interviewing subject and related individuals during the execution of the warrant. (However, CI cannot interview third parties and/or the subjects after the execution of another agency's warrants without an SCI.) If CI is the affiant, an SCI must have been approved for work.

    2. Consensual monitorings.

    3. Undercover Operations.

    4. Mail covers.

    5. Discussions with the referring IRS officer.

    6. Contact with foreign (tax treaty and other nations) government bodies, including local tax authorities. These must be coordinated through the Director, International Operations. Contact with the taxpayers by mail to verify their filing record using Letter 1509 (DO), Request for Filing Information. This form letter will not be used to solicit an admission if there is good cause to believe that a taxpayer has willfully failed to file. Use of this form should be approved by the SAC.

    7. Access to original tax return.

  2. In addition to the above activities, the following activities are permitted in QRP/RPP PIs:

    1. Contact employers and other filers of information return documents to verify data shown on the information returns, e.g., Forms W-2, W-4, 1099, 8300, etc.

    2. Contact with employers of potentially fictitious persons is permitted but limited to determining the validity of the employee’s earnings and withholding.

    3. Limited third party inquiries are also allowed to determine the true identity of a filer of false or fraudulent claims being evaluated by the applicable campus questionable refund detection team. This includes verification of addresses used by individuals responsible for filing the fraudulent return.

  3. Special agents may disclose the name of the subject of a PI for identification purposes in an effort to secure information that is relevant and necessary to the investigation.

  4. In a Financial Investigative Task Force, or in a Title 31 or SAR investigation, CI personnel may serve subpoenas authorized by the US Attorney’s Office.

Subject Criminal Investigations

  1. An SCI is initiated on an individual or entity alleged to be in non-compliance with the laws enforced by the IRS and having criminal prosecution potential.

  2. The object of an SCI is to gather pertinent evidence to prove or disprove the existence of a violation of the laws enforced by the IRS.

  3. An SCI will always be initiated by either requesting that an approved PI be elevated to an SCI or by relating the SCI initiation request to the approved PI of a separate entity, commonly referred to as a “spin-off SCI”. A PI and an elevated SCI can be initiated simultaneously in those instances when the investigation has criminal prosecution potential, however, the requested PI will first need to be approved before the SCI elevation can be requested.

Ownership of a Subject Criminal Investigation

  1. Ownership of an SCI may be changed by transferring the SCI from the initiating field office to another field office. This may not be done until the transfer has been approved by the SACs of the two field offices involved. An SCI and the PI to which it is associated may or may not have the same owner. Once the approval of both SACs has been obtained, send the request to transfer the SCI to the CIMIS staff at *CI CIMIS.

Initiating a Subject Criminal Investigation

  1. To initiate an SCI, certain information is required to be entered into the CIMIS database by the initiating special agent. The information will then be reviewed and approved by the appropriate management official(s) prior to the investigation being authorized as an SCI. IRM Part 9 Chapter 9, CIMIS should be consulted for instructions regarding the specific information required in order to initiate an SCI.

  2. For narcotics cases, an SCI will be initiated from an OCDETF PI once a financial component is developed and specific subjects are identified. Each such SCI must contain the OCDETF-issued investigation number when initiated in CIMIS. Instructions for proper formatting of the OCDETF-issued investigation number are found in CI Connections.

  3. If the subject of the investigation resides in another field office’s territory, concurrence of the SAC for the territory in which the subject resides is necessary before the SCI can be initiated.

Approving a Subject Criminal Investigation

  1. Any non-sensitive Title 26 SCIs may be approved by the field office SAC or ASAC.

  2. Any non-sensitive SCI involving violations of 18 USC §1956, §1957, §1960, §371T and/or Title 31 may be approved by the field office SAC, or the ASAC upon local delegation of authority from the SAC.

  3. All sensitive Title 18, 26, and 31 SCIs must be approved by the Chief, Criminal Investigation upon request of the SAC through the respective Director, Field Operations.

  4. A sensitive investigation is defined as one involving:

    1. currently serving elected Federal officials;

    2. currently serving Article III Judges;

    3. currently serving high-level Executive Branch Officials (for the Treasury Department, this is defined as items d through g listed below);

    4. all individuals within the Treasury Department Serving in Executive Levels I through V;

    5. all individuals within the Treasury Department serving in the Senior Executive Service grades GS-16 and above;

    6. all individuals within the IRS grade GS-15 serving in positions centralized in the IRS Executive Resources Board;

    7. all individuals within the Treasury Department (other than IRS) in grade GS-15 which the Deputy Secretary may designate;

    8. currently serving elected statewide officials;

    9. currently serving members of the highest court of the states;

    10. mayors currently serving populations of 250,000 or more;

    11. perjury in the US Tax Court;

    12. Exempt Organizations;

    13. publicly traded companies;

    14. companies with annual gross revenues exceeding $10,000,000,000.


    A publicly traded company is defined as a company that has issued securities through a public offering and which are traded on the open market.

  5. Investigations of the following financial institutions as defined in the Title 31 USC Section 5312 (a)(2)(A), (B), and (G) must be authorized by the Chief, CI for possible criminal violations of 31 CFR Part X (except 31 CFR 1010.340):

    1. an insured bank (as defined in section 3 (h) of the Federal Deposit Insurance Act (12 USC 1813 (h)));

    2. a commercial bank or trust company or a broker;

    3. a dealer registered with the Securities and Exchange Commission under the Securities Exchange Act of 1934 (15 USC 78a et. seq.).

  6. See IRM 1.2.52 (subsection, Delegation Order 25.5 (formerly DO 143, Rev. 6)).

Subject Criminal Investigative Techniques

  1. An SCI is considered a full-scale criminal investigation and, therefore, can use the broad spectrum of investigative techniques available to the special agent.

  2. An SCI is required for the execution of a search warrant when CI is the affiant. If CI has a PI number only, special agents can still assist other agencies in the execution of a search warrant, including interviewing subjects and related individuals during the execution of the warrant. CI cannot interview third parties and/or subjects after the execution of another agency's warrant without an SCI that is approved for work.

Seizure Investigative Activity

  1. In order to capture time on criminal or civil seizure actions (18 USC §981, 18 USC §982, 18 USC §984, 26 USC §7301, 26 USC §7302 and 21 USC §881), seizure investigative activity must be approved on a PI or SCI. All time applied on PIs or SCIs with authorized seizure investigative activity will also be used to capture time applied to the seizure. This time will not be accounted for separately.

Ownership of a Seizure Investigative Activity

  1. Authority to conduct seizure investigative activity on an investigation will reside with the field office that initiated and has ownership of the PI or SCI with the approved related seizure investigative activity on CIMIS. If a field office other than the field office with ownership of the PI or SCI on CIMIS wishes to conduct seizure activity related to the same individual they must by SAC to SAC memo request approval and concurrence from the field office SAC where the PI or SCI resides. A copy of the approved memo should be kept in the PI or SCI file and copies should also be maintained by the AFCs in the affected field offices.

  2. All time applied to the seizure investigative activity will be captured on the PI or SCI with the approved seizure investigative activity The second field office will not open a second investigation on CIMIS.

Initiating the Seizure Investigative Activity

  1. To conduct seizure investigative activities either a PI or SCI must exist and this type of activity must be approved by the appropriate management.

Approving the Seizure Investigative Activity

  1. The authority to approve the initiation of all non-sensitive seizure investigative activity rests with the SAC. All sensitive Title 18, 26, and 31 investigations involving seizure investigative activity must be approved by the Director, Field Operations. See subsection which provides a definition of sensitive investigations. This approval authority cannot be re-delegated.

Seizure Investigative Activity Techniques and Procedures

  1. Seizure investigative activity must always be associated with a PI or SCI. The underlying PI or SCI can be closed only when one of the following actions occurs:

    1. All the assets seized have been disposed.

    2. No assets were seized and no further action will be taken.

    3. The PI was initiated to charge time assisting another agency’s seizure investigation and no more time will be charged to the investigation.

  2. Additional information relating to seizure investigations and forfeitures can be found in IRM Part 9 Chapter 7, Asset Seizure and Forfeiture.