News

Suspicious activity reports and other regulatory submissions required by the Bank Secrecy Act, or BSA, fueled nearly 16 percent of the cases that IRS Criminal Investigation, which focuses entirely on financial crime, opened from October 2021 through September of last year.

Separately, more than 80 percent of the 5,202 total cases that IRS-CI referred to federal prosecutors over the past three fiscal years targeted suspects whose names popped up in SARs or other regulatory filings, Jim Lee, who has led the division since 2020, said, adding that his investigators search Treasury’s BSA database 1.8 million times annually.

Lee discussed SARs and other financial crime-related topics in a press call Wednesday amid calls from banks and other firms for more feedback on their efforts to flag illicit finance, and following criticism from within the government that too few law enforcement agencies generate share metrics on the quality of BSA reports.

IRS-CI launched 962 money laundering investigations in fiscal year 2022 and ultimately referred 796 of those cases to the Justice Department. Tax fraud remains IRS-CI’s bread and butter, but the division has also developed expertise in tracing potentially illicit transactions in cryptocurrency to individual suspects, sometimes with dramatic results.

In November, for example, prosecutors revealed that IRS-CI helped track down 50,000 bitcoins stolen from Silk Road nine years earlier to several memory devices hidden throughout a suspect’s residence in Georgia, one of which was found in a popcorn tin. At the time of the theft, the bitcoins amounted to nearly $3.4 billion.

But IRS-CI’s headcount has declined nearly 30 percent since 2010 even while taking on cryptocurrency-related investigations and other new, complex and time-consuming responsibilities. The Inflation Reduction Act, which President Joe Biden signed in August, restores investigative resources to the IRS, some of which will bolster IRS-CI.

With controversy swirling around IRS funding levels, Lee discussed the evolution of financial crime and IRS-CI’s priorities for 2023 with ACAMS moneylaundering.com reporter Fred Williams ahead of Wednesday’s press call.

An edited transcript of their conversation follows.

In April 2022, IRS-CI and other agencies shut down the Hydra darknet market, the largest such criminal bazaar seized to date. Now researchers say online illicit markets are moving to channels on encrypted messaging apps such as Telegram instead of using anonymous web browsers as Hydra did. Have your investigators encountered this trend, and is it more difficult to penetrate online criminal markets that are organized in such a way?

We have seen that trend and it does challenge law enforcement when criminal enterprises or criminal actors switch technology. But the way I think of it is, the crimes underlying the illicit money in the past 30, 40, 50 years are the same. What has changed is the speed and convenience of moving money, the evolution of digital assets, cryptocurrencies, the anonymous nature of the transactions. While these criminal enterprises and actors are changing, IRS-CI has evolved as well, at the same pace. We’re doing that by making strategic investments in cyber and data technology, and through the partnerships we’ve built throughout the law enforcement community, both domestic and international.

The expansion of IRS’s budget under the Inflation Reduction Act provides for 500 additional IRS-CI personnel, including 360 new agents by the end of fiscal 2023. That will still leave the division short of the 2,760 agents that it fielded back in 2010. How will IRS-CI use the new resources? Will it now be able to take on cases that it previously couldn’t?

Certainly, additional resources equate to being able to do more in a whole host of program areas. There are different pots of funding—we also receive funds from the Treasury asset forfeiture office to address sanctions. Regardless of what pot of money is being used, hiring is my priority. That’s going to increase our presence, but those new resources will also need to be trained.

Congressional opponents of restoring resources to the IRS want to cut 90 percent of the new funding provided by the Inflation Reduction Act. How would that affect the ability of IRS-CI to find leads and carry out investigations?

Those decisions are outside of my scope. I’m just making sure my team has the tools they need to bring the most impactful cases while keeping in mind that we have to remain nimble. Just this past fiscal year, my division identified $32 billion in tax fraud and other financial crimes—that’s three times more than the year before—and seized almost three petabytes of data, about two-and-a-half times more than we did a year before. That’s close to 300 times the data equivalent in the printed material in the Library of Congress. You need investment, you need funding to be able to manipulate that much data. Funding obviously is part of any law enforcement agency’s success.

In the next quarter or two we hope to open our Advanced Collaboration and Data Center in the Washington, D.C., area. We refer to it as ACDC; this is a cyber center to address technological challenges, including crypto assets, which every investigator around the country can use. It’s going to be set up in public-private partnership with blockchain analysis companies; we will have the ability to wall off investigative information they aren’t permitted to see.

To give you an example of how the new center will work: Some of the data we seize is on old equipment infected with malware or running obsolete operating systems. Agents in the field don’t have a way to extract that information. They can access the center, where there are going to be all the tools and expertise needed to get the information off the device.

A case unsealed last year revealed that IRS-CI had tracked down a record haul of 94,000 stolen bitcoins from the 2016 hack of Bitfinex through cryptocurrency exchanges to an unhosted wallet, which was further protected by encrypted passwords.

IRS-CI appears to have defeated several sophisticated money-laundering schemes to make the seizure. Even so, digital money launderers still have plenty of options to cover their tracks, such as mixers, privacy coins and money mules. What novel techniques do you expect will emerge in the coming months? Will it become harder to track suspicious movements of cryptocurrency?

I think the new techniques will be all of the above. When you look at three cases —Hydra, Bitfinex and Silk Road—it suggests that crypto is not as anonymous as folks think. But bad actors are going to try to evolve and stay under the radar, and the agent in the field needs help analyzing the blockchain and tracing transactions.

We have hundreds of crypto cases in inventory; new cases, cases referred over. I’m noticing over the past three fiscal years leading to 2023, while initially they were dominantly related to money laundering, more than half of them now have a tax evasion component. So we’re going to be paying close attention to that space. Perhaps a small percentage of all crypto activity is illicit, but we’re going to be focusing on that small percentage.

IRS-CI is also part of the KleptoCapture Task Force, which came into being in March of last year to combat sanctions evasion by blacklisted Russian oligarchs. How has that impacted the workload?

We’re in the business of tracking financial proceeds globally, so it makes sense we’re part of that task force. We’ve identified about 50 leads that turned into 20 or so active investigations. We conduct investigations, seizures and forfeitures while working closely with the Office of Foreign Assets Control, and we share information with domestic and international law enforcement partners.

Have we focused more on sanctions enforcement over the past year? Yes, we were able to shift some resources.

The same goes for COVID-19 fraud, which predominantly involves money laundering crimes. We’ve initiated close to 800 cases, gotten close to 400 indictments and by the end of the last fiscal year we had about 180 cases reach sentencing, with a three-year prison sentence on average, suggesting to me that judges aren’t taking those cases lightly. So we had to be nimble to address this financial threat and managed to shift pretty quickly.

Has the COVID-19 caseload peaked, or do you foresee new cases as more information becomes available?

My take is there was a ton of money pumped into the economy, and whenever you do that you know there are going to be bad actors who take advantage of the situation. We’ve been spending around 5 to 7 percent of our time on COVID relief fraud, and I suspect we’re on pace to see that same amount of time again in fiscal year 2023.

Contact Fred Williams at fwilliams@acams.org