IRS Criminal Investigation: What It Is, What Triggers It, and What to Do

Written by Sam Brotman, J.D., LL.M. (Taxation), MBA — Managing Attorney, Brotman Law  ·  Updated May 2026

What IRS Criminal Investigation Actually Is

IRS Criminal Investigation (CI) is the only IRS division with law enforcement authority — special agents are armed federal officers with the power to arrest, execute search warrants, and refer cases for federal prosecution.

This is worth being clear about because the word "IRS" tends to conjure an image of auditors and correspondence notices. CI is different. Special agents are not auditors. They carry badges and firearms. They operate under the same legal framework as FBI agents and DEA agents. When CI is involved, the potential consequence is not a penalty assessment — it's a federal indictment and prison time.

CI's jurisdiction spans three areas of federal law:

• Title 26 (Internal Revenue Code): Tax evasion under IRC § 7201, filing false returns under IRC § 7206, failure to pay under IRC § 7203, and related violations.
• Title 31 (Bank Secrecy Act): Willful failure to file FinCEN Form 114 (FBAR), structuring transactions to evade currency reporting requirements, and related BSA violations.
• Title 18 (money laundering statutes): 18 U.S.C. § 1956 and § 1957 — money laundering charges that are frequently added to tax cases when the underlying funds pass through financial accounts.

CI employs approximately 2,000 special agents nationwide. Despite that relatively small headcount, it runs a high conviction rate — historically around 90% or above in cases it refers for prosecution. CI generally does not refer a case to the Department of Justice unless it believes the evidence supports a conviction. By the time charges are filed, the government's case is typically well-developed.

Federal criminal tax cases require specialized defense. The attorney-client privilege, Fifth Amendment protections, grand jury procedure, and DOJ Tax Division approval process all function differently here than in a civil tax dispute. A CPA or a generalist attorney does not have the framework to handle this kind of case.

If CI Has Contacted You

Here is what is happening when a special agent makes contact: they already have information. CI investigations are methodical and typically run for two to five years before investigators make direct contact with the subject. By the time an agent is at your door, they have likely reviewed financial records, interviewed third parties, and built a working theory of the case. They are not there to figure out what happened. They already believe they know.

The reason agents make contact at this stage is often to get you to confirm facts, explain transactions, or make statements that fill in the remaining gaps in their case. They are skilled interviewers. The conversation will feel like a clarification. It is not.

The correct response: "I am represented by counsel. Here is my attorney's number." No explanations. No documents. No clarifications. Then call your attorney.

This is not about guilt or innocence. It is about how federal criminal investigations work. Every experienced criminal defense attorney will tell you the same thing — voluntary statements almost never help and frequently make things worse.

How a CI Investigation Starts

CI investigations most commonly start from five sources: civil audit referrals, Suspicious Activity Reports from financial institutions, informants, other federal agency referrals, and CI's own analytical work.

Civil Audit Referral (the Eggshell Scenario)

The most common path into a CI investigation is through a civil examination. When an IRS revenue agent conducting an audit identifies what the IRS calls "badges of fraud" — indicators that suggest the understatement was willful rather than negligent — they can complete a Form 2797 (Referral Report of Potential Criminal Fraud Cases) and refer the matter to CI. The civil examination is typically suspended at that point while CI evaluates the referral.

This transition — from civil audit to criminal investigation — is the most dangerous transition in tax law. The taxpayer often does not know it has happened. See the section on eggshell audits below for the warning signs.

Suspicious Activity Reports (SARs)

Financial institutions are required under the Bank Secrecy Act (31 U.S.C. § 5318(g)) to file Suspicious Activity Reports with FinCEN when they identify transactions that suggest potential illegal activity. FinCEN shares relevant SARs with CI. Patterns that generate SARs include structuring transactions to stay below the $10,000 currency transaction reporting threshold (a practice called smurfing, which is itself a federal crime under 31 U.S.C. § 5324), large cash deposits inconsistent with reported income, and rapid movement of funds through multiple accounts.

Informants

CI accepts tips from confidential informants, including employees, business partners, and former spouses. The IRS Whistleblower Office (under IRC § 7623) also operates a formal whistleblower program that pays awards to informants whose tips lead to collected taxes — which creates a financial incentive structure for detailed, documented disclosures.

Other Federal Agency Referrals

The FBI, DEA, Homeland Security Investigations (HSI), and FinCEN regularly refer cases to CI when their investigations surface evidence of tax violations. This is common in cases involving drug trafficking, public corruption, healthcare fraud, and foreign financial account violations. CI may enter a case as a secondary agency alongside the originating agency, or take the lead if the tax component is the primary charge.

CI's Own Analytical Work

CI has analysts who review public filings, court records, corporate registrations, and financial disclosures looking for patterns inconsistent with reported income. High-profile spenders with modest reported income, business owners with unexplained wealth, and offshore account holders are recurring subjects of this type of analysis.

The Four Stages of a CI Investigation

Stage 1: Preliminary Investigation

In the preliminary stage, CI agents conduct background research, financial analysis, and database queries without contacting the taxpayer. They review tax returns, financial records obtained through summons, property records, court filings, and records from third parties — banks, brokers, business partners. No contact with the taxpayer occurs at this stage.

The preliminary investigation is designed to determine whether there is probable cause to believe a crime has occurred. If CI does not find sufficient basis to proceed, the case is closed here. If they do, it moves to the next stage.

Stage 2: Subject Investigation

When CI determines that probable cause exists, the taxpayer is formally designated a "subject" of a criminal investigation. This is when CI begins building the full evidentiary record: conducting witness interviews, executing summonses for financial records, and coordinating with the assigned Assistant U.S. Attorney (AUSA).

Direct contact with the taxpayer — showing up at a home or business, calling a phone number — typically happens during this stage. This is also when search warrants may be executed. CI agents may also interview neighbors, employees, accountants, and attorneys (subject to privilege limitations).

Stage 3: Grand Jury

If the subject investigation produces sufficient evidence, CI works with the assigned AUSA to present the case to a federal grand jury. Grand juries in federal tax cases are seated in the relevant district. The grand jury can issue subpoenas compelling document production and witness testimony. It operates in secret — targets and subjects do not have the right to appear before the grand jury or hear the evidence against them.

Receipt of a grand jury subpoena — particularly if it arrives before any direct CI contact — is sometimes the first indication that a formal investigation is underway. See the section on grand jury subpoenas below.

Stage 4: Indictment and Prosecution

If the grand jury finds probable cause, it returns an indictment. Before CI can refer a tax case to the AUSA for prosecution, the case must receive approval from the DOJ Tax Division in Washington, D.C. That approval process — described in the DOJ Tax Division section below — is a meaningful checkpoint. Not every CI referral results in prosecution approval, and the negotiation that happens at that juncture is one of the most important stages for defense counsel.

Subject, Target, or Witness: What Your Status Means

The DOJ distinguishes between three designations in a federal investigation: subject, target, and witness. Each status carries different legal implications and should affect how you and your attorney approach the investigation.

The practical significance of these distinctions: your status can change as the investigation develops. A witness who is interviewed without counsel present can make statements that shift them into subject territory. A subject who proactively retains counsel and engages the government strategically may, in some cases, avoid indictment entirely. Status is not fixed.

If you receive a target letter, it means the DOJ or grand jury believes the evidence is sufficient to charge you. That is not a guarantee of prosecution — the DOJ Tax Division approval process and negotiation with the assigned AUSA can still affect the outcome — but it means the investigation is at a late stage.

When a Special Agent Shows Up

When agents show up at your door, they will typically identify themselves with credentials, explain they are conducting a federal investigation, and ask if you have a few minutes to talk. The conversation is designed to feel informal. It is not.

There is no legal obligation to speak with them. You have Fifth Amendment rights against self-incrimination. You have no obligation to let them into your home without a warrant. You have no obligation to produce documents voluntarily.

The response is simple: "I am represented by counsel. Here is my attorney's number." Provide the card or phone number. Do not explain why you have an attorney. Do not say you don't have anything to hide. Do not say anything else. Then close the door and call your attorney.

If the agents have a search warrant, they can enter your premises and seize specified items. Even then, you are not required to answer questions. You can request to see the warrant, identify the scope of what they are authorized to take, and have your attorney notified — but you do not need to assist beyond what the warrant legally compels.

A few specific situations that come up:

• If they call instead of appearing in person: The same principles apply. Do not discuss the investigation, do not explain, do not clarify. Politely state you are represented and end the call.
• If they contact your employees or business partners: Your employees have their own rights and their own interests. Alert your attorney so counsel can advise on how to handle third-party contact appropriately.
• If they contact your accountant: The accountant-client privilege (under Circular 230) is narrower than attorney-client privilege. An accountant who prepared your returns can be compelled to testify or produce workpapers. This is one reason why retaining a criminal tax attorney and placing your accountant under a Kovel arrangement matters.

The Eggshell Audit: When a Civil Exam Becomes a Criminal Problem

An eggshell audit is a civil IRS examination that carries the risk of a criminal referral — either because the IRS suspects fraud or because the taxpayer is aware of information that, if discovered, could expose criminal liability.

The term captures the situation accurately. The audit looks like an ordinary civil examination from the outside, but the shell is fragile — one wrong step and it breaks into criminal territory.

The warning signs that a civil audit may have become, or may be moving toward, a criminal referral:

• The revenue agent's demeanor changes. An agent who was communicative becomes distant or noncommittal. Questions shift from "can you document this deduction" to questions that probe intent — "did you know at the time," "who made this decision," "what was your understanding."
• The agent refuses to discuss statute of limitations extensions. In an ordinary civil audit, agents will request a Form 872 consent to extend the statute when they need more time. An agent who will not discuss extensions may be anticipating a criminal referral, where different statute of limitations rules apply.
• The audit is suspended or withdrawn without explanation. A revenue agent who was actively working the examination stops responding or closes the case without issuing a report. This can mean CI is evaluating a referral and the civil process has been placed on hold.
• New agents appear alongside the original examiner. If a second agent — particularly one with different credentials or from a different IRS division — begins attending meetings or requesting information, that warrants immediate attention.
• Information requests focus on intent and knowledge rather than arithmetic. Civil audits are about whether you claimed the right amount. Criminal investigations are about whether you willfully understated. The shift in question types is a signal.

If you are currently in a civil audit and one or more of these signs are present, coordinate with a criminal tax defense attorney before the next interaction with the revenue agent. Information disclosed voluntarily during a civil examination can be used in a subsequent criminal case. The Fifth Amendment does not prevent you from declining to answer questions in a civil context when there is genuine criminal exposure.

See also: the formal examination procedures under the IRS audit process and how eggshell audits differ from standard field examinations.

Grand Jury Subpoenas

A federal grand jury subpoena compels either the production of documents or live testimony — and often both. Receipt of a grand jury subpoena in a tax matter is one of the clearest signals that a CI investigation is at an active, serious stage.

There are two types:

• Subpoena duces tecum: Compels the production of specified documents, records, or other tangible items. Financial records, emails, corporate books, and bank statements are common targets in tax cases. The recipient must either produce the specified items or raise a legal objection — typically attorney-client privilege, Fifth Amendment, or a motion to quash.
• Subpoena ad testificandum: Compels live testimony before the grand jury. The witness appears, is placed under oath, and answers questions posed by the AUSA or grand jurors. Defense counsel is not permitted in the grand jury room — the witness may step out to consult with counsel between questions, but counsel does not observe the testimony.

The Fifth Amendment privilege against self-incrimination applies in grand jury proceedings, but invoking it requires careful handling. An individual who is the subject or target of an investigation can assert the Fifth Amendment in response to grand jury questions. A witness who is not a target has more limited grounds for refusal and can be compelled to testify.

Attorney-client privilege issues arise frequently in grand jury subpoenas directed at attorneys or accountants. The crime-fraud exception — which strips privilege from communications made in furtherance of a crime — is regularly litigated in this context. Kovel accountants (accountants retained under the supervision of defense counsel) are generally protected by attorney-client privilege; accountants who prepared returns directly are generally not.

If you receive a grand jury subpoena, do not produce documents or appear to testify before consulting with a criminal tax defense attorney. The subpoena itself must be reviewed to determine scope, potential privileges, and whether any aspect of compliance should be contested.

How Long CI Investigations Take

There are a few reasons for this timeline. First, financial investigations require assembling records from many sources — banks, brokers, business entities, foreign institutions — each of which takes time through summons or treaty request procedures. Second, criminal charges require proof beyond a reasonable doubt, which means the government builds its case more thoroughly than in a civil audit. Third, DOJ Tax Division review adds time at the back end — Tax Division approval is required before any federal tax prosecution can proceed.

The criminal tax statute of limitations is generally six years from the due date of the return for IRC § 7201 tax evasion, and three years for most other tax violations under IRC § 7203 and § 7206. The government typically files charges well within those windows, but the multi-year investigation timelines are common.

An important implication of the long timeline: if you have reason to believe a CI investigation may be open — or may be opening — waiting for the investigation to conclude before retaining counsel is not a viable strategy. Early involvement of criminal tax defense counsel can affect how the investigation develops, what information the government obtains, and whether prosecution is ultimately recommended.

DOJ Tax Division Involvement

Every federal tax prosecution requires approval from the DOJ Tax Division in Washington, D.C. CI does not indict anyone on its own — it refers cases to the AUSA, who then must seek Tax Division approval before proceeding.

The Tax Division approval process is a meaningful checkpoint, not a rubber stamp. Tax Division attorneys independently review the CI referral package — the evidence assembled, the legal theory, the proposed charges — and can decline to authorize prosecution, authorize a reduced set of charges, or request additional investigation. Cases that Tax Division considers factually weak, legally questionable, or poor candidates for prosecution policy reasons are declined.

This is one of the junctures where experienced criminal tax defense counsel can have an impact. The Tax Division review is conducted on paper — it reviews what CI and the AUSA have submitted, not what the defense has independently developed. In some cases, defense counsel can communicate with Tax Division to present mitigating facts, legal arguments, or voluntary disclosure information that affects the prosecution decision.

Tax Division's current prosecution priorities, as reflected in its publicly available case inventory, focus on tax evasion by high-income individuals and business owners, FBAR willfulness, employment tax fraud (trust fund violations at scale), and tax-related fraud schemes that overlap with other federal priorities (COVID-related fraud, cryptocurrency, healthcare).

Voluntary Disclosure and the CI Window

The IRS voluntary disclosure practice (described in IRM 9.4.3) has historically allowed taxpayers who came forward before a criminal investigation began to resolve their liability civilly, without prosecution. The key requirement is that the disclosure must be timely — meaning it occurs before the IRS is on notice of the conduct, before a civil examination is referred to CI, and before CI takes any overt investigative step with respect to the taxpayer.

For taxpayers with unreported foreign financial accounts or unreported offshore income, the offshore voluntary disclosure pathway also closed to new applicants in 2018. Streamlined filing procedures remain available for non-willful violations, but for willful conduct — which is the standard relevant to CI — those procedures do not provide the same protection.

The practical takeaway: if you have reason to believe your situation has criminal exposure, the window for proactive disclosure is before CI is involved, not after. A criminal tax attorney can evaluate whether voluntary disclosure is available, whether it makes sense given the facts, and how to structure it to maximize protection.

What a Criminal Tax Defense Attorney Does That a CPA Cannot

Attorney-client privilege, the ability to engage DOJ Tax Division, and experience with grand jury and proffer proceedings are the capabilities that distinguish a criminal tax defense attorney from any other professional in this context.

Here is what that looks like in practice:

Attorney-Client Privilege

Communications between a client and their attorney are protected from disclosure by attorney-client privilege. Communications between a client and their CPA are not — or at least not to the same degree. Circular 230 provides a narrow federally authorized privilege for CPAs in certain non-criminal tax proceedings, but it does not apply in criminal investigations or grand jury proceedings. An accountant who knows about a client's unreported income can be subpoenaed and compelled to testify. An attorney generally cannot be.

Kovel Arrangements

A Kovel arrangement — named after United States v. Kovel, 296 F.2d 918 (2d Cir. 1961) — is a structure in which an accountant is retained by the defense attorney, rather than directly by the client, to assist the attorney in providing legal advice. When structured correctly, the Kovel accountant's work product and communications with counsel are covered by attorney-client privilege. This allows defense counsel to use an accountant's technical expertise while maintaining the privilege that protects what those conversations produce.

Grand Jury Defense

Navigating grand jury subpoenas — asserting privilege, moving to quash overbroad subpoenas, preparing witnesses, evaluating Fifth Amendment invocations — requires criminal procedure experience that is specific to this context. A CPA has no standing in the grand jury process. A generalist attorney may not have the tax-specific knowledge to evaluate the substantive theory underlying the subpoena.

Proffer Negotiations and DOJ Tax Contacts

A proffer agreement is an agreement with the government under which a subject or target provides information to the prosecution in exchange for certain use limitations — typically, the proffer statements cannot be used against the subject in the government's case-in-chief. Proffers are a standard tool in federal criminal investigations and can, in appropriate cases, be a path to reduced charges or non-prosecution. They require careful evaluation — a proffer that provides harmful information without securing meaningful protections can be worse than no proffer at all.

Criminal tax defense also involves direct engagement with DOJ Tax Division attorneys at the review stage, coordination with the AUSA throughout the investigation, and strategic decisions about how and when to present defenses — including defenses specific to the willfulness element of tax crimes.

None of this is work that a CPA or a generalist criminal defense attorney without tax-specific experience is equipped to do. Federal criminal tax cases have a distinct vocabulary, a distinct evidentiary framework, and a procedural path through CI, the AUSA, and the Tax Division that requires knowing all three.