Principle 3. Have adequate investigative powers
40. The standard purpose of a criminal (tax) investigation is to find the truth by investigating the alleged criminal (tax) behaviour. In conducting an investigation, criminal investigators will generally seek to find and analyse information for the purposes of determining whether or not a crime has been committed. Investigations can result in finding both incriminating (“inculpatory”) evidence and evidence that confirms innocence (“exculpatory evidence”). This is used for prosecution authorities to decide whether or not to prosecute the accused. As criminals seek to hide the criminal nature of their conduct, criminal law enforcement agencies need an appropriate range of investigative powers in order to obtain the necessary information. In particular, in the context of investigating tax offences, there is significant value in being able to effectively investigate the source and movement of financial assets. This can be essential to establish the commission of fraud, and to identify the role of an intermediary or accessory, even where the assets themselves have been moved.
41. Depending on which agency has responsibility for investigating tax crimes (see Principle 5 for more details), the nature and extent of investigatory powers in a particular agency may vary. In general, the competency for conducting criminal tax investigations will fall within one of these four models, as described in the Effective Inter-agency Co-operation In Fighting Tax Crimes And Other Financial Crimes, Third Edition, 2017 (the “Rome Report”) (OECD, 2017[1]).
42. A tax administration conducting criminal tax investigations under organisational Model 1 may not always have the full range of investigative powers, expertise or resources, such as the ability to search and seize, intercept communications and demand production of documents. If the tax administration is responsible for conducting criminal tax investigations but does not have the full range of investigative powers itself, these powers should still be available indirectly where needed, such as through the ability to call on the police or another agency to provide investigatory services.
43. Under organisational Model 2 and under Model 4, where the police or public prosecutor conducts and/or directs the investigations, the investigative powers will most likely be similar to the investigative powers of the police conducting other financial investigations. Under Model 3, an agency separate to the tax administration is responsible for investigating tax crime cases, and the investigative powers are also likely to be similar to the investigative powers of the police.
44. Whichever organisational model is used, the agencies responsible for investigating tax offences should have the investigative powers that it considers are necessary and effective in the context of its own mandate, and taking into account the ability to work with other law enforcement agencies which may have additional powers. These investigative powers should allow accessing information and evidence in the digital world in addition to the more traditional sources of information.
45. The availability of relevant investigative powers amongst survey respondents is set out below. Throughout this section of the guide, it is noted that the precise circumstances and legal procedures that need to be followed in order to use such powers vary. The representation of jurisdictions as having “direct powers” is not intended to reflect that the power can be used in all investigations of a tax offence, but that the agency is able to exercise the powers itself in the authorised circumstances (including circumstances where a warrant or court authorisation is granted to the agency). The reference to having indirect powers via another agency reflects an arrangement where the power would be exercised by a different agency outside the criminal tax investigation agency, such as by the police.
46. The power to obtain information may be needed to access documents and information from financial institutions and other third parties. These powers require a third party to hand over documents or information within a specified amount of time. If the demand is not met, more intrusive powers that involve a physical search of property or digital media may follow. The power to obtain third party documentary information is particularly appropriate where the information sought is not readily available in a physical form (e.g. banks which do not maintain paper copies of a customer’s bank statements or telecommunications providers’ data) since this power allows the third party time to collect the demanded material. These powers can take the form of a subpoena, production order, or other powers to demand or compel the handing over of documentary information. This power is available in survey respondents as follows:
47. It is noted that this particular investigatory power may have the same purpose as the civil powers of tax examiners and tax auditors when conducting a civil tax examination, which is to obtain information. Since procedural safeguards should apply once a civil examination becomes a criminal investigation, in order to protect a suspect’s rights it is important to identify the point at which that line is crossed (see Principle 10). In some jurisdictions civil actions need to cease at this point, while in others civil powers to obtain information for the purposes of the civil examination / audit may still be deployed and may run parallel to a criminal investigation.
48. However, deploying civil powers for the purposes of the criminal investigation may constitute an abuse of powers and any evidence obtained may be inadmissible in court. Procedural safeguards are of particular importance under the organisational “Model 1” referred to above, where the tax administration conducts civil examinations or audits and also has the authority to conduct criminal investigations. In such a model it is important to take measures or implement an organisational structure or standard operating procedure that prevents interference of civil audits / examinations with criminal investigations to prevent an abuse of powers occurring.
49. This investigative power refers to the search of property and the ability to search and seize physical evidence such as books and records and other materials that may be evidence of a tax crime. This power generally also allows the investigating authority to use reasonable force to enter the property if needed. This power is available in survey respondents as follows:
50. Search powers should be accompanied by corresponding safeguards that respect a person’s right to privacy and to be free from “unreasonable” search. As such, search powers may be limited by a requirement that there are reasonable grounds to believe that a crime has been committed and that procedural authorisations be obtained such as a search warrant.
51. This refers to the power to review a person’s communications, including e-mails, on-line chats, social media, tracking devices and dial number recorders (devices which record incoming and outgoing telephone numbers), keyboard loggers, internet routing addressing, communications using the dark web and many other types of interceptions. This can be an important source of information to establish further inculpatory or exculpatory evidence, to establish a basis to obtain a search warrant, to identify potential search locations, associated persons and co-conspirators to the crime, and to identify criminal assets. Experience from jurisdictions shows that the power to intercept communications varies, as it is a relatively intrusive power and which may be used only in the most serious cases. This power is available in survey respondents as follows:
52. Tax crime investigators may need to search and seize evidence which is in digital form, and be able to do so in a forensically sound manner. While the search powers to obtain evidence referred to above focusses on the search and seizure of physical evidence, this investigative power is focused on the ability to secure digital evidence such as e-mails, text messages, electronic documents and banking records. This type of evidence may be held within computer hardware or software, tablets, cell phones, or any number of electronic storage media including storage in the cloud. For some jurisdictions, this may be an area where the description of investigatory powers in the law has not yet caught up with the rapidly changing digital landscape, and may need to be reformed. This power is available in survey respondents as follows:
53. This power has become essential given the increasing use of technology to commit tax crimes and transfer of criminal proceeds.
In 2020, the FIOD and the Public Prosecution Service took one of the largest online mixers for cryptocurrencies offline, named Bestmixer.io. This operation deals a severe blow to the concealment of criminal flows of money by mixing cryptocurrencies such as bitcoins. Six operational servers have been dismantled and seized in the Netherlands and Luxembourg. The investigation was conducted in close co-operation with the Dutch Digital Intrusion Team (DIGIT), Europol and the authorities in Luxembourg, France and Latvia. In June 2018 the Financial Advanced Cyber Team (FACT) of the FIOD started the investigation under the supervision of the National Public Prosecutor’s Office for Serious Fraud and Environmental Crime and Asset Confiscation. The reason for the investigation was a report from cyber security company McAfee.
The investigation gathered information regarding transactions between customers and Bestmixer.io. The customers are located all over the world, especially in the US, Germany and the Netherlands. The FIOD analyzed the information together with Europol. After that the data was shared with other countries. On the anonymous part of the Internet, the darknet, cryptocurrencies are a regular means of payment and are often used as means of payment in the criminal world. A crypto mixing service is an online service that makes it possible to conceal the origin or destination of cryptocurrencies. This service is used to split up cryptocurrencies against payment of a commission, after which they are mixed together in a different combination.
People who use a mixing service probably do so to increase their anonymity. The investigation so far shows that many of the mixed cryptocurrencies have a criminal origin or destination. In these cases, the mixer was probably used to conceal and launder criminal flows of money. The total turnover of darknet markets amounts to approx. USD 800 million per year. It is believed that a large part of the payments via the darknet take place via mixers in order to launder the criminal (crypto) money.
Bestmixer.io is one of the three largest mixing services for cryptocurrencies and offered services for mixing the cryptocurrencies bitcoins, bitcoin cash and litecoins. The service started in May 2018 and achieved a turnover of at least USD 200 million (approx. 25 000 bitcoins) in a year’s time and guaranteed that the customers would remain anonymous. The operation against Bestmixer.io is a significant and important step in the fight against criminal flows of money in general and virtual criminal flows of money in particular.
54. During a physical search of a home or office, documents can be reviewed in a manner that quickly indicates whether or not they are covered by the search warrant and relevant to the investigation. However, digital media may contain hundreds of thousands of e-mails, documents and text messages, created over many years, and not necessarily related to the tax crime. It is therefore challenging, if not impossible, to determine during the onsite search whether or not a particular piece of electronic information is covered by the search warrant and its relevance. Therefore, the search may include digitally copying or imaging the data that is held, and examining the contents in a forensic lab in order to determine which pieces of the information are within the scope of the search warrant and relevant to the case under investigation.
55. For example, in Australia, police have the power to operate electronic equipment found at a search warrant premises to access data (including data not held on the premises). If the data accessed is evidential material, it can be copied and removed by operating the equipment or, if it is not practicable to do so, seizing the equipment. An item found at the warrant premises may be removed for up to 14 days for examination or processing in order to determine if it may be seized under the warrant, if it is significantly more practicable to do so having regard to timeliness and the cost of examining or processing the item and the availability of expert assistance. This has proven particularly useful in large complex tax and fraud investigations, in which large amounts of data must be searched on the digital media in order to identify the relevant evidence.
56. There may also be legal challenges connected with the search and seizure of digital data in computers and other electronic devices. Personal data in an electronic device may not be relevant to the suspected tax crime, or may contain data protected by a legal professional privilege. This may require that the search is carefully governed to ensure it is limited to the terms of the authorisation. There may also be legal challenges connected with the search and seizure of computers and other electronic devices. This may be particularly pertinent in cases where the search powers contained in the law refer explicitly to searches or seizure of physical documents, or where a person challenges a search of digital media on the basis that it is overly broad and goes beyond the terms of the search authority or could include privileged documents.
57. Based on survey data, the most commonly reported challenge agencies face in the search and seizure of digital media involves data stored outside the jurisdiction or in the cloud, as their legislation only allows for the search of data which is locally stored. Jurisdictions also noted the challenges of searching large amounts of data, data protected by encrypted passwords, and data that is unable to be accessed because of secrecy laws. Possible solutions mentioned by jurisdictions included the development of an IT system able to sort the main relevant data and a special IT training for professionals in tax crime investigation.
58. This investigative power refers to the ability to interview suspects, accused persons and witnesses to obtain information.
59. The power to interview is generally a power to initiate an interview, rather than a power to compel a person to speak or to provide information during that interview. A distinction should be made between suspects, accused persons and witnesses. Whether or not a suspect provides information during the interview relies on the voluntary co-operation of that suspect. This reflects a suspects’ right to remain silent and right to protection from self-incrimination. For this purpose, suspects should be cautioned at the start of the interview. With respect to witnesses, although they do not have the same right to remain silent, legal privileges and professional secrecy provisions may be applicable, e.g., for family members or certain professions. This power is available in survey respondents as follows:
60. Jurisdictions may also have powers to compel the giving of information, such as inquiry powers which can subpoena potential witnesses before a tribunal or court to answer questions under oath. This can be a particularly powerful tool where a person is unwilling to provide information, such as where contractual duties of confidentiality exist. However, legal privileges and the right of a suspect to remain silent continue to apply. This power is available in survey respondents as follows:
61. This power refers to the covert monitoring of the movements, conversations and other activities of a suspect to identify co-conspirators or witnesses, locate evidence in order to obtain search warrants, identify assets being used in perpetrating the tax crime or assets that are the proceeds of crime. Covert surveillance can include observation of a person in private places such as within a person’s home or vehicle as well as observation of a person in public. Covert surveillance can be particularly relevant for investigating any tax crimes involving organised crime. This power is available in survey respondents as follows:
62. This power refers to the ability to conduct an undercover operation, where an enforcement officer takes on a different identity in order to obtain information and evidence. This investigative tool may be particularly important in the investigation of ongoing serious crimes such as identifying enablers of tax crimes and other financial crimes where organised crime is involved. The type of information that can be obtained using this investigative power is similar to that sought through covert surveillance, including establishing the identity of co-conspirators and location of assets.
63. The distinction between conducting covert surveillance to obtain this information and conducting an undercover operation is the embedding of the undercover officer, or at least direct contact of the undercover officer, with the criminal organisation for the purposes of gaining their trust to obtain information. The contact of the officer may be physical interactions or digital interactions such as on online platforms. This power is available in survey respondents as follows:
64. Undercover operations are costly and can be dangerous, and require expert skills and training of the officers involved. As such, undercover operations are likely to be used less frequently. As with the other investigative powers noted within Principle 3, issues of suspect’s rights and protections such as privacy and issues related to entrapment must be safeguarded by following the correct legal procedures governing the use of these powers.
65. The power to arrest a person refers to the power to stop, restrain and take a person into custody, often for the purpose of formally charging them with an offence. The power to arrest a person and to take them into custody (with or without restrictions) can be critical during a tax crime investigation, so as to prevent them from influencing other suspects or witnesses as well as when there is a risk of flight by the accused or suspect, or to restrain this person in order to prevent them from committing additional crimes. This power is available in survey respondents as follows:
66. In some jurisdictions, the arrest and custody of an accused person or suspect also provides continuous availability for interviewing the suspect or accused person for a certain period of time, subject to protections under the law.
67. As is the case with the use of investigative powers by any law enforcement agency, these must be accompanied by safeguards, oversight, and authorisations to ensure that the suspects and accused persons are adequately protected from any potential abuse of these investigative powers (see Principle 10 for more details).
References
[1] OECD (2017), Effective Inter-Agency Co-Operation in Fighting Tax Crimes and Other Financial Crimes - Third Edition, OECD Publishing, Paris, https://www.oecd.org/tax/crime/effective-inter-agency-co-operation-in-fighting-tax-crimes-and-other-financial-crimes.htm.