Since 1867, the internal revenue laws have allowed the government to pay awards to individuals who provided information that aided in detecting and punishing those guilty of violating tax laws. In 1996, Congress increased the scope of the program to also provide awards for detecting underpayments of tax. It also changed the source of awards to money IRS collects as a result of information whistleblowers provide rather than appropriated funds. The Tax Relief and Health Care Act of 2006 created a mandatory whistleblower award program which made fundamental changes to IRS’s existing informant awards program. The 2006 act also established the IRS Whistleblower Office. The Whistleblower Office processes claims that allege a tax noncompliance of more than $2 million as potential 7623(b) claims. If these claims meet the requirements for an award, the whistleblower receives a mandatory award of between 15 and 30 percent of collected proceeds, with the exact percentage determined by IRS’s Whistleblower Office based on the extent of the whistleblower’s contributions. Claims not meeting the criteria for a 7623(b) claim are referred to as 7623(a) claims and are subject to procedural steps similar to those of 7623(b) claims. However, 7623(a) claims are neither eligible for appeals to the U.S. Tax Court nor subject to mandatory award payments. For claims processed as 7623(b) claims, the whistleblower claims process involves multiple steps, starting with a whistleblower’s initial application and ending with a rejection, a denial, or an award payment. The process begins when a whistleblower submits a signed Form 211, Application for Award for Original Information, to the Whistleblower Office. The Initial Claim Evaluation unit, which is part of the Small Business/Self- Employed operating division, performs an administrative review of the incoming applications. The Initial Claim Evaluation unit examines the submission for completeness and logs it into E-TRAK. They may reject claims because the tax noncompliance allegation is unclear, no taxpayer is identified, or the whistleblower is ineligible for an award. Claims that are not rejected are sent to classification to determine which operating division should review the claim. Claims are then generally sent to subject matter experts in the various operating divisions—usually the Small Business/Self-Employed or Large Business & International division—where they are reviewed to determine whether the claims merit further consideration by the operating division, should be referred to Criminal Investigation for investigation, or should be sent back to the Whistleblower Office as denied. Claims can be denied if there is limited audit potential or if there is limited time left on the statute of limitations, among other reasons. Claims that are not denied are generally added to the operating division’s inventory for potential examination. If a claim is selected for examination, the examiner completes and returns to the Whistleblower Office a Form 11369, Confidential Evaluation Report on Claim for Award, at the conclusion of the examination. The Whistleblower Office uses the information on this form when making an award determination. Figure 1 summarizes the full claim review process for 7623(b) claims. According to the fiscal year 2017 Whistleblower Office annual report, IRS collected $191 million in fiscal year 2017 as a result of both 7623(a) and 7623(b) whistleblower claims. IRS also paid out $34 million on 367 claims to 242 whistleblowers. The average whistleblower award for fiscal year 2017 was over $140,000. Figure 2 below shows the collection and payout amounts for fiscal years 2012 through 2017. Prior to February 9, 2018, section 7623(b) of Title 26 required the Whistleblower Office to calculate whistleblower award amounts as a percent of “collected proceeds (including penalties, interest, additions to tax, and additional amounts).” On August 12, 2014, IRS issued a final rule to implement section 7623 (the whistleblower law) that clarified that certain penalties—those collected under Title 31 for FBAR violations, and those collected under Title 18 for criminal and civil penalties for tax law violations—do not constitute collected proceeds for calculating whistleblower awards. IRS received comments on the proposed rule contending that excluding money collected under Title 18 and Title 31 eliminates a whistleblower’s incentive to provide information on violations under these titles and would reduce the number of whistleblowers willing to provide information to IRS. IRS stated in its final rule that section 7623 only authorizes awards for amounts collected under Title 26. IRS also noted that under the Victims of Crime Act, criminal fines paid for tax law violations must go into the Crime Victims Fund and are unavailable for payment to whistleblowers. Whistleblowers challenged IRS’s definition of collected proceeds in court. In August 2016, the U.S. Tax Court issued a ruling in response to a petition filed by a married couple who, as whistleblowers, had provided information leading to a conviction related to a tax fraud scheme and then disputed the award determination made by the Whistleblower Office. The U.S. Tax Court ruled that criminal fines and civil forfeitures were collected proceeds for purposes of an award under Section 7623(b). In its ruling, the court held that “the term ‘collected proceeds’ means all proceeds collected by the Government from the taxpayer” and that “…the term is broad and sweeping; it is not limited to amounts assessed and collected under title 26.” On April 24, 2017, IRS filed an appeal of the Tax Court’s decision with the U.S. Court of Appeals for the District of Columbia Circuit. Before the U.S. Court of Appeals made a final ruling, Congress replaced the term “collected proceeds” with the term “proceeds” and provided a definition of “proceeds” on February 9, 2018, in the Bipartisan Budget Act of 2018. The act’s definition of proceeds includes: (1) penalties, interest, additions to tax, and additional amounts provided under the internal revenue laws; and (2) any proceeds arising from laws for which the IRS is authorized to administer, enforce, or investigate including criminal fines and civil forfeitures, and violations of reporting requirements. This includes FBAR penalties in the definition of proceeds, as well as criminal fines and civil forfeitures. This definition of proceeds applies to cases for which a final determination for an award was not made prior to enactment. On March 26, 2018, IRS withdrew its appeal before the U.S. Court of Appeals. Under the Bank Secrecy Act of 1970, and in particular those sections incorporated into Title 31 of the U.S. Code, U.S. persons with a financial interest in, or signature or other authority over a bank, securities, or other financial account in a foreign country are required to keep records and file reports on transactions with foreign financial institutions. Persons with a financial interest or signature authority over one or more foreign financial accounts with a total value of more than $10,000 must file an FBAR with the Department of the Treasury (Treasury). If an FBAR is required, it must be filed each year for the previous calendar year on or before April 15 (or other date as prescribed by the IRS) to coincide with the tax filing deadline. Administration of this statute has been delegated by Treasury to the Financial Crimes Enforcement Network (FinCEN). In April 2003, FinCEN delegated its authority to IRS to enforce the FBAR requirements. These requirements include conducting examinations of FBAR compliance and taking such enforcement actions as assessing penalties, as appropriate. A person’s civil penalty for each FBAR violation can be up to $500 for a negligent FBAR violation and up to $10,000 for non-willful violation. In addition, a person with a willful FBAR violation may be subject to a civil monetary penalty equal to the greater of $100,000 or 50 percent of the amount in the account at the time of the violation, and also be subject to possible criminal sanctions. These penalties are per person, per account, and per year. According to the Internal Revenue Manual (IRM), FBAR penalties assessed by IRS are collected and tracked separately from tax assessments. IRS assessed approximately $10.7 million in FBAR penalties to taxpayers who were identified in our sample of whistleblower claims. We reviewed 92 whistleblower claims closed between January 1, 2012, and July 24, 2017, where the identified taxpayer was also subject to an IRS FBAR examination. IRS assessed FBAR penalties in 28 of these 92 cases. In none of these instances was the FBAR penalty included in the collected proceeds used to calculate whistleblower awards. Our analysis of these 28 claims suggests that if IRS had included FBAR penalties in the awards, the whistleblowers involved could have received an additional $1.6 million to $3.2 million, assuming an award of between 15 and 30 percent. Examples of Whistleblower Claims A whistleblower claim may provide IRS information on the undisclosed offshore account of a single individual (such as a business partner, former spouse, or family member), while other whistleblowers, such as bank insiders, may provide IRS a list of individuals with undisclosed offshore accounts. The exclusion of FBAR penalties from whistleblower awards is consistent with IRS’s August 2014 regulation outlining the whistleblower award process. The final regulation describes the process for determining whistleblower awards and includes a definition of collected proceeds. Specifically, the regulation defines collected proceeds as “limited to amounts collected under the provisions of Title 26, United States Code.” This definition excluded FBAR penalties assessed under Title 31 and criminal fines assessed under Title 18. This regulation’s definition of collected proceeds, however, has been superseded by the replacement of “collected proceeds” with “proceeds” and a definition of “proceeds” in the Bipartisan Budget Act of 2018, effective February 9, 2018. The new law defines proceeds as including “penalties, interest, additions to tax, and additional amounts provided under the internal revenue laws and any proceeds arising from laws for which the Internal Revenue Service is authorized to administer, enforce, or investigate, including criminal fines and civil forfeitures, and violations of reporting requirements.” While no whistleblowers were paid for any FBAR penalties collected as a result of the information they provided to the Whistleblower Office, our analysis found that IRS took FBAR enforcement actions against at least 10 taxpayers based on whistleblowers’ information. Table 1 shows the FBAR enforcement outcomes for the 92 claims we reviewed. Of these 92 whistleblower claims we reviewed where the identified taxpayer was subject to an FBAR enforcement effort, 39 involved taxpayers accepted into IRS’s Offshore Voluntary Disclosure Programs (OVDP). OVDP enables taxpayers with tax noncompliance from undisclosed offshore accounts to avoid prosecution and resolve their past noncompliance by paying limited civil penalties. As one of a number of required actions for OVDP, IRS assesses taxpayers accepted into the program a miscellaneous Title 26 offshore penalty in lieu of all other penalties for undisclosed foreign accounts, including FBAR penalties. According to IRS officials, because the OVDP penalty is a Title 26 penalty, these collections were included in collected proceeds for the purposes of whistleblower award calculations even before the new definition of proceeds took effect on February 9, 2018. The case files we reviewed included some examples of whistleblowers receiving an award based in part on the miscellaneous Title 26 OVDP penalty in addition to tax, interest, and other penalties. If the taxpayer had not participated in OVDP, the whistleblower would not have received an award on the part of the collected proceeds that came from the FBAR penalty. FBAR Warning Letters At the conclusion of a Report of Foreign Bank and Financial Accounts (FBAR) examination, an examiner can either assess a penalty or can use a warning letter (Letter 3800, Warning Letter Respecting Foreign Bank and Financial Accounts Report Apparent Violations) to notify taxpayers that they are not in compliance with FBAR reporting requirements. The examiner can use their discretion to issue a warning letter if they determine that the taxpayer would improve their FBAR reporting compliance in the future. A taxpayer’s failure to file an FBAR after receiving a warning letter supports a determination of a willful FBAR violation. The new definition of proceeds establishes a policy of including FBAR penalties in whistleblower awards regardless of whether the identified taxpayer enters OVDP or is assessed an FBAR penalty as a result of an FBAR exam. It also creates consistency with the treatment of penalties assessed under the Foreign Account Tax Compliance Act (FATCA). FATCA, enacted in 2010 under Title 26, assesses penalties for failure to report foreign financial accounts and assets. Because FATCA is under Title 26, any penalties assessed stemming from a whistleblower’s information were already eligible for inclusion in whistleblower awards. Of the total revenue collected from the 28 whistleblower claims we reviewed with an FBAR penalty assessed, more than 97 percent came from 10 cases with willful FBAR penalties. Willful FBAR penalties, which are up to 50 percent of the value of the account, represent a small portion (less than 0.1 percent) of all whistleblower claims closed in our time frame, and less than half of the 28 FBAR penalty cases we reviewed. However, we calculated that had these willful penalties been included in awards, the whistleblower awards would have increased by up to $3,145,754. In contrast, the 18 cases that had a non-willful or negligent FBAR penalty would have led to an increase in whistleblower awards of up to $78,912 based on our calculations. Table 2 shows the number of cases and total amount of FBAR penalties collected by the type of FBAR penalty. Whistleblowers may play an important role in bringing willfully noncompliant taxpayers to the attention of IRS. These taxpayers may be purposefully hiding their assets from IRS detection. To highlight the difference in the magnitude of FBAR penalties between willful and non- willful or negligent taxpayers, figure 3 shows the range of potential whistleblower awards had FBAR penalties been included in award determinations. There is no way to estimate how many whistleblowers would have come forward had IRS included FBAR penalties in whistleblower awards. However, we found a small number of whistleblower claims that included FBAR information anyway. To look for how often whistleblowers submitted claims with allegations of FBAR noncompliance, we identified 401 of the 10,306 IRS whistleblower claims closed between January 1, 2012, and July 24, 2017, as likely to contain allegations of FBAR noncompliance by an identified taxpayer. We identified three groups of claims as being most likely to contain allegations of FBAR noncompliance: 92 claims where the identified taxpayer was subject to an FBAR enforcement action (population discussed above); 299 claims that included key terms in E-TRAK indicating offshore assets; and 10 claims that were closed with “no Title 26 collected proceeds,” which could indicate FBAR noncompliance since FBAR penalties are Title 31 penalties. Since FBAR penalties were excluded from whistleblower proceeds, IRS did not track FBAR allegation data in E-TRAK. Therefore, our numbers might underrepresent the total population of claims likely to include allegations of FBAR noncompliance. We reviewed all 92 of the claims that included taxpayers that were also present in IRS’s FBAR Database (matched claims) and found that 85 of them included allegations of FBAR noncompliance on IRS Form 211, the form used to submit a claim to the Whistleblower Office. We reviewed a random sample of 30 claims from the 299 claims we identified as being likely to include FBAR information based on key terms in the E-TRAK database (key terms claims)—11 of them included allegations of FBAR noncompliance. We also reviewed all 10 of the claims that were closed with “no Title 26 collected proceeds” and found one allegation of FBAR noncompliance. This was not unusual because IRS uses the “no Title 26 collected proceeds” code for closures other than those with FBAR penalties, such as claims with Title 18 criminal fines. Table 3 shows our three populations and how often we found claims with allegations of FBAR noncompliance in each. Based on our stratified sample of selected whistleblower claims, we estimate that at least 1.4 percent (or at least 146 claims) of all large-dollar (7623(b)) whistleblower claims closed between January 1, 2012, and July 24, 2017, involved allegations of FBAR noncompliance. Because the Whistleblower Office did not require data in E-TRAK to indicate the nature of the violation the whistleblower is reporting, the actual number of claims that include allegations of FBAR noncompliance may be higher. While our estimate represents a small proportion of all whistleblower claims, this may be because of the prior policy of excluding FBAR penalties from awards. However, the analysis suggests that despite being ineligible for award payment, some whistleblowers provided information on FBAR noncompliance to IRS that may have helped improve FBAR’s effectiveness as a tool for anti-money laundering and tax enforcement. With the statutory change in award basis, IRS may see more whistleblowers come forward with better information about FBAR noncompliance, according to whistleblower attorneys we interviewed. Even though FBAR penalties were not considered for whistleblower awards until the February 9, 2018 legislative change, the Whistleblower Office forwarded allegations it received of FBAR noncompliance to IRS’s operating divisions for further examination. Whistleblower Office officials told us that if a whistleblower provides information concerning offshore accounts held by a taxpayer, including specific allegations of FBAR noncompliance, IRS evaluates it as it does any other information. The presence of information on possible FBAR noncompliance does not change the process for evaluating the claim. Whistleblower Office instructions for the initial review of a claim specify that, if the claim merits further consideration, it will be referred to the appropriate operating division for review. According to officials from the Small Business/Self-Employed and Large Business & International operating divisions, during their review process information dealing with offshore accounts and possible FBAR violations is treated just as all other information provided by a whistleblower. Once a claim is referred to an operating division, it is generally reviewed by a subject matter expert who then determines whether the claim has sufficient audit potential to warrant adding it to the division’s inventory of possible returns for audit. If the subject matter expert concludes that the claim does not have sufficient audit potential, or the division later decides not to proceed with an examination, the claim is returned to the Whistleblower Office. If the subject matter expert forwards a whistleblower claim for possible audit and an examination takes place, the examiners will establish an audit file for the tax examination. If evidence of FBAR noncompliance is found, a separate audit file is to be created. Most often, both files are maintained and updated by the same examiners. According to IRS officials and procedures laid out in the IRM, the outcome of the examination is based on the quality of the evidence and is not influenced by the presence of a whistleblower or the source of the information. Information on FBAR noncompliance developed by examiners may or may not be provided to the Whistleblower Office. At the conclusion of the examination process, the examiner provides the Whistleblower Office with a Form 11369, Confidential Evaluation Report on Claim for Award. On this form, examiners are required to answer a series of detailed questions about the whistleblower’s contribution to the investigation, such as whether the whistleblower identified specific issues or provided analysis that saved IRS time and resources. According to the IRM, the purpose of the Form 11369 is to inform the Whistleblower Office of the whistleblower’s contribution, if any, to an examination, investigation, or other action. According to the instructions on the Form 11369 as well as the IRM, the Whistleblower Office bases its award determinations in large part on the form and information provided to supplement it. There is no specific space set aside on the Form 11369 for information dealing specifically with FBAR noncompliance. In addition, there are no instructions on or accompanying the form to require examiners to provide documentation relating to FBAR noncompliance. Prior to the legislative change in February 2018 to include FBAR penalties in awards, the Whistleblower Office retained in its files any FBAR-related information provided by the operating division but did not use it for the award determination process. According to Whistleblower Office officials, any information about FBAR noncompliance in its claim files was there incidentally and not collected or retained for any specific tracking purposes. These officials told us, and we found in our review, that some claim files had information about FBAR violations or penalties because the operating division examiner chose to include it in the Form 11369 narrative or in supplemental information, even though the examiner was not required to do so. Because providing FBAR information with the Form 11369 was discretionary prior to the legislative change in February 2018, Whistleblower Office officials told us that if FBAR information existed in the files at the time of the interview, it may not be complete. While having complete information about FBAR exams on the Form 11369 was not needed when IRS did not consider FBAR noncompliance as part of award determinations, now that it is defined as such by statute, the Whistleblower Office will need such information on FBAR noncompliance on Form 11369 to properly determine whistleblower awards in accordance with the new legal requirements. As of June 28, 2018, the Whistleblower Office had not updated Form 11369 or its accompanying instructions. Whistleblower Office officials told us they were reviewing and commenting on draft guidance from the Office of Chief Counsel on how to implement the new provision but had not yet updated the Form 11369 or its instructions. IRS officials did not provide a timeline for when IRS expects to update the form. Because this form asks questions specific to Title 26 tax noncompliance examiners may not have clear guidance indicating that non-Title 26 issues should be included in these answers. According to the IRM, the Form 11369 should assist the Whistleblower Office in making an award determination by explaining how the whistleblower and their information assisted IRS in taking action. By not using an updated form that reflects the technical language distinguishing between tax issues and non-Title 26 issues that IRS also enforces, the Whistleblower Office may not be able to ensure the information it collects for determining whistleblower awards that includes non-Title 26 violations is complete and accurate. When enacted on February 9, 2018, the new law immediately required information concerning FBAR violations to be included in the awards determination process. Subsequently, the Whistleblower Office and IRS started to make changes to policies and procedures to ensure award determination decisions are made fairly and with full information. The day the new statutory definition became law, IRS placed a hold on whistleblower award determinations while the Whistleblower Office developed new procedures. On February 15, 2018, IRS lifted the hold, instructing Whistleblower Office analysts to check with their managers prior to making award determinations on any claims that may include non- Title 26 proceeds. However, the Whistleblower Office did not issue any additional specific guidance to Whistleblower Office staff on how to review claims for any non-Title 26 issues until April 19, 2018. According to IRS officials, the Whistleblower Office closed 2,096 whistleblower claims between the date the law changed and April 19, 2018 when IRS issued the internal guidance. In the April 19, 2018 policy alert, later reissued as a memo on May 8, 2018, Whistleblower Office staff were instructed to look over the Form 211 for indications of FBAR or criminal activity when reviewing a Form 11369 or making award determinations. The policy alert also instructs staff to contact the FBAR Penalty Coordinator and review Special Agent’s Reports and Judgement Documents for non-Title 26 proceeds and to document the results of these reviews in E-TRAK. Issuing complete and final guidance will take time; however the Whistleblower Office did not issue any interim guidance to IRS units outside the Whistleblower Office for more than 2 months after the enactment of the statute redefining proceeds. On April 12, 2018, the Director of the Whistleblower Office issued a memo to the commissioners of the operating divisions and chief of the Criminal Investigation division. This memo stated that those working on whistleblower claims need to provide the Whistleblower Office with details of how whistleblower information was used in any actions taken regardless of whether they were Title 26 issues or not. The Whistleblower Office emailed a communication similar to the memo to other IRS employees working on whistleblower claims on April 18, 2018. The initial memo did not provide specific instructions as to how to provide such information, such as specifying to use Form 11369, but the email said additional guidance and training would be forthcoming. According to Whistleblower Office officials, the timing of the internal communication about the change in whistleblower award basis was because the Whistleblower Office was waiting on draft guidance from the IRS Office of Chief Counsel. The Whistleblower Office received this draft guidance on April 19, 2018. In late April and early May, the Whistleblower Office posted information about these changes in internal IRS media, including IRS-wide web pages and pages for individual IRS operating divisions. The Whistleblower Office specified information should be included with the Form 11369 in these later communications. However, as noted above, the Form 11369 itself and its accompanying instructions had not been updated to reflect these new requirements. The current regulations on whistleblower claims, issued in August 2014, exclude non-Title 26 proceeds from the basis for determining whistleblower awards. According to IRS officials, as of June 20, 2018, IRS had not yet started to take action on making the regulatory change. IRS, however, is in the process of updating the IRM, which serves as the primary guidance for IRS employees. Section 25.2.2 of the IRM, which provides procedures and instructions for the whistleblower award programs, defines collected proceeds for the purpose of awards as tax, penalties, interest, and additions to tax limited to amounts collected only under the provisions of Title 26. According to IRS officials, while IRM updates take time to complete, generally the IRM can be updated quicker than a regulation. The officials could not provide a timeline for when these changes would be complete. IRS can communicate to the public about statutory changes to the whistleblower program through its various external communication channels, such as its website and social media accounts. Such communications are important because whistleblowers have a limited 30- day period to appeal certain award determinations. On May 9, 2018, IRS posted an announcement about the statutory change on the Whistleblower Office page of its web site. The announcement noted the enactment of the provision redefining proceeds for the purpose of whistleblower awards and provided a link to the May 8, 2018 Whistleblower Office memorandum. This information was posted 3 months after the statutory change went into effect and a month after we notified IRS that IRS had not yet announced the change through a press release, its web site, or its Twitter account. IRS collects and maintains FBAR penalty data in a stand-alone database. According to IRS officials, they use these data to carry out IRS’s delegated duties to assess and collect such penalties. For example, the data are used for sending demand notice letters to taxpayers and tracking cases referred to the Department of Justice. According to these officials, IRS also uses information on FBAR penalty assessments and payments for a variety of related purposes including reporting FBAR data to the Financial Crimes Enforcement Network (FinCEN) and for use in annual reports to Congress. IRS also uses the database for internal management. Specifically, IRS officials stated that they use reports on inventory, penalties, and appeals for decision making. Given the February 2018 legislative change to include FBAR penalties in the definition of proceeds, the Whistleblower Office will also use FBAR penalty data for calculating some whistleblower award determinations. While FinCEN retains the rule-making authority for FBAR and is the repository of FBAR filings, IRS assesses and collects FBAR penalties from taxpayers who violate the FBAR reporting requirements. IRS also maintains the FBAR Database. While individuals file their FBAR forms through FinCEN’s online Bank Secrecy Act E-filing portal, IRS enforces these filing requirements. Following procedures laid out in the IRM, IRS examiners can access FBAR filing data from FinCEN’s database during the course of a tax examination. Information on the taxpayers’ FBAR filings is available to examiners through IRS’s Integrated Data Retrieval System, including data from filed tax and information returns. Data on FBAR enforcement actions, including penalties, are only housed in the FBAR Database. The FBAR Database is a stand-alone database maintained by the FBAR team within the Small Business/Self-Employed operating division. The FBAR Database does not interface or connect with any other IRS data sources or systems. Therefore, there is currently no mechanism for any data to automatically feed into or from the FBAR Database to cross-check with taxpayer information in other databases. When examiners open an FBAR exam, the IRM directs them to report exam and exam-outcome information to the FBAR team. Examiners fax, mail, or e-mail FBAR examination and penalty assessment information to the FBAR team which then transcribes the data into the FBAR Database manually. Within IRS, only the FBAR team has access to the database. Because the stand-alone FBAR Database is the only data source within IRS that tracks FBAR penalty assessments and payments, the FBAR team is responsible for completing all data entry as well as generating and circulating reports on FBAR enforcement actions to others within IRS. We assessed the reliability of the FBAR Database for the purposes of using limited data from this database for our own analysis. We determined that the data fields we used were sufficiently reliable for our purposes. Specifically, we matched taxpayer identification numbers in the FBAR Database to those in E-TRAK and reported on enforcement outcomes, including a limited number of penalty payments, as discussed previously. These data were the only available data within IRS on FBAR penalties and enforcement actions. Even though we found the data that we used to be sufficiently reliable for our purpose of identifying penalty information and selecting a sample of claims to review further, we identified some data control deficiencies related to data input and validation. We found certain elements of the database to have limited reliability. Because FBAR penalty information will be used for whistleblower award determinations, it is important for these data to be reliable. A key principle of federal internal control is the use of quality information. Agencies should have controls in their information systems to ensure the validity, completeness, and accuracy of data. Further, these controls should be documented. In addition, the Federal Information Security Modernization Act of 2014 (FISMA) provides for the development and maintenance of the minimum controls required to protect federal information and information systems. Among other things, FISMA requires the National Institute of Standards and Technology (NIST) to develop standards and guidelines that include minimum information security requirements on how agencies should design, protect, and manage their respective data systems. NIST’s guidance outlines appropriate data safeguards for agency data systems based on a risk- based approach. NIST guidance also states an agency’s information system should have controls to check the validity of inputs. This includes checking the valid syntax of inputs to ensure they match the specified definitions for format and content. NIST guidance also recommends controls to help ensure the information system behaves predictably, even if invalid data are entered. While FBAR team employees transcribe data manually into the database from emails or faxed or mailed paper forms, there are no procedures for data testing or validation. For example, there is no secondary check by another individual to ensure data were entered correctly and completely. The FBAR Database procedures also lack sufficient validity checks to ensure that the data entered are accurate. There are some basic data entry checks in the database, such as limiting input to alphanumeric entries and a warning if a date is more than a year from the current date. However, these checks serve only as a reminder for the employees entering the data to verify its accuracy; these checks do not prevent erroneous data from being entered and retained. Without additional controls for accuracy and validity, IRS risks relying upon inaccurate information for some of its reporting and decision making. According to IRS officials, not all fields in the FBAR Database are mandatory. In addition, some fields are new as of January 2017 and, therefore, only contain data after this time. IRS officials also told us that they are aware there are some data missing in the database, such as incomplete records for some taxpayers, but they could not quantify how often this occurs. They also told us that such missing data can contribute to inaccurate reports of FBAR total assessments. For example, if a date field is left blank, certain reports that pull data based on these date fields will not pull the records with this missing field, thereby underreporting FBAR outcomes. We found 44 records with input errors in this date field. The officials stated that they make every effort to input complete data into the database, but sometimes complete information is unavailable from the exam team. Because the FBAR data lack some reliability controls, IRS may rely on insufficient or incomplete data for reporting and decision making, including amounts of whistleblower awards. IRS officials did not have any documentation showing why or how the database was developed in November 2003. Further, IRS officials told us the only documentation on how the database is used is the FBAR Database desk guide. The desk guide provides instructions for data input; however, this guide does not include any information to describe or define the elements in the database. Standard data element definitions are intended to ensure that all users of the system define the same data in the same way and have a common understanding of their meaning. Such documentation is important for providing clear instructions to users to know what information should be input in each variable field to ensure that the type of data in each variable field is consistent. Without it, IRS and other users of the data may not have reasonable assurance that data in the database are input as intended. IRS recognized the need to address the FBAR Database and established an FBAR Improvement Project Team to review the FBAR Database and records system and make recommendations for improvements. The team was established in 2016 after reviews of database-generated reports indicated missing data. The FBAR Improvement Project Team has made recommendations to improve the overall function and reliability of the dataset, including updating FBAR policies and procedures and validating data for the report to Congress. They are also exploring automating case building by pulling taxpayer data from other IRS data sources and creating a report automation tool. As of April 2018, these recommendations had not been implemented. IRS officials were reviewing the recommendations and specific plans had not been vetted by the leadership in the relevant operating divisions. IRS officials noted that because of the small size and limited use of the database, it may be a low priority for scarce information technology resources. Until IRS develops and documents improved controls for the validity, completeness, and accuracy of data in the FBAR Database, it risks using incomplete and insufficient data for decision making. Whistleblower attorneys we spoke with referred to the former exclusion for FBAR and other non-Title 26 collections from whistleblower awards as a significant concern for them and their clients. Their concerns are important to the success of the whistleblower program because if whistleblowers are discouraged from coming forward, IRS risks losing opportunities to identify tax fraud and abuse and ultimately reduce the tax gap. This loss of help in identifying noncompliance could be significant for IRS. According to IRS, between 2007 and 2017, whistleblower information helped IRS collect $3.6 billion in tax revenue that may have otherwise gone uncollected. According to the whistleblower attorneys we spoke with, as well as information we gathered in a search of relevant literature, the estimated value of undisclosed offshore accounts may be in the tens of billions of dollars, but could be as great as hundreds of billions of dollars. Prior to the legislative change in the definition of collected proceeds, we interviewed 11 whistleblower attorneys from nine law firms about their experiences representing tax whistleblowers who submitted allegations of FBAR noncompliance to IRS. Several of these firms also had experience helping whistleblowers appeal IRS award determinations. Of these nine firms, eight firms’ attorneys told us they had refused or limited the number of whistleblowers alleging FBAR noncompliance they were willing to take on as clients when such collections were excluded from award determinations. For example, one attorney told us that his firm would take on whistleblower clients alleging FBAR violations only if there was strong evidence of tax noncompliance. An attorney with another firm reported that the firm was willing to take on such clients but advised these clients that the inclusion of FBAR penalties in any award may have to be litigated in court at the award determination phase. Further, attorneys with three of the nine firms reported fewer whistleblowers either approaching them for representation or following through on filing a claim once informed of the exclusion of non-Title 26 collections from awards. Attorneys with eight of the nine firms also reported that the exclusion of criminal fines from collected proceeds was a potential reason for whistleblowers not coming forward. We spoke with attorneys at eight of the nine firms again after the passage of the statutory change in the definition of proceeds. Most said that this was a positive step for the IRS whistleblower program and expected that more whistleblowers will come forward with information on criminal and FBAR violations. Attorneys with seven of the eight firms stated they would be willing or already had started taking on clients reporting FBAR and criminal violations. However, they cited other concerns with the program that could continue to limit their willingness to represent tax whistleblowers and discourage whistleblowers. These concerns included limits on anonymity for whistleblowers appealing Whistleblower Office decisions to the Tax Court; restrictions on filing claims anonymously; delays in award payments during the lengthy appeals process; and limited communication with the Whistleblower Office during the claim review process. According to these attorneys, for those whistleblowers who are offered an award that excludes FBAR penalty and criminal fine collections, many choose to forgo appealing the decision because it would delay their collection of any part of the award until the appeals process was complete, which can take years. Further, the whistleblower may risk losing their anonymity in an appeal. They added that some whistleblowers risk their lives and livelihoods to come forward and that anonymity is critical to their willingness to provide information to IRS. The attorneys generally stated that these issues can discourage whistleblowers, which then can limit the whistleblower program’s effectiveness. Some of the attorneys we interviewed indicated that whistleblowers may have been further discouraged from bringing information on offshore noncompliance to IRS if they believed that IRS was purposefully trying to limit whistleblower awards by assessing higher FBAR penalties and lower taxes when a whistleblower was involved. The IRM provides IRS examiners with some level of discretion about when to assess tax and FBAR penalties, subject to the facts and circumstances of each individual case. Attorneys at seven of the nine firms we interviewed expressed concern that IRS examiners may have used this discretion to assess higher FBAR penalties and lower taxes as a way to reduce a whistleblower’s potential award. However, these attorneys did not provide specific evidence of this occurring. Because of taxpayer information privacy laws, IRS limits the amount and type of information it can share with whistleblowers and their attorneys about their claims once submitted to the Whistleblower Office. To investigate this claim, we analyzed IRS data on taxpayers that were assessed FBAR penalties from tax years 2010 to 2015. We compared the proportion of FBAR penalties assessed to the overall tax and FBAR penalties assessed to a taxpayer for exams where a whistleblower was and was not involved. Our analysis did not find any evidence of a statistically significant difference between the taxpayers identified by a whistleblower and taxpayers with no whistleblower involved. The IRM lays out the steps examiners should take when determining whether FBAR penalties are warranted and how they should be assessed. These steps are independent of IRM guidance on tax examinations and assessments. IRS officials that we interviewed, including those with oversight of examiners in Small Business/Self- Employed and Large Business & International, indicated that the Title 26 tax exams and Title 31 FBAR exams are conducted independently of each other and neither influences the outcome of the other. Further, they stated that the presence of a whistleblower has no bearing on the decision of whether to assess a tax or penalty or the amount of such assessments, as previously discussed. For the IRS whistleblower program to be successful, whistleblowers need to have confidence in the program’s processes and outcomes, including paying awards when a whistleblower’s information is used. Despite IRS’s prior policy of not including non-Title 26 collections, we found some whistleblowers brought such information to IRS, and IRS assessed penalties on noncompliant taxpayers. However, according to whistleblower attorneys we spoke with, this policy of award exclusions may have discouraged other whistleblowers with significant information on FBAR reporting and tax noncompliance from coming forward. With the new statutory definition of proceeds enacted on February 9, 2018, that includes FBAR and other non-Title 26 collections, whistleblowers may now be more willing to submit claims. However, IRS has not yet fully changed some of the whistleblower program’s policies and procedures to reflect that FBAR penalties, as well as criminal fines and civil forfeitures, are now included in whistleblower awards. Because the change was effective for claims that had not had a final determination made as of February 9, 2018, the Whistleblower Office taking immediate steps to ensure it had full information from other offices and divisions within IRS about claims reaching the award determination phase would have helped IRS act on these determinations. While IRS has now taken steps to communicate the need for information about non- Title 26 actions to be included with the Form 11369, updating the form itself and its instructions will help to better ensure that complete and accurate information about such actions is reflected on the form to be provided to the Whistleblower Office for inclusion in award determinations. The FBAR Database is the only comprehensive source of information within IRS about the FBAR penalties assessed and paid. If this database does not have the controls necessary to provide reasonable assurance that the data are reliable, accurate, and complete, there is a risk that the Whistleblower Office may make award determinations based on incorrect data. We are making the following two recommendations to IRS: The Commissioner of Internal Revenue should ensure that the Director of the Whistleblower Office modifies the Form 11369 and its accompanying instructions to clarify how to document how whistleblower information was used in any IRS actions taken, regardless of whether the laws administered, examined, or enforced are outside of Title 26, such as FBAR penalties. (Recommendation 1) The Commissioner of Internal Revenue should ensure that the Deputy Commissioner for Services and Enforcement develops and documents improved controls for the validity, completeness, and accuracy of data on FBAR exams and enforcement actions. (Recommendation 2) We provided a draft of the sensitive version of this report to IRS for review and comment. IRS agreed with our recommendations and provided technical comments which we incorporated as appropriate. However, IRS deemed some of the information in their original agency comment letter pertaining to the FBAR Database to be sensitive, which must be protected from public disclosure. Therefore, we have omitted the sensitive information in the comment letter, which is reproduced in part in appendix II. These omissions did not have a material effect on the substance of IRS’s comments. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees and the Commissioner of Internal Revenue. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9110 or at mctiguej@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III. Our objectives were to: (1) describe the extent to which the Internal Revenue Service’s (IRS) Whistleblower Office included Report of Foreign Bank and Financial Accounts (FBAR) penalties in whistleblower awards prior to the statutory change; (2) examine how IRS used whistleblower information on FBAR noncompliance and how IRS responded to the statutory change in definition of proceeds; (3) describe the purposes for which IRS collects and uses data from the FBAR Database and assess the controls for ensuring data reliability; and (4) summarize what is known about the potential effect exclusions from collected proceeds, including FBAR penalties, may have had on whistleblowers bringing claims to IRS. This report is a public version of a sensitive report that we issued in August 2018. IRS deemed some of the information in our August report to be sensitive, which must be protected from public disclosure. Therefore, this report omits sensitive information about the information security safeguards of IRS’s FBAR Database as well as an associated recommendation. Although the information provided in this report is more limited, the report addresses the same objectives as the sensitive report and uses the same methodology. To address the first objective, we conducted a case file review of a generalizable stratified sample of closed 7623(b) whistleblower claims to identify how often and to what extent whistleblower claims included information about offshore accounts and FBAR violations. For this case file review, we started with the population of 10,306 7623(b) claims that had been closed by IRS between January 1, 2012 and July 24, 2017 (the time of our analysis). We identified three subpopulations of whistleblower claims from which we selected the claims we reviewed: 1. All 92 claims involving taxpayers who were identified in a whistleblower claim and who also appeared in IRS’s FBAR Database as having been subject to an FBAR examination. We designated this subpopulation as “Matched Claims.” 2. A random sample of 30 claims from a population of 299 claims that a text search within E-TRAK had identified as likely involving noncompliance with offshore account requirements, including FBAR, and that were not included in other samples. We designated this subpopulation as “Key Terms.” 3. All 10 denied claims closed in E-TRAK, the IRS Whistleblower Office’s claim tracking system, with the closing code “Denied - No Title 26 Collected Proceeds.” We designated this subpopulation as “No Title 26 Collected Proceeds.” Table 4 shows descriptive information about each of these subpopulations. The purpose of our file review was to determine how often whistleblower claims in each of our different subpopulations involved offshore accounts and allegations of FBAR violations. We reviewed all claims in our first and third subpopulations; because of the larger number of claims in the second subpopulation, we selected a random sample for review. For the 132 whistleblower claims in our review, two reviewers coded the content of each file into different categories, including: whether the Form 211, Application for Award for Original Information, included allegations of FBAR noncompliance; whether the whistleblower received a whistleblower award; and what collections were included in collected proceeds for those paid whistleblowers. To the extent there were disagreements among the reviewers’ coding for a file, a third reviewer resolved the differences. We agreed on a final coding for all of the data elements collected, recorded them in a summary document, and used these for our analysis. Because whistleblower files were not required to contain information on FBAR penalty assessments or other enforcement actions, although some of the files we reviewed did have this information, we supplemented our file review with data on FBAR enforcement actions, such as penalties and warning letters, from the FBAR Database. We assessed the reliability of the FBAR Database and E-TRAK database for the purposes of using limited data from these databases for our own analysis. We reviewed agency documents, electronically tested data for missing data and outliers, and interviewed IRS officials about these databases. These two databases are the only sources of data within IRS for whistleblower claims information and FBAR enforcement actions and outcomes. We compared data in both databases to identify individuals that were both named by a whistleblower and subject to an FBAR enforcement action. We used data from the FBAR Database for the purpose of identifying and summarizing FBAR enforcement actions taken by IRS, and we used data from the E-TRAK database to identify whistleblower claims that were likely to include allegations of FBAR noncompliance. IRS officials told us that the FBAR Database is the most reliable data source at IRS for individuals who were subject to such FBAR enforcement actions as penalty assessments. We discuss the limitations of these databases in this report, but we concluded that the elements we used in our analyses were sufficiently reliable for the purposes of identifying a sample of whistleblower claims likely to include allegations of FBAR noncompliance and FBAR enforcement outcomes. We also interviewed IRS officials concerning the processing of claims and the operation and maintenance of the E-TRAK and FBAR databases. For the second objective, we reviewed relevant portions of the Internal Revenue Manual and other IRS internal guidance and documentation and interviewed officials from IRS’s Whistleblower Office and operating divisions that handle whistleblower claims about what IRS does when it receives information from whistleblowers that include allegations of FBAR noncompliance. We also reviewed the recently enacted statutory provisions concerning the definition of collected proceeds on which whistleblower awards are based. In addition we spoke to IRS Whistleblower Office officials concerning any changes IRS plans to make in its policies and procedures as a result of the statutory change. For our third objective, we evaluated IRS’s FBAR Database to identify any control deficiencies, using as criteria Standards for Internal Control in the Federal Government, the Federal Information Security Modernization Act of 2014, and National Institute of Standards and Technology Special Publication 800-53. We electronically tested the FBAR Database for missing data, outliers, and obvious errors. We also reviewed IRS documentation on the database. In addition, we interviewed IRS officials responsible for maintaining and using the database to determine how IRS uses the data, what controls are in place, and any known limitations of the database. We also met with IRS officials and discussed the ongoing development of plans for improvement of the database. For our fourth objective, we interviewed a nonprobability sample of attorneys who have represented multiple whistleblowers who have submitted claims to the IRS Whistleblower Office under section 7623(b). The views expressed in these interviews represented only those of the attorneys who participated and are not generalizable to all whistleblower attorneys or law firms. These attorneys have a financial interest in IRS’s treatment of whistleblower claims; however, interviewing these attorneys allowed us to gather broad viewpoints on how whistleblower award exclusions may affect their professional decisions and the decision of their clients and prospective clients. We began with whistleblower attorneys whom we previously spoke with for our 2011 and 2015 reports on the IRS Whistleblower Office and requested from those attorneys names of other attorneys currently active in the IRS whistleblower community who have represented clients who submitted allegations that included FBAR noncompliance. We individually interviewed 11 attorneys from nine firms, asking the same questions of each to obtain their perspectives on the effect the exclusion of FBAR penalties and criminal fines has on the nature and volume of whistleblower complaints and on the cases they bring forward. We also attended a regularly scheduled meeting of attorneys representing whistleblowers, including some we had spoken with and several others. Following the enactment of statutory provisions defining collected proceeds for the purpose of whistleblower awards to include FBAR penalties and other non-Title 26 collections, we contacted the 11 attorneys we had previously interviewed for their views on the effect of the new legislation, and we received written responses from 8 of them. For balance, we also analyzed data on FBAR penalty and tax assessments for a sample of taxpayers who were assessed an FBAR penalty in calendar years 2010 through 2015. For all taxpayers in our sample, we identified those where a whistleblower was involved in providing IRS information about the taxpayer and those where there was no whistleblower presence. We analyzed whether there was a statistically significant difference in proportion of FBAR penalty assessments compared to tax and FBAR penalty assessments based on whether a whistleblower was involved or not using a nonparametric Wilcoxon-Mann- Whitney test. This analysis did not control for other factors that could affect the results, such as the taxpayer being willfully noncompliant with FBAR reporting requirements, the total tax assessment of the taxpayer, or the total income of the taxpayer. In addition, we interviewed IRS Whistleblower Office officials and operating division officials to discuss the relative complexity of claims involving and not involving FBAR and how the exam teams use whistleblower information related to FBAR noncompliance. The performance audit upon which this report is based was conducted from March 2017 to August 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We subsequently worked with IRS from August 2018 to September 2018 to prepare this public version of the original sensitive report for public release. This public version was also prepared in accordance with these standards. In addition to the contact named above, Tara Carter (Assistant Director), Danielle N. Novak (Analyst-in-Charge), James Ashley, Steven J. Berke, David Blanding, Amy Bowser, Andrew Emmons, Steven Flint, and Kayla Robinson made key contributions to this report.

Summary: Tax whistleblowers who report on the underpayment of taxes by others have helped IRS collect $3.6 billion since 2007, according to IRS. IRS pays qualifying whistleblowers between 15 and 30 percent of the proceeds it collects as a result of their information. However, until February 9, 2018, IRS did not pay whistleblowers for information that led to the collection of FBAR penalties. GAO was asked to review how often and to what extent whistleblower claims involve cases where FBAR penalties were also assessed. Among other objectives, this report (1) describes the extent to which FBAR penalties were included in whistleblower awards prior to the statutory change in definition of proceeds; (2) examines how IRS used whistleblower information on FBAR noncompliance, and how IRS responded to the statutory change in definition of proceeds; and (3) describes the purposes for which IRS collects and uses FBAR penalty data, and assesses controls for ensuring data reliability. GAO reviewed the files of 132 claims closed between January 1, 2012, and July 24, 2017, that likely included FBAR allegations; analyzed IRS data; reviewed relevant laws and regulations, and IRS policies, procedures and publications; and interviewed IRS officials. Prior to February 9, 2018, when Congress enacted a statutory change requiring the Internal Revenue Service (IRS) to include penalties for Report of Foreign Bank and Financial Accounts (FBAR) violations in calculating whistleblower awards, IRS interpreted the whistleblower law to exclude these penalties from awards. However, GAO found that some whistleblowers provided information about FBAR noncompliance to IRS. In a sample of 132 whistleblower claims closed between January 2012 and July 2017, GAO found that IRS assessed FBAR penalties in 28 cases. It is unknown whether the whistleblower's information led IRS to take action in all of these cases. These penalties totaled approximately $10.7 million. Had they been included in whistleblower awards, total awards could have increased up to $3.2 million. Over 97 percent of the FBAR penalties collected from these 28 claims came from 10 cases with willful FBAR noncompliance, for which higher penalties apply. IRS forwards whistleblower allegations of FBAR noncompliance to its operating divisions for further examination. However, IRS Form 11369, a key form used for making award determinations, does not require examiners to include information about the usefulness of a whistleblower's information FBAR and other non-tax issues. After Congress enacted the statutory change, IRS suspended award determinations for 1 week, but resumed the program before updating the form or its instructions, or issuing internal guidance on new information required on the Form. As of June 28, 2018, IRS had not begun updating the Form 11369 or its instructions. The lack of clear instructions on the form for examiners to include information on FBAR and other non-tax enforcement collections may result in relevant information being excluded from whistleblower award decisions. IRS maintains FBAR penalty data in a standalone database. It uses these data for internal and external reporting and to make management decisions. Because of the change in statute, IRS will need these data for determining whistleblower awards. GAO found that IRS does not have sufficient quality controls to ensure the reliability of FBAR penalty data. For example, IRS staff enter data into the database manually but there are no secondary checks to make sure the data entered are accurate. Without additional controls for data reliability, IRS risks making decisions, including award determinations, with incomplete or inaccurate data. This is a public version of a sensitive report issued in August 2018. Information on the FBAR Database that IRS deemed to be sensitive has been omitted. GAO recommends IRS update IRS Form 11369 and improve controls for the reliability of FBAR penalty data. IRS agreed with all of GAO's recommendations.