FinCEN Calls Attention to Payroll Tax Evasion and Workers’ Compensation Fraud in the Construction Sector

FIN-2023-NTC1 August 15, 2023
FinCEN Calls Attention to Payroll Tax Evasion and Workers’ Compensation Fraud in the Construction Sector The Financial Crimes Enforcement Network (FinCEN) is issuing this Notice to call financial institutions’1 attention to what law enforcement has identified as a concerning increase in state and federal payroll tax evasion and workers’ compensation insurance fraud in U.S. residential and commercial real estate construction industries.2 Every year across the United States, state and federal tax authorities lose hundreds of millions of dollars to these schemes, which are perpetrated by illicit actors primarily through banks3 and check cashers.4 As described in this Notice, many payroll tax evasion and workers’ compensation fraud schemes involve networks of individuals and the use of shell companies and fraudulent documents.5 These schemes further affect the local and national construction job markets, and put legitimate construction contractors and their employees at a competitive disadvantage. This Notice aligns with the anti-money laundering/countering the financing of terrorism (AML/CFT) National Priorities,6 and provides financial institutions with an overview of the underlying schemes, red flag indicators, and specific SAR filing instructions.

1. See 31 U.S.C. § 5312(a)(2); 31 CFR § 1010.100(t).
2. See, e.g., U.S. Department of Justice (DOJ), U.S. Attorney’s Office, Middle District of Florida, Press Release,
   “Jacksonville Man Sentenced To More Than Four Years In Federal Prison For Facilitating ‘Off The Books’ Pay Scheme As Part Of Conspiracies To Defraud The IRS And Workers’ Compensation Insurance Company” (Dec. 12, 2022); Internal Revenue Service (IRS)-Criminal Investigation (CI), Press Release, “Polk County Man Sentenced for Role in Construction-related Wire Fraud and Tax Fraud Conspiracy” (Jul. 12, 2022); IRS-CI, Press Release, “Couple Pleads Guilty to Conspiracy to Commit Wire Fraud and Conspiracy to Impede and Defraud the IRS” (Mar. 10, 2022); see also DOJ, U.S. Attorney’s Office, Middle District of Florida, Press Release, “Massachusetts Man Sentenced to Prison for Fraudulent Scheme to Evade Payroll Taxes and Workers’ Compensation Requirements in Construction Industry” (Jul. 7, 2021); DOJ, U.S. Attorney’s Office, District of South Carolina, Press Release, “Twelve Plead Guilty to Tax and Immigration Charges after Undercover Operation Marking Largest Criminal Tax Case in Pee Dee History” (Oct. 26, 2021); DOJ, U.S. Attorney’s Office, District of Oregon, Press Release, “Oregon Check Casher and Construction Company Operators Indicted in Payroll Tax Evasion Scheme” (Dec. 2, 2021).
3. See 31 CFR § 1010.100(d).
4. Check cashers are a type of money services business (MSB). See 31 CFR § 1010.100(ff)(2).
5. Shell companies are typically non-publicly traded corporations, limited liability companies, or other types of entities
   that have no physical presence beyond a mailing address, generate little to no independent economic value, and generally are created without disclosing their beneficial owners. See FinCEN, Beneficial Ownership Information Reporting Requirements, 87 Fed. Reg. 59,501 (Sept. 30, 2022).
6. See FinCEN, “AML/CFT National Priorities” (June 30, 2021).
   Suspicious Activity Report (SAR)
   Filing Request:
   FinCEN requests financial institutions reference this Notice in SAR field 2 (Filing Institution Note to FinCEN) and the narrative by including the following key term:
   “FIN-2023-NTC1”.

Description of Payroll Tax Evasion and
Workers’ Compensation Fraud Schemes
Payroll tax evasion and workers’ compensation fraud schemes are perpetrated through the use of shell companies and fraudulent documents. The basic structure of the scheme is as follows:
1. Individuals involved in the scheme will set up a shell company whose sole purpose is to allow
certain construction contractors to avoid paying workers’ compensation premiums as well as state and federal payroll taxes.
2. The shell company achieves this by engaging in two kinds of fraud:

• First, once established, the shell company operators take out a minimal workers’
  compensation policy and rents or sells the policy to construction contractors that employ a much larger number of workers than the policy is designed to cover, thereby committing insurance fraud.7
• Second, the shell company operators facilitate tax fraud because the contractors use the shell
  company to pay their workers “off the books,” and without paying the required state and federal government payroll taxes.8 Each step in these schemes is described further below. Insurance Fraud Step 1: As described in Figure 1 below, the scheme begins when individuals, usually part of an existing fraud network, recruit others into that network. Step 2: The new recruits establish a shell company purporting to be a legitimate subcontracting construction company and whose existence enables construction contractors with whom it partners to underbid law-abiding construction firms and evade paying the requisite payroll taxes and workers’ compensation premiums. The shell company may also engage in other illicit transactions such as money laundering.9
  7. Insurance fraud may occur under state law when a company materially and knowingly misrepresents to insurers the
  number of its employees and associated payroll to obtain a lower premium.
  8. According to law enforcement, the contractors frequently employ undocumented workers, and the scheme typically
  involves undocumented individuals setting up and running the shell companies. The shell companies may engage with a crew of undocumented workers to work on a construction project, without including those workers formally on the payroll or workers’ compensation policy: in these cases, the shell company “rents” itself to the undocumented workers for a fee.
  9. Based upon Bank Secrecy Act (BSA) reporting and other available information, FinCEN has identified money
  laundering activity by drug trafficking organizations and transnational criminal organizations that leverage these schemes to launder cash proceeds from their other criminal activity. These schemes are often part of a broader, global money laundering network that inserts cash into the U.S. financial system in small amounts, across a large number of cities, and then collects checks from the involved businesses—including shell construction companies.

Step 3: Next, the shell company operators, or other facilitators within the network, obtain a minimal workers’ compensation policy for a small number of purported employees, typically through a local insurance agent. The insurance policy enables the shell company to apply for and receive official business registration status, which can be verified through the appropriate state authority’s website. Step 4: The shell company then “rents” or sells access to its minimal workers’ compensation policy, along with its business license and any tax documents, to construction contractors (who may be complicit in the scheme), most of whom employ a larger number of workers than what the insurance policy is designed to cover. The result is that a workers’ compensation policy that was meant to cover just a handful of workers is used fraudulently to cover potentially hundreds of workers. This enables the construction contractors that have rented or purchased access to the workers’ compensation policy to avoid paying most of their workers’ compensation insurance premiums.
Figure 1
Establishment of a Shell Construction Company

Evasion of Worker Payroll Taxes
The second component of the scheme is when the construction contractors write checks payable to the shell company to facilitate “off the books” payroll and evade state and federal payroll taxes (Figure 2 below). Step 1: Construction contractors write checks payable to the shell company which creates the façade that the shell company is performing construction projects. Step 2: After the shell company operators receive the contractors’ checks from either a work crew boss or other representative, the shell company operators will take the checks to a check casher or deposit them into the shell company’s bank accounts and make bulk cash withdrawals from the company’s bank accounts. Step 3: The shell company operator will then return the cash to the construction contractor, but not before deducting a fee (typically four to ten percent) from the contractor for renting the workers’ compensation insurance policy and conducting the payroll-related cash transactions. The shell company operator may also choose to issue individual checks drawn on the shell company’s account and made out directly to each worker working for the construction contractor. Step 4: The construction contractors will then use the cash or checks to pay the workers without withholding appropriate payroll-related taxes or paying any workers’ compensation premiums.
Figure 2
Payroll Tax Evasion Scheme Transactional Steps

Construction Company Operator Sentenced to Federal Prison for Role in Payroll Tax Evasion Scheme A Portland, Oregon, area construction company operator was sentenced to federal prison for his role in a multiyear scheme to evade the payment of payroll and income taxes on the wages of construction workers. The individual, Melesio Gomez-Rivera, was sentenced to 30 months in federal prison and three years of supervised release. He was also ordered to pay $29.9 million in restitution to the Internal Revenue Service (IRS). According to court documents, he owned and operated a residential construction company called Novatos Construction. From January 2014 until December 2017, Gomez-Rivera and several other construction company owners conspired with each other and David A. Katz, the operator of Check Cash Pacific, Inc., a check cashing business with locations in the Portland area and Vancouver, Washington, to defraud the United States by facilitating under-the-table cash wage payments to construction workers. Their actions, individually and collectively, impeded and obstructed the IRS’s ability to compute, assess, and collect payroll and income taxes due on the cash wages. To carry out the scheme, Gomez-Rivera and the other company owners cashed or had other individuals cash millions of dollars in payroll checks at various locations of Katz’s check cashing business, used the cash to pay construction workers under-the-table, and filed false business and payroll tax returns. In total, the group cashed approximately $192 million in payroll checks, causing a combined employment and individual income tax loss of $68 million. On December 2, 2021, a federal grand jury in Portland returned a five-count indictment charging Gomez-Rivera, Katz and four other individuals with conspiring with one another to defraud the United States. Katz was additionally charged with four counts of filing false Currency Transaction Reports (CTRs) with FinCEN. On March 1, 2023, Gomez-Rivera became the first of the six co-conspirators to plead guilty. All others are awaiting trial, presently scheduled to begin on December 5, 2023.10 Select Red Flag Indicators of Construction-Related Payroll Tax Evasion and Workers’ Compensation Fraud FinCEN, in coordination with the Internal Revenue Service-Criminal Investigation (IRS-CI) and Homeland Security Investigations (HSI), has identified a range of red flags to assist financial institutions in detecting, preventing, and reporting suspicious transactions associated with shell companies perpetrating payroll tax evasion and workers’ compensation fraud in the construction industry. No single red flag is determinative of suspicious activity, and financial institutions should consider the surrounding facts and circumstances, such as a customer’s historical financial activity, whether the transactions are in line with prevailing business practices, and whether the customer exhibits multiple red flags, before determining if a transaction is
indicative of payroll tax evasion and workers’ compensation fraud or is otherwise suspicious.
10. See DOJ, U.S. Attorney’s Office, District of Oregon, Press Release, “Construction Company Operator Sentenced to
Federal Prison for Role in Payroll Tax Evasion Scheme” (May 31, 2023).

The customer is a new (i.e., less than two years old) small construction company specializing in one type of construction trade (e.g., framing, drywall, stucco, masonry, painting, etc.) with minimal to no online presence and has indicators of being a shell company for illicit activity.11 The person or company opening the account has no known prior involvement with, or in, the construction industry, and the individual opening the account provides a non-U.S. passport as a form of identification. Beneficial owners of the shell company have no known prior involvement with, or in, the construction company and may have prior convictions involving fraud. The company’s recently acquired workers’ compensation insurance policy, which may be verifiable through an official state website, was issued within the last year and covers only a small number of employees. However, a high volume of transactions is observed in the company’s bank accounts, which is not commensurate with a construction company of that size. A customer receives weekly deposits in their account that exceed normal account activity from several construction contractors involved in multiple construction trades (e.g., framing, drywall, stucco, masonry, painting, etc.). The deposits may be conducted from locations in multiple cities or states. A customer engages in behavior that suggests efforts to evade CTR filing requirements (e.g., the account holder or company representative alters or cancels a transaction when advised a CTR would be filed or engages in structuring with multiple check payments for under $10,000). A representative of the construction company conducts large or unusual volumes of cash withdrawals or negotiation of checks for cash when accompanied by another involved person(s) or using an armored car service to deliver bulk cash.12 Large volumes of checks for under $1,000 are drawn on the company’s bank account and made payable to separate individuals (i.e., the workers), which are subsequently negotiated for cash by the payee. The company’s bank account has minimal to no tax- or payroll-related payments to the IRS, state and local tax authorities, or a third-party payroll company despite a large volume of deposits from clients.
11. See FinCEN, “The Role of Domestic Shell Companies in Financial Crime and Money Laundering: Limited Liability
Companies” (Nov. 2006), at p. 4.
12. The involved person(s) may be providing security for the account holder because of the large amount of cash being
withdrawn. In some cases, the involved person(s) may also be the driver if the account holder does not have a driver’s license.

The Internet Protocol (IP) address identified from the account holder’s online banking activity also may be associated with the online banking activity for another customer involved in the same type of purported construction-related activity. The account holder or company representative makes statements to bank tellers or check cashers that the purpose of the cash withdrawals, negotiation of checks for cash, or check cashing activity is for payroll and the volume, amount, and frequency of transactions are uncharacteristic for a construction company with a small number of employees. Reminder of Relevant BSA Obligations and Tools for U.S. Financial Institutions Suspicious Activity Reporting Other Relevant BSA Reporting USA PATRIOT ACT Section 314(b) Information Sharing Authority Suspicious Activity Reporting A financial institution is required to file a SAR if it knows, suspects, or has reason to suspect a transaction conducted or attempted by, at, or through the financial institution involves funds derived from illegal activity; is intended or conducted to disguise funds derived from illegal activity; is designed to evade regulations promulgated under the BSA; lacks a business or apparent lawful purpose; or involves the use of the financial institution to facilitate criminal activity.13 All statutorily defined financial institutions may voluntarily report suspicious transactions under the existing suspicious activity reporting safe harbor.14 When a financial institution files a SAR, it is required to maintain a copy of the SAR and the original or business record equivalent of any supporting documentation for a period of five years from the date of filing the SAR.15 Financial institutions must provide any requested documentation supporting the filing of a SAR upon request by FinCEN or an appropriate law enforcement or supervisory agency.16 When requested to provide supporting documentation, financial institutions should take special care to verify that a requestor of information is, in fact, a representative of FinCEN or an appropriate law enforcement or supervisory agency. A financial institution should incorporate procedures for such verification into its BSA compliance or AML program. These procedures may include, for example, independent employment verification with the requestor’s field office or face-to-face review of the requestor’s credentials.
13. See 31 CFR §§ 1020.320, 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320, 1029.320, and 1030.320.
14. See 31 U.S.C. § 5318(g)(3). Financial institutions may report suspicious transactions regardless of amount involved
and still take advantage of the safe harbor.
15. See 31 CFR §§ 1020.320(d), 1021.320(d), 1022.320(c), 1023.320(d), 1024.320(c), 1025.320(d), 1026.320(d), 1029.320(d),
1030.320(d).
16. Id. See also FinCEN, “Suspicious Activity Report Supporting Documentation” (June 13, 2007).

SAR Filing Instructions
SARs, and compliance with other BSA requirements, are crucial to identifying and stopping payroll tax evasion and workers’ compensation fraud schemes. FinCEN requests that financial institutions indicate a connection between the suspicious activity being reported and the activities highlighted in this Notice by including the key term “FIN-2023-NTC1” in SAR field 2 (Filing Institution Note to FinCEN), as well as in the narrative. Financial institutions may highlight additional advisory or alert keywords in the narrative, if applicable. Financial institutions should select SAR Field 34(z) (FRAUD-Other) as the associated suspicious activity type and include the term “Payroll tax evasion” and/or “workers compensation” in the text box. Financial institutions also should select all other relevant suspicious activity fields, such as those in SAR Fields 36 (Money Laundering) and 38 (Other Suspicious Activities), if applicable. Financial institutions should include any and all available information relating to the account and locations involved in the reported activity, identifying information related to other entities and persons involved in the depositing or cashing of suspicious checks and the status of their accounts with the institution. Financial institutions also should provide any and all available information regarding other domestic and foreign financial institutions involved in the activity; where appropriate, financial institutions should consider filing a SAR jointly on shared suspicious activity.17 Law enforcement has found the following types of information, when included as a part of the SAR or when kept as supporting documentation that law enforcement can request, valuable to their investigations:

• Customer profile information for the shell company and owner.
• Spreadsheet of transactional details associated with the suspicious activity.
• Examples of deposited or cashed items described in the SAR, including copies of the fronts
  and backs of checks.
• Examples of checks paid or cashed that were described in the SAR, including copies of the
  fronts and backs of checks.
• Bank or MSB surveillance footage of the subject(s) of the SAR withdrawing cash or
  negotiating checks that has been taken inside the branch or agent location (particularly if the customer does not have a driver’s license as law enforcement may not have a picture of the person otherwise available), as well as outside before and after the transaction; this may capture footage of the meetings that frequently occur just outside the bank or MSB branch or agent location to disperse the cash to the contractor or crew bosses.

17. See 31 CFR §§ 1020.320(e)(1)(ii)(A)(2))(i), 1021.320(e)(1)(ii)(A)(2)), 1022.320(d)(1)(ii)(A)(2), 1023.320(e)(1)(ii)(A)(2)(i),
    1024.320(d)(1)(ii)(A)(2), 1025.320(e)(1)(ii)(A)(2), 1026.320(e)(1)(ii)(A)(2)(i), 1029.320(d)(1)(ii)(A)(2), 1030.320(d)(1)(ii)(A) (2).

• Any statements made by the subject(s) regarding the basis for the transaction(s).
• IP address information associated with the subject’s online banking sessions.
  Other Relevant BSA Reporting Requirements
  Financial institutions and other entities or persons also may have other relevant BSA reporting requirements to provide information in connection with the subject of this Notice. These include obligations related to the CTR,18 Report of Cash Payments Over $10,000 Received in a Trade or Business (Form 8300),19 Report of Foreign Bank and Financial Accounts (FBAR),20 Report of International Transportation of Currency or Monetary Instruments (CMIR),21 Registration of Money Services Business (RMSB),22 and Designation of Exempt Person (DOEP).23 These standard reporting requirements may not have an obvious connection to illicit finance, but may ultimately prove highly useful to law enforcement. Form 8300 Filing Instructions When filing a Form 8300 involving a suspicious transaction relevant to this Notice, FinCEN requests that the filer select Box 1b (“suspicious transaction”) and include the key term “FIN￾2023-NTC1” in the “Comments” section of the report. Information Sharing Information sharing among financial institutions is critical to identifying, reporting, and preventing payroll tax evasion and workers’ compensation fraud. Financial institutions and associations of financial institutions sharing information under the safe harbor authorized by
  section 314(b) of the USA PATRIOT Act are reminded that they may share information with
  one another regarding individuals, entities, organizations, and countries suspected of possible terrorist financing or money laundering.24 FinCEN strongly encourages such voluntary information sharing.

18. A report of each deposit, withdrawal, exchange of currency or other payment or transfer, by, through, or to a financial
    institution that involves a transaction in currency of more than $10,000. Multiple transactions may be aggregated when determining whether the reporting threshold has been met. See 31 CFR §§ 1010.310-313, 1020.310-313, 1021.310- 313, 1022.310-313, 1023.310-313, 1024.310-313, and 1026.310-313.
19. A report filed by a trade or business that receives currency in excess $10,000 in one transaction or two or more related
    transactions. The transactions are required to be reported on a joint FinCEN/IRS form when not otherwise required to be reported on a CTR. See 31 CFR § 1010.330; 31 CFR § 1010.331. A Form 8300 also may be filed voluntarily for any suspicious transaction, even if the total amount does not exceed $10,000.
20. A report filed by a U.S. person that has a financial interest in, or signature or other authority over, foreign financial
    accounts with an aggregate value exceeding $10,000 at any time during the calendar year. See 31 CFR § 1010.350; FinCEN Form 114.
21. A form filed to report the transportation of more than $10,000 in currency or other monetary instruments into or out
    of the United States. See 31 CFR § 1010.340.
22. A form filed to register an MSB with FinCEN, or to renew such a registration. See 31 CFR § 1022.380.
23. A report filed by banks to exempt certain customers from currency transaction reporting requirements. See 31 CFR §
    1010.311.
24. See FinCEN, “Section 314(b) Fact Sheet” (Dec. 2020).

For Further Information
FinCEN’s website at https://www.fincen.gov/ contains information on how to register for FinCEN Updates. Questions or comments regarding the contents of this Notice should be addressed to the FinCEN Regulatory Support Section at frc@fincen.gov. If you have immediate information to share with law enforcement regarding this or any other payroll tax fraud, please contact the IRS-CI field office nearest you (or your state tax authority).25 If you would like to report criminal activity relating to this or any other form of workers’ compensation, insurance, labor exploitation or wire fraud, please contact HSI at 1-866-347-2423. The mission of the Financial Crimes Enforcement Network is to safeguard the financial system from illicit use, combat money laundering and its related crimes including terrorism, and promote national security through the strategic use of financial authorities and the collection, analysis, and dissemination of financial intelligence.
25. For contact information of an IRS-CI field office near you, see IRS-CI, “2022 Annual Report” (Nov. 3, 2022), pp. 23-43.