Third Parties under Local Government Revenue Recapture Act

The Local Government Revenue Recapture Act allows a local government (i.e., a municipality or county) to contract with a third party to ensure that the local government receives the correct tax disbursement from the Illinois Department of Revenue (IDOR). The third party is allowed to review a municipality's or county's financial information related to that county or municipality's sales and use tax disbursements. A third party must adhere to all of the following to be eligible to receive this financial information:

• The third party must have entered into a confidentiality agreement with the local government in the form and manner required by IDOR prior to receiving the financial information.
• The third party must have an existing contract with the local government at the time the third party enters into the confidentiality agreement with the local government. A copy of this contract must be on file with IDOR.
• The third party must abide by the same conditions as the local government with respect to the furnishing of financial information from IDOR set forth in Section 11 of the Retailers' Occupation Tax Act (35 ILCS 120/11).
• The third party must be registered with IDOR as required by 50 ILCS 355/5-35.

With respect to taxes administered by IDOR, counties and municipalities and the third parties with which they contract are prohibited from the following:

• engaging in an audit of any taxpayer;
• assessing tax against any taxpayer;
• engaging in collection actions against any taxpayer for the tax, or
• engaging in any other action related to these taxes that by law is IDOR's responsibility.

The Local Government Revenue Recapture Act prohibits a third party from communicating directly with taxpayers within a local government about any matters related to or covered by the third party's contract with the local government. The Act also prohibits a local government from sharing financial information with another local government or another third party. A local government also may not share the findings of a third party with another local government or another third party.

The Local Government Revenue Recapture Act regulates who may register to become a third party. The Act prohibits the following persons¹ from becoming registered third parties:

• persons¹ who have been convicted of a felony related to financial crimes under any federal or state law, or employees, officers, managers, members, partners, or directors of any entity that has been convicted of a felony related to financial crimes under any federal or state law, if IDOR, after investigation and a hearing if requested by the applicant, determines that the person has not been sufficiently rehabilitated to warrant the public trust;
• persons employed by or appointed or elected to the corporate authorities of any municipality or county in Illinois, or that person's employees, contractual employees, officers, managers, or directors (An applicant also would be prohibited if any person or persons who own more than five percent of the applicant is employed by or appointed or elected to the corporate authorities of any municipality or county in Illinois.):
• persons who have been determined to be ineligible or would not be eligible to receive a certificate of registration under the Local Government Revenue Recapture Act or a license under the Illinois Public Accounting Act for any reason, or that person's employees, contractual employees, officers, managers, or directors (An applicant also would be prohibited if any person or persons who own more than five percent of the applicant has been determined to be ineligible or would not be eligible to receive a certificate of registration under the Local Government Revenue Recapture Act or a license under the Illinois Public Accounting Act for any reason.);
• persons with a family member² who is employed by or appointed or elected to the corporate authorities of any municipality or county in Illinois;
• qualified practitioners, as defined by Section 10-15 of the Local Government Revenue Recapture Act (50 ILCS 355/10-15);
• third parties owned, in whole or in part, by any entity that competes directly or indirectly with any taxpayer whose financial information the third party is seeking or receiving; and
• persons who own in whole or in part, directly or indirectly, any entity that competes, directly or indirectly, with any taxpayer whose financial information the person is seeking or receiving:
  

The Act requires third parties to register with IDOR electronically. Third party applicants can register by completing Form REG-1, Illinois Business Registration Application, using MyTax Illinois. Applicants that already have registered with IDOR to report and pay Illinois taxes (e.g., Illinois withholding income tax) can use the Register for New Tax Accounts link in MyTax Illinois to register as a third party. Applicants must attach copies of the following documents to the registration application in MyTax Illinois:

• a letter signed by an attorney or certified public accountant licensed and authorized to practice in Illinois certifying that, after due diligence, the author is of the opinion that the applicant meets the standards under Section 5-35 of the Act to act as a third party (50 ILCS 355/5-35);
• an insurance policy, as required under Section 5-37 of the Act (50 ILCS 355/5-37), issued by an insurance company authorized to transact fidelity and surety business in Illinois; and
• an attestation of good standing to do business in Illinois from the Illinois Secretary of State.

The Act also requires an annual registration fee of $15,000 to register as a third party. MyTax Illinois prompts applicants to download a voucher to print and mail with this payment.

Section 5-35 of the Act requires third parties to adhere to the following standards:

• The third party has confidentiality standards for storing encrypted data at rest, using a cryptographic algorithm, that conform to the Federal Information Processing Standard (FIPS) Publication 140-2.
• The third party uses multi-factor authentication.
• The third party uses HTTPS with at least TLS 1.2 or its successor to protect the data files while in transit between a browser and server.
• The third party adheres to best practices as recommended by the Open Web Application Security Project (OWASP).
• The third party has a firewall that protects against unauthorized use of the data.
• The third party maintains and shall continue to maintain at all times a physical location in Illinois.

As noted above, Section 5-35 of the Act requires third parties to file with IDOR and maintain in force an insurance policy issued by an insurance company authorized to transact fidelity and surety business in Illinois, which shall be for coverage of potential legal claims, including, but not limited to, penalties set forth in the Act, embezzlement, dishonesty, fraud, omissions or errors, or other financial wrongdoing in the course of providing third party services. The policy must be in the sum of $500,000 and continuous in form and run concurrently with the original and each renewal certification period unless terminated by the insurance company.

Third parties also must submit to IDOR copies of all contracts for all local governments for which the third-party will make referrals to IDOR under the Act. These contracts may be submitted using MyTax Illinois at the time the third party registers with IDOR, or the third party can use MyTax Illinois after registering to submit contracts.

Third parties may make referrals to IDOR if a review of the financial information it received from a local government reveals that local retailers' or service occupation taxes may have been underpaid. To make a referral, a third party must have an active logon to MyTax Illinois. After logging into MyTax Illinois, the third party must use the referral link to submit information regarding a possible underpayment of local tax. Upon receipt of a referral, IDOR will determine whether the referral is actionable and notify the county or municipality if the referral is not actionable, with an explanation for that decision. If the referral is actionable, IDOR will proceed according to Section 10-30 of the Act, which governs audit referrals.

The Local Government Revenue Recapture Act has strict protocols regarding third parties' handling of taxpayers' financial information. Third parties may not permanently retain this information and must permanently destroy any physical copies of the financial information if the taxpayer is not referred to IDOR within 30 days after receipt of the taxpayer's financial information from a local government, unless the third party is monitoring disbursements from IDOR on an ongoing basis for a local government. The third party also must dispose of the information within 30 days of the third party submitting a taxpayer audit referral to IDOR. Third parties must dispose of financial information in a manner that renders it unreadable, unusable, and undecipherable.

Third parties are prohibited from selling, leasing, trading, marketing, or otherwise utilizing or profiting from a taxpayer's financial information, except for a fee as negotiated by the local government. Third parties may not permanently or temporarily collect, capture, purchase, use, receive through trade, or otherwise retain a taxpayer's financial information except as authorized in the Act. Third parties may not disclose, share, or otherwise disseminate a taxpayer's financial information.

Upon registration with IDOR, third parties can be allowed access to MyLocalTax, IDOR's online portal for local governments. Access to MyLocalTax allows a third party to access certain financial reporting that IDOR provides to local governments.

Third parties must submit an activation request in MyLocalTax for each local government for which the third party has provided IDOR a contract. The local government must update its Reciprocal Agreement for Exchange of Confidential Information with IDOR to designate employees of the third party who will be allowed to access MyLocalTax for a local government's financial reporting information. IDOR will only approve activation requests submitted by employees added to the local government's reciprocal agreement. Employees of the third party must submit their own activation requests. If approved, IDOR will issue the employees an authorization notice. The employee will not have access to MyLocalTax until the activation request is submitted using information from the authorization notice.

Third parties also may use MyLocalTax to submit a referral for the local government associated with that logon.

Third parties who violate any provision of the Act shall be subject to the penalties set forth in Section 11 of the Retailers' Occupation Tax Act. Third parties who violate the Act's provisions on the retention, collection, disclosure, and destruction of financial information (see 50 ILCS 355/5-20) are subject to a civil penalty of not more than $10,000 for each taxpayer with respect to whom financial information is improperly disclosed, profited from, or disposed of in violation of the Act. The Illinois Attorney General also may impose a civil penalty not to exceed $50,000 for each instance of improper disposal of materials containing financial information.

A third party must annually provide the local government with a final summary of its review for publication. The third party is responsible for ensuring that the summary contains no personal or identifiable taxpayer information. The summary can only aggregate amounts by tax type and can make no claim of specific tax savings or revenue generation.