I'd argue that it's shouldn't even be only income + $xyz, it's income * (1 / chance of succesful enforcement) to reduce companies that thought that as long as it's hidden enough you'll be safe. It'll be a lot more arbitrary though.