Federal RICO claims can be brought as civil lawsuits or as criminal prosecutions. (Most statutes have state laws parallel to the Federal RICO statute with both civil lawsuits and criminal prosecutions as potential offenses, with the statute of limitations and the time it accrues, i.e. starts to run, depending upon state law which can vary considerably from the federal model.)
Determining the starting date is not straight forward in either case, because the underlying nature of the offense is complex.
When Does The Civil Claim Accrue?
The statute of limitations for a civil RICO lawsuit is four years from the date of injury and discovery of the offense. Agency Holding v. Malley-Duff, 483 U.S. 143 (1987). The official syllabus to that U.S. Supreme Court opinion explains that:
The 4-year statute of limitations applicable to Clayton Act civil
enforcement actions, 15 U.S.C. § 15b, applies in RICO civil
enforcement actions. Because the predicate acts that may establish a
civil RICO violation are far ranging and cannot be reduced to a single
generic classification, and because important RICO concepts were
unknown to common law, there is a need for a uniform limitations
period for civil RICO in order to avoid intolerable uncertainty for
parties and time-consuming litigation. The Clayton Act offers the
closest analogy to civil RICO, in light of similarities in purpose and
structure between the statutes, and the clear legislative intent to
pattern RICO's civil enforcement provision on the Clayton Act's.
Moreover, the Clayton Act provides a far closer analogy to RICO than
any state statute. It is unlikely that Congress intended state
"catchall" statutes of limitations to apply, or that such statutes
would fairly serve the federal interests vindicated by RICO, and, in
those States that do not have catchalls, any selection of a state
statute would be at odds with RICO's sui generis nature. RICO cases
commonly involve interstate transactions, and the possibility of a
multiplicity of applicable state limitations periods presents the
dangers of forum-shopping and of complex, expensive, and unnecessary
litigation. Application of a uniform federal period also avoids the
possibility that application of unduly short state periods would
thwart the legislative purpose of providing an effective remedy.
Section 15b is preferable to the "catchall" federal 5-year statute of
limitations that applies in RICO criminal prosecutions, since that
statute does not reflect any congressional balancing of the competing
equities unique to RICO civil enforcement actions.
In a civil RICO case one must show that two predicate crimes under the statute were committed in a way that was continuous or related that continued for at least a year and caused damages to the plaintiff or plaintiffs.
So, the statute of limitations for a civil RICO lawsuit can't start sooner than one year after the first offense, and can't start sooner than the time that the second offense is committed. Whether the offense is continuous or not with respect to the plaintiff depends upon the nature of the underlying predicate offense.
Most often, civil RICO cases are based upon some form of fraudulent activity, which depending upon the underlying facts, could happen in a single transaction for each plaintiff, or could happen for a sustained period of time.
For example, if a company charges a class of customers credit cards a certain dollar amount every month that was never authorized by any of them, for a period of years, that might be a single continuing violation. But if a company adds charges that weren't actually incurred to a single foreclosure sale bid in hundreds of transactions, as to that plaintiff, the injury would occur at the time that the foreclosure occurred.
In a fraud based civil RICO case, usually, the date of the discovery of the fraud, and not the injury, will be the start of the statute of limitations, because the victims of the fraud wouldn't have suffered the injury if they'd been aware that it was caused by fraud at the time.
Often, the discovery is the result of investigative journalism, or from facts revealed in the discovery process (i.e. the process of formal court supervised pre-trial investigation of a case) in a case that didn't originally involve allegations of fraud and turns out to impact many, many plaintiffs (which is why most civil RICO cases involve many plaintiffs or class action lawsuits).
The fact that the actions of the corrupt organization which, together with its participants in the organization, is the defendant in the lawsuit has ceased operations and also ceased criminal activity before the wrongdoing is discovered isn't important for the civil statute of limitations in the fact pattern of this question.
If the victims only discover the wrongdoing in year 7 then that is when the four year statute of limitations starts to run on civil RICO lawsuits brought by those victims. So, the statute of limitations for civil lawsuits by these victims will have expired sometime in year 11.
When does the criminal statute of limitations begin?
The statute of limitations for a criminal prosecution is five years from when the offense is committed. 18 U.S.C. § 3282
In criminal RICO prosecutions, in contrast, discovery is irrelevant, and the statute of limitations will typically begin to run when the continuous course of criminal conduct ends, in year 5 in the example of the question. So, the criminal statute of limitations will have expired sometime in year 10.
But, there is room to argue, for example, that there was not one course of criminal conduct, but several, and that there were distinct sub-enterprises which engaged in criminal conduct, and that the statute of limitations should be applied separate to each course of criminal conduct and each criminal enterprise.
Also, in a criminal RICO prosecution, the statute of limitations could run at different times as to different defendants. Maybe the organization as a whole is subject to the latest statute of limitations, but maybe one particular individual defendant was only involved for the first three years and then broke all ties with the organization and left it. The statute of limitations as to that one individual defendant might begin when that individual left the organization, and not when the enterprise as a whole ceased to engaged in criminal activity.
Furthermore, while the conduct that gives rise to civil liability and the conduct that gives rise to criminal liability are superficially almost identical (except that causation of injury doesn't have to be shown in a criminal case), in practice, criminal RICO prosecutions are typically much closer to what one stereotypically thinks about as organized crime, like drug dealing, prostitution rings, protection rackets, and loan sharking by gangs and cartels, rather than the institutionalized fraud by seemingly legitimate business activity done in a fraudulent way that is the typical basis of a civil RICO lawsuit. So, the way that the statute of limitations is applied to particular fact patterns is often, in practice, very different for civil RICO lawsuits and criminal RICO prosecutions.