Three perspectives on the Panama Papers: Law enforcement, compliance experts and policy makers

The leak of more than 11 million records from a Panamanian law firm revealing how offshore secrecy apparently helped shield political leaders, fraudsters and drug traffickers will be required reading for compliance officers, a “goldmine” for investigators and could force global policy changes to bring shadowy beneficial owners to light.

The information, published last week by the International Consortium of Investigative Journalists (ICIJ), German newspaper Süddeutsche Zeitung and other news organizations, involves Panama City-based Mossack Fonseca, and highlights a loophole considered one of the most powerful tools employed by organized crime groups, corrupt politicians and terror financiers: shell companies with impenetrable ownership structures.

The virtual gushing geyser, considered the largest such leak in history, involves the secretive assets of some 140 public servants and political powerbrokers, including past and present leaders of China, Iceland, Pakistan, Russia, Saudi Arabia and other jurisdictions. In the wake of the leak, Iceland’s prime minister last week stepped down due to certain undisclosed financial dealings.

The papers also show that some of the world’s largest banks, including UBS, HSBC and others worked “hand in glove” with Mossack Fonseca to create anonymous corporate shells for the “superrich, politicians and criminals keep their assets under wraps.”

More than 500 banks, their subsidiaries and branches registered nearly 15,600 shell companies with Mossack Fonseca, according to the ICIJ. To view an interactive map of the various disclosures, individuals involved and whether or not there are politics at play, please click here.

The Panama papers leak will “put more pressure on legislators to think more seriously about some of the plans being proposed on beneficial ownership registries” and related rules that could capture company formation agents, attorneys and financial institutions, said Chris Focacci, the Chief Information Officer, at New Jersey-based TransparINT, a compliance technology firm.

Banks have already started running the names against internal databases and proprietary, algorithm-driven search engines, said Focacci, a former compliance officer at several large domestic and international banks, citing the queries surging through the company’s platform.

The leak presents both opportunities and pitfalls for those involved in financial crime compliance, investigations and the government and civil society groups pushing for global corporate transparency, including:

  • For named banks: For the banks named in the leak, they must quickly get their compliance houses in order, scrutinizing their exposure to the shell entities, underlying clients and their associates to see if there were any missteps in customer due diligence, monitoring or failure to file suspicious activity reports.
  • Sanctions exposure: If these banks also missed reporting on any sanctioned entities or tax evaders, now is their time to quickly report that to the US government – something that will help mitigate the damage, but not alleviate all penalty exposure or the painful remediation to come.
  • For compliance officers: The names of the companies, individuals behind them and associates must now be crossmatched with current and prior customer databases, transaction logs and viewed with fresh eyes to see if the new information reaches the threshold of creating a suspicious activity report. What banks have done in response to the leak and names will likely be one of the first things they get asked during their next regulatory financial crime compliance exam.
  • US, international investigators: The names will represent a treasure trove to law enforcement and federal investigators the world over. They will run the names against current and cold investigations and start new inquiries tied the companies now that they finally have the names of the secretive entities pulling the strings.
  • Policy makers, civil society: The magnitude of the leak, and contextual point that this is all coming from just one law firm in one secrecy jurisdiction, could represent a tipping point that forces jurisdictions like the United States to crack open corporate secrecy.
  • Congressional roadblocks: In this country, for instance, congressional initiatives to require company formation agents to get this information and provide in some centralized database have failed and a current proposal to require banks to capture the information still leaves institutions with no way to check if the information they are given is accurate.
  • National response: At the national level, the US could require banks to raise the risk of dealing with countries that allow anonymous ownership structures.
  • International outrage: At the international level, groups like the Paris-based Financial Action Task Force (FATF), Organisation for Economic Cooperation and Development (OECD), United Nations, and others, could institute a new blacklist for countries that use opaque ownership structures as a selling point.

Panama papers scandal 2016 vector graphic

Panama Papers snapshot: by the numbers

  • Files reveal the offshore holdings of 140 politicians and public officials from around the world
  • Current and former world leaders in the data include prime ministers of Iceland and Pakistan, the president of Ukraine, and the king of Saudi Arabia
  • More than 214,000 offshore entities appear in the leak, connected to people in more than 200 countries and territories
  • Major banks have driven the creation of hard-to-trace companies in offshore havens

Source: ICIJ

Compliance challenges ahead

For banks named in the leak, there are several avenues of exposure, Focacci said.

The most troublesome is if the bank was actively helping individuals set up shell companies and evade taxes, while the less quarrelsome, but no less important, is if the bank simply whiffed on due diligence and customer risk ranking duties, allowing a company to transact without knowing the person behind the veil, he said.

In the eyes of a regulator or investigator, that could denote weak training or a lack of authority for AML compliance staff or worse, missed instances of suspicious activity that should have been filed, but weren’t, because the institution couldn’t put all the disparate data points together.

“If I am a bank and I get a hit on the name, I have to go back and check policies and procedures,” Focacci said. “A key question is did I do enough due diligence. The bank might have to do a lookback on these companies to ensure there isn’t something it should have found.”

Moreover, even if a bank didn’t help the individuals set up the shell companies, it still can “face major exposure if the anonymous companies became a client of the bank later, or sent money through the bank,” he said. “

Apart from potential penalties for compliance lapses, banks could face more direct fines if the individual controlling any of the anonymous companies was blacklisted by the United States, other countries or the United Nations, he said.

In the US for instance, the government body responsible for the country’s sanctions programs, the US Treasury’s Office of Foreign Assets Control, has a zero liability standard for violations, even if the bank didn’t know it was aiding a sanction entity.

Expanding the lens out from companies to countries, banks are also likely to raise the risk ranking of Panama and engage in a broad re-scoring of countries the world over not based on the classic risk indicators, such as AML rules and implementation, but on if the country is considered a secrecy haven and allow anonymous shell companies.

“Before this leak, countries had individual high risk and low risk scores, but now that may change,” Focacci said. “Now, just because a company or country has a connection to Panama, that could make them high risk.”

The 10 banks that requested the most offshore companies for clients

Folder tabs with focus on offshore account tab. Business concept image for illustration of tax evasion.


More than 500 banks, their subsidiaries and branches registered nearly 15,600 shell companies with Mossack Fonseca, according to ICIJ’s analysis. HSBC and its affiliates created more than 2,300 in total.

Source: The Panama Papers Read more

Alleged bank offenders have rap sheet

The data points obtained by the group – it’s still unclear if the information was purloined by an insider, hacker or other avenue – include potential incriminating information on several banks that have already been penalized heavily by the U.S. Department of Justice, paying billions of dollars for violating anti-money laundering, sanctions and tax laws.

HSBC paid $1.92 billion in 2012 for violating AML laws and sanctions rules tied to violent Mexican drug cartels and blacklisted regimes.

In a statement, the bank stated offshore accounts can only stay open if they are “thoroughly vetted” for KYC checks, if authorities request the account stay open for case creation purposes or if the account is frozen under sanctions policies.

In tandem, Commerzbank, Credit Suisse, Société Générale and UBS have together paid more than $3 billion for helping US citizens evade taxes and sanctioned regimes evade bank filtering systems, also allegedly created thousands of shell operations with the firm in Panama.

Mossack Fonseca itself has had very light brushes with US authorities up until the Panama Papers leak. The law firm was mentioned as the “care of” entity tied to the 2008 sanctions designation of Ridgepoint Overseas Development Ltd before delisting the company in 2014.

Beyond that, the ICIJ notes that Mossack Fonseca aided some dozens of individuals and companies that have been included on U.S. sanctions lists, according to ICIJ, including:

  • 33 companies and people blacklisted by the U.S. government appear in Mossack Fonseca’s files
  • Alleged terrorism and nuclear weapons financiers from the Middle East and North Korea, arms traders and backers of Syria’s barrel bombings found in files
  • Mossack Fonseca employees repeatedly acknowledged failing to properly check blacklisted customers

As the ICIJ points out, many of the companies set up for the banks’ customers “were used for legitimate purposes. But some have also been used to mask unscrupulous or criminal activity, serving as fronts for dictators, fraudsters and drug dealers.”

The group reported that the “structures UBS created through Mossack Fonseca ranged from offshore companies controlled by Muhammad bin Nayef bin Abdulaziz Al Saud, the Crown Prince of Saudi Arabia, to companies controlled by Roberto Videira Brandão, convicted of fraud in the collapse of a Brazilian bank, and Marco Tulio Henriquez, a Venezuelan banker and fugitive charged by the U.S. Department of Justice with money laundering for drug cartels.”

Compliance, investigative ‘shockwaves’

Banks across the globe are likely already running any names, companies and entities publicized in the leak through customer databases and historical transaction logs, said Kenneth Hines, an independent consultant at Hines Consulting USA based in Seattle Washington, and a former Director of Operation with IRS CI.

“This is going to send shockwaves” through the banking world, he said. “Some of them might not know their clients have these offshore accounts” or vice versa that some of the companies these banks have ties to are controlled by high-risk, illicit or sanctioned individuals, he said.

Foreign banks may also have US taxpayers hidden behind the offshore corporations, which mean they could be in violation of the Foreign Account Tax Compliance Act (FATCA).

If the foreign bank has already signed on to FATCA, a far-reaching law that requires foreign banks to search for and report on their US customers – either to the IRS or their own government – and the bank now finds it has a host of US customers when previously reporting it didn’t, the institution could be presented with several legal conundrums.

If the foreign bank is an approved foreign financial institution under FATCA, and the bank is found now to have US clients, they would be in violation of the agreement, Hines said. The bank then has to find out if that happened only because of some individual mistakes or people, or is a systemic problem.

It could just be that the bank failed to do enough due diligence on a corporation or worse, that certain pockets of foreign bank executives are actively helping customers to create shell companies, doing it themselves or directing them to other law firms, to evade taxes or move the proceeds of corruption.

Furthermore, if the individuals behind the anonymous companies, are American and told a foreign bank they didn’t have any US funds or assets, they could be viewed as having lied to the IRS, Hines said.

If the people behind the anonymous companies tried to mislead the IRS, “they now run the risk of criminal prosecution” for providing false documents.

For civil and criminal investigators, the information coming out in the leak “is a goldmine,” Hines said. “They can do name searches for active investigations or ones that have gone cold because they were waiting on information.”

Global KYC frameworks could be ‘refurbished’

The massive leak may be garnering new attention to Panama, but for several years, it has been “one of the hottest spots in the world where things happen for creating offshore accounts, tax evasion and creating anonymous companies,” said Marius-Cristian Frunza, a partner at Schwarzthal Kapital in France, and author who studies financial crime from an economics perspective.

Moreover, in certain cases, if someone invests beyond a certain threshold in a Panamanian bank account, it can be as low as $1,500, the individual can be eligible to get a passport and become a citizen, “pretty easily making Panama your main tax domain country.”

Panama offers a range of residency and citizenship options depending on the amount of the investment. In some cases, individuals can become residents for only a few thousands dollars, while citizenship options vary widely depending on how quickly someone wants that to happen. Anecdotal and publicized information on offshore investment websites state that citizenship in some cases can be obtained for as low as $5,000 and be official in five years or cost in the hundreds of thousands to lower the time frame to a year or two.

Panama is just one symptom of a great problem: that there are dozens of jurisdictions around the world that not just offer anonymous shell companies, but also know of each other to help safeguard individuals getting attention from authorities, Frunza said.

“This problem goes beyond Panama,” he said. “It’s not the issue, because there are other countries doing the same thing and have been for many times. And all of the jurisdictions are integrated, kind of like a global platform. So people can stay in one country a few years, and easily pick up to another secrecy jurisdiction when there is a change in regulations” to more transparency.

Large, global law firms and with operations in secrecy jurisdictions are also likely to get more scrutiny from global banks, he said.

“There are a lot of law firms doing this” beyond Panama, Frunza said. “They call themselves specialized tax firms, accounting or legal firms and there will set up anonymous companies for a fee. They are not even true law firms or certified accounts. They just take business, harbor it in their country to ensure it’s anonymous. These firms are unregulated and unknown without any financial supervisors.”

In addition to direct issues, global banks may have to review their correspondent links to Panama and Panamanian financial institutions, Frunza said.

On the regulation side, some of the KYC frameworks in countries globally “could be refurbished,” Frunza said. “People will not only have to do KYC on a company, but networks of companies” and the individuals behind the firms and how they are interlocked in certain industries and regions. “You have heard of KYC and KYE. Now a new term will enter: KYN, which standards for know your network of clients.”

Some banks also just need to use a bit of common sense and get to know geography to realize if a company is trying to hide something, he said.

In some instances, companies have even registered that they operate on islands so small and remote that “the islands are uninhabited, it’s a no man’s land,” Frunza said, adding that if a bank has never even heard of the place the company is allegedly operating or incorporated, that is itself a whopping red flag.

“The Panama Papers show the critical importance of all countries fully and effectively implementing the FATF standards, especially in relation to beneficial ownership,” said David Lewis, FATF executive secretary.

“Under scrutiny from FATF Panama has acted to do this in the last 12 months,” he said in a statement. “They and other countries now need to enforce these measures; and not just those with nice beaches.”