Are Your Company’s Legal, Due-Diligence, De-risking, or Compliance Obligations Impacted by the “Panama Papers”?

A. Introduction
In an unprecedented event earlier this week, 11.5 million files from the Panamanian law firm Mossack Fonseca were allegedly leaked.  Assuming they are genuine, as appears to be the case, these “Panama Papers” offer a behind-the-scenes look at over 200,000 offshore shell companies—and, in some instances, their high-net-worth or politically exposed ultimate beneficial owners.  Numerous government and media probes are now expected to begin to investigate whether these companies were used to hide illicit funds, launder money, receive bribes, commit “kleptocracy,” or evade taxes at the highest levels of government and society.  Some public allegations include a suspected billion-dollar money-laundering ring associated with Russian President Vladimir Putin while others allege that Iceland’s Prime Minister did not properly declare his interests in his wife’s wealth—an accusation that already led to his resignation.

Mossack Fonseca (and, indeed, many other firms) provides numerous legal, accounting, and banking services in Panama and worldwide.  Often operating in the Bahamas, the British Virgin Islands, Costa Rica, Cyprus, Hong Kong, Malta, Seychelles, Switzerland, or other jurisdictions perceived as having favorable business climates but higher risks for financial crime, these firms market to legitimate clients seeking privacy, anonymity, lower taxes, or effective wealth management.  Indeed, forming holding companies, shell companies, or trusts and administering them for a fee is not inherently illegal.  As noted by several criminal and civil enforcement agencies, though, these types of special-purpose vehicles may be used for criminal purposes to obscure ultimate beneficial owners that are on sanctions lists or otherwise improperly taking money from governments, contracts, or criminal interests around the world.

This alert notes the previous guidance that regulators have issued on the risks associated with shell companies and discusses how these regulators will likely investigate the numerous entities named in the Panama Papers.  This increased scrutiny by regulators will affect companies dealing with these entities and also elevates the standard for what regulators will expect from companies doing business with or through such similarly structured entities in the future, particularly in the financial-services and anti-corruption contexts.

B. Financial institutions have stringent compliance obligations with regard to shell companies
In 2006, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) issued specific guidance noting money-laundering concerns with shell companies, which are non-publicly traded companies that “typically have no physical presence . . . and generate little to no independent value.” [1]  The Panama Papers offer evidence of such concerns being well-founded because, in practice, the true owners of money may be hidden behind layers of facilitators and intermediaries.  “The use of shell companies provides an opportunity for foreign or domestic entities to move money by means of wire transfers or other methods, whether directly or through a correspondent banking relationship, without company owners having to disclose their true identities or the nature or purpose of transactions.” [2]  FinCEN requires financial institutions with operations in the United States to monitor transactions and file Suspicious Activity Reports involving such companies, particularly when (1) due diligence cannot identify the true originators and beneficiaries of transactions, (2) transaction patterns are inconsistent with normal business activity, (3) payments have no stated purpose, (4) client goods or services provided do not appear to match the client’s industry or known profile, (5) clients share the same address or rely solely on registered agents, (6) an unusually large number of people receive money from one client, (7) clients or beneficiaries are “located in high-risk, offshore financial centers[,]” and (8) multiple payments “between shell companies occur with no apparent legitimate business purpose.” [3]

In 2010, FinCEN issued joint guidance with the Securities and Exchange Commission (“SEC”), the Board of Governors of the Federal Reserve System, and several other regulators “to clarify and consolidate existing regulatory expectations for obtaining beneficial ownership information for certain accounts and customer relationships.” [4]  This guidance explains that “[t]he cornerstone of a strong Bank Secrecy Act / Anti-Money Laundering (BSA/AML) compliance program is the adoption and implementation of internal controls, which include comprehensive customer due diligence (CDD) policies, procedures, and processes for all customers, particularly those that present a high risk for money laundering or terrorist financing.” [5]  Shell companies are among the highest risk customers, so financial institutions are expected to obtain information from the customer, cross-check it with other databases, and make appropriate, risk-based decisions on the need to reassess, follow up, or report on certain relationships or transactions.

The Panama Papers now create a repository of information for financial institutions both to test their prior CDD practices and to consult in future CDD exercises.  Similar to mandatory searches of terrorist watchlists, regulators may expect widespread reports of misconduct or nefarious beneficial ownership of a previously obscure shell company to be thoroughly investigated by a party that did or is now doing business with that shell company.  Indeed, similar issues arose in the anti-corruption space when the WikiLeaks trove revealed information about numerous previously obscure entities that had been assessed and commented on by the U.S. Department of State.

C. Anti-corruption laws create an expectation of similar due diligence on third-party intermediaries and shell companies involved in government contracts or sales

“We are seeing an increasing trend where businesses and business professionals are being recruited by transnational criminal organizations to facilitate corrupt practices, such as creating shell corporations and fronts for money laundering and other illegal activity[.]” [6]

- Peter Edge, Homeland Security Executive Associate Director

Enacted in 1977 to respond to widespread bribery of foreign officials by American entities after the Watergate scandal, the U.S. Foreign Corrupt Practices Act (“FCPA”) “was intended to halt those corrupt practices, create a level playing field for honest businesses, and restore public confidence in the integrity of the marketplace.” [7]  The FCPA prohibits American companies from offering, promising, or giving a foreign official anything of value to obtain or maintain an improper advantage or secure action from the official. [8] 

Importantly, the FCPA prohibits these payments through the use of a third party or intermediary.  Liability premised on third-party payments requires “knowing” the money or valuable item would be directed to a foreign official.  This knowledge standard encompasses “willful blindness” or awareness of a high probability that the illegal payment would occur. [9]  Therefore, companies often conduct due diligence on their business partners to detect red-flag indicators of corruption risks or illegal activity.  In 2012, the U.S. Department of Justice (“DOJ”) and the SEC advised that third-party red flags could include, among other items, a finding that “the third party is merely a shell company incorporated in an offshore jurisdiction [or] the third party requests payments to offshore bank accounts.” [10]  Similarly, per FinCEN guidance, financial institutions have “the duty to conduct enhanced scrutiny of any private banking account that is maintained for senior foreign political figures in order to detect and report the proceeds of foreign corruption.” [11]

In the United Kingdom, the Bribery Act 2010 (“UKBA”) prohibits giving someone a financial benefit to perform their role improperly.  Bribery in both the private and public sphere can be prosecuted. 

A company can be liable where its employees or anyone performing a service on its behalf, including agents and intermediaries, pays a bribe to obtain or retain business for it. [12]

Under the UKBA, it is a defense for a company to demonstrate that it had in place adequate procedures to prevent bribery.  This will invariably include having done adequate due diligence on any intermediaries acting on their behalf.  Where no such defense is available, the penalties can be significant.  Standard Bank PLC (“Standard Bank”) was the subject of an indictment alleging failure to prevent bribery contrary to Section 7 of the UKBA.  It entered into the United Kingdom’s first Deferred Prosecution Agreement on November 30, 2015.  Standard Bank had to pay in excess of US$32 million in financial penalties, compensation and prosecution costs as it did not have adequate procedures in place to prevent the corrupt conduct taking place. [13]

Thus, both financial institutions and companies that sell their goods or services overseas should be alert to documents—now available online after a few keystrokes—that suggest that their customers, agents, intermediaries, or other partners are involved in illegal activity or beneficially owned by a person on a sanctions list or holding public office.  They may also need to go further and make positive enquiries to establish the ultimate source of the funds being used in any transaction.  For example, when the European Union’s 4th Money Laundering directive comes into force, it will be necessary to establish where politically exposed persons obtained their money from before buying valuable property on their behalf.  The days when it was sufficient to have a document that stated source of wealth “inheritance” are long gone. [14]

D. Recent enforcement actions demonstrate the potential for large penalties for inadequate diligence or improper relationships with shell companies
A 2013 Global Fraud Survey by a reputable accounting firm reported that “over 90% of reported FCPA cases involved third-party intermediaries.” [15]  In recent years, FinCEN and other regulatory agencies have taken a hard stance on the illegal use of shell companies, including by:

• Proposing a rule under the Bank Secrecy Act to identify hidden owners and require enhanced customer due diligence; [16]
• Naming Banca Privada d’Andorra a “foreign financial institution of primary money laundering concern” due to its poor AML controls that transformed the bank into an “easy vehicle for third-party money launderers”; [17] and
• Ordering various title insurance companies in New York and Florida to identify and report the beneficial owners of shell companies associated with high-end real estate. [18]

Similarly, recent punishments for violations of the FCPA associated with shell companies have been significant, including:

• A settlement agreement of US$397.6 million between U.S. regulators and VimpelCom, the world’s sixth largest telecommunications company, for VimpelCom’s use of a shell company to channel over US$114 million in bribe payments to a government official in Uzbekistan; [19]
• A US$7.1 million criminal penalty against IAP Worldwide Services for the use of shell companies and third parties to funnel money to be offered as bribes to Kuwaiti officials to obtain a government contract; [20] and
• The imposition of a 48-month prison sentence on a former Russian official living in Maryland for his part in a conspiracy to transmit over US$2 million “to offshore shell company bank accounts . . . with the intent to promote the FCPA violations.” [21]

E. Potential steps to mitigate risks and future liability
In light of the increasing media attention due to the Panama Papers, recognizing the risk associated with shell companies is crucial to effectively mitigate potential liability.  To ensure compliance with anti-money laundering and anti-corruption laws, companies should consider:

• Independently assessing or conducting internal investigations regarding their potential exposure to anti-money laundering and other violations related to shell companies—particularly those companies named in the Panama Papers;
• Implementing or updating controls to identify risks associated with current and future third-party business partners, particularly shell companies in high-risk jurisdictions, by using appropriate questionnaires, databases, and analytic reviews;
• Routinely monitoring these business partners;
• Conducting annual risk assessments, employee and third-party trainings, and due-diligence reviews;
• Catering due diligence to the particular third party, the jurisdiction, and the business environment in which operations occur;
• Documenting the provision and certified completion of that training; and
• Implementing procedures to identify and remediate potential illegal activity.

Notes:
[1] FIN-20060G014, Potential Money Laundering Risks Related to Shell Companies (Nov. 9, 2006), https://www.sec.gov/about/offices/ocie/aml2007/fin-2006-g014.pdf.

[2] Id.