The leak of millions of documents apparently hacked from Panama-based law firm Mossack Fonesca has exposed the tax strategies of some of the world’s elite. But the Panama Papers also shine a light on some failures of Mossack Fonesca to screen out problematic clients — failures of due diligence that the firm itself recognized.

Petropars and the Iranian connection

Mossack Fonesca rose to prominence at the same time that Panama was emerging as a center for offshore banking activity, as a New York Times article explains. When the International Consortium of Investigative Journalists obtained the document trove now known as the Panama Papers, Mossack Fonesca’s own internal communications showed that it had represented dozens of companies and people on various U.S. government blacklists — despite internal firm policies that should have screened out such clients, the ICIJ said.

One case in point is Petropars Ltd., which the ICIJ described as an Iranian-government- controlled intermediary between foreign companies and Iran’s oil ministry. Through its offices in Dubai and London, Petropars was also a player in the development of Iran’s multibillion-dollar South Pars natural gas field.

The Clinton administration banned U.S. involvement with Iranian oil development back in 1995; in 2010, the U.S. Treasury sanctioned Petropars, and put it on the Office of Foreign Assets Control’s blacklist. The list is of individuals and companies connected with sanctioned countries, regimes, entities and people targeted as threats to U.S. security or policy.

The links between Petropars and the Iranian government had surfaced in 2001, when the company was investigated for possible corruption in handing out oil and gas contracts, and the conduct of the Iranian Oil Minister came under scrutiny, as the New York Times reported at the time.

Mossack Fonesca incorporated Petropars in the British Virgin Islands in 1998; the firm represented Petropars until 201o, when Jurgen Mossack, one of the firm’s founders, learned that Mossack Fonesca’s BVI post office box address had been listed as Petropars’ address in OFAC’s blacklist entry for the company.

“This is dangerous!”

Mossack raised the alarm in an internal e-mail addressed to the firm’s “Compliance Department,” among others. He wrote “This is dangerous! … Everybody knows that there are United Nations sanctions against Iran and we certainly want no business with regimes and individuals from such places.”

He called into question how Petropars had been vetted as a firm client to begin with, and blasted the firm’s United Kingdom office: “It would appear Mossfon UK are not doing their Due Diligence [sic] thoroughly (or maybe none at all), and maybe from now on we ourselves will have to do the DD on all clients that Mossfon UK have with us, present and future!”

Mossack wrote that “Anybody having had to do anything with this company [sic], … should have realized immediately that the names associated with it were Iranian names. A red flag should have been raised immediately.”

The firm resigned as Petropars’ registered agent in October 2010.

Red flags, the duty to supervise, and avoiding problems

Later, in 2012, the firm’s audit of its London office concluded that the outpost had “no procedure in place” for “handling high-risk politicians, family and associates” and was not even conducting Internet searches to screen potential clients, according to the ICIJ.

Of course, Mossack Fonesca is not a U.S. law firm, and as such neither OFAC’s sanctions list nor our Rules of Professional Conduct apply to it. But its founder certainly recognized the trouble it was courting by the apparent breakdown in its system of evaluating and screening potential clients. For lawyers operating under U.S. rules, even without considering whether a firm is being used to assist client wrongdoing (see Model Rule 1.2(d)), agreeing to represent a client on OFAC’s sanctions list is not a wise move.

Engaging in conduct that is prejudicial to the administration of justice violates Model Rule 8.4(d). And under Rule 5.1, law firm managers must make reasonable efforts to have measures in place to ensure that firm lawyers are following the ethics rules. Moreover, a “supervisory lawyer” can be responsible for another lawyer’s ethics violations, either by ratifying them or by failing to take remedial action against known ethics lapses.

Take home lesson: If any component of your practice is international, and even if not, your client intake process should include thorough vetting, and close examination of relevant U.S. government sanctions lists.