From early 2015, 11.5 million documents belonging to a Panamanian law firm, Mossack Fonseca, were provided to a German newspaper, Süddeutsche Zeitung, who shared them with the International Consortium of Investigative Journalists (“ICIJ”). The ICIJ shared these documents with 400 journalists at 107 different media organisations who kept them secret while they were reviewed in detail. The first news reports were published on 3 April 2016 when the documents became known as the “Panama Papers”.

Although it has not been proven whether the leak was caused by unauthorised access by an employee or contractor, or an external hack by an unrelated third party, the amount of material accessed, copied and removed without detection at the time of the processing may call into question the firm’s data security procedures and information management systems. Both of these are likely to be investigated by regulators and those claiming to have suffered damage arising from the publication of the data and the subsequent loss of confidentiality.

Following this leak, the UK Government is setting up a new regulatory taskforce (the “Panama Taskforce”) to investigate money laundering and tax evasion linked to the Panama Papers. The records run from 1977 to 2015 and relate to over 14,000 clients. They include 214,000 offshore entities and at least 33 entities blacklisted by U.S. sanctions authorities. Many entities are legitimate but some have links to terrorist groups or suggest possible cases of tax evasion and money laundering.

The National Crime Agency and HMRC will lead the Panama Taskforce, working alongside the Serious Fraud Office and the Financial Conduct Authority (“FCA”). It will report directly to the Chancellor, George Osborne, and the Home Secretary, Theresa May, with its first report expected in summer 2016. The Panama Taskforce will have a budget of £10 million. This is a significant commitment when one considers other Government legal spending commitments. For example, it exceeds the entire Government Legal Department’s spending for 2014/15.

HMRC has identified 700 current cases with a link to Panama. No doubt these will be further investigated by the Panama Taskforce, but other regulators are also taking steps following the leak of the Panama Papers: the FCA has already sent a letter to 20 major businesses giving them until 15 April to conduct internal investigations into links to Mossack Fonseca, and the Law Society has approached four firms that have been specifically identified in the papers.

The UK is by no means the only country looking at the Panama Papers. In the U.S., the Department of Justice is reviewing the papers for evidence that could lead to prosecutions for corruption. For a discussion of the implications under the US Foreign Corrupt Practices Act for institutions getting caught up in the fallout from the Panama Papers see the article Effective FCPA Compliance Strategies in the Wake of the Panama Papers by Nicholas M. Berg, Kim B. Nemirow and Jaime Orloff Feeney. Across Europe, the Swiss regulator FINMA is investigating which of its Banks worked with Mossack Fonseca, the French ACPR has asked Banks for relevant information and investigations have begun in Sweden, the Netherlands and Austria.

The Panama Papers remain in the hands of the ICIJ. The group and its parent company, the Centre for Public Integrity, have a “long-standing” policy against handing documents to Governments. The ICIJ also refrains from publishing individual records that are not in the public interest. However, it plans to release all of the information from Mossack Fonseca that it deems to be in the public interest in early May 2016.

Impact of Leaks for Taxpayers

The Panama Papers is not the only recent incidence of sensitive tax-related information being disclosed to the media. In November 2014, the ICIJ revealed the “Lux Leaks” involving 28,000 pages of leaked confidential information including tax rulings granted by the Luxembourg authorities to over 340 multinational companies dating from 2002 to 2010.

Unfortunately for high profile taxpayers, as tax information becomes more widely available, the debate around the significance of that information looks ever more ill-informed. It is apparent from the public and media debate in the UK that there is little patience for unravelling the complexities of individual cases to distinguish between tax evasion, tax avoidance and non-tax-driven offshore structuring (for example, those driven by confidentiality concerns). It will be incumbent on any institutions caught up in this type of public disclosure to deal with the reputational fallout. There is unlikely to be much public assistance from revenue authorities or governments.

Clients should also note that information regarding their tax affairs is increasingly likely to be shared with other tax authorities. A current example is that taxpayers are beginning to be notified that certain rulings given by the Luxembourg tax authorities are to be shared under Directive 2015/2376/EU. This directive provides for the automatic exchange with other European tax authorities and the European Commission of certain tax rulings and pricing arrangements that have a cross-border element and that have been issued, amended or renewed since the beginning of 2012. Interestingly, the Luxembourg authorities are asking taxpayers to participate in this process. While, to some extent, this is a question of sharing the administrative burden, it may be helpful for taxpayers to have a voice in what information is shared and the way in which it is presented.

Transparency in tax affairs is also one of the pillars of the OECD’s Base Erosion and Profits Shifting project (“BEPS”), which is now in the implementation phase and will involve significant changes to domestic and international tax rules. Large multinationals will be required to undertake country-by-country reporting, which broadly involves reporting certain financial and tax information broken down by jurisdiction, to be shared among tax authorities. The European Commission recently adopted a proposal for a directive to require some of this information to be shared with the public.

While a more rational approach can be expected in the course of any revenue authority investigation, it is still important to appreciate how much the standards by which tax planning will be judged has changed in the last few years, and that historic planning will be judged by the new standards rather than those that applied at the time of implementation. It should also be noted that HMRC has come under heavy criticism for being seen to be too accommodating to “big business”, and is likely to take a robust approach to future investigations.

In our view, it is advisable that clients who become aware that any part of their tax affairs, however innocuous, is to be disclosed either publicly or to other tax authorities, should critically re-evaluate the relevant transactions so that they are well prepared in advance for any questions that may arise. Circumstances may also arise where an even more pro-active approach will be beneficial.

New Obligations on Companies to Maintain a Register of Persons with Significant Control

The drive towards transparency is also in evidence outside of the tax sphere. UK companies are now required to maintain a register of persons with significant control over them, and the legislation is designed to look upwards through corporate structures to individuals. Ultimately, this register will be publicly available on the Companies House website.

Maintenance of this register is mandatory and it is backed by criminal penalties. Companies are obliged to enquire, and persons are obliged to respond. Persons who fail to respond are not only subject to potential criminal enforcement, but may also have their rights under any shareholding suspended.

The U.S. is also taking action aimed at increasing transparency, at least in part in response to the Panama Papers disclosures, by adopting a rule requiring financial institutions to identify the beneficial owners of private corporate entities. The final rule released on Friday, May 6, by FinCEN, the Treasury Department’s financial intelligence unit, will require banks to determine the identity of an individual who owns at least 25 percent of a legal entity and an individual who controls the legal entity. The rule, known as the customer due diligence rule, will require banks to collect information that will allow law enforcement agencies to “disrupt” illicit financial schemes and track down tax evaders, the Treasury Department said. The Treasury Department has also announced that they will require non-U.S. owners of disregarded entities to register with the Internal Revenue Service, in order to better track and identify beneficial owners of holding companies. This supplements the rules to which many financial institutions are already subject, to collect and share account holders’ tax information under the US’s Foreign Account Tax Compliance Act (“FATCA”) and the OECD’s Common Reporting Standard.