The leak of confidential files by the Panamanian law firm, Mossack Fonseca, two weeks ago has highlighted the reputational risks of engaging in off-shore secrecy havens and the data security risks that businesses face today.

In the largest ever recorded data leak, an anonymous source (possibly an 'insider' in the firm) forwarded over 11.5 million lawyer-client documents dating from the 1970s to a German newspaper. The documents were then forwarded to the International Consortium of Investigative Journalists and thereafter distributed to media centres across the world.

The Panama Papers contain the identities of prominent public officials, national leaders, company directors and shareholders, and high net-worth individuals that have used opaque off-shore structures and shell companies to hide their wealth and avoid paying tax. Many have received adverse media attention since news of the data leak first broke on 3 April 2016.

Regulatory investigations

The Panama leak has prompted worldwide regulatory investigations, and banks and financial institutions are already being directly implicated in these investigations.

Whilst Mossack Fonseca is maintaining that it has done nothing illegal (because tax avoidance is not illegal), its possible involvement in the use of off-shore companies to circumvent international trade sanctions in Iran, Syria and North Korea and other illicit activities including money laundering and bribe payments are now being investigated by the US Department of Justice.

In the UK, the FCA has asked 64 financial services firms and banks to disclose details of any accounts handled by Mossack Fonseca and explain what they are doing internally to assess their exposure. The deadline for providing this information has now expired.

The FCA has not yet announced any conclusions from its preliminary analysis but given the allegations of breaches of sanctions, money-laundering offences and other crimes published in the media, the FCA has said that it will be considering whether the banks' anti-money-laundering controls should have raised "red flags".

Banks, investment houses, wealth managers and professional advisers that played a role in off-shore transactions involving Mossack Fonseca be called on further to assist with these regulatory investigations, possibly by attending compelled interviews and producing documents for regulatory scrutiny.

Evaluation of Banking Practices

The FCA acting Chief Executive, Tracey McDermott, has reported "a significant amount of business in Panama would be expected to be "perfectly legal" and it is, of course, possible that the regulatory investigations will conclude there was no illicit activity and no prosecutions will follow.

Irrespective of the legalities of off-shore transactions, however, the Panama Papers leak has been a wake-up call to all involved in off-shore structures and highlighted the vulnerabilities of storing confidential data electronically. Banking practices should be evaluated so that proper consideration is given to:

  • the reputational risks to banks and other financial institutions of being associated with secrecy havens;
  • the importance of reviewing relationships with law firms and financial advisors in off-shore jurisdictions that deal with opaque structures;
  • the importance of enhanced due diligence regimes when dealing with off-shore transactions showing that the banks have properly considered money-laundering, breaches of trade sanctions and other possible corruption; and
  • the risk that banking activities will be scrutinised by the regulators if there are concerns of possible complicity in or turning turning a blind eye to financial crimes.  

The regulatory response and press reporting following the Panama leak is evolving on a daily basis and it is likely that the FCA investigation will be ongoing for some time to come.