Hackers leaked approximately 13.4 million confidential client documents from Appleby, Estera, and Asiaciti Trust to the International Consortium of Investigative Journalists.

The leaked files, known as the "Paradise Papers," show that Appleby set up companies and bank accounts in low tax jurisdictions. The client list is reportedly dominated by U.S. companies and individuals, including "politically exposed persons," Fortune 500 companies, financial institutions, and high-net worth individuals. The leak resulted from a hacker attack last year. It is unclear when reporters first got the hacked files, or if governments had early access. Similar leaks, such as the Panama Papers, have led to investigations.

Offshore accounts and investments are common, but U.S. law requires reporting and recordkeeping. For example:

  • Financial institutions, hedge funds, private equity firms, and trust companies have reporting, record-keeping requirements, and know-your-customer obligations under antimoney laundering regulations, including newly revised Customer Due Diligence (CDD) rules.
  • Foreign financial institutions have reporting requirements under the Foreign Account Tax Compliance Act (FATCA) and the Common Reporting Standard (CRS) of the Organization for Economic Co-operation and Development (OECD).
  • Domestic title companies may have disclosure requirements for all-cash real estate purchases over specific amounts in certain geographic regions.
  • Foreign beneficial owners of U.S. limited liability companies have new IRS disclosure requirements.
  • Entities and trusts must report non-U.S. transactions.
  • U.S. persons must report foreign assets and accounts.

The leaked information could also lead to investigations into tax evasion, money laundering, violations of the Foreign Corrupt Practices Act, and other offenses, including investigations in the United States of tax evasion in other countries. In light of the Paradise Papers, earlier leaks, and possible future leaks, those potentially impacted by these leaks should take immediate steps to assess and address any past noncompliance, including possible participation in voluntary disclosure programs.