Mickie Abraxa looks out at the Panama City skyline and asks Le Carre’s tailor, Harry Pendel: “Do you know what the poor call those? The Cocaine Towers. And our 85 banks? The launderettes.”   Pity Panama: known for its canal, its hats, a fictional tailor, and its status as the third busiest offshore tax haven in the world.  And, since the leaking of the 11.5 million “Panama Papers”, the most notorious.  At this point, let us pause the Panama bashing and point out that, despite its draw for thriller writers and now enthralled journalists, the country is also host to many more orthodox and conventional business operations. These include a Control Risks technology centre that employs 40 Panamanians - a real bricks and mortar business.

From just one law firm headquartered in the country, Mossack Fonseca, the leaked trove of documents relating to individuals’ and companies’ activities in tax havens around the world can only hint at the true extent of the offshore capital ecosystem: more than 200,000 companies identified, incorporated on behalf of over 14,000 clients, with connections to almost every country in the world.

The media feeding frenzy has so far cost the Prime Minister of Iceland his job and many politicians, corporations, banks and their management are sure to face further scrutiny in the coming months. But amid this frenzy, the polarity of the debate about tax havens has not changed much between those who say they exist for tax avoidance and abet criminality and those arguing that they are an important lubricant to the flow of international trade and cross-border corporate development.

What has changed is the context in which these issues sit: who owns the debate, the evidence they call on, and the impact this can have on an organization, or on the environment in which it operates. These changes create uncertainty and, as such, they are a source of risk. Regardless of an organization’s or an individual’s actual guilt or involvement in unlawful activities, firms should take account of this new context and adapt their behaviours accordingly. Three observations from the most recent case support this view.

1. All data can be discovered
Data leaks now come with regularity and the Panama bombshell will not be the last.  If companies and individuals have something to hide, that something has a habit of finding its way out into the light.  There are more people than ever prepared to help that process: whistleblowers are being afforded unprecedented protection and are increasingly incentivized to act (see the multi-million dollar bounties available under the Dodd Frank Act). Hackers, whether activists motivated by their concepts of social justice or nation state actors motivated by geo-political imperatives, feed on corporate data. The “Panama Papers” have shown us once again that journalists, data analysts and investigators are only too happy to act as a global network, sifting through vast tracts of information in search of newsworthy fare.  What Panama – and Snowden and Target, and Ashley Madison before them – have demonstrated is that leaks are inevitable and, as never before, operating under a light-of-day principle is critical. Control Risks has been saying for some time now that cyber security does not sit in an exotic sub-section of the risk landscape. Protecting your networks and data is central to your viability as an organization and needs board-level engagement.

2. Reputation, traction and the court of public opinion 
There will be many firms and individuals identified in the “Panama Papers” who are now dealing with significant scrutiny and potential long-lasting reputational damage, in spite of never having broken the law.  But the global network of analysts who scoured the data is broadcasting its findings around the world; followers are providing a helpful echo chamber. Whilst there are undoubtedly cases of serious wrongdoing being highlighted, other more ambiguous cases will still have a real, negative impact on firms’ reputations. It is the nature of social media to amplify confirmation biases; once a story gains traction the perception is often more important than the reality. Do you remember the headline “Tycoons and world leaders who built secret UK property empires” or the note that “There is no suggestion of wrongdoing or unethical behaviour by any individual”? Individuals and organizations need to be mindful of this.

3. Ethics, not (just) compliance 
The simple and timeless observation underlying this entire case is that, if an organization behaves within the ethical norms of the society in which it operates, it is unlikely to face opprobrium. With a global population of connected, educated people accessing more information than ever before, a consensus is emerging that certain behaviours, whilst legal, are nevertheless unfair and should be opposed.  We suspect that in the case of the “Panama Papers” there may even be a bigger point: that to engage in activities that are also engaged in by criminals – the use of secretive offshore vehicles in this case – is particularly unpalatable in certain constituencies. Whether that is a case of tarring with the same brush, or a desire to hold organizations to even higher ethical standards than before, we are not sure. But given the speed with which social media and news reporting can do significant damage to a company’s reputation and potentially to its share price, careful thinking needs to go into whether legality alone is your benchmark for strategic decisions.

So what?  Don’t use shell companies to hide illegal activities and let it be said again: get a firm, c-suite handle on your cyber security. That should be stating the obvious.  There are two other risk factors that these observations should lead an organization to think about seriously: one external and one internal.

Externally, you need to appreciate the level of regulatory change and likely scrutiny in jurisdictions the world over. Since the global financial crisis of 2008, governments have been chasing every last tax penny, squeezing onshore companies and citizens. Those citizens are starting to insist on a financial system that they perceive as fairer. Demonstrations in Iceland have cost the top man his job. The President of Argentina, Mauricio Macri is being investigated by a federal prosecutor and Australia has started investigations in to 800 citizens named in the “Panama Papers”. What is this going to mean for you?

Internally, think about third party risk in a new light. Large organizations are more reliant on third parties than ever before, and you are all aware of the march of regulation highlighting the need for good counterparty risk management. But if there is one thing that the “Panama Papers” demonstrate, it is that the odour - not the details - of the relationship with those third parties is what counts in the court of public opinion. One law firm is already feeling the heat over this, but many other firms will be feeling a little warm and the temperature will rise. You may be sure of your ethical and legal position – but those with whom you do business may not have such scruples and you could get hit with the shrapnel of their reputational explosion.