The data leak from the Panamanian law firm, Mossack Fonseca (MossFon), styled by the media as the Panama Papers, has been discussed, dissected and reported on ad nauseam over the past few months, and the issue will remain in the headlines for the foreseeable future.
The purpose of this article is to lay out some thoughts as to the long-term impact this episode will have on the industry in terms of the structure of service providers, marketing, strategy and general matters.
The beginning of the end of the high-profile multi-jurisdictional players
The targeting of Mossack Fonseca was probably not by coincidence or chance. The International Consortium of Investigative Journalists and other left-wing organizations which abhor tax competition presumably targeted the larger and more high-profile firms such as Mossack Fonseca. This latest episode follows what happened in the LuxLeaks case, the LGT affair in Liechtenstein and the BVI leaks which focused on Portcullis TrustNet and Commonwealth Trust Limited. In all these cases, the targets of the leak were high-profile service providers with multiple offices around the world.
What this means is that no large, high-profile player is safe from the potential of being a target and that includes the large trust and corporate services companies and the major international financial services center (IFC) law firms. This also means that clients of these firms are at risk of having their information compromised. That includes the few who may be engaged in nefarious activities as well as the majority of clients who are totally in compliance with the laws of the IFCs and their own home countries. It is my view that no client is immune from this risk and no large high-profile player can sleep well at night as long as the ICIJ and its friends in the media are active in this project.
I suspect strongly that many other large players will soon discover that despite their best IT/computer data systems, they too may be hacked either from inside or outside by the ICIJ. Or they may be hacked by persons or groups who will pass on the information to the ICIJ, and both they and their clients will pay a high price. Hacking becomes even more of a probability and not just a possibility especially if and when state actors become involved. It is now clear that the concentration of vast amounts of information on clients in one central location is a recipe for disaster.
Profile, notoriety and media coverage, while beneficial to firms in other industries, is an albatross in the private-client, wealth-management sector where the use of IFCs is involved and should be avoided as much as is practical. The higher the profile a company formation agent, trust company or IFC law firm has, the greater the target it becomes and the higher the chances of it being attacked. As a consequence, legitimate clients who wish to make use of these jurisdictions for legal tax and estate planning are best advised to seek out boutique, small, niche and competent service providers to work with. While this is no guarantee, the chances of keeping one’s information private are greater than in the case where a client works with a larger, more well-known service provider.
The tragedy of all these leaks is that clients who played by the rules are now being lumped into the mix with others who may not have.
Politically exposed persons (PEPs) should not be clients of any IFC service provider without continued monitoring at appropriate fee levels
Any service provider accepting a PEP without extensive due diligence both at inception and on a regular basis post-establishment of the business relationship is courting disaster. The Financial Action Task Force (FATF) defines a PEP as “ as an individual who is or has been entrusted with a prominent public function.”
The FATF states: “Due to their position and influence, it is recognized that many PEPs are in positions that potentially can be abused for the purpose of committing money laundering offences and related predicate offences, including corruption and bribery, as well as conducting activity related to terrorist financing. This has been confirmed by analysis and case studies. The potential risks associated with PEPs justify the application of additional anti-money laundering/counter-terrorist financing (AML/CFT) preventive measures with respect to business relationships with PEPs. To address these risks, FATF Recommendations 12 and 22 require countries to ensure that financial institutions and designated non-financial businesses and professions implement measures to prevent the misuse of the financial system and non-financial businesses and professions by PEPs, and to detect such potential abuse if and when it occurs.”
The Panama Papers leak makes it clear that a PEP is not only high risk but is likely to bring the service provider itself into disrepute if it is later discovered that said service provider worked with this person without ensuring that all the proper due diligence and monitoring, including after the relationship was established. A service provider who breaches this cardinal rule will rue the day that he/she got involved with a PEP.
PEPs are more likely than most to be involved in corruption, looting state assets, taking bribes, and using friends, families and cronies to provide cover for them. Thus, to take one on as a client requires extensive background checks and monitoring and the charging of fees commensurate with the risk involved. In this new era, a general blanket rule against accepting any PEPs would be ideal but if a service provider wants, needs or chooses to work with one, then proper fees must be charged and KYC controls established and implemented.
It is worth noting that the FATF has specifically said that: “These requirements [the aforementioned recommendations for enhanced customer due diligence] are preventive (not criminal) in nature, and should not be interpreted as stigmatizing PEPs as being involved in criminal activity. Refusing a business relationship with a PEP simply based on the determination that the client is a PEP is contrary to the letter and spirit of Recommendation 12.”
The great challenge, of course, is finding PEPs that are clean and then providing them with services where the costs do not exceed the revenue.
The end of the cheap and cheerful IFC structure has arrived: Be prepared to lose clients or to lose your license
The new world that is dawning upon us dictates that quality and service will be directly linked to costs. Intermediaries who are often unlicensed and clients who do not understand the role of service providers in the IFCs will soon learn that one gets what one pays for. Cheap and cheerful structures are no longer possible. This is because of the increasing know-your-customer (KYC) obligations being imposed by regulators and governments on service providers and the AML/CFT rules which have to be complied with. Service providers will also learn that one cannot and will not be able to compete on cost and low-price jurisdictions like Belize, Nevis, Seychelles and Samoa will learn this also. It is only a matter of time before the less onerous AML/KYC regimes catch up with both the service providers and jurisdictions as a result of the changing landscape. Reputational damage will impact both greatly and clients would be advised to take the necessary steps to protect themselves from now.
Services providers who do not adjust their fees to cover these increased costs will eventually be forced out of business. This will be both from a lack of financial resources to meet the new compliance regimes and administrative penalties that regulators such as the Financial Services Commission in Anguilla will impose. Said service providers may also have their licenses revoked or suspended and worse yet, may be prosecuted criminally. The Commission in Anguilla recently wrote to all service providers noting that continued breaches of the AML/KYC rules will result in the imposition of administrative penalties and criminal referrals for prosecution under the Proceeds of Crime Act.
Service providers will therefore have a choice: either increase fees to cover compliance costs, which will of course risk losing clients to others who choose not to increase fees or to other jurisdictions like those mentioned above, or risk losing their licenses. It is not an easy one to make but it is the reality in my opinion in the post-Panama Papers world.
All this will occur while states like Delaware in the United State will continue to offer the formation of companies without licensing the registered office providers or requiring them to conduct or hold any KYC information.
The company formation situation in the U.S. will of course pose challenges for the rest of the world. IFC service providers have no choice, until pressure is brought to bear on U.S. domiciles to change their practices, but to compete on this uneven playing field and do the best we can.
The use of nominee directors/shareholders is dead except if they are part of the service provider or another regulated person
Service providers probably should not provide services for any entity, especially registered agent/office services, for a company which has a nominee as a shareholder or director. This is unless that nominee entity or person is an employee of or owned by the service provider. Even in such a scenario, the service provider should have full control over the structure and all bank accounts. The service provider should question closely why the ultimate beneficial owner does not wish to operate the company in his or her own personal capacity.
However, what is not sensible in this new era, in my opinion, is for a service provider, say in Anguilla, to provide registered agent/office services in the following scenario: The company is incorporated on instructions from an unlicensed intermediary in the U.K. and owned by someone from Uzbekistan who uses two people in Cyprus as nominee shareholder and director with a bank account in Latvia.
This, with the greatest of respect, is a ridiculous structure which no longer passes the smell test. It is not one which should be encouraged, especially where neither the intermediary nor the nominees are licensed and regulated elsewhere. The obvious question is why doesn’t the ultimate beneficial owner who is from Uzbekistan want to be director and shareholder of his company? If the answer is not one that is cogent and even if it is cogent, granted the myriad of players and risks involved as a result of this and the geographical spread, then careful thought should be given to accepting this structure or remaining as registered agent/office if it comes into being post-incorporation.
The service provider has to focus his mind on these questions.
How am I going to exercise proper monitoring as required under the AML regime to ensure that the structure is not being used for money laundering or terrorist financing?
Given the complicated nature of the structure, the players involved and the fact that I don’t have access to bank statement information or the daily operational activities of the company, should I take on this structure?
Given this, the obvious action to take is not to provide any services for this company, in my opinion. I would even suggest that the use of corporate shareholders and directors owned by the same beneficial owner as the company being incorporated itself, in this new era of transparency, should be avoided unless it is absolutely necessary. Again, the necessary fees need to be charged to cover the increased KYC operational costs involved in conducting due diligence and securing information on corporate entities, etc.
Intermediaries need to be licensed
In addition to always arguing about fees and trying to beat service providers down on price, the major problem with many intermediaries, from a service provider perspective, is that they live and function in jurisdictions where the provision of company formation or trustee services is not licensed and regulated in the same manner as is done in the IFCs. As a consequence, these intermediaries neither understand nor appreciate the regulatory and legal regimes under which IFC service providers operate. Service providers have to protect themselves so that they are not held criminally liable for dropping the ball and failing to do what the law says they should do on a daily basis – that is to monitor the activities of all companies and trusts to which they provide services.
To solve this problem of perspective and AML/KYC compliance, it would be best if intermediaries secured their own licenses to be their own registered agent/office in the IFC jurisdictions. This is because the intermediaries are closer to the direct client than the registered agent several thousand miles away. This can be accomplished using a separate office space with dedicated staff so mind and management is done locally, thus adding substance to the jurisdiction, or through a brass-plated operation using the business office space of another agent who already has those facilities in place.
Conclusion
The impact of the Panama Papers has just started to be felt globally and in the financial services industry. The fallout from this leak and the many others to come will continue and even more long-term and consequential effects will follow. It is best then for those of us in the industry to seek to adapt our business models and operational practices to the new reality and seek not only to survive but to flourish.
Featured in Cayman Financial Review