Article · FinCrime history
The Firm That Sold Secrecy
Mossack Fonseca packaged offshore opacity at industrial scale, failed as an AML gatekeeper, and shut in March 2018 after the Panama Papers made beneficial-ownership blindness a public fact. Prosecutions stayed uneven; the control lesson did not.
On 3 April 2016, Süddeutsche Zeitung and the International Consortium of Investigative Journalists began publishing from 11.5 million confidential documents taken from Mossack Fonseca, a Panamanian law firm and corporate-service provider. The files spanned roughly 2.6 terabytes and decades of incorporation work.[1][2] Two years later, on 14 March 2018, the firm said it would close all offices after reputational damage, financial pressure, and official action it described as irreparable.[3]
Mossack Fonseca was not a bank. It did not hold client money. What it sold was distance from the natural person: shell companies, foundations, nominee directors, signature services, and the paperwork that could separate an asset from the natural person who controlled it. For FinCrime desks, the case remains the clearest public record of what happens when a formation agent treats intermediaries as a control boundary, and those intermediaries assume the formation agent already identified the beneficial owner.
The leak did not prove that every person or entity in the files committed a crime. Offshore companies, trusts, and foundations have lawful uses. The firm consistently disputed that it knowingly enabled criminal conduct and said its services were lawful.[1][3] That denial matters. It does not erase the British Virgin Islands' administrative AML finding against the local operation, the ownership gaps documented after the breach, or the business consequence that followed: a trust-and-company provider that cannot explain who its customers are cannot stay in business.
A wholesaler of distance
Mossack Fonseca opened in Panama and grew into a major offshore corporate-service firm. ICIJ reported that by 2013 it had more than 500 employees and collaborators across more than 40 offices, including eight in China, with billings above $42 million. The British Virgin Islands was a central incorporation hub for the firm's work, and many leaked entities were formed there.[1][8][9]
The product was layered separation. A company in one jurisdiction, accounts or assets in another, professional introducers in a third, and nominee directors or shareholders on the papers a bank or counterparty might see. ICIJ described how firm-supplied nominee directors could mask the person effectively controlling an offshore company, and how Panamanian foundations did not require founder or beneficiary names to be publicly recorded.[1]
A U.S. indictment later summarized the marketed toolkit in enforcement language: sham foundations that "owned" shell companies in Panama, Hong Kong, and the BVI; client names generally absent from incorporation papers while clients retained control; and, for fees, corporate minutes, resolutions, mail forwarding, signature services, and accounts in bank-secrecy jurisdictions.[4] Those are allegations as to the charged schemes. They also show why formation agents sit at an AML choke point. The provider that creates and administers the vehicle often holds, or should hold, the only complete map of beneficial ownership, purpose, and introducer chain.
Intermediaries all the way down
After the leak, Mossack Fonseca said about 90 percent of its clientele were professional intermediaries (banks, trust companies, law and accounting firms) and that those intermediaries were responsible for KYC and AML checks on end clients.[1][3] The files showed the scale of that model. The firm worked with more than 14,000 banks, law firms, incorporators, and other middlemen. More than 500 banks, subsidiaries, and branches registered nearly 15,600 shell companies through it, most since the 1990s.[2][5]
ICIJ and contemporaneous reporting associated large volumes with major banks: HSBC and affiliates with more than 2,300 companies; UBS with more than 1,100; Credit Suisse with about 1,105; Société Générale with 979. ICIJ also reported that the firm agreed to give HSBC clients a softer due-diligence process, and that in 2010 UBS told Mossack Fonseca in Zurich that the law firm was responsible for identifying shell-company owners.[5][6] The banks named denied wrongdoing. Holding an offshore company is not itself unlawful.
The control gap is structural. Reliance on an introducer is legitimate only when it is documented, risk-tested, and continuously challenged. A formation agent that accepts the introducer's word as a substitute for knowing the natural person, and a bank that treats the formation agent's paperwork as proof of transparency, can leave tens of thousands of entities without a verified owner on either side of the relationship.
Gatekeeping that did not know the customer
The most operationally damaging ownership finding came from a later tranche of internal records. Two months after discovering the breach, Mossack Fonseca still could not identify the owners of more than 70 percent of its roughly 28,500 active BVI companies, its busiest hub, or 75 percent of its roughly 10,500 active Panamanian shell companies.[7] For an AML program, that is not a filing error. It is a failure of the control that decides whether a relationship should begin, continue, be reported, or be exited.
Screening failures were documented in the same investigative record. ICIJ found the firm had worked with at least 33 people and companies on U.S. sanctions lists, including parties linked to terrorism, narcotics trafficking, or regimes such as North Korea and Iran. Reporting said loose procedures sometimes allowed blacklisted or questionable clients to remain or enter the system. Mossack Fonseca said it never knowingly allowed its companies to be used by people working with sanctioned governments and stressed the intermediaries' due-diligence role.[1]
In November 2016, the BVI Financial Services Commission imposed a $440,000 administrative penalty on Mossack Fonseca & Co. (BVI) Ltd., described as the territory's largest fine to that point, after inspections and a compliance monitor. The regulator cited eight breaches of AML/CFT and regulatory codes, including failures in risk assessment, due diligence, and identification procedures. It was the fourth penalty against the firm there since 2012.[8][9]
Those findings give official form to what the files illustrated. Beneficial ownership that stops at a corporate shareholder, a nominee director, or an introducing lawyer is not an answer. It is the start of the inquiry: who ultimately owns, controls, benefits from, or directs the entity, and can the provider corroborate that answer independently?
From leak to commercial failure
The Panama Papers was a public stress test. More than 100 media partners joined the investigation. Police in Panama, Peru, and El Salvador raided local offices. Internal correspondence showed staff scrambling to identify clients while intermediaries reacted angrily to interception of the files.[3][7][10]
Political consequences followed publication. Iceland's prime minister resigned after revelations about a BVI company linked to him and his wife. In 2017, Pakistan's Supreme Court removed Nawaz Sharif from office; he was later sentenced on corruption charges. Reporting also described offshore companies tied to associates of Vladimir Putin moving large sums.[2][10]
The firm's March 2018 closure statement blamed deteriorating reputation, media pressure, financial strain, and what it called irregular action by some Panamanian authorities, while maintaining that the firm had committed no crime.[3] For desk work the causal chain is clear enough: exposure, formal regulatory sanction, intense legal and reputational pressure, and a business climate in which the trust function could not be sustained. A criminal conviction was not required for collapse.
Prosecutions stayed uneven
Closure did not prove every allegation in court. The record is more complicated, and that complexity is itself an investigative lesson.
In the United States, federal prosecutors in Manhattan unsealed a December 2018 indictment against Ramses Owens, a Panamanian lawyer who worked for Mossack Fonseca; Dirk Brauer, an investment manager at an affiliated asset-management company; Richard Gaffey, a U.S. accountant; and Harald Joachim von der Goltz, a client. Charges included wire fraud, tax fraud, and money-laundering conspiracy. Allegations included coaching U.S. clients to repatriate untaxed funds through debit cards and fictitious sales, and falsely naming von der Goltz's elderly mother as owner of shell companies and accounts.[4] Von der Goltz pleaded guilty and was sentenced to 48 months. Gaffey pleaded guilty to charges including money-laundering conspiracy and aggravated identity theft and was sentenced to 39 months, with forfeiture of about $5.37 million. At the time of those sentencings, Owens and Brauer remained at large.[11]
In Germany, Cologne prosecutors issued international arrest warrants in October 2020 for Mossack and Fonseca on charges including accessory to tax evasion and forming a criminal organization. In April 2026, the Cologne regional court convicted Christoph Zollinger, a former third director, of aiding and abetting tax evasion and sentenced him to one year and nine months on probation. The court described offshore companies set up on a massive scale "in a factory-like manner." Prosecutors tied 50 companies to a tax loss of about €13 million; the criminal-organization charge was dropped. Zollinger admitted the tax charges and waived appeal.[10][12]
In Panama, outcomes ran the other way. On 28 June 2024, a trial court acquitted all 28 defendants in proceedings tied to Brazil's Operation Car Wash and related funds, including Jürgen Mossack. Prosecutors had sought the 12-year maximum for both founders. Ramón Fonseca died in May 2024 before the verdict, and the case against him was dismissed. The court found that electronic evidence taken from firm servers and submitted in physical form did not satisfy chain-of-custody requirements, and that remaining evidence was insufficient and inconclusive.[13] On 10 August 2026, Panama's superior liquidation court confirmed that acquittal on appeal.[14]
The appellate confirmation does not erase the BVI administrative enforcement or the commercial failures exposed by the leak. Nor does it establish that all conduct in the files was lawful. It means that specific Panamanian prosecution did not meet the criminal standard with admissible, sufficiently reliable evidence. Intelligence reports, bank narratives, and public writing must keep that distinction. Leaked data can generate exceptional leads; it cannot replace a defensible evidence plan, provenance, integrity checks, and independent corroboration through registries, bank records, witnesses, and properly obtained service-provider documents.
Fallout beyond the firm
The Panama Papers moved beneficial ownership from a specialist topic into mainstream enforcement. The IMF's 2024 assessment of Panama notes the country was placed on the FATF grey list in June 2019 for strategic AML/CFT deficiencies and remained there until October 2023. Reforms described in that assessment include a beneficial-ownership registry and stronger supervision of resident agents, with enhanced due diligence expected for nominee services, including the natural person for whom a nominee acts, the purpose of the arrangement, and source of funds or wealth. Implementation continues.[15]
ICIJ's ten-year reporting summarized parallel rule changes elsewhere: BVI requirements for service providers to report real owners to authorities; New Zealand's tightened foreign-trust rules and a sharp drop in registrations; a United Kingdom criminal offense for lawyers who fail to report clients' tax evasion, with lawmakers repeatedly citing the Papers; stronger EU AML directives, later constrained in places by privacy rulings on public ownership registries; and the U.S. Corporate Transparency Act in 2021, with beneficial-ownership database implementation later described as stalled.[10]
Money followed the files. In a 2025 update, ICIJ reported that governments had publicly identified more than $1.3 billion in recovered taxes, fines, and penalties linked to its major offshore investigations, while cautioning that the tally was incomplete.[16] Ten-year reporting repeated that floor and noted higher tallies from some tax agencies, plus India identifying about $1.4 billion in linked offshore investments still largely uncollected.[10] Those figures measure enforcement tails, not Mossack Fonseca's adjudicated liability, and not proof that every record reflected wrongdoing.
Banks remained in the remediation path. In July 2026, Swedbank agreed to pay a $50 million penalty to the New York State Department of Financial Services to settle an investigation opened in 2019 after the leak showed customers of its Estonian subsidiary used Mossack Fonseca as registered agent. DFS found that after the leak, Swedbank failed to report Mossack Fonseca relationships in response to information requests, did not acknowledge European regulatory inquiries, and withheld information about Baltic subsidiaries. The consent order said the leak exposed "the failure of global financial institutions to follow legal requirements" meant to keep customers from facilitating fraud or money laundering.[17]
What desks still pull from the file
Mossack Fonseca shows why incorporation paperwork is not proof of transparency, and why a corporate-service provider must be assessed as a high-risk counterparty in its own right.
Look through the structure to the natural person. Map owners, controllers, beneficiaries, nominators, settlors, protectors, directors, authorized signers, and anyone with practical authority. Reconcile that map against registries, customer files, and independent documents. A foundation that owns shells with no natural person on the papers is a starting typology, not an answer.[1][4]
Treat nominee and introducer arrangements as escalated risk. Obtain the nominee agreement and the identity of the person for whom the nominee acts. Test whether the intermediary is transparent, regulated, and willing to provide underlying due-diligence material. Preferential or lighter diligence for a high-volume referral partner is a warning, not a service. A refusal or unexplained gap should drive a risk decision, including decline or exit.[5][7]
Connect static due diligence to activity. "Holding investments" does not explain pass-through payments, PEPs, sanctioned-country exposure, funds inconsistent with declared wealth, or repatriation through prepaid cards and fictitious sales. Signature services, mail forwarding, and formation-agent minutes sold as add-ons deserve the same scrutiny as the incorporation itself.[4]
Build cases from evidence that survives scrutiny. Treat leaks, databases, and media as intelligence. Preserve digital material correctly; corroborate with original records; document analytical steps; and distinguish a regulatory finding, a civil allegation, an investigative lead, and a criminal adjudication. When supervisors ask about relationships with a compromised gatekeeper, incomplete answers can cost more than the underlying exposure, as Swedbank learned.[14][17]
The Panama Papers did not reveal a single bad transaction. They exposed an ecosystem in which opacity could be packaged, distributed through intermediaries, and normalized at scale. Mossack Fonseca's failure was a failure of gatekeeping. Its closure shows that in the trust-and-company business, the inability to explain who a customer is and why a structure exists is not only an AML vulnerability. It is a business-ending risk. The firm is gone. The structures it built, and the questions about who owns them, still turn up in casework a decade later.
Sources
- ICIJ, "Panamanian Law Firm Is Gatekeeper To Vast Flow of Murky Offshore Secrets" (3 April 2016).
- ICIJ, "Giant Leak of Offshore Financial Records Exposes Global Array of Crime and Corruption" (3 April 2016).
- ICIJ, "Panama Papers law firm Mossack Fonseca closes its doors" (14 March 2018); see also The Guardian, "Mossack Fonseca law firm to shut down after Panama Papers tax scandal" (14 March 2018).
- U.S. Attorney's Office, SDNY, "Four Defendants Charged In Panama Papers Investigation" (4 December 2018).
- ICIJ, "Global Banks Team with Law Firms To Help the Wealthy Hide Assets" (4 April 2016).
- CNN Money, "Panama Papers: Banks dismiss claims they helped hide money" (5 April 2016); AFP / Le Monde via Business Standard, "Major banks set up thousands of offshore firms: Le Monde" (5 April 2016).
- ICIJ, "New Panama Papers Leak Reveals Mossack Fonseca's Chaotic Scramble" (June 2018).
- Government of the Virgin Islands, "Enforcement Action Taken Against Mossack Fonseca & Co. (BVI) Ltd" (November 2016).
- ICIJ, "BVI Hits Mossack Fonseca With Largest Fine Ever After Panama Papers Investigation" (16 November 2016).
- ICIJ, "Ten years after the Panama Papers, enablers and tax cheats are still being brought to justice" (2 April 2026).
- U.S. Department of Justice, "U.S. Accountant in Panama Papers Investigation Sentenced to Prison" (September 2020); SDNY, "U.S. Taxpayer In Panama Papers Investigation Sentenced To 4 Years In Prison".
- ICIJ, "Former co-owner of Panama Papers law firm convicted of aiding and abetting tax evasion" (24 April 2026).
- ICIJ, "Panama Papers trial concludes with all defendants acquitted of money laundering" (1 July 2024).
- Órgano Judicial de Panamá, "Confirman sentencia absolutoria en caso Panama Papers y Lava Jato" (13 August 2026), confirming the 10 August 2026 appellate decision.
- International Monetary Fund, "Panama: Financial Sector Assessment Program Technical Note on Anti-Money Laundering and Combating the Financing of Terrorism," Country Report No. 24/233 (July 2024).
- ICIJ, "Hundreds of millions more dollars recouped by governments after ICIJ investigations" (3 April 2025).
- ICIJ, "Swedbank fined $50 million by New York authorities over Panama Papers revelations" (17 July 2026); NYDFS Consent Order.