January 21, 2020 | Written by: Ciaran Doyle
Categorized: AI | Banking | FinTech | IBM RegTech Innovations
Share this post:
Shell companies and the hidden threat of entity risk
While not inherently illegal, shell companies have been getting a lot attention recently for the role they play in illegal activity. This makes sense, as two of the legitimate uses of shell companies are the ability to shield owners from litigation and as a vehicle for tax avoidance (not evasion). They are also helpful tools for managing complex corporate and intellectual property ownership structures.
Those completely legal benefits don’t stop at legitimate organizations. In addition to beneficial ownership – as we’ve seen in the Panama and Paradise Papers, as well as the Troika Laundromat – complex shell arrangements are often used to mask flows of money to expressly confuse or obfuscate the source and beneficiary. Besides reducing tax burdens, shell structures are a great mechanism for hiding money laundering and funds from organized crime activities as well.
Why they are hard to spot
Unfortunately for compliance, sanctions and AML departments, there is no easy way to identify a shell company. With limited visibility into cross-institution transaction flows and beneficial ownership structures, in addition to siloed organization data, financial institutions often don’t get the full picture of who knows who and who is who. (And as far as I can tell, “shell company” doesn’t yet have a NAICS code).
The way financial institutions manage their Know Your Customer (KYC) operations also makes shell companies hard to spot. By that I mean the KYC process focuses on understanding the risk of an organization or individual when they become a customer, during the on-boarding process. It involves a fairly static risk scorecard for that point-in-time, where location, demographics and expected use all play a role in gauging risk.
But after the initial process, many institutions don’t follow up to see if the expected behavior matches actual behavior or if customer details represent a higher risk than during initial review. Yet that is where you can uncover potential shell companies.
Finding the (suspected) shell company
Anyone who claims they can definitively identify a shell company has either a) lied, b) memorized the Panama and Paradise Papers or c) created the company themselves. But understanding patterns of activity indicative of shell companies provides greater insight into potential shell companies.
Understanding these patterns involves looking at two types of data: relationships and transactional activity. By taking in and aggregating data from both internal and external sources, institutions can build out networks that show connections between various entities, and better understand ownership, affiliation and transactional flows.
The second area of looking at transactions also reveals certain patterns that highlight the rationale for shell company formation. One example is incorporating a company in a lax regulatory jurisdiction but conducting a majority of the business transactions with a more rigorous regulatory jurisdiction. This is not to say that there cannot be any legitimate business formed in a lax regulatory regime, but it begs the question why? Why not form a business where you actually do business? What are some of the benefits to obfuscating ownership, avoiding rigorous KYC processes or escaping government oversight?
Why shells matter
As I said at the outset, shell companies are not illegal. But the criminal world understands this and has been exploiting the legitimate benefits of this corporate structure for illicit means. Understanding if a company could be a shell is the first step in better managing the risk it may pose to your business. Greater scrutiny of ownership and transactional behavior will exonerate (diminish) that risk by justifying that structure or aggravate (magnify) that risk by revealing additional risks.
To learn more about entity risk and how shell companies play a role, watch our latest RegTalk webinar, “Risky business: Risky business: Uncovering entity risk with AI”.