The hacker, the tax haven, and what $200 million in offshore deposits can tell us about the fight against illicit wealth

The global financial system is infected with dirty money. Despite decades of progress in strengthening policies aimed at stamping out cross-border tax evasion and money laundering, many of those looking to stash their money overseas to avoid taxation or prosecution can still do so with relative impunity. As the FinCEN Files scandal last year revealed, banks—themselves the tip of the spear in the fight against financial crime—often fail to catch the worst offenders in a timely manner. Tax authorities and financial intelligence units also struggle to keep up, due to the basic fact that it becomes very difficult to track what happens to money the minute it leaves your economy and goes offshore.

A lot of hidden wealth either ends up in or transits through tax havens: jurisdictions that offer low tax rates and high degrees of financial secrecy, including legal systems and regulations that make it easier for people to keep their wealth hidden from the prying eyes of their governments back home. In the past decade many governments have made a lot of progress in getting archetypal havens to start sharing information on the owners of offshore wealth. But while these efforts have succeeded in sending a lot of tax haven clients scrambling for new places to hide their money, they have given policymakers and researchers only a glimpse into who uses and benefits from tax havens.

Fighting dirty money is going to require a concerted effort by regulators, law enforcement, the press, civil society, and researchers around the world.

Occasionally, data leaks mean we get to fully rip back the curtain surrounding the offshore economy. In late 2019, Distributed Denial of Secrets, a Wikileaks-style journalist collective, released a leaked cache of internal files and emails from the Cayman National Bank and Trust — a bank based in the Isle of Man, home of a large offshore financial industry. The leak appears to have been perpetrated by the anonymous hacktivist known as Phineas Fisher. The hacker—whose only live interview to date is in the form of a sock puppet—made their name by hacking surveillance and spyware organizations like the Gamma Group and Hacking Team.

Thanks to the leak, investigative journalists around the world have highlighted several of the bank’s more questionable clients. These ranged from a Russian billionaire on the lam from the IRS for tax evasion, a former Armenian government official under investigation for corruption, and even companies connected to the German payments company Wirecard, which recently collapsed under the weight of a 1.9 billion euro accounting fraud scandal. But while the headline-grabbing cases are more salient, they don’t tell the whole story. In a new working paper, I use the data from the leak to start answering some fundamental questions about who stores their money in tax havens and how that should alter our approach to fighting dirty money, both abroad and at home.

After a year of going through the data, which at its peak covered about $200 million in offshore deposits, I made three discoveries.

Discovery #1: The rich will always be with us, but audit rates need to reflect that

The data in the leak allowed me to pinpoint where the bank’s clients were based: both those with their own account and those indirectly connected to the bank because they owned or benefited from an entity that held an account there. This made it possible to understand whether clients were more likely to come from richer parts of the world and if the amount of wealth they had—measured by their account balances—suggested they were likely to be rich themselves.

Clients of offshore banks appear to be wealthy by nearly any metric. Adjusted for each country’s population, there are nearly five times as many clients from countries with a GDP per capita of $50,000, such as Sweden, than there are for those with a GDP per capita of $5,000, such as Ghana. No matter what country they were based in, at their peak the amount of money clients had in their bank account was substantial, with the median person having about twice their national income. For some countries, the difference was even more stark: Clients from Ukraine had roughly 50 times their national income in offshore deposits and those from Nigeria had roughly 150 times. Even when we look within a country, offshore clients appear rich. Pinpointing where the bank’s British clients lived revealed that they were more likely to be based in parts of the United Kingdom that were richer and had higher property values.

While “rich people like to use tax havens” is not going to make the headlines, it reinforces a growing body of evidence that, no matter which country you are looking at, it is those that are the most well off that are the most likely to stash their money in offshore accounts. This wouldn’t be a problem if tax authorities knew where to find that money, but they don’t. A recent working paper written by academics in collaboration with the IRS shows that random audits routinely fail to capture the extent to which richer taxpayers stash their wealth abroad—leaving approximately $15 billion in taxes on the table (most of which was owed by the top 0.1 percent of the income distribution). This not only makes it hard to raise revenue, it forces tax authorities to claw back more money from poorer people by auditing them more often. The offshore world doesn’t just enable the rich to reduce their tax bill, it amplifies inequality around the world.

To fight back, tax authorities are going to have to start investing in auditing rich people more—a reality that the Biden administration has recently embraced by proposing an $80 billion increase in IRS funding. But to set those audits up for success, we have to break down the information barriers that governments face. This means expanding and improving upon the growing global network of exchange agreements that tax authorities use to hunt down those offshore deposits—an effort that will require not only more coordination, but full participation from the United States.

Discovery #2: Many offshore clients have connections to people with political power

Far too often, politicians use their connections to enrich themselves, their friends, or their families. Because of this, banks are required by most regulators to identify clients who wield political power—or those close to powerful people—to ensure they are not using the financial system to hide ill-gotten gains. The data from the leak indicate that Cayman National Bank did just this: Records suggest they maintained a register of these politically-exposed persons (PEPs), conducted frequent due diligence, and reported them to the authorities whenever concerns arose.

Yet despite being watched more closely, offshore clients with political connections displayed some worrying characteristics. Compared to other clients of the bank they were more likely to use tax havens both as a domicile and as a source of funds. They also controlled substantially more wealth during their relationship with the bank. Relative to the number of ordinary clients the bank was connected to, PEPs were also disproportionately from countries that have a poor record on corruption, many of them from post-Soviet countries.

None of these statistics prove anyone was doing anything wrong, but the presence of a large number of politically connected clients in the offshore (or any other) economy should give regulators pause. Because a government official working in a financial intelligence unit will only observe a politically-connected client if and when a bank registers a concern (through a process known as suspicious activity reporting), the presence of political elites in the banking system will largely go unseen by regulators.

Regulators need to know when their economies are being targeted by those with political power—either those at home or from abroad. For example, while the presence of a single Russian politically connected client wouldn’t be cause for alarm—regulators would certainly want to know if most of a bank’s clientele were Russian PEPs. One solution would be to require banks to begin reporting aggregate figures on PEP clients. This could be an important component in the risk assessments that governments around the world routinely conduct in order to understand where the money laundering threats and vulnerabilities in their economy lay.

Discovery #3: Shell companies are hurting our ability to understand how much wealth sits offshore

Most people with offshore bank accounts don’t hold money under their own name, but instead establish shell companies—firms that have no physical presence and don’t engage in any real forms of economic activity—to hold it on their behalf. Their presence can make it very hard for regulators (and even banks) to fully understand who ultimately controls a bank account or benefits from a transaction. Even when shell companies in tax havens are being used for legitimate reasons, their existence creates a fundamental problem for the way we measure offshore wealth—one that international tax researchers have been grappling with for years.

Most studies of offshore wealth and its drivers rely in part on data from the Bank of International Settlements (BIS). Every quarter, banks in participating jurisdictions are required to count up and report all the deposits owned by foreigners (known as cross-border liabilities), which the BIS then aggregates and publishes as part of its Locational Banking Statistics. However, the BIS only requires banks to report this information based on the residence of “immediate counterparty”—that is, the most proximate owner of the offshore wealth. When that is a person, it is a relatively straightforward process: Deposits owned by French residents will get assigned to France. But when a French resident owns those deposits through a shell company based in Liechtenstein, the bank will only report that they are controlled by someone in the latter, not the former. In practice, this means that the BIS’s data—without adjustment—will undercount wealth held in tax havens by the rest of the world.

How badly does this skew the data? Information from the leak offers a few clues: Because it is possible to observe the ultimate “beneficial owner” or “beneficiary” of the offshore entities that had an account with the bank, it’s possible to calculate the share of deposits that are actually owned by foreigners who are based in non-haven countries but are instead reported to the BIS as being owned by people in tax havens because they are owned through entities based in havens. Once this correction is made, the differences are stark: About half of all wealth owned by people who don’t live in tax havens is incorrectly reported as being owned by people who live in tax havens (for the record, very few people live in tax havens).

The presence of shell companies and the way data on them is collected makes it harder to understand how much wealth sits offshore, but much of this can be fixed with a simple tweak of the rules. The Bank of International Settlements should ask banks to start collecting information based on the ultimate residence or nationality of their clients. This would not be an onerous exercise for banks, as they are already required to collect this information as part of their due diligence obligations for onboarding new clients. It would also be in keeping with the BIS’s efforts to understand the ultimate nationality of ownership for other financial instruments, such as debt securities.

Turning the tide on illicit wealth

Much like the lessons learned after the Panama Papers scandal or the FinCEN Files, these three discoveries were only possible because someone leaked data onto the internet. While we should take every opportunity we can to learn from these leaks, it’s not a sustainable way to bring light to the darkest recesses of the offshore world.

Fighting dirty money is going to require a concerted effort by regulators, law enforcement, the press, civil society, and researchers around the world. The closest thing to a silver bullet that the effort needs is better information on who owns what. And we can get that information by passing laws that force the ultimate owners of shell companies and trusts to reveal themselves. At least 80 countries around the world have started making progress on this front, passing laws to create what are called “beneficial ownership” registries. The U.S. has recently followed suit with the introduction of the Corporate Transparency Act, which will require companies to disclose this information to FinCEN, our financial intelligence unit.

But while providing that information to the right people in government is a first step, it isn’t enough. When possible, data from beneficial ownership registries (and even anonymized information from tax exchange agreements) needs to be made public. This enables the public to act as an auditor as a last resort: Civil society and the media have highlighted major issues in beneficial ownership registries in both the U.K. and Luxembourg. It also helps entrepreneurial data sleuths hunt for clues that law enforcement might miss.

Our ability to understand and curb the impact that offshore wealth has on our world shouldn’t be decided by the efforts of hackers and investigative journalists. We need policies in place to make this kind of data more freely available, to everyone. While the financial system may be infected with dirty money, it turns out that sunlight can be a powerful disinfectant.