On March 9, 2016, employees of Mossack Fonseca, a Panamanian law firm that for decades had kept the financial secrets of global celebrities, oligarchs and criminals, made a stomach-churning discovery. Someone had copied huge amounts of data from its computers.
Emails, contracts, banking statements – 11.5 million documents of the firm’s most sensitive client records, a staggering 2.6 terabytes of data – had been taken.
Suddenly, the day-to-day business of setting up shell companies in tax havens was no longer the priority. Instead, newly obtained Mossack Fonseca documents show, employees began working furiously on a new mission: find out who its clients were.
As a key player in the world of offshore finance, Mossack Fonseca had for years flouted rules requiring lawyers and other offshore specialists to identify and verify their clients, requirements designed to prevent aiding criminal activity.
Over the year, newly leaked documents show, Mossack Fonseca employees frantically emailed bankers, accountants and lawyers – the professionals who had hired the firm to set up shell companies for wealthy clients who wanted to remain anonymous – in an attempt to close the gaps in its recordkeeping. Those intermediaries responded with panic and fury.
“THE CLIENT DISAPPEARED! I CAN NOT FIND HIM ANYMORE!!!!!!!,” Nicole Didi, a Swiss wealth management adviser, wrote in March 2017. A long-time intermediary of Mossack Fonseca, she acted for 80 companies set up by the firm.
“This has been ridiculous,” wrote Eliezer Panell, a Florida lawyer who grew exasperated at Mossack Fonseca’s multiple requests – sometimes only one day apart – that he obtain and share documents from two offshore company owners to prove their identity.
“WE CAN’T GO BACK a day after asking for papers to ask for something else,” he wrote. “WE LOOK LIKE FUCKING AMATEURS. A Mickey Mouse operation.”
In late March of 2016, Mossack Fonseca told ICIJ that the firm conducts “thorough due diligence on all new and prospective clients that often exceeds in stringency the existing rules and standards to which we and others are bound.”
The new documents reveal that Mossack Fonseca, in fact, often had no idea who was benefiting from its services. The firm couldn’t identify tens of thousands of owners of companies it had registered in opaque, low-tax jurisdictions, the documents show.
Two months after the firm became aware of the records breach, it still couldn’t identify owners of more than 70 percent of 28,500 active companies in the British Virgin Islands, the firm’s busiest offshore hub. It didn’t know who owned 75 percent of 10,500 active shell companies in Panama, the records show.
It shouldn’t be acceptable that a firm like this doesn’t know the owner of one shell company, let alone thousands of them.
The firm’s ignorance about who benefited from the shell companies it helped set up represented a significant risk. Failure to comply with know-your-client rules could expose Mossack Fonseca to lawsuits and even criminal investigations – and force the firm to shutter the shell companies, throwing its own and clients’ businesses into chaos.
Know-your-client standards have grown ever stricter over time as governments have stepped up efforts to combat terrorism funding and money laundering. Mossack Fonseca’s brazen disregard of such a fundamental legal obligation was extraordinary, experts say.
“It shouldn’t be acceptable that a firm like this doesn’t know the owner of one shell company, let alone thousands of them,” said Jack Blum, a U.S. attorney who specializes in tax fraud and money laundering. That there was no record of who owns what, Blum said, “tells you how far the shell business has gone in terms of being a sham. It strikes me that it’s as crazy as crazy can be.”
Mossack Fonseca’s lawyer, Guillermina McDonald, said in an interview in June with ICIJ partners that Mossack Fonseca defined its “clients” as lawyers, bankers and accountants and not end-users. The law firm “always” knew what it was required to know about company owners, she said.
This account of Mossack Fonseca’s final months is the result of a second major leak from the firm. The first leak led to the Panama Papers investigation and the firm’s undoing.
In April 2016 the International Consortium of Investigative Journalists and more than 100 media partners published hundreds of stories based on the leak of millions of internal documents that exposed the firm’s inner workings from the late 1970s to 2015.
The Panama Papers investigation convulsed the worlds of politics, finance and law. The roster of publicity-shy parties who used Mossack Fonseca’s services included members of Vladimir Putin’s inner circle, the then-prime minister of Iceland, and a company suspected of holding proceeds from a famous 1983 London gold heist.
Iceland’s prime minister, Sigmundur David Gunnlaugsson, resigned after the investigation revealed a stake in an offshore company that he and his wife used secretly to hold nearly $4 million in bonds in Icelandic banks, even as his government was negotiating with the banks’ creditors.
Pakistanis protested in the streets when it was revealed that children of then-prime minister Nawaz Sharif had set up shell companies to help discreetly hold multi-million dollar London real estate. Sharif resigned in July 2017 after Pakistan’s supreme court disqualified him from office.
Police raided Mossack Fonseca’s offices in El Salvador, Peru and Panama City. By the end of 2016, governments and companies in 79 countries had opened 150 inquiries, audits or investigations into the law firm, its intermediaries or clients.
The new leak offers a view inside Mossack Fonseca and the circle of professionals it did business with in the weeks before the Panama Papers investigation broke and during the aftermath, as the firm scrambled to identify clients, and clients began to drift away. The documents, which include emails, passport copies and criminal case files, are dated from early 2016 through the end of 2017, a few months before the firm collapsed.
The information was obtained by the same newspaper that had received the first leak, Süddeutsche Zeitung. The records were shared with ICIJ and its media partners.
Decades of offshore secrecy and then a data breach
In 1986, Jürgen Mossack, a German immigrant whose father moved his family to Panama after serving in Hitler’s Waffen-SS, and Ramón Fonseca, a prominent Panamanian novelist and attorney, merged their law practices.
The firm, Mossack Fonseca, developed a niche helping the rich conceal their wealth offshore. From its base in Panama City, the firm expanded its operations to more than 30 countries, working closely with global banks including HSBC, UBS and Credit Suisse and law firms in the Netherlands, Mexico, the United States and Switzerland.
Mossack Fonseca rarely communicated directly with the ultimate beneficiaries of its work. It corresponded instead with the intermediaries that stood between the firm and the wealthy individuals seeking to shield luxury homes, yachts and jets, bank accounts and valuable art collections from unpredictable court battles, former spouses and inquisitive tax inspectors. Some beneficiaries of Mossack Fonseca’s discreet services used shell companies to bribe government officials and hide away mountains of cash.
The arrangement allowed Mossack Fonseca to operate largely in obscurity for decades. Then someone made off with a vast trove of its most confidential records, which made their way to reporters.
In early March 2016, calls from ICIJ journalists began pouring into Mossack Fonseca and to intermediary professionals. With the discovery of the computer breach, the firm shifted fully into crisis mode.
The day after the breach was confirmed, Mossack Fonseca’s lawyer asked Panama’s attorney general to launch a criminal investigation and “urgently interrogate” journalists from France, Denmark, Australia, the United States and Germany who were in Panama filming documentaries for what would become the Panama Papers investigation. The journalists must not be allowed to leave Panama or their Hilton Hotel until they reveal how they obtained documents from Mossack Fonseca, the lawyer demanded – unsuccessfully.
Nicole Didi, the Swiss adviser, was among the first to contact the firm about journalists’ inquiries.
“This French journalist wants to publish an article in the newspaper Le Monde which is not acceptable for me!!!,” Didi wrote in an email that included yellow highlighted text.
Mossack Fonseca’s client service coordinator, Jorge Cerrud, tried to calm Didi over the telephone, the records show.
“I will go ahead and talk to our PR department to see how we can help you prepare in case the journalists contact you again,” Cerrud later emailed.
After the Panama Papers investigation was published on April 3, emails and phone calls to the law firm surged. Firm employees increased the use of a CrisisCommittee@mossfon email address, the records show.
Many emails echoed one sent by Charles Hotton, managing director of a Jersey subsidiary of the Bank of Singapore, which helps the wealthy protect their assets.
“URGENT…what documents/BO info was taken from files and when,” Hotton wrote, referring to the so-called “beneficial owners” of offshore companies, whose purpose can be to conceal the ultimate “BOs”.
Cerrud, the client relations coordinator, gamely tried to assuage Hotton. “We have stopped the hack from further retrieving information from our email system as of March,” he replied.
Sometimes, high-profile clients themselves rushed forward to prove to Mossack Fonseca they were, in fact, clients.
Aides of Ukraine’s president Petro Poroshenko sent the embattled law firm an electricity bill to prove his identity after anti-money laundering authorities in the British Virgin Islands demanded ownership confirmation of Poroshenko’s offshore company. Lawyers for the president of the United Arab Emirates, Sheikh Khalifa bin Zayed Al Nahyan, dashed off a password-protected letter to Mossack Fonseca about his passport and his family members. Such proof would allow the monarch to keep owning and managing properties in the United Kingdom through offshore companies.
Among the correspondence are 17 emails with representatives of Hollywood star Jackie Chan, a Mossack Fonseca client who provided his scanned passport and an American Express statement in an attempt to keep open offshore trading and film production companies and to help Mossack Fonseca avoid fines for incomplete paperwork. Mossack Fonseca also corresponded with lawyers who helped manage the Panama company of Argentinian soccer superstar Lionel Messi, who had recently been found guilty of tax fraud in Spain as part of a case unrelated to the Panama Papers.
Others reacted to news of the breach with disbelief and anger. According to internal Mossack Fonseca emails, one Uruguayan accountant rejected the law firm’s suggestion that he hand-write and backdate a document to make it appear that the firm had accurate information from the beginning on the ownership of a company controlled by the family of Argentina President Mauricio Macri. The idea was dropped after the accountant reportedly told Mossack Fonseca the document would be “easily refuted by an expert calligrapher.” (A Macri family company spokesman told ICIJ partner La Nación that the president’s father had declared his ownership and had no further comment.)
A lawyer representing Nigeria’s powerful Senate president Bukola Saraki and his wife took an overnight flight from London to Panama. And one of Switzerland’s highest-profile lawyers excoriated the firm on behalf of the family of Beny Steinmetz, a mining executive now under investigation in Israel for alleged bribery and corruption in Africa.
“The leaking of information of which Mossack Fonseca & Co was the guardian has caused damage to our clients, who were wrong to have trusted you and believed in your abilities and professional rigor,” wrote lawyer Marc Bonnant.
A spokeswoman for Steinmetz told ICIJ the bribery and corruption allegations are baseless.
One finance professional told Mossack Fonseca that he had never given permission for his name to be written on offshore company documents, let alone made public.
“It’s gob smacking, and I demand you DELETE my name from all your files,” Jean-Yves de Louvigny wrote in an email to Mossack Fonseca’s office in Luxembourg.
“I am stunned by the fact that someone else can provide my name without my consent!,” de Louvigny wrote. The banker had seen his name published as part of the Panama Papers but claimed he had never had any involvement with an offshore company. He likened the gaffe to writing the names of then-French president François Hollande and then-U.S. president Barack Obama. “Would you have done that?????”
ICIJ sought comment from de Louvigny and other intermediaries named in this story, but none responded.
Mossack Fonseca goes into damage control
Amid its campaign to identify its clients, Mossack Fonseca was trying to limit the fallout from the leak.
Mossack Fonseca told clients and intermediaries it had installed a firewall to rebuff computer attacks and that it had introduced a system to encrypt emails and documents about the most sensitive part of the offshore industry – who owns what.
The firm hired media relations consultants to “give our version of the events.” It also contacted what it called “industry ambassadors” to ask them for public support, emails show.
The law firm pointed clients to an opinion piece by Daniel Mitchell, co-founder of the libertarian Center for Freedom and Prosperity, in Caribbean News Now. Mitchell proactively wrote that “firms like Mossack Fonseca are merely just the latest stand-ins and proxies for a much wider campaign being waged by left-wing governments and their various allies and interest groups.”
Mitchell told ICIJ that a Mossack Fonseca employee contacted him after the leak but that he was “already on top of the issue.” Mossack Fonseca’s closure is “unfortunate,” Mitchell said.
“The protection and security of information is our most important priority,” Mossack Fonseca told clients in a May 2016 announcement after the Panama Papers publication. “We once again apologize for the difficult situation that has been created by this unlawful breach.”
Clients weren’t much reassured by the firm’s attempts at damage control, records show. One lawyer grew impatient listening to telephone hold music and complained in a July 2016 email to Josette Roquebert, a senior Mossack Fonseca director in Panama. Another grew increasingly frustrated as days passed without a response to an email. “Our customers are not wind vanes to be twirled at your leisure,” the offshore management company employee wrote.
One Swiss intermediary was totally fed up. “By a lot of messages, you, MOSSACK, are trying to convince we clients that you are taking control of this unbelievable situation,” Félix Chille wrote.
The message concluded: “This email will, probably, be intercepted like 11,600,000 other documents. I don’t care.”
Others were more sympathetic but made it clear that Mossack Fonseca had violated the offshore industry’s sacred, if unwritten, code of secrecy.
“We are very sorry about what happened…and wish you the best, but the main purpose of this type of structures has been broken: confidentiality,” wrote Uruguayan financial planner Ignacio Frechou.
Investigations, audits and “significant deficiencies”
The firm received pointed questions from regulators and law enforcement in the weeks and months after the story broke.
Governments opened investigations into companies set up by some of Mossack Fonseca’s busiest office locations, including Panama, the British Virgin Islands, Samoa, the Seychelles and Anguilla.
In April 2016, the Seychelles Financial Services Authority, which regulates operators like Mossack Fonseca to ensure offshore vehicles are not misused, asked the firm to reveal who owned some of the 5,379 active companies it had incorporated in the island archipelago.
One way Mossack Fonseca eluded strict know-your-client rules was to rely on outside lawyers to vouch for the reputation and identity of the actual company owner.
Internal emails show employees acknowledging to each other that they might not be able to comply with the requests – and discussing the potential risk of losing the right to operate in the country.
“This is a gray area that lends itself to interpretation,” wrote Josette Roquebert about the firm’s reliance on certain third parties to vouch for the reputation and identity of clients. The practice “could be considered a breach” of Seychelles law, Roquebert wrote.
An audit by the Seychelles’ financial crime agency months later concluded that Mossack Fonseca’s office did not regularly monitor high-risk, politically-connected clients and had violated six anti-money-laundering laws and regulations, according to the new files.
“Overall, the examiners found significant deficiencies in Mossack Fonseca Seychelles’ operations,” wrote Phillip Moustache, director of the country’s Financial Intelligence Unit, in a letter to the firm.
The firm’s clients were also being investigated. Authorities in India, Spain, Sweden and Argentina demanded information from Mossack Fonseca about taxpayers who owned offshore companies through the firm, the newly leaked records show. Local police searched Mossack Fonseca’s British Virgin Islands office for records as part of a British bribery probe involving Nigerian oil mogul Kolawole Aluko.
Two months after publication of the Panama Papers investigation, British authorities forced Mossack Fonseca to hand over documents on a shell company managed by a subsidiary of Eurasian Natural Resources Corporation (ENRC), a publicly-traded mining and energy company. In 2013, the United Kingdom’s Serious Fraud Office announced an investigation of ENRC for alleged bribery in Kazakhstan and Africa. The company delisted from London’s stock exchange later that year.
The ENRC shell company, Cofiparinter Ltd., was being investigated by the U.K’s Serious Fraud Office for corruption, bribery and money laundering and other alleged offences, according to a copy of the search warrant. The investigation into the company has not previously been reported.
A spokesman for ENRC told ICIJ “it would be inappropriate to comment on any ongoing investigation.”
“The deal involving Cofiparinter raises a host of questions about who benefited from Congo’s natural wealth,” said Anneke van Woudenberg, a Congo mining expert with U.K. nonprofit Rights and Accountability in Development (RAID). “One answer is clear: it was not Congo’s impoverished citizens.”
British authorities declined to comment on what prompted the Cofiparinter investigation or to say if it is ongoing.
Partners Mossack and Fonseca retire, as firm prepares to “wither away”
At first, Mossack Fonseca tried to encourage its clients to remain loyal, despite the raging legal and public relations storm.
The firm slashed fees and offered some clients the option to change their shell company’s name so that business operations could discretely continue.
Mossack Fonseca helped some clients by changing its own business name to remove any obvious reference to the Panamanian founders on mail, packages and invoices. In Samoa, Mossack Fonseca became Central Corporate Services Ltd. In Panama, Mossack Fonseca transferred clients to Orbis Legal Services, which hired some Mossack Fonseca employees to maintain the “same level of service.”
Other clients simply moved their business to other offshore service providers in havens such as Guernsey in the Channel Islands, the British Virgin Islands and Cyprus.
“YOUR COMPANY IS NOT RELIABLE AND CREDIBLE———-BYE BYE,” wrote Luxembourg-based intermediary, Jeffrey Davies.
Clients started reporting that banks were refusing to accept or process any payments to Mossack Fonseca.
In May 2016, the firm announced to clients that it was shutting down its office in the Isle of Man, the British Crown dependency in the Irish Sea. Office closures in Jersey and Hong Kong soon followed.
Later that year, Fonseca and Mossack announced that they would retire from the firm they had founded. A skeletal Mossack Fonseca would remain open for a few years longer to fulfill existing obligations but would “eventually wither away,” an email to clients said.
In February 2017, Panama’s attorney general, Kenia Porcell, alleged that Mossack Fonseca companies had been used to make and receive bribes across Latin America in connection with the Lava Jato or “car wash” scandal. The probe, which is ongoing, centers on allegations that dozens of politicians and executives at Brazil’s state-run oil company, Petrobras, received billions of dollars in bribes from contractors who were awarded generous contracts.
Attorney General Porcell called Mossack Fonseca “a criminal organization that is dedicated to hiding money assets from suspicious origins.” She ordered Mossack and Fonseca arrested on money laundering charges. The men, who denied wrongdoing, spent several months in jail before making bail.
“The prosecutors are trying to obtain evidence for a crime that does not exist,” Mossack scrawled in a notebook from his jail cell. “If this were Spain in the dark ages they would have us burning at the stake.”
Mossack and Fonseca were released in April 2017. About a year later, the law firm bearing their names closed for good.
In May 2018, Panama prosecutors charged 10 other Mossack Fonseca employees with money laundering as part of investigations into Brazil’s Lava Jato scandal. Mossack remains under investigation by prosecutors in Cologne, Germany, as an accessory to tax evasion, according to a statement provided to Süddeutsche Zeitung.
Panama’s attorney general’s office told Süddeutsche Zeitung that five criminal investigations related to Mossack Fonseca are ongoing.
Mossack and Fonseca did not respond to specific questions from ICIJ or its partners. In June, the lawyers issued a press release that said the law firm, its employees and its founders were “never involved in unlawful acts.”
Client offered last bit of help with list of alternative offshore firms
The messages from Nicole Didi didn’t let up. The Swiss adviser was one of the first intermediaries to email Mossack Fonseca after being questioned by journalists, and she continued to write to the firm, with mounting frustration, for the next 19 months.
She accused the firm of misplacing documents, wrongly identifying the owner of an offshore company and repeatedly asking questions that Didi felt she could not answer.
“I can not believe your company!!!!!!!!!!!!!!!!!!!!!,” Didi wrote in May 2017.
Eventually, Makya Villarreal, the manager of Mossack Fonseca’s Seychelles office, told Didi it was time she took her business elsewhere.
“We will not reply to any messages that you send, and you must sort out any issues with the new Agent that you choose to work with,” the manager wrote.
The Mossack Fonseca employee did offer one last bit of help.
Villarreal pointed Didi to a list of 67 other offshore specialists based in the Seychelles that offered the same services as Mossack Fonseca.
Contributors to this story: Ryan Chittum.
