Unravelling the Magic of Shell Companies
FinCEN is building a new database of information on company ownership. But what impact will this have on law enforcement efforts?
Investigating money laundering is no easy task. It requires law enforcement officers to identify the individuals involved, determine the initial source of illicit proceeds, and follow the money through winding paths of transactions from which it will eventually emerge, clean and ready to use. Powerful criminal organizations employ professional accountants and computer scientists to facilitate this process.1 Law enforcement, in contrast, tend to operate on shoestring budgets.2 And even for those agencies that do have sizable resources, such as the U.S. Federal Bureau of Investigation, there is another major challenge: access to data.3
One key piece of data often eluding law enforcement is the “beneficial ownership” of legal entities that may be involved in criminal schemes. Beneficial ownership includes standard legal ownership, such as someone holding 40% of the shares of a particular company. But it also includes those who benefit from exercising substantial control over the company despite holding no shares. This could include senior staff such as the Chief Financial Officer. And it would also include anyone with the authority to appoint or remove those senior staff.4
Beneficial ownership information is key because money laundering often involves the use of complex corporate structures. If you were a trade finance specialist in the mid-2000s, you might not find anything strange about facilitating transactions for Sunny Minerals Company Limited. It sounds friendly enough. But if you were to look more closely at its beneficial ownership structure, you would find that it was actually a front company used by Li Fangwei — one of the world’s most notorious arms dealers — to facilitate the delivery of dual-use goods to Iran.5
Thanks for reading False Positive! Subscribe for free to receive new posts and support my work.
These schemes often include the use of shell companies. Shell companies are a sort of legal magic trick. They have no physical presence and perform no obvious economic function.6 But they are useful. Shell companies can, for example, take the form of trusts to manage estate planning. They can also help companies address some of the complications of carrying out business in foreign jurisdictions. This is all perfectly legal. Even the FBI uses them!
But they can also be weaponized for obfuscation. Criminals utilize shell companies to create endless layers of intermediary relationships that serve no purpose other than to hide their ultimate beneficial owners. Imagine, for example, that you are a Mexican drug lord buying a horse farm in Oklahoma to launder your profits.7 You aren’t going to just list yourself as the beneficial owner. No, the horse farm will be purchased by a shell company, which will itself be owned by yet more shell companies, eventually leading back to you or, better, a close associate.8
The capacity of American law enforcement to obtain this information — to unravel, in other words, the magic of shell companies — is very limited. Some countries, such as the UK, have created national registries of beneficial ownership.9 But in the U.S., this information has historically been collected through a confusing mixture of state-level registries, federal filings, and private company due diligence, all using inconsistent data formats that cannot be easily reconciled. Finding ownership information in the U.S. is, in other words, a hot mess.
The Status Quo: A Hot Mess
If you were seeking to understand the ownership structure of a U.S. entity, it would be natural to first turn toward state registries. Companies generally need to register with the state(s) in which they do business. Let’s take a fun example: Crime Scene Cleaners Inc, “a cleaning maintenance service specializing in the cleanup of homicide, suicide, & accidental death.”10 You can find Crime Scene Cleaners Inc in the Idaho registry of businesses, including information on a “registered agent.”
But what you see above is all you get. Not very useful if you were seeking to unravel the layers of a complex ownership structure. Making things worse, the information collected by different states and territories is inconsistent.11 Most require that you provide the name and address of a ‘registered agent’ responsible for receiving any official correspondence. But only some require their signature. And while a handful of states need the names of key officers, others don’t. Plus, there is often no need to update this data when ownership changes.12
These requirements are a bit different if the company is public and issues shares that can be purchased by investors.13 Anyone who acquires more than 5% of a public company must disclose that purchase to the SEC within five days.14 Here’s the most recent one I could find. Gloria E. Gebbia of Miami Beach, Florida now beneficially owns 43% of Siebert Financial Corp., a financial advisory company whose shares currently trade for $1.78 on NASDAQ. Congratulations Gloria.
Is this type of disclosure useful for investigating financial crime? Not really. While money laundering can take place through public companies, most of the dark arts — the good stuff — is happening through unlisted Limited Liability Companies (LLCs) and shell structures.
But if state registries are unhelpful for investigating these companies, where would you turn next? The answer is financial institutions. Banks, brokerages, and other companies in the U.S. are required to identify and verify the beneficial ownership of their legal entity customers. This normally involves asking clients for copies of their corporate charter, articles of incorporation, organizational structure chart, and lists of key officers that might qualify as ‘controllers.’ Generally the expectation is that these institutions trace each layer of legal entities until they reach the ‘ultimate’ beneficial owners: the real people at the top of the pyramid.
This is much more useful than state registries. But there are limitations. Financial institutions in the U.S. are only legally required to verify those who own 25% or more of a company.15 These institutions often apply lower thresholds for higher-risk clients (say, verifying to the 10% level). But the option to ignore a quarter of the ownership structure — plenty of room for all kinds of shenanigans — remains.
More to the point, the information that is collected by financial institutions is neither public nor automatically shared with law enforcement. If investigators are lucky, they may be able to access this data from a Suspicious Activity Report, or SAR. Financial institutions are required to submit these reports to FinCEN, a department of the U.S. Treasury which subsequently makes them available to law enforcement. But SARs, even if available, may not provide a full picture.
It is more likely that investigators will have to issue subpoenas to financial institutions to obtain more information about legal entities of interest. But even this step is riddled with risks. The financial institution could, for example, challenge the legality of the request, causing delays to the process. Worse, they could tip off the client that they are the subject of a law enforcement inquiry. This is not supposed to happen. But, oh yes, it most certainly does.
All of this is about to change. As of January 1st, U.S. companies are now required to report beneficial ownership information directly to FinCEN. This new Beneficial Ownership Information (BOI) Database will subsequently be made available to law enforcement and other actors to assist with their investigations. In so doing, the BOI will upend the status quo, creating a national registry of beneficial ownership data and flipping the dynamics of information access.
Cutting out the Middle-Men
Here’s how the new BOI Database works. Certain companies, including LLCs registered to do business in America, are required to report beneficial ownership information directly to FinCEN.16 This includes anyone who exercises ‘substantial control’ or owns 25% or more of the company. These companies are also required to report any changes to their beneficial ownership structure.17 FinCEN will maintain this database and make it available to various actors. This includes law enforcement, regulators, and intelligence agencies. And it also includes, upon request, government agencies in other national jurisdictions.
This is a remarkable development. For most of modern history, states have outsourced financial crime detection to the private sector. But states are increasingly reversing this arrangement by acquiring direct access to financial or, in this case, ownership data. Notable examples are the UK and EU’s ownership registries (the latter of which is ironically called BORIS). There is also the Consolidated Audit Trail, which allows the SEC to directly monitor stock trading for manipulation.18 The BOI Database is the latest example of this trend, which one might interpret as an implicit admission that relying on private firms to monitor their own customers is futile.
FinCEN’s new database is also good news for regulators and law enforcement in other countries. These agencies often request beneficial ownership information from their U.S. counterparts to assist with investigations. But the latter’s lack of direct access to the data precluded assistance. FATF, an international agency that assesses countries’ efforts to combat financial crime, complained about this in 2016:
The lack of readily accessible BO [Beneficial Ownership] information means that U.S. authorities are unlikely to undertake a resource-intensive investigation to uncover BO information on behalf of a foreign counterpart unless the case is of a significantly high priority.19
The BOI Database should make this process far more efficient. But it’s not perfect. And before we get too excited, it’s worth considering how clever criminals might carefully exploit the new rule’s exclusions.
Let’s pretend that we run a Chinese crime syndicate with significant money laundering operations in the U.S. Our American lawyers — who, unlike financial institutions, have no obligations to verify where our money comes from — have advised that FinCEN is creating a new database that may impact our operations.21 They have proposed to host a brainstorming session in their Seattle office. We can’t do Thursday because we have to host a goat sacrifice as part of an initiation ceremony for new recruits. So we agree to meet on Friday.
One of the first things our lawyers highlight is that 23 types of entities are excluded from the reporting requirement.22 This includes tax-exempt charities and non-profit organizations.23 This is great news! Charities often accept cash and have legitimate excuses to operate in conflict zones, making them useful for helping terrorist groups raise and move money.24 The exclusion also extends to any LLCs controlled or wholly owned by tax-exempt charities.25 Therefore, we may have some opportunities to shift cashflow from regular companies to tax-exempt entities. We’ve always talked about starting a new church as a front — what better time than now?26
Another opportunity is self-evident: the reporting obligations are limited to a 25% ownership threshold. The calculation of this ownership can get complicated as it also includes things like “convertible instruments,” such as stock options that do not afford ownership now but can be converted to ownership in the future.27 And there’s also a ‘catch-all’ provision to capture any other methods by which someone might exercise substantial control over the company. But this is fine. We can still re-organize some of our shell company structures to ensure certain members of the syndicate do not pop up in the database. And, to avoid the catch-all provision, we can put some associates in charge of the holding companies, associates that have no obvious connection but can collect laundered profits on our behalf.
Suddenly a young lawyer musters up the courage to speak: can we exploit the filing timelines? Any new company created after January 1st, 2024, will have 90 days to file with FinCEN. That timeframe decreases to 30 days one year later.28 In Florida, you can register an LLC online in 2-5 business days. Can we set-up a company, open a crypto account, make some transfers, and close the company before we reach the deadline for registering with FinCEN? Maybe!
There are real opportunities to sidestep FinCEN’s new requirements. But focusing on these loopholes is a bit unfair. Overall, the BOI Database is a huge step forward for law enforcement. They will soon have access to an enormous dataset on companies operating in America and their primary owners. And these things tend to expand. It would not be surprising if users of the database push FinCEN to collect more and more information as time passes.
The BOI Database is also good for financial institutions. Some of these institutions will be granted access to help them satisfy their Anti-Money Laundering requirements, a step that should help reduce compliance costs.29 These institutions currently collect beneficial ownership information from every legal entity customer that passes through their doors. This is hugely time consuming. If the BOI database operates as advertised, they should be able to skip this step in many circumstances and simply download the information from FinCEN.
There is, however, an elephant in the room. This rosy interpretation of the new rules ignores a valid concern about the privacy implications. Centralized government databases are a little creepy. The BOI will not be available to the public. But it will be accessible to quite a few government agencies, both domestic and foreign.30
But I am not too concerned. It is not obvious that legal entities deserve a right to privacy.31 Nor is it obvious that the owners of these entities deserve to keep their controlling interests in the dark, particularly when one considers the many societal ills — money laundering, terrorist financing, tax evasion — facilitated by the dark arts of shell companies and complex corporate structures. If we are serious about combatting these problems, transparency is essential. As former Supreme Court Justice Louis Brandeis once wrote, “Sunlight is said to be the best of disinfectants.”32
As Steven M. D’Antuono, Acting Deputy Assistant Director within the FBI’s Criminal Investigative Division stated to Congress in 2019, “…while the FBI and other federal law enforcement agencies may have the resources required to undertake long and costly investigations and thus mitigate to a small degree some of the challenges [of determining the true beneficiaries of illicit proceeds], the same is often not true for state, local, and tribal law enforcement.”
In 2023, the FBI had a budget of approximately $11.3 billion, which included 260 attorneys and 13,606 agents.
FinCEN’s recent FAQ provides further information (but, as discussed later, lacks clarity in various areas).
As FinCEN summarizes, “The term “shell company,” as used herein, refers to non-publicly traded corporations, limited liability companies (LLCs), and trusts that typically have no physical presence (other than a mailing address) and generate little to no independent economic value.”
Aside from yearly or half-yearly updates, depending on the jurisdiction. FATF, Mutual Evaluation of the United States, 224.
Gary Gensler, Statement on Final Rules Regarding Beneficial Ownership.
For those interested, I have a journal article covering the history of the CAT and its less known predecessor, the MOSS.
To reiterate the obvious, the fictional exercise in this section is not legal advice!
The obligations of lawyers to perform customer due diligence (or lack thereof) is worthy of its own dedicated post. There is a bill called the ENABLERS Act which would expand the definition of financial institutions to include attorneys. It was blocked by the Senate in 2022 and currently sits dormant.
Certain information on non-profits still has to be registered with the IRS. I’m less familiar with these requirements, but my understanding is that this would still provide quite a limited picture of a complex legal entity’s ownership structure.
We will see how this actually works in practice. There are sure to be some implementation complications.
But I am interested in counterarguments.