How Address Data Unmasks Shell Companies in Underwriting

“On the internet, nobody knows you’re a dog,” reads the caption to the famous New Yorker cartoon. Establishing identity is central to underwriting. No one speaks much about the kennel, though, but perhaps they should.

Feeling confident that claims at an address can be enforced is key to managing risk. This is where it gets interesting. Addresses can be used to evade sanctions, perpetrate crime, and launder money, as we’ll discover in this blog.

The Panama Papers

The Panama Papers confirmed what underwriters always knew to be true: offshore structures and shell companies, whilst legal, can be used to conceal the identities of their ultimate beneficial owners. In this way, they can be used for illegal purposes, including fraud, tax evasion, sanctions busting, and money laundering.

The 2015 leak of the Panama Papers comprised 11.5 million files from the database of the world’s fourth largest offshore legal and corporate services firm, Mossack Fonseca in Panama. Acting on instruction from intermediaries, Mossack Fonseca incorporated shell companies in offshore jurisdictions and acted as a registered agent for more than 200,000 companies.

In doing so, it enabled end clients to hold property and bank accounts anonymously. This included politically exposed persons (PEPs), such as members of President Putin’s circle and the Syrian president’s financial fixer, sanctioned individuals, businesspeople, organised crime syndicates, and celebrities.

Due diligence around addresses, corporate structures, and the individuals behind them was central to the Panama Papers scandal and to the challenge facing merchant underwriters today. Attendees at RiskConnect 2019 can hear directly from the two Pulitzer Prize-winning journalists, Bastian Obermayer and Frederik Obermaier, who broke the story.

Customer due diligence = ID&V + KYC

Under the 4th European Anti-Money Laundering Directive, firms must conduct customer due diligence (CDD) when establishing a business relationship. They cannot automatically apply simplified due diligence measures, even if this would have been sufficient in the past. They must first ascertain that the relationship presents a lower degree of risk. Higher-risk customers, such as politically exposed persons (PEPs), require enhanced due diligence as standard.

Firms must identify the beneficial owners of legal entities and structures, namely those with an interest of 25% or more in private companies, in accordance with 4AMLD stipulations. They must also conduct CDD if there are doubts about the veracity or adequacy of previously obtained customer identification data.

Identification and verification of individuals are important. Indeed, for sanctioned entities, it is an absolute requirement. Sanctions may be imposed at an international, regional, or national level against countries, regimes, people, companies, activities, industry sectors, or vessels (e.g., Iraqi ships). Underwriters cannot take a risk-based approach to sanctioned individuals or entities. It is an offence to start or maintain a relationship with, or process transactions for, one.

Yet the challenge for merchant underwriters is that sanctioned individuals or those with criminal intent are unlikely to conduct business in their own name. They hide behind various nominee directors, shell, or shelf companies. A shell or letterbox company has no employees at its official registered office, which is merely the address of an agent. Shelf companies are readymade shell companies for clients, who need a company that does not look as if it has been established recently.

Sometimes thousands of businesses may be registered at the same address. This illustrates the importance of getting behind the address. Moreover, Visa updated its merchant location rules and compliance programme in 2017 to clarify that merchants must have a physical location, not merely a virtual one. Physical locations cannot include a post office box, forwarded mail address, or one associated with a law firm, agent, or vendor.

High-risk hubs

A 2016 Reuters report revealed how a former steel town in the north-east of England was at the centre of a company formation ring. Consett, Co. Durham, has become a hub for high-risk online porn and poker merchants. Around 400 people in the town were recruited as directors for more than 1,000 shell companies. Sometimes unemployed and struggling to make ends meet, these local residents were small players in the company formation industry.

They served as directors of multiple companies, receiving £50 cash for a directorship and £150 a year to forward mail received at their addresses. A local businessman offered company formation services for £2,500-£3,000 per time, administrating 1,200 companies at his peak, Reuters found.

Although they had no real operations or staff in the UK, a UK address allowed the companies to open merchant accounts in Europe. These were frequently used to process card payments for high-risk merchant sectors. In a similar trend to that seen in the Panama Papers, such shell companies served as fronts for online porn, gambling, and dating websites or those selling health products, frequently on negative option or with fake free trials.

Introducing AddressReveal

Establishing where prospective merchants are based is integral to CDD. Where does the merchant do business and pay taxes? Where are the directors located? Where is the business registered, and is it the same place as where the merchant has an address for correspondence? Does the address even exist?

AddressReveal, a new enhanced money laundering protection service from Web Shield, confirms this with a quick validation check. This includes when the merchant is located in a different country to the underwriting entity.

Knowing how many entities or directors are connected to an address quickly identifies potential shell or mail-forwarding company hubs. If addresses are already known for being used by fraudsters or dubious businesses, AddressReveal flags this.

Underwriters receive a probability score and a full report per address, which can be used for sign-off escalation and record-keeping. Setting alerts within Web Shield’s Monitor platform is also possible to help answer the question: if you knew then what you know now, would you still board the merchant?

‍