On October 3, the International Consortium of Investigative Journalists began reporting on millions of confidential documents relating to the financial activities of heads of state, international business leaders, and other prominent individuals as part of the so-called Pandora Papers. Media organizations around the world summarized the leaked documents in a coordinated series of articles designed to attract publicity to activities involving foundations, trusts, and other components of the international offshore financial system.
This is the latest high profile data leak involving sensitive and confidential financial information. Last year, the FinCEN Files leak contained thousands of U.S. Treasury Department materials and, before that, the Swiss leaks, Panama Papers, and Paradise Papers included similar troves of financial data.
These leaks often raise more questions than answers, but they nonetheless pose risks to companies and individuals who may be identified in the files or those with whom they do business.
Categorizing the Vulnerabilities
The Pandora Papers raise a host of well-trod risks:
Reputational. Regardless of what information is actually contained in the data, the initial press coverage was an attempt to cast all private transactions as inherently bad. Individuals named in the Pandora Papers have had to issue public denials to a global, coordinated effort involving journalists in a number of jurisdictions. This wide-ranging negative publicity can raise questions with business partners and clients about the financial activities reported in the leak, as well as the parties’ ability to keep very sensitive information private.
Regulatory. Regulators around the globe have an established “playbook” for leaks of offshore data. It normally involves making immediate inquires as to potential exposure on the part of the financial institutions they supervise, then following up with particular issues as they arise. Those inquiries can generate significant additional work for already-stretched compliance departments, who will need not only consider the potential exposure arising from the information itself, but also review policies and procedures to determine whether the leaks reveal any weaknesses in the overall control framework.
Criminal enforcement. Negative reporting can also generate attention from prosecutors around the world who cooperate regularly on cross-border investigations. Such attention could be limited to informal requests for information or lead to full-blown criminal investigations focused on the issues being reported. The Panama Papers, for instance, led to multiple indictments and guilty pleas in the U.S.
Business partners. In the wake of such allegations, business partners and other third parties may demand additional transparency as a condition for a continuing relationship. For example, investors, lenders, or others might require that audits be conducted or turned over to them.
Legislative inquiries and reactions. Some parliaments and legislatures, particularly those whose governments are customers or business parties of named entities, may open investigations or seek to cut off commercial relationships.
Litigation. Litigation adversaries – both current and prospective – could seize upon the information in the leaks to their advantage in global disputes. This could lead to claims being brought or attempts to enforce existing judgments in new jurisdictions where assets are supposedly held.
With that backdrop, it is important not to jump to conclusions based on what is being reported, but rather prepare a careful response. Parties concerned about the leak should review relevant transactions to gain context and get ahead of any requests for information.
The bottom line is that as more information rolls out to the public on these issues, it is essential to be prepared for inquiries that could come from a variety of sources. This effort may pose challenges as complex entities and offshore structures are often sophisticated and designed to be secretive. Investigative points to bear in mind include:
Age of transactions. The relevant transactions or accounts may be quite old or even dormant. While this may reduce some risk, it does not eliminate it. Statutes of limitations vary in different jurisdictions, and allegations of conspiracy can stretch those timelines even more. In short, transactions that might seem like ancient history still merit close attention.
Patterns and repeat players. An entity, such as an intermediary, that appears again and again in the Pandora Papers or other data leaks is likely to generate more scrutiny than a one-off. It is worth examining any potential connections to repeat players or common types of transactions.
Documentation. Explaining transactions and business relationships to skeptical audiences is easier with robust backup documentation. Any analysis of these issues should include identifying and categorizing materials on hand that describe the purpose of the relationships and money flows.
In sum, while the consequences of a data leak such as the Pandora Papers can pose significant business, reputational and enforcement risks, such risks can be mitigated by a proactive and diligent investigative effort focused on the transactions and accounts at issue.