Shell Companies and Beneficial Ownership

Shell Companies and Beneficial Ownership
Concept	Legal entities used to separate assets from their true controllers
Key standard	FATF Recommendations 24 and 25 (transparency of legal persons and arrangements)
U.S. regime	Corporate Transparency Act (2021), narrowed by FinCEN final rule of Aug 2026
UK regime	Companies House PSC register; ID verification under ECCTA 2023
EU regime	National registers; AMLR (Reg. 2024/1624) applies from July 2027
Landmark leak	Pandora Papers (ICIJ, Oct 2021)

A shell company is a legal entity with no significant independent operations, employees, or assets of its own, used to hold property, move money, or sign contracts. Shells are lawful and common (holding vehicles, special-purpose entities, dormant companies), but they are also the standard building block of money laundering, sanctions evasion, bribery and billing fraud. A front company differs in that it has a real or apparent business that disguises illicit flows. Beneficial ownership is the question of who ultimately owns or controls the entity, as opposed to who is named on the registry. The gap between the two is what investigators work to close.^[1]

1 How concealment is built

Concealment is usually achieved by stacking several features, each of which is legal alone:

• Nominee directors and shareholders. A professional service provider's employee is listed as director or shareholder, often under a private side agreement (a declaration of trust or a signed-but-undated resignation letter) that preserves the real owner's control. A single nominee may sit on hundreds or thousands of boards, a pattern visible in registry data.
• Registered-agent addresses. Thousands of entities share one street address. In the United States, formation in Delaware, Wyoming, Nevada and New Mexico has long been favored because member or manager names of an LLC need not appear in the public filing; only a registered agent and the formation date are disclosed.
• Layering across jurisdictions. A Delaware LLC owned by a BVI company owned by a trust in a third jurisdiction forces an investigator to obtain records under three legal systems.
• Bearer or unregistered instruments (largely abolished but still found in legacy structures) and trusts and foundations, which often sit outside company registers entirely.
• Circular and cross-holdings that make the 25% ownership arithmetic hard to resolve.

The scale is documented by journalism. The ICIJ's Pandora Papers, published beginning 3 October 2021, drew on about 11.9 million files (roughly 2.9 TB) from 14 offshore service providers, and named dozens of current and former heads of state and government among thousands of beneficial owners.^[2] The earlier Panama Papers (2016, Mossack Fonseca) established the same pattern: the provider, not the client, is the investigator's best document source. Leak datasets are searchable through the ICIJ Offshore Leaks Database, which is an OSINT lead generator, not proof of wrongdoing: holding an offshore entity is not itself unlawful.

2 Registers and legal regimes in 2026

United States. The Corporate Transparency Act (CTA), enacted in the Anti-Money Laundering Act of 2020, required reporting companies to file beneficial ownership information (BOI) with FinCEN. After litigation and a March 2025 interim rule that exempted domestic companies, FinCEN issued a final rule dated 11 August 2026, effective 14 August 2026, that removes the reporting and update obligation for U.S. companies and U.S. persons; only entities formed abroad and registered to do business in a U.S. state or tribal jurisdiction remain reporting companies, and they report only foreign beneficial owners. FinCEN said it will work with the National Archives on a one-time deletion of BOI received before 11 February 2027 that it reasonably believes was supplied by U.S. persons.^[3][4] The practical effect for investigators is that there is no federal database of who owns a typical Delaware or Wyoming LLC, and the BOI database was never open to the public in any case (access was limited to law enforcement, certain regulators and financial institutions with consent). Customer due diligence (CDD) rules for banks, which require identifying owners of 25% or more and one controlling person at account opening, remain in force, so the bank's file is now the main U.S. repository of ownership data, reachable by subpoena or in civil discovery.

United Kingdom. Companies House has published a free, searchable register of People with Significant Control (PSC; over 25% of shares or votes, or control of the board) since 2016. The Economic Crime and Corporate Transparency Act 2023 added identity verification for directors and PSCs: voluntary from 8 April 2025, mandatory from 18 November 2025 with a 12-month transition for existing officers.^[5] Verification improves the reliability of the register but does not detect a verified person acting as a straw owner.

European Union. Each member state keeps a beneficial ownership register under the AML directives. In WM and Sovim SA v Luxembourg Business Registers (Joined Cases C-37/20 and C-601/20, 22 November 2022) the CJEU held that unrestricted public access was invalid, and many registers closed to the public.^[6] The AML Regulation (EU) 2024/1624, applying from 10 July 2027, replaces this with access for persons who can show a legitimate interest, expressly including journalists and civil society organizations; the new Anti-Money Laundering Authority (AMLA) in Frankfurt begins direct supervision in 2028.^[7] Until then, access depends on the country.

Jurisdiction	Ownership data held	Who can see it (Oct 2026)	Verification
United States (federal)	BOI for foreign-registered entities only	Law enforcement, some regulators, FIs with consent	Self-reported
United States (state)	Name, agent, formation date; sometimes managers	Public (Secretary of State search)	None
United Kingdom	Directors, PSCs, shareholders	Public, free	ID verification phased in 2025–26
EU member states	Beneficial owners (25%+ or control)	Varies; legitimate interest model emerging	Varies

3 Forensic examination: piercing the structure

Piercing a shell involves two separate tasks: establishing who controls it (an identification problem) and establishing whether it is a sham (a legal and evidentiary problem). The following procedures are used in combination and are normally documented in the working papers described in Report Writing.

3.1 Registry and corporate-record pull

1. Obtain the certified formation documents, annual reports, and every amendment from the state or registry. Record the formation date, agent, filer name, and any organizer signature. Organizers who are law-firm or formation-service staff identify the incorporator, which is a subpoena target.
2. Pull all entities sharing the registered agent address, officers, phone, email domain or website host. Cluster analysis (see Analytical Methods) on those fields often exposes a family of shells created within days of each other.
3. Build the ownership chart to the first natural person, applying the 25% rule multiplicatively: an individual holding 60% of A, which holds 50% of B, holds 30% of B indirectly. Flag any branch that terminates in a trust, foundation or nominee rather than a person.

3.2 Bank and payment records

The account-opening file (signature cards, CDD forms, source-of-wealth statements, IDs) is usually the first document naming a natural person. Examine: authorized signers versus listed officers; the address and IP used for online banking; the first deposits (whose money capitalized the account); and the beneficiary names on outgoing wires. Compare signatures and device identifiers across supposedly unrelated entities. Procedures for tracing flows are set out in Asset Tracing, and for crypto-funded entities in Cryptocurrency Tracing.

3.3 Document metadata and infrastructure

Invoices, contracts and incorporation papers submitted by a suspected shell should be examined for authorship metadata (PDF producer, author and creation dates), template reuse across different “vendors” (identical fonts, typos, layout), and WHOIS and hosting history for the company website (see Document Examination and Digital Forensics). Invoices from different shells created on the same machine within minutes are strong evidence of a common hand.

3.4 Substance tests

A real business leaves real footprints. Check for: employees (payroll filings, unemployment-insurance wage reports); a physical premises (site visit, lease, utility accounts); tax filings that match claimed revenue; licenses and insurance; independent customers or suppliers; web or marketplace presence predating the transaction; and sales-tax or VAT registrations. A vendor that billed $2 million but filed no payroll tax and has a virtual-office address fails most substance tests.

3.5 Leak and sanctions datasets, then court tools

Screen entity and officer names against the ICIJ Offshore Leaks Database, OpenCorporates, national registers, litigation dockets, and sanctions lists (see Sanctions and Export Controls). Where records are abroad, formal channels include mutual legal assistance treaty requests, letters rogatory and, in civil matters, Norwich Pharmacal and Mareva-type orders in common-law jurisdictions. U.S. courts may order disclosure of ownership and, in appropriate cases, apply alter-ego or veil-piercing doctrines (see section 6).

4 Worked example: vendor-side shell test

This is an illustrative, hypothetical analysis in the style of the vendor-file tests used for billing-scheme detection. A company's accounts-payable ledger shows 14 new vendors set up over 18 months. The examiner extracts, for each vendor: bank account, address, phone, tax ID, approver, and total paid.

Test	Result	Interpretation
Vendor address matches an employee address	0 of 14	No direct hit
Vendor address is a known registered-agent/virtual office	5 of 14	Consistent with shell; not proof
Same approver on all invoices	5 of 5 agent-address vendors; approver is a manager with no purchasing authority	Control override
Invoice totals just below approval limit ($9,500 vs $10,000 limit)	41 of 47 invoices to those 5 vendors	Threshold avoidance
Sequential invoice numbers (001, 002, 003 over 14 months)	3 vendors	Vendor has almost no other customers
Payments to a bank account that later pays a personal account	$212,000 across 3 vendors	Beneficiary traced via subpoenaed bank records

The result is not a conclusion; it is a set of leads. Each pattern would be confirmed by bank-account-opening records (who signed), the vendor's tax filings, and delivery evidence. The output of the examination is typically (a) a flow-of-funds chart, (b) a vendor-profile exhibit, and (c) a schedule of payments with approver and date, admissible under the business-records rules discussed in Evidence and Testimony. The same logic applies to public procurement: when a bidder's registry data shows the same agent, phone and formation date as a competing bidder, bid-rigging analysis becomes appropriate.

5 Red flags

• Entity formed shortly before the first transaction, with no operating history.
• Same address, phone, email domain or director across many unrelated entities.
• Nominee officers who hold dozens of directorships.
• Payments to a company whose stated activity does not match its industry code, or round-dollar invoices for vague “consulting” or “management services.”
• Ownership that terminates in a trust or foundation with no named settlor.
• Rapid pass-through: funds in and out within days with a negligible balance retained.
• Reluctance to supply source-of-wealth documents; frequent changes of registered agent or name.
• Bank account in a jurisdiction unrelated to customers or suppliers.

See also the broader Red Flags catalogue.

6 Limits and legal pitfalls

Courts pierce the corporate veil only on a showing, typically, of unity of interest (commingling, undercapitalization, disregarded formalities) and injustice or fraud; an entity's mere lack of employees is not sufficient. An investigator must also separate legal privacy from illegality: forming an anonymous LLC is lawful, while concealing ownership from a bank or lying on a CDD form can be a crime (for example under 18 U.S.C. 1344 or 1956). Private investigators must not obtain bank records by pretexting (the Gramm-Leach-Bliley Act prohibits it) and should follow the guidance in OSINT Ethics. After the August 2026 FinCEN rule, claims that a U.S. entity's owners “are in the FinCEN database” should be treated as unreliable.

See also: Asset Tracing, Money Laundering, AML Law, Sanctions and Export Controls, Tax Fraud and Evasion, Anti-Corruption OSINT.

References

1. FATF. Guidance on Transparency and Beneficial Ownership and Recommendations 24–25. fatf-gafi.org
2. ICIJ. "Pandora Papers." October 2021. icij.org/investigations/pandora-papers
3. FinCEN. "Beneficial Ownership Information Reporting Requirement Revision." Final rule, 91 Fed. Reg., Aug 14, 2026. federalregister.gov
4. Troutman Pepper Locke. "Relief Is Real But Not Universal: FinCEN Permanently Ends BOI Reporting for U.S. Companies." 2026. troutman.com
5. Companies House / Economic Crime and Corporate Transparency Act 2023, identity verification timeline. Burges Salmon summary
6. McCann FitzGerald. "Public access to beneficial ownership information restricted" (on CJEU C-37/20 and C-601/20). mccannfitzgerald.com
7. Regulation (EU) 2024/1624 (AML Regulation). eur-lex.europa.eu