The Anatomy of Onshore Money Laundering

The use of legitimate “onshore” economies as a thoroughfare for international financial crime is surprisingly widespread. Whilst scrutiny has long targeted offshore tax havens and low-disclosure jurisdictions - and not without good reason - comparatively, little attention has been paid to fraudsters brazenly operating on home ground. 

Supposedly well-regulated and transparent economies across the globe are increasingly having to face up to this reality. Recent scandals have revealed that banks in Europe and the United States have been used to drain more than $4.8 billion of public money out of Venezuela; and that the United Kingdom is considered by the authorities to be a “higher-risk jurisdiction,” on a level with notorious offshore hubs like Cyprus.

The logic behind this methodology is simple. Nesting so-called “laundromats” at the heart of respected economies is a slick route to faux legitimacy. But the breadcrumb trail is there to be traced, for those with the willpower, and the open source intelligence (OSINT) capabilities, to seek it out.

The Choreography of Money Laundering

Laundromats are essentially networks with links, nodes, and behavioral patterns. Corporate entities, assets, and individuals are meticulously arranged to allow dirty money to flow through them, under the guise of a legitimate operation. Placing elements of the structure in well-respected jurisdictions helps “launder” the funds: washing off the appearance of dirt from dirty money, by distancing it from its illicit origin, destination, or purpose. 

OSINT allows investigators to align this carefully constructed paper trail with the reality on the ground, by cross-referencing available company reporting with diverse sources drawn from across the open source environment. Success means identifying both the nodes - who and what is involved - and the links between them - how they relate to each other, and how they are using these relationships to make, move, and manipulate funds.

The Best Way to Rob a Bank is to Own One

Where laundromats are concerned, the links are almost more important than the nodes. This is because that transitional space - where money moves from one place to another, particularly between related companies - is rife for fraud and misappropriation, from trade mis-invoicing or transfer pricing, through to share price manipulation.

In advanced money laundering operations, money moves fast. Whilst the money itself may not be visible without access to internal documents, its movement is reflected through changes in the structural network - much of which can be seen in the open source environment. Changes in one entity correspond to movements in another, and to activities on the parts of key agents. Understanding when, where, why, and how money moves means analyzing these changes both chronologically (how the network changes over time) and spatially (how movements ripple across the network).

The rapid incorporation and dissolution of companies across a larger company network, for example, can suggest a carefully orchestrated attempt to draw a veil over internal activities. Typically, one entity will wind up before it is required to publicly report on its activities, at the same time as another entity crops up, ready to take over its funds and role in the overall company structure. This effectively allows controlling parties to manipulate funds behind closed doors. 

Word Games

In these often vast structures, giving individual entities generic or interchangeable names make it easier to misrepresent relationships or financial flows in reporting. OSINT can be used to analyze the use and misuse of nomenclature. For example, hypothetical “Company A Inc” might list payments to another entity named “Catering Inc.” It would be tempting to write this off as an innocent transaction: catering provided by an external entity. But closer examination could reveal the entity in question to be an undeclared off-balance-sheet entity controlled by the same Ultimate Beneficial Owner (UBO), and used to shift funds or liabilities out of the visible structure.

Another common technique is to conflate semi-identical legal and trading names, to obscure the overall flow of funds. A parent company legally registered as “Company A Ltd” might use the trading name “Company B,” whilst a subsidiary legally registered as “Company B Ltd” might use the trading name “Company A,” and so on. Or, “Company A Ltd” might have a subsidiary registered as “Company A1 Ltd,” and an off-balance-sheet entity registered as “Company A2 Ltd,” both of which are abbreviated simply to “Company A” in reporting. 

If this sounds confusing, that’s exactly the point. The bigger the structure, the more complicated this sleight of hand can get. Cross-referencing of public company reporting with references to the company structure in sources as diverse as legal reports, website infrastructure, property records, tax declarations, social media, and media reporting, is critical to solidifying the logical framework underneath these intricate word games. 

What’s in a name?

On the other hand, many financial criminals are surprisingly predictable, lazy, or idiosyncratic in the way they name the individual entities that make up their laundromat. This can be a helpful way to identify undeclared affiliations in those jurisdictions - often supposedly transparent ones - that make it difficult to identify a company’s UBO. Many US corporate registries, for example, do not disclose shareholders; some, like Delaware and Nevada, are so opaque as to be considered virtually offshore jurisdictions. Even legal requirements to declare the UBO, in jurisdictions like the United Kingdom, can be manipulated by assigning ownership to anonymized offshore holding companies or proxies. 

Here, identifying an idiosyncratic pattern in nomenclature can break the back of a case - but it requires intense OSINT preparation. One UBO may prefer to name their companies after streets on the Monopoly board; another might flip the original company name around to read in the reverse (think “ACompany” instead of “CompanyA”); some are unable to resist stamping everything with their own initials; they may have a soft spot for famous lakes, Kanye songs, or Star Wars characters. Without intricate knowledge of the UBO and their lifestyle, however, personalized patterns like this can go entirely unnoticed, leaving critical entities undetected. 

Castles built on Sand: Reporting vs. Reality

Fraud in the twenty-first century can be as easy as putting the right story on paper: as long as nobody thinks to double-check it. People - from key stakeholders and agents, through to listed employees, accountants, bankers, and auditors - are vital to this kind of duplicity. 

For example, a company may report paying salaries and pensions to five thousand employees - but only be traceable to five employees on LinkedIn. Alternatively, directors or shareholders who seem out of place can point to the use of proxies. Lifestyle-focused OSINT can help determine whether an individual truly exists: and if they do, whether they have the funds, experience, and expertise to hold a given role, or are standing in for someone else. It might also point to who that “someone else” might  be.

Location can be equally rich in implications. 1209 North Orange Street, Delaware, made headlines in 2016 for being the registered address for no less than 285,000 different companies - perhaps the most notorious indicator of a so-called shell company. Where an address is shared by a smaller of companies, they may share a key agent, such as an accountant registered at the address; or the owner of the building may turn out to be the UBO. Satellite imagery and ordinance maps can help assess whether the site in question fits the given narrative: whether it is an office block or a storage unit; a chicken shop in a run-down area, or a luxury apartment in a swanky part of town. Current and historic detail can be compared to shed light on changes, undeclared activities, or an obvious absence of reported activities.

Ultimately, these indicators are only the tip of the iceberg when it comes to detecting onshore laundromats. By their very nature, money laundering mechanisms and their behaviors are complex, elusive, and constantly evolving. The key advantage of OSINT is the ability it gives investigators to keep pace with these evolutions, cross-referencing diverse information to make intelligent deductions. Documents produced by a company are more likely than not to tell the desired narrative. Intelligent criminals will manipulate timing, geography, regulations, and reporting in an infinite number of ways to limit visibility. Using OSINT methodologies, it becomes possible to contrast this narrative with a much broader pool of information, drawn from a vast range of sources. Advanced technologies like Skopenow make it possible to do this at pace, and in-depth - leaving even the sophisticated criminal mind less room for maneuver.