On 29 December 2016, according to FinCEN's consent order of September 2023, a Venezuelan company that claimed to work in construction sent a $100,000 wire to a British Virgin Islands company. It cleared through the correspondent account that AllBank, a Panamanian bank, held at Bancrédito, an offshore bank licensed in Puerto Rico.
Public information tied the BVI company to "an address commonly affiliated with shell companies", the order records. AllBank was the sender's bank; Bancrédito held AllBank's account.
Payments routed through jurisdictions the customer has no tie to sit among the red flags of the money laundering methods and typologies. This one ran from a Venezuelan company through a Panamanian bank and a Puerto Rico account to the BVI.
What is an offshore bank, and how is it different from a shell bank?
Table 1. Four kinds of bank, as of November 2026
| Kind of bank | Who it may serve | Where mind and management sit | Who supervises | Can a US or UK bank hold its correspondent account? | Source |
|---|---|---|---|---|---|
| Onshore bank | Residents and nonresidents, in local and foreign currency | In the licensing country | The licensing country's supervisor | Yes; US enhanced due diligence only if another trigger applies | 31 CFR 1010.610(c) |
| Offshore licensed bank | Not the licensing country's citizens, or not in its local currency | Can be thin: Puerto Rico requires only four resident employees | The licensing authority | Yes, with US enhanced due diligence; UK third country checks for payment relationships | 31 CFR 1010.605(i); 2022 NMLRA, printed p. 69 |
| Booking branch | The parent bank's business with nonresidents | Elsewhere; locally often only "brass plates" | The parent bank's home supervisor | Yes, as part of a bank that a home supervisor regulates | Basel Committee, 2003 |
| Shell bank | Anyone; no regulated group stands behind it | Nowhere: no physical presence in any country | In practice nobody; the supervisor where it is run is generally unaware of it | No: banned in the US, the UK and the EU | 31 CFR 1010.605(g), 1010.630(a)(1); MLR 2017 reg. 34(2); Directive 2015/849 art. 24 |
In everyday use, offshore means any account or company held outside the owner's home country. The banking term is narrower. Under 31 CFR 1010.605(i), an offshore banking license "prohibits the licensed entity from conducting banking activities with the citizens of, or in the local currency of, the jurisdiction that issued the license."
A Senate Minority Staff report of February 2001 read the license the same way and found that nearly all of the foreign banks it investigated held one. It cited an estimate that nearly 60 jurisdictions had licensed about 4,000 offshore banks by the end of 1998.
A shell bank fails a different test. US rules define a foreign shell bank as "a foreign bank without a physical presence in any country". Physical presence there means a fixed address in a country where the bank may do banking business, other than an electronic address or a post office box alone. At that address the bank employs at least one person full time and keeps operating records, and the authority that licensed it can inspect it. The FATF glossary puts the test as "meaningful mind and management located within a country" and says a local agent or junior staff are not enough. In the FATF and Basel definitions, a shell bank also sits outside any supervised financial group.
The Basel Committee adds a third case. A booking branch has no meaningful mind and management where it is licensed, yet it belongs to a bank that a home supervisor regulates, and that is what separates it from a shell bank. An offshore licensed bank with its mind and management on site is a bank with a narrow license. One with only an agent and no regulated parent is a shell.
Why do money launderers use offshore accounts?
The first reason is the supervisor. The Senate staff report found that a country has "significantly less incentive to oversee and regulate banks that do not do business within the country's boundaries" than banks that do. Offshore banking, the report adds, earns money for the governments of small countries. The fewer demands a government makes on bank owners, the more attractive it is as a place to license a bank.
Local presence can be thin. Treasury's 2022 risk assessment notes that Puerto Rico's international banking entities need to employ only four residents of the island. At the far end, for a shell bank run from a third country, the Basel Committee says the supervisor there "is generally unaware that the bank exists".
The onshore bank sees one layer. US enhanced due diligence covers transactions "to, from, or through the correspondent account", which means the respondent bank's wires, while the respondent's own customers stay one step removed. Each country on the route adds a regulator and a separate set of records; the Bancrédito case below moved money from Colombia through a Panamanian bank and a Puerto Rico account.
The Senate report says offshore banks often become "vehicles for money laundering, tax evasion, and suspect funds", and hiding income from the tax authority is the core of tax fraud. Treasury's 2026 National Money Laundering Risk Assessment lists offshore bank accounts, beside shell companies and sham invoices, among the ways corrupt payments are concealed.
How does dirty money move through an offshore bank?
Company 2, in the consent order, was a Panamanian company and an AllBank customer that said it provided online education but had no web presence offering it. Public documents indicated that it bought and sold cryptocurrency, and adverse media at the time connected it to a risky crypto venture later known as the OneCoin Ponzi scheme. From August to November 2018, companies in Colombia sent it $970,000 in six wires, all through the account AllBank kept at Bancrédito.
Each bank held a different piece. AllBank knew the business its customer claimed and could set it against the wires. Bancrédito held AllBank's account and processed the wires from Colombia to an AllBank customer. FinCEN found that Bancrédito at times let AllBank's transfers through without any analysis of the underlying transactions.
Moving funds through accounts in several countries, each with a stated purpose that does not match the flow, is layering, the stage that puts distance between proceeds and their source.
For the bank that holds a respondent's account, the risk score starts with the respondent: its license type, the country that issued the license and the people who own it. In complead, formerly Sanction Scanner, customer risk assessment lets a team set its own factors, weights and thresholds. It can keep a separate model for each segment, entity type or jurisdiction, so respondent banks are scored on a model built for banks.
What did FinCEN find at Bancrédito?
Bancrédito held a license as an international banking entity (IBE) under Puerto Rico's Law 52 of 1989. That law, the consent order says, "prohibits IBEs from providing financial services to residents of Puerto Rico." Treasury's 2022 risk assessment counted 27 IBEs licensed in Puerto Rico as of November 2021 and named their offshore banking business model as a particular concern.
On 15 September 2023, FinCEN announced a $15 million civil money penalty against Bancrédito. It was FinCEN's first enforcement action against a Puerto Rico IBE and the first violation of the Gap Rule, the AML program requirement in effect since 15 March 2021. Bancrédito admitted willful violations of the Bank Secrecy Act between October 2015 and May 2022. It failed to report suspicious transactions on time, had no due diligence program for the correspondent accounts it kept for foreign financial institutions, and failed to implement and maintain an AML program.
The order describes Bancrédito as an offshore financial institution for people doing business in or with Venezuela. AllBank moved over $100 million through its account there from 2014 to 2019. In September 2019 Panamanian authorities seized AllBank and began liquidating it, partly for failing to comply with Panama's AML laws. Bancrédito agreed to surrender its IBE license and not to seek any new banking license.
What happens when a bank is licensed in one country and run from another?
FBME Bank shows the pattern at scale. In 2003, as FinCEN's final rule on the bank records, it left the Cayman Islands and incorporated and set up its headquarters in Tanzania, while its Cypriot operations became a branch. By July 2014 the Cyprus branch carried over 90 percent of the bank's global business, and over 90 percent of its assets sat there. FinCEN found that the bank attracted high risk shell companies as customers.
Section 311 of the USA PATRIOT Act lets Treasury impose special measures on a foreign bank it finds to be of primary money laundering concern. FinCEN's final rule of 31 March 2016 used it to stop covered US financial institutions from opening or keeping any correspondent account for FBME from 29 July 2016.
As of November 2026 the prohibition still stands in 31 CFR 1010.658.
The Basel Committee saw the same pattern in 2003. A shell bank typically "maintains nothing but a registered agent in its country of incorporation", a structure the Committee ties to some offshore centers, and a booking branch is often "nothing more than 'brass plates'". Nauru's offshore banking scandal shows the gap across a whole jurisdiction. The US Treasury named Nauru a primary money laundering concern, citing its sale of offshore banking licenses and its failure to set adequate procedures for licensing, regulating and supervising offshore banks, a finding withdrawn in 2008.
Which rules apply when your bank deals with an offshore bank?
US rules go furthest. Under 31 CFR 1010.610(c)(1), a US bank or other covered financial institution must apply enhanced due diligence to any correspondent account for a foreign bank under an offshore banking license. The enhanced scrutiny includes, as appropriate, information on the respondent's AML program and monitoring of transactions to, from or through the account. Where the respondent's customers can direct transactions through the account themselves, the institution also obtains their identity and the source and beneficial owner of the funds. It must take reasonable steps to find out whether other foreign banks use the account through the respondent and, where the respondent's shares are not publicly traded, to identify each owner of 10 percent or more.
Section 5318(j) of Title 31, the USA PATRIOT Act's section 313, forbids a covered institution to keep a US correspondent account for a foreign bank with no physical presence in any country. The one exception is a supervised affiliate of a bank that has one. Under 31 CFR 1010.630 the institution also takes reasonable steps against indirect service to shell banks. It keeps US records of a US agent for legal process and of the owners of each respondent whose shares are not publicly traded, unless the respondent must keep its current owners on file with the Federal Reserve Board. A certification from the respondent, renewed at least once every three years, counts as compliance.
UK banks and financial institutions apply regulation 34 of the Money Laundering Regulations 2017. It bars a correspondent relationship with a shell bank and asks for enhanced measures against respondents known to let one use their accounts. For a respondent from a third country, regulation 34(1) adds further checks where the relationship involves executing payments. UK rules define no offshore license. In the EU, article 24 of Directive 2015/849 bans shell bank relationships, and from 10 July 2027 article 39 of the AML Regulation does the same for "shell institutions". FATF Recommendation 13 asks for the same prohibition and for respondents that keep shell banks off their accounts.
What should an onshore bank or payment firm check?
- License type. Ask whether the respondent holds an offshore license, because that alone triggers US enhanced due diligence; a form that asks only for the supervisor and license number does not say it.
- Owners at 10 percent. For an offshore licensed respondent whose shares are not publicly traded, US rules want every owner of 10 percent or more, lower than the 25 percent that general ultimate beneficial owner questions ask about, so lower the figure in any form you send.
- Nested banks. Ask which other foreign banks use the respondent's account with you, then monitor the wire transfers they send through it.
- Direct use by the respondent's customers. If those customers can move money through your account themselves, know who they are and where their funds come from.
- Beneficiaries at shell addresses. The opening wire went to a company tied to an address used by shell companies, so screen beneficiary names and addresses as well as the respondent.
- Volume against the stated business. Six wires worth $970,000 to an online education company with no web presence offering it is the mismatch Bancrédito let through.
- The licensing country's list status. Recheck the country against the FATF increased monitoring list and the EU high risk third country list at each update.
- News of license loss, seizure or liquidation. Panamanian authorities seized AllBank in September 2019, so run the respondent and each owner through an adverse media check at onboarding and at review.
- A customer's own account abroad. Ask for the source of funds. A US person who has a financial interest in foreign accounts, or signature authority over them, must file an FBAR when their combined value exceeds $10,000 at any time in a calendar year.
What did 2026 change for offshore and correspondent banking?
- 29 January: Delegated Regulation (EU) 2026/83 took effect, adding the British Virgin Islands and Bolivia to the EU's high risk third country list.
- March: Treasury's 2026 risk assessment named offshore bank accounts among the means of paying and hiding bribes.
- 13 October: Bank of America admitted to FinCEN that, among other failures, it did not conduct due diligence for correspondent accounts of foreign financial institutions.
- 30 October: the FATF kept the BVI under increased monitoring, where it has been since June 2025.
Three things to do this week:
- List every respondent with an offshore license and its last certification date; chase any older than three years.
- Pull last quarter's wires through respondent accounts and flag ordering banks you have never assessed.
- Rescreen each respondent and its owners for news of license loss, seizure or liquidation.
