The Panama Papers are a leak, not a verdict. A name in the files shows that a company existed; whether anyone committed a crime is a question for a court.
On 28 June 2024 a Panama judge acquitted all 28 people tried over shell companies allegedly used in bribery and corruption scandals in Brazil and Germany, ICIJ reported that day. On 17 August 2026 La Prensa reported that an appeal court had upheld the ruling.
Banks fared differently. On 16 July 2026 New York's Department of Financial Services (DFS) fined Swedbank $50 million for withholding information about its ties to the firm.
What Mossack Fonseca sold was a company held in someone else's name. Layering, one of the money laundering methods, often runs funds through such companies to hide where they came from.
What were the Panama Papers?
The Panama Papers are the internal files of Mossack Fonseca, a Panama law firm named after its founders, Jürgen Mossack and Ramón Fonseca, that set up offshore companies for clients. The International Consortium of Investigative Journalists (ICIJ) puts the leak at 11.5 million records in its overview of 3 April 2016 and says they show how law firms and big banks sell financial secrecy. They cover nearly 40 years, from 1977 through the end of 2015, and 214,488 offshore entities connected to people in more than 200 countries and territories.
Reporters at Süddeutsche Zeitung obtained the records from a confidential source and shared them with ICIJ and other partners. None of the outlets paid for them. More than 370 journalists from 76 countries reviewed the files in a yearlong investigation. ICIJ calls the source "John Doe"; in a statement ICIJ published on 6 May 2016, the source gave income inequality as the reason for the leak and offered, on conditions, to make the documents available to government authorities.
In May 2016 ICIJ put the data into its Offshore Leaks Database, which anyone can search. The Panama Papers sit there beside four other leaks: Offshore Leaks from 2013, Bahamas Leaks from 2016, the Paradise Papers of 2017 and 2018, which came from the offshore law firm Appleby and seven corporate registries, and the Pandora Papers of 2021, from offshore service providers. They hold more than 810,000 offshore entities.
The FinCEN Files of 2020 were a different kind of leak: suspicious activity reports that banks had filed.
How did Mossack Fonseca's companies hide their owners?
By putting other names where the owner's should be. The indictment US prosecutors unsealed on 4 December 2018 alleges one such pattern, laid out by stage in Table 1. Its last column is illustrative and makes no finding about any bank.
| Stage | What the firm did | What the paperwork showed | The check that applies today |
|---|---|---|---|
| Introduction | Worked with banks for their clients: more than 500 banks, subsidiaries and branches since the 1970s | The introducing bank, not the client | Record who introduced the client and what that party checked |
| Ownership | Set up a foundation that "owned" the shell company | A company and a foundation, with the client's name generally absent | Follow the chain through the foundation to a natural person |
| Management | Supplied nominee directors who controlled the company on paper only | Directors who sign but do not decide | Ask whether any director or shareholder acts for someone else |
| Upkeep | Provided minutes, resolutions, mail forwarding and signatures | A company that looks active | Ask where the business is run and by whom |
| Banking | Opened accounts where bank secrecy laws were strict | An account in a secrecy jurisdiction | Ask why the account sits there and weigh it in the risk score |
| Repatriation | Told clients to use debit cards and fictitious sales to bring money home | Card spending and sales with no trade behind them | Compare card use and invoices with the stated business |
Table 1. How one structure hid its owner, stage by stage (illustrative: allegations from the 2018 US indictment, with ICIJ's figures and its definition of a nominee)
Banks did more than open accounts. The files list nearly 15,600 paper companies that banks set up for clients who wanted their finances kept out of view. The firm itself often did not know whom it served: a 2015 internal audit found it knew the real owners of just 204 of the 14,086 companies it had formed in the Seychelles.
The European Commission's questions and answers of July 2016 stated the problem in one line: "The Panama Papers revealed that complex ownership structures have been used to hide links to criminal activities and tax obligations."
For a bank, an offshore company chain in which no document names the person in control is a risk factor to score at onboarding. complead, formerly Sanction Scanner, lets a team set its own factors and weights in its customer risk assessment, so a nominee director, a foundation at the top of the chain or an account in a secrecy jurisdiction can each become a factor. Each then carries its own weight. Once the score reaches the level the team chose, enhanced due diligence starts, and the case lists the factors behind it.
Who was named in the Panama Papers?
ICIJ's first report counted 12 current and former world leaders and 128 more politicians and public officials. For a bank these are politically exposed persons, customers whose public role carries a higher risk of bribery and corruption, and PEP screening at onboarding and after is how a firm finds them.
The files also held at least 33 people and companies blacklisted by the US government because of evidence that they had been involved in wrongdoing. That is a sanctions question, and a bank holding such a company's account needs to know who owns it.
Under the FATF Recommendations, firms like Mossack Fonseca were supposed to watch for clients who might be involved in money laundering, tax evasion or other wrongdoing, and to pay special attention to politically exposed persons. The firm missed at least one. ICIJ reported on 3 April 2016 that British Virgin Islands (BVI) authorities had fined it $37,500 for breaking anti money laundering rules: it had formed a company for the son of a former head of state and failed to identify the connection.
Asked whether everyone in the Panama Papers avoided or evaded tax, ICIJ's FAQ answers no: there are legitimate reasons to set up a company offshore, and many people declare such companies to their tax authorities when the law requires it. An offshore company used to keep income from the tax authority is another matter, and that is tax fraud.
What happened to Mossack Fonseca and the people named?
Iceland's prime minister, Sigmundur David Gunnlaugsson, resigned in 2016 after nationwide protests over revelations that the prime minister and the prime minister's spouse owned a company in the British Virgin Islands, ICIJ recounted on 2 April 2026. The firm closed its doors in 2018, ICIJ reported on 21 August 2019.
On 4 December 2018 prosecutors in New York charged four people with wire fraud, tax fraud, money laundering and other offenses over a scheme they alleged the firm ran for decades, with the charged conduct running from 2000 through 2017. On 20 October 2020 DW reported that Cologne prosecutors had issued international arrest warrants for the two founders, on charges of accessory to tax evasion and forming a criminal organization.
In Panama, the judge acquitted all 28 defendants on 28 June 2024, Jürgen Mossack among them, ICIJ reported that day. Ramón Fonseca had died in May, and the case against Fonseca was dismissed. In Germany, Cologne's regional court gave one of the firm's former owners one year and nine months' probation for aiding and abetting tax evasion, ICIJ reported on 24 April 2026. The defendant admitted the charges. The indictment covered 50 offshore companies and about 13 million euros in lost tax. Panama's appeal court upheld the 2024 acquittals, La Prensa reported on 17 August 2026.
La Prensa's account of the 118 page appeal ruling gives the court's reasons. The chain of custody of computer evidence seized when police raided the firm's office in 2016 had failures, so forensic experts could not vouch for it. Nor could the court establish that the founders knew the money reaching the firm came from corruption in Brazil. It accepted that the firm sold companies, with a team that did nothing else, and held that this was neither a crime nor a laundering scheme. Prosecutors can still file a cassation appeal with the criminal chamber of the Supreme Court.
What changed in AML rules after the Panama Papers?
Rules on company ownership moved in both directions after 2016.
- 5 May 2016, US. Treasury announced a Customer Due Diligence Final Rule: covered financial institutions must identify and verify any individual owning 25 percent or more of a company opening an account, and an individual who controls it. The release does not mention the leak.
- 5 July 2016, EU. The Commission proposed tighter rules against money laundering and, in parallel, a Communication that "responds to the recent Panama Papers revelations".
- 2017, BVI and UK. A BVI law in force from 30 June 2017 made registered agents identify companies' real owners and record them in a database the territory's authorities can search. The UK's Criminal Finances Act 2017 created unexplained wealth orders and corporate offenses of failing to prevent the facilitation of UK or foreign tax evasion.
- 30 May 2018, EU. The fifth AML directive, Directive (EU) 2018/843, changed the 2015 rules so that information on the owners of companies and other legal entities incorporated in each member state was open to any member of the general public.
- June 2019, Panama. The FATF placed Panama under increased monitoring, its gray list, noting Law No. 70, which made tax offenses predicates for money laundering.
- 2021, US. The Corporate Transparency Act required US companies to disclose their owners to the Treasury Department.
- 22 November 2022, EU. The Court of Justice struck down the rule that let the general public see owner information in every case. The interference with Charter rights, it found, went beyond what is strictly necessary and was not proportionate.
- 27 October 2023, Panama. The FATF took Panama off its list of jurisdictions under increased monitoring.
- 10 July 2026, EU. Member states had to bring Article 12 of Directive (EU) 2024/1640 into force. It opens owner registers to any person who can show a legitimate interest in preventing and combating money laundering, its predicate offenses and terrorist financing.
- 14 August 2026, US. The exemption from beneficial ownership reporting that an interim rule gave US companies in March 2025 became permanent when FinCEN's final rule took effect.
Since 2022 the EU has narrowed who may see the owners of shell companies, and the US has narrowed who must report them.
Why are banks still paying for the Panama Papers in 2026?
Because after the leak DFS opened reviews of the banks it licenses that had ties to the firm, and two of those reviews ended in penalties in 2026. At least four DFS orders tie a bank to Mossack Fonseca or the leak.
The earliest of the four came on 19 August 2016, when DFS fined Mega Bank $180 million and found that a substantial number of customer entities with accounts at other Mega Bank branches "were apparently formed with the assistance of the Mossack Fonseca law firm in Panama". On 27 August 2024 Nordea agreed to pay $35 million. DFS said the leak had exposed Nordea's role in helping hundreds of customers set up companies to shelter tax through offshore accounts, and cited "deficient AML controls, an unsophisticated transaction monitoring apparatus".
Swedbank's case is about candor. Its $50 million order of 16 July 2026 rests on DFS findings that the bank had not told the regulator that customers of Swedbank Estonia used Mossack Fonseca as their registered agent, and that it had intentionally left its Baltic subsidiaries out of what it produced. SEB's $33 million order followed on 15 October 2026, after DFS found weak customer due diligence, and transaction monitoring in the Baltic subsidiaries in Estonia, Latvia and Lithuania so backlogged that transactions escaped timely review.
Each penalty answered a failure in the bank's own work: due diligence that did not match the risk, monitoring that could not keep up, or answers to the regulator that left things out.
What should a compliance team do when a leak names a customer?
Open a review of the customer file. Eight steps, each with its reason:
- Search the database and treat a hit as a lead. ICIJ says a listing does not imply illegal or improper conduct, warns that many people and entities share the same or similar names, and suggests confirming identity from addresses and other details.
- Resolve ownership to a natural person. Foundations, trusts and nominees are layers, and KYB and UBO verification follows each one until a person is named.
- Screen everyone the chain names. Owners and directors go through sanctions, PEP and adverse media checks at onboarding and again while the customer stays.
- Ask why the structure exists. A nominee, a foundation or a secrecy jurisdiction needs a business reason and a source of wealth that fits the customer.
- Review what introducers brought in. More than 500 banks worked with the firm, so check which customers came through a formation agent or another bank, and what that party checked.
- Look for the way money came back. Prosecutors alleged debit cards and fictitious sales, so card spending and invoices that do not fit the business deserve a look.
- Record the search and the decision. Note who searched, what was found and why the relationship stays or ends.
- Report if suspicion remains. Where the review still leaves a suspicion of laundering, file a suspicious activity report.
Which Panama Papers cases and rules moved in 2026?
- 2 April. ICIJ estimated that at least $1.3 billion recouped by authorities can be traced directly to the investigation, and called the figure likely an undercount.
- 24 April. ICIJ reported the Cologne conviction of one of the firm's former owners.
- 10 July. EU member states had to give people with a legitimate interest access to owner registers.
- 16 July. DFS fined Swedbank $50 million.
- 14 August. FinCEN's final rule made the exemption for US companies permanent.
- 17 August. La Prensa reported that Panama's appeal court had upheld the 2024 acquittals.
- 9 October. The EU took Panama off its list of non-cooperative tax jurisdictions, ICIJ reported.
- 15 October. DFS fined SEB $33 million.
ICIJ's database holds four other leaks. The open question for a compliance team is whether it would know, within days of the next leak, that a corporate customer or one of its owners is named, and who would decide what happens to that relationship. If the answer today depends on someone happening to read the news, that check has no owner. Give it one before the next leak.
