Shell companies and money laundering: how to spot them

On 9 November 2006, FinCEN told financial institutions in its guidance FIN-2006-G014 that Suspicious Activity Report data showed shell companies in the United States had been used to move "billions of dollars globally". Almost 20 years later, the federal record of their owners is shrinking. A FinCEN final rule in force since 14 August 2026 exempts US companies from reporting beneficial owners, and FinCEN plans to delete what they filed.

For a KYB analyst, the owner of a US company customer now sits in one place: your firm's own due diligence file. Whether that file names the right person depends on the KYB and UBO verification done at onboarding, and on knowing how a shell behaves once its account is open.

What is a shell company in money laundering?

A shell company is a legal entity that exists mostly on paper. In FinCEN's meaning, it is a corporation, limited liability company (LLC) or trust that is not publicly traded, typically has no physical presence beyond a mailing address, and produces little or no independent economic value. Shell corporation and shell firm are other names for the same structure.

Its nearest relative is the front company, which really trades and hides illicit money inside its sales; a shell has no trade to hide behind. A shelf company is a third case: an older company kept dormant, then sold ready made.

The legal form itself is neutral. FinCEN says most shells are formed for legitimate reasons: to hold the shares or intangible assets of other businesses, to move money and assets at home or across borders, or to complete a merger. Launderers want them for other reasons. A shell is easy and cheap to set up, FinCEN noted in 2006 that most US states collected no owner details for LLCs at formation, and one company can own another, so layers stack until no filing shows a person.

Picture two LLCs with identical paperwork: no staff and a registered agent's address. The first holds the shares of an operating subsidiary, names its owners and receives one dividend a year. The second takes wires from a dozen unrelated payers. It sends them abroad within days.

How do shell companies work in money laundering?

On 28 April 2026, a federal judge in New York sentenced Maximilien de Hoop Cartier to eight years in prison after a guilty plea to running an unlicensed money transmitting business and to conspiring to commit bank fraud. The Justice Department's release describes an OTC crypto exchange run through shell companies based in the US, more than a dozen bank accounts, and companies presented to the banks as software publishers.

Drug money arrived as cryptocurrency, was converted into hard currency, deposited in the shell accounts and passed on until it was withdrawn in Colombia: more than $470 million in all. Forged contracts and invoices made the funds look to the banks like income from legitimate business.

In KYB terms, the accounts came first. They gave the drug money a business name. An account held by a company with no trade, which money passes through rather than stays in, is what bankers usually mean by a shell account. The forged invoices gave each transfer a reason. People stood in front of both: FinCEN describes nominee directors, shareholders and bank signatories acting for owners who never appear, and a FATF and Egmont Group study of more than 100 cases found trust and company service providers often playing a role in such structures.

The chain then puts one company inside another across countries, and each hop is a layering step, the middle of the three stages of money laundering.

How are shell companies used for tax evasion, fraud and other financial crimes?

For tax evasion, a company holds income or assets away from the owner's name. On 24 April 2026, ICIJ reported that a Cologne court had convicted a former Mossack Fonseca partner of aiding and abetting tax evasion; the indictment listed 50 offshore companies and an estimated tax loss of 13 million euros.

For fraud, shells receive the proceeds. In a case sentenced on 18 May 2026, prosecutors alleged that a health care fraud network gave nominee owners false corporate registration documents to open accounts, then moved the money "to shell companies and various banks overseas".

FinCEN adds that nominee services, legal in themselves, may attract people who launder funds or finance terrorism. Sanctions evasion works the same way, with a blocked person standing behind a company named on no list. The OFAC 50 percent rule reaches part of that gap: an entity counts as blocked when blocked persons together own half of it or more, while control without that ownership stays outside the rule.

What are examples of shell companies used to launder money?

For scale, take the Panama Papers. In April 2016, ICIJ and more than 100 media partners began publishing more than 11.5 million documents from the law firm Mossack Fonseca, in which more than 214,000 offshore entities appear.

The British Virgin Islands, home to the largest number of the companies named, passed a law in 2017 making offshore service providers report the real owners, and Iceland's prime minister resigned. Ten years on, ICIJ counts "at least $1.3 billion" recouped by authorities, likely an undercount.

Which red flags point to a shell company?

FinCEN's 2006 guidance lists eight elements that recur in Suspicious Activity Reports on shell companies. In a KYB file they look like this, with a ninth sign from practice and the check that catches each one.

Table 1. Nine red flags and the check that catches each (FinCEN guidance of 9 November 2006; row 9 added from practice)

Cartier's forged contracts and invoices were made for row 3. A payment that names only an invoice number says nothing about goods, and a forged invoice fills that gap without proving a sale. Ask the customer for the trade behind it: a shipment, a license, a buyer who exists.

Row 9 is a practitioner's addition, built on FinCEN's warning that a nominee signatory can run a shell's account for owners who stay hidden. Money that circles between companies one person signs for is, in practice, one business, whatever the registers say.

The register and ownership checks behind rows 1, 5 and 8 are the core of KYB and UBO verification software. complead, formerly Sanction Scanner, confirms the entity against official registers and vetted sources, then follows owners with no fixed depth cap, up the chain until natural persons are reached, and marks unresolved layers as unresolved.

How does a compliance team check a corporate customer for shell risk?

Effective compliance methods for shell risk are ordinary KYB steps, put in an order where each step tests the one before:

1. Set the depth by risk. FinCEN ties the risk of serving a shell to its ownership structure, the customer, the services, the account's purpose and where the services are delivered, so a holding company with a named parent and an LLC with nominee directors get different files.
2. Confirm the company in its register. Registration number, status, filing history and registered address come first; a company struck off, dormant or younger than its stated history stops the file until someone explains it.
3. Test the address. An agent's address, or one the company shares with the businesses it trades with, is FinCEN's fifth sign; the guidance also describes office packages sold to make a shell look local.
4. Follow ownership to natural persons. Record each layer, name everyone who owns or controls the company, and mark unresolved layers instead of stopping at the first corporate shareholder.
5. Ask why the structure exists. A holding company above an operating subsidiary has an answer; a chain through three countries for a small importer needs one in writing.
6. Match the stated business to the money. Expected volumes, counterparties and countries go in the file at onboarding, so rows 2 to 4 of Table 1 have something to fail against.
7. Screen every party. The company, its directors, owners and signatories go through sanctions and PEP screening and adverse media checks; a clean company name can sit on top of a listed owner.
8. Escalate offshore and nominee chains. Nominee shareholders or owners in secrecy jurisdictions move the file to enhanced due diligence: source of funds, the ownership chart and its documents.
9. Write rules for pass through behavior. Money that leaves within days of arriving and one signatory across several customers are patterns for transaction monitoring.
10. Watch the structure after approval. Owners and directors change; each change means screening the new party and working out control again.

Whether a structure is acceptable, needs limits or ends the relationship is for the compliance function and counsel to decide, on the evidence these steps collect.

Where can a firm still find out who owns a company in 2026?

In the United States, the Corporate Transparency Act (CTA) was enacted on 1 January 2021 within the AML Act of 2020.

The CTA's owner test is substantial control or at least 25 percent of the ownership interests. Under FinCEN's final rule, US companies are exempt from reporting, and only certain foreign companies registered in the US still file, not for their US owners.

Banks still apply the CDD Rule, 31 CFR 1010.230: each individual with 25 percent or more of the equity, and one individual with significant responsibility to control. Picture a new LLC customer in December. No federal database answers for its owners, so the bank's CDD record is what an examiner reads.

In the United Kingdom, owners sit on the public register of people with significant control (PSCs), and identity verification has been a legal requirement since 18 November 2025.

New directors verify to be appointed. Existing directors verify with their next confirmation statement and PSCs by an appointed day, all inside a 12 month transition. The Companies House transition plan puts completing it and starting compliance activity "no earlier than the end of 2026".

Prosecutions have started. On 16 September 2026, three directors of two companies were fined at City of London Magistrates' Court, the Insolvency Service's first convictions for these offenses.

In the European Union, the Court of Justice ended general public access to owner registers on 22 November 2022.

AMLD6 gives obliged entities timely access for due diligence (Article 11), and anyone with a legitimate interest in fighting money laundering sees the beneficial owner's name, month and year of birth, country of residence, nationality and interest held (Article 12). Both were due by 10 July 2026; the AML Regulation applies to most obliged entities from 10 July 2027.

Behind all three sits FATF Recommendation 24, tightened in March 2022, and FATF's 2023 guidance states the aim: "shell companies can no longer be a safe haven for illicit proceeds with links to crime or terrorism".

Table 2. Who can see a company's owners, as of November 2026

Which 2026 cases and rule changes touch a shell company file?

The year so far, in date order:

• 2 April. ICIJ put the money recouped after the Panama Papers at no less than $1.3 billion.
• 24 April. ICIJ reported a Cologne court's conviction of a former Mossack Fonseca partner for aiding tax evasion.
• 28 April. Cartier was sentenced to eight years for laundering through shells posing as software firms.
• 10 July. EU owner registers were due to open to obliged entities and to people with a legitimate interest.
• 14 August. FinCEN's final rule took effect and made final the March 2025 exemption of US companies from owner reporting.
• 16 September. The Insolvency Service secured its first convictions for UK identity verification offenses.
• Mid November. The UK's 12 month transition for existing directors and PSCs runs out.

The ten checks run out at one structure: a chain that ends in a trust, a nominee or a foreign register with no natural person at the top.

Sources and review. Emirhan Akgün wrote this page from documents opened on 7 November 2026: FinCEN's 2006 shell company guidance, the 14 August 2026 final rule and FinCEN's BOI page, 31 CFR 1010.230, the Companies House rollout notice of 5 August 2025 and its transition plan, the Insolvency Service release of 17 September 2026, AMLD6 and the AML Regulation, FATF's 2023 guidance with the 2018 FATF and Egmont Group report, three ICIJ pages and two Justice Department releases. Fact checked by Ufuk Gürdaş, Compliance Specialist; reviewed on 8 November 2026.