At the last count there were over thirteen countries that have opened up investigations flowing from the recent story about the leak of private data from the law firm Mossack Fonseca. They include Australia, Brazil, Canada, Chile, Costa Rica, France, Indonesia, Nepal, New Zealand, Pakistan, Romania, Singapore, Thailand, the UK and USA. Rather an intriguing mix.

I thought it would be interesting to take a look at whether the existing tax evasion frameworks have the capability to identify this data in the absence of a leak. If you think about it, FATCA and CRS (collectively known as ‘GATCA’) have to uncover exactly the kind of individuals that have appear to have been ‘leaked’ in this event. This is the basic objective of these regulations.

Interestingly, in FATCA, the law firm cited in the leaks actually has two GIINs registered in BVI (84CQFN.99999.SL.092 and VFAWUC.00000.SP.092), and BVI has an IGA with the USA. Panama on the other hand has no IGA and is thus subject to the primary FATCA regulation, which requires that reports on US Persons should be sent directly to the IRS. My point being that it doesn’t matter whether the data was in Panama or in BVI, both jurisdictions would be covered by FATCA one way or another and, by getting two GIINs (one of which is for a sponsoring entity), Mossack Fonseca has, by inference, at least a responsible officer who is aware of the purpose of FATCA and the obligations of his/her firm.

So surely the IRS should already have all the leaked information about US Persons? The GIINs would indicate agreement to conduct the appropriate due diligence which would identify these people. The IGA with BVI states in Article 3 Clause 5 that reports were due to the IRS (from the BVI regulator) within nine months of the end of the calendar year to which the report data applies. Since the IGA was signed in 2014, that means that the IRS should have received reports, presumably disclosing the US Persons identified in the leaked documents as far back as September 2015. The Panama company is also subject to FATCA directly but without the mitigating effects of an IGA. In both cases, the information that this law firm had should, in principle, have already been already been disclosed to the IRS. The question for the law firm and the IRS is – was it?

I find it rather ironic that the FATCA system is so opaque precisely at this point. By that I mean that the whole system is intended to force disclosure by financial institutions while at the same time, the identities of those disclosed (and found to be evading tax) are not published. In other words, the US could theoretically come out and say that, of those US Persons whose identities had been leaked, they already knew about them through FATCA reporting and are taking appropriate action. Now that would be news. That would be a vindication of the FATCA system. The difficulty is that after the reports get to the IRS, FATCA (and the IRS) becomes silent. What is the IRS doing with all this data? Of course, in theory, it’s processing the data to match it to 1099s and FBAR reports and, where there’s no match there is potential tax evasion (accidental or deliberate) which could lead to a prosecution under US domestic law (there being no prosecutorial element in FATCA itself). The problem is that there appears to be no publication of the process, how long it takes, or whether the identities of those thought to be evading tax will be published. I can understand the issues that give rise to this opacity, it’s just rather funny that all this disclosure ends up behind closed doors. Given that FATCA is a US regulation that has such extra-territorial reach it seems odd (or perhaps not) that the regulation itself is silent about the end of the process. One would think that the regulation, if not the HIRE Act which spawned it, would put some explicit obligation on the IRS so that we can all see that there’s a defined process at the end.

And therein lies the rub. Governments, in dire need of finance and political support, are perfectly happy to surf the media driven tidal wave of outrage and righteous indignation surrounding tax evasion. This forced the financial services industry, still trying to regenerate trust after the crash of 2008, to meekly extract and deliver their client’s sensitive data to foreign governments. The IGAs, before you ask, being a rather disingenuous and blunt instrument whose sole objective is really to bypass the data protections that they themselves bestowed on their residents.

Please don’t misunderstand me, I am absolutely against tax evasion of any form. It’s just that there is a truly enormous flaw (amongst all the others) in all this tax evasion regulation (both FATCA and CRS). It assumes that the bad guys will stop being bad guys just because a regulation exists saying ‘be good guys’ or ‘tell us if your customers are bad guys’. If a financial institution is actively participating in tax evasion, it, like its customer, will not have a problem either falsifying reports or, in the case of FATCA, simply not disclosing. Their perfidy is only realised when there’s a leak because the control and enforcement systems in FATCA are not only weak, but only applied triennially through Periodic Reviews. So all that compliance money isn’t really addressing the problem. Equally, we should understand that people who evade tax are very, very smart, and since these regulations (FATCA) and frameworks (CRS) are public, you can be sure they will be analysing them far more assiduously than any financial institution for holes and weaknesses that can be exploited. By the time the reports and data starts to flow, I suspect that all the really smart tax evaders will be long gone.

It’s also interesting that Bloomberg recently mentioned the USA and Panama in the same breath as having a commonality in not adopting the OECD Common Reporting Standard. The USA has FATCA, under which most partner jurisdictions have intergovernmental agreements (‘IGAs’) of which, in turn, most are reciprocal in nature. So, the US has its own standard in which it will find American tax evaders and the rest of the world has a method to extract the same data as would collected under CRS – via the reciprocity of the IGAs. I see no such comparable standard in Panama so, I’m not sure I agree with grouping these two countries together from that perspective.

Someone is soon going to use that fateful phrase ‘tip of the iceberg’ and governments will have renewed vigour and self belief that further measures can be added to GATCA to strengthen its effects and plug the leaks.

Image Credit: Sarah Murray