Shining a light on the shadows: why strengthening corporate registry verification matters

• Regulators around the world are responding to the pernicious use of legal entities to facilitate money laundering, terrorist financing and other financial crimes by opening corporate registries and making owners, directors and other parties more transparent.
• This is a welcome step – but there is more to do. The verification threshold for input data can be extremely low, as demonstrated by recent investigations by Wired and other outlets.
• To strengthen KYB checks, beneficial ownership data must be verified with independent and authoritative sources to ensure it is trustworthy.

I first learned how to write code from a library book. Checking out a physical book to learn how to program seems incongruous given all the tools that are now available online, but it was all we had access to as children. I recall marveling at the lines in BASIC that popped up on our family’s 286 PC once I’d corrected a few errors. One of the lessons in that stuck with me as an amateur programmer and continues to resonate is “garbage in, garbage out”– the notion that the quality of input determines the quality of output.

Fast forward to today and nowhere does this adage stand truer than in relation to corporate registries. Regulators around the world are responding to the pernicious use of legal entities to facilitate money laundering, terrorist financing and other financial crimes by opening registries and taking steps to make owners, directors and officers, and other related parties transparent and verifiable. This is an excellent and necessary step – but there is more to do.

While these registries are official sources, in many cases, the verification threshold for input data is so low that it calls into question whether they can truly be regarded as authoritative. As a point of comparison, take most countries’ drivers licenses or passports. To gain entry to these authoritative databases, one must appear in person with certified copies of birth certificates and other documentation required for review and validation. FinCEN’s new Beneficial Owner Information Reporting rules require entities (barring a select number of entity types that are not required to report at all) to provide detailed information and an image of an ID document for every beneficial owner. However, as best we can infer from the regulation, no verification of any type is applied to this self-reported data. Hence, the concern of “garbage in”.

Wired recently published a hard-hitting piece by William Turton and Dhruv Mehrotra detailing the results of their investigation into Registered Agents Inc. They write that “Registered Agents Inc., is a one-stop shop for people seeking to incorporate a business in any US state, often in those with advantageous tax policies, while obscuring their identities.” Their research reveals that this secretive organization enables hundreds of thousands of businesses to operate in almost total anonymity. According to former employees, the founder of Registered Agents, Inc. created a multitude of false personas and used them to establish businesses. Turton and Mehrotra searched some of the known false personas and found over 36,000 corporations registered in their names.

Across the pond, similar vulnerabilities present themselves. In the UK, registering a company can cost as little as £12, but according to the Bureau of Investigative Journalism, Companies House takes no steps to verify name or address data provided by applicants. An extensive investigation led by Transparency International UK revealed that 14% of the Limited Liability Partnerships registered in the UK “bear the hallmarks of shell companies used for serious financial crime.” Duncan Hames, Director of Policy at Transparency International UK, said: “This research lays bare the seemingly industrial-scale abuse of UK LLPs and how this type of company has been used to facilitate billions in economic harm.”

Around the world, regulators are taking strides to drive transparency and accountability for corporations, and to reduce criminals’ ability to use entities as a means of money laundering and conducting other financial crimes. However, unverified data and poor controls on information input into official registries is undoubtedly a weak link in the chain. Charles Babbage, the father of the computer, said “I have been asked, “…if you put into the machine wrong figures, will the right answers come out? ... I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question.” If we depend uncritically on data sourced from corporate registries who have poor or no controls on data input, we are expecting to get the right answer from “wrong figures.”

Beneficial owner data must be verified with independent and authoritative sources to be deemed trustworthy. Otherwise, KYB (Know Your Business) checks become compliance theater, where we allow criminals and fraudsters to self-report critical data and then use that same, self-reported data to deem them valid and trustworthy. This is a new problem for us to confront in the 21^st century, but the 20^th century’s “garbage in, garbage out” rule still reigns supreme.