Two global companies were under mounting pressure, and threats were flying.

For years, the Swiss banking giant UBS and a Panama law firm named Mossack Fonseca embraced each other in a mutually profitable relationship. UBS had customers who wanted offshore shell companies to keep their finances hidden. And Mossack Fonseca, one of the largest creators of offshore companies in the world, was happy to sell them.

But in 2010, under threat of a U.S. criminal prosecution for tax evasion and money laundering, UBS was scrambling to contain the damage. The bank’s board of directors wanted out of the shell-company business.

Tensions boiled over in a meeting in Zurich on September 28 when UBS asserted that Mossack Fonseca was responsible for identifying the owners of the shell companies behind the secret accounts – not the bank.

Mossack Fonseca employee Dieter Buchholz argued that his firm had no idea who really owned some of the companies created for UBS customers, because the bank had withheld that information. UBS executive Patrick Küng objected, saying Mossack Fonseca was “in violation of the Swiss money laundering code,” and he was “seriously” contemplating reporting the law firm to the authorities, according to emails describing the encounter.

The emails appear among more than 11 million internal Mossack Fonseca documents obtained by the International Consortium of Investigative Journalists (ICIJ), Süddeutsche Zeitung and other media partners.

The leaked records provide not only a peek into the UBS-Mossack Fonseca spat but an unprecedented picture of how major global banks work hand-in-glove with other players in an offshore industry that helps the superrich, politicians and criminals keep their assets under wraps.

More than 500 banks, their subsidiaries and branches registered nearly 15,600 shell companies with Mossack Fonseca, according to ICIJ’s analysis of the records. The vast majority of them were created since the 1990s.

The British banking giant HSBC and its subsidiaries alone account for more than 2,300 of the companies, and UBS accounts for more than 1,100. Other big banks doing business with Mossack Fonseca included Société Générale (979 companies), the Royal Bank of Canada (378), Commerzbank (92), and Credit Suisse (1,105).

The American investigation into banks’ role in offshore tax evasion quickly broadened beyond UBS. Credit Suisse pleaded guilty to criminal conspiracy charges in 2014 for, among other things, “assisting clients in using sham entities to hide undeclared accounts” and paid $2.8 billion to settle. The Swiss bank Julius Baer settled for $547 million in early 2016. Wegelin, Switzerland’s oldest bank, closed down in 2013 after paying the U.S. $58 million for aiding tax evaders. In all, at least 80 Swiss banks have settled with the U.S. since the UBS investigation began.

“In all cases, UBS knows the identity of the beneficial owners of the companies that its customers ask the bank to work with, and we apply the same strict anti-money laundering rules to all of our bank and business relationships,” a UBS spokeswoman said in a statement. “UBS proactively decided to discontinue” setting up companies for customers in 2010 “due to changes in regulation in some of the jurisdictions where offshore companies were held and due to a further tightening of UBS's internal policies.”

A Mossack Fonseca spokesman said in a statement, “We conduct thorough due diligence on all new and prospective clients that often exceeds in stringency the existing rules and standards to which we and others are bound. Many of our clients come through established and reputable law firms and financial institutions across the world, including the major correspondent banks, which are also bound by international ‘know your client’ protocols and their own domestic regulations and laws.”

Due diligence lite

With UBS’s newly aggressive stance in 2010, Mossack Fonseca initially felt betrayed by its long-time partner.

“UBS has totally changed and because of the problems they had to face they are now reacting in an outrageous way,” wrote Mossack Fonseca’s Geneva representative Adrian Simon in reply to Buchholz’s email about the tense meeting.

“Looks like they just want to push their responsibility away!” added Christopher Zollinger, one of Mossack Fonseca’s three senior partners.

UBS and Mossack Fonseca eventually worked out a deal in 2010 that benefited them both. The law firm would take over administration of UBS’s shell companies and give “special treatment” to the bank’s customers, who would retain their UBS bank accounts.

Normally Mossack Fonseca required banks to provide “due diligence” information verifying owners’ identity and confirming that they were not involved in overt criminal activity before setting up or managing companies created for banks’ clients.

But it now agreed to accept “DD light” from UBS, requiring much less documentation on the true owners and why they were using shell companies, according to a December 2010 email.

As a result, Mossack Fonseca would deal with the customers directly, not through the bank, and UBS would put some distance between itself and the world of shell companies.

Mossack Fonseca made similar arrangements with other major banks so they also could insulate themselves from their customers’ offshore companies, the files show. “It would be ideal that the special treatment of customers ex-UBS is extended to all banks in Geneva,” the law firm’s partners decided.

In 2010 and 2011, Mossack Fonseca reached agreements with Credit Suisse and HSBC to give “special treatment” to their customers’ shell companies.

For French multinational Société Générale, that VIP service started as early as 2008 and involved companies that had been set up for customers of the bank using so-called bearer shares. Companies that have bearer shares don’t record an owner’s name. If they’re in your hands, you are the owner. They have long been considered a vehicle for money laundering and other wrongdoing and have been gradually disappearing worldwide under tighter regulation.

When Société Générale refused to tell Mossack Fonseca who really owned the bearer share companies it had purchased in the British Virgin Islands for its customers, Mossack Fonseca went along with it, agreeing to require no due diligence documents from the bank, according to the files obtained by ICIJ.

Mossack Fonseca also set up two foundations to act as shareholders of Société Générale’s companies, further obscuring their true ownership from the authorities. The law firm charged the bank higher fees because “the special flexible service that we are providing (without much due diligence)… definitely entail[s] a higher risk.”

A spokesman for Société Générale said, “Bearer shares, in the jurisdictions where they exist, can be used for legitimate (non tax) confidentiality reasons, for example the protection of a well-known family in a country where there is a genuine safety risk for the family. Société Générale has not bypassed and did not ask Mossack Fonseca to bypass any due diligence requirements… SG identifies and knows the beneficial owners of every company.”

A spokeswoman for Credit Suisse said that since 2013 the bank has been implementing “tax regularization programs” that require private clients to provide evidence of tax compliance. “For Credit Suisse it is key that its clients use structures only for legitimate purposes, e.g. organizing the wealth of families that have a wide range of financial assets which are held in different countries,” the spokeswoman said.

Mossack Fonseca said that “due diligence procedures were carried out in accordance with the laws in place at the time the companies and cases you made reference to were incorporated and in existence.”

An RBC spokeswoman said the bank has an extensive due diligence process “to ensure we understand who the client is and what their intentions are, and will not proceed with a transaction until we do.”

Commerzbank declined to comment.

Legitimate to unscrupulous

Many of the companies set up for the banks’ customers were used for legitimate purposes. But some have also been used to mask unscrupulous or criminal activity, serving as fronts for dictators, fraudsters and drug dealers.

The structures UBS created through Mossack Fonseca ranged from offshore companies controlled by Muhammad bin Nayef bin Abdulaziz Al Saud, the Crown Prince of Saudi Arabia, to companies controlled by Roberto Videira Brandão, convicted of fraud in the collapse of a Brazilian bank, and Marco Tulio Henriquez, a Venezuelan banker and fugitive charged by the U.S. Department of Justice with money laundering for drug cartels.

In February 2011, with the Syrian civil war about to erupt, Mossack Fonseca debated whether to continue to do business with Rami Makhlouf, the billionaire bagman of Syrian dictator Bashar Assad.

As early as 1996, Mossack Fonseca had set up offshore companies that Makhlouf used to hold bank accounts at HSBC. The firm contacted HSBC as war loomed to alert the bank of its concerns. HSBC did not see a problem, the files show, despite the fact that the U.S. Treasury Department ordered Makhlouf’s assets to be frozen in 2008.

Mossack Fonseca’s partners decided that if Makhlouf was good enough for HSBC then he was good enough for them.

“From my part – if HSBC Head Quarters [sic] in England – do not have an issue with the client, then I think we can also accept him,” wrote Zollinger, the Mossack Fonseca partner. “As far as I can see, there are allegations (rumors), but not any facts or pending investigations or indictments against these persons.”

The firm noted that its competitors would take the business if it refused, although the firm later relented and ended its association with Makhlouf.

Politically exposed persons “do not have to be rejected just for being so; it is just a matter of proper risk analysis and administration,” Mossack Fonseca said in its statement.

Shell companies and bank secrecy together create roadblocks for governments and for individuals and businesses trying to find out who really owns a company. “In most situations the trail does run cold or it dies out or turns into a cul de sac because of the inability to trace what we call ‘the last mile’ . . . the name and address and location for the beneficial owner,” said Steve Lee, a veteran private financial investigator in Los Angeles whose cases frequently lead into the offshore world. “Bank secrecy and secrecy jurisdictions provide opportunities for bad guys to get away with fraud.”

In a statement, HSBC said, “The allegations are historical, in some cases dating back 20 years, predating our significant, well-publicized reforms implemented over the last few years. We work closely with the authorities to fight financial crime and implement sanctions.”

Impact of crackdowns

The files show that the banks’ involvement in setting up offshore companies for customers has been influenced – for better or worse – by government efforts to stamp out secret accounts and catch tax dodgers.

In 2005, for instance, the European Union implemented a new law called the European Savings Directive, which required banks to withhold taxes on accounts of customers living in European countries.

But the savings directive covered only individuals, not corporations. The files show this loophole was seized upon by the banks, which began marketing products that transferred assets from individuals to offshore corporations for tax-reporting purposes.

Bank-related incorporations soared at Mossack Fonseca. In 2005, banks helped create 1,814 shell companies with the Panama-based law firm and its far-flung offices, up from 543 two years earlier.

The number of bank-created shell companies stayed high over the next few years. Almost one in every three

companies set up through Mossack Fonseca was incorporated between 2005 and 2008.

The leaked files suggest that the U.S. criminal investigation of UBS and other banks, starting in 2009, helped slow — but not end — banks’ use of the offshore companies.

Banks’ requests for new offshore companies dropped. And many of the companies created in past years were shut down.

But that doesn’t mean that banks got out of the offshore business. They just changed their focus. Some banks, for example, unloaded companies onto offshore middlemen but continued to offer banking services to customers through the offshore companies.

In 2013, a Credit Suisse private banker explained that “the current trend is that lawyers prepare the structure, and the bank’s focus is on managing the bank accounts (and not the structure),” according to a Mossack Fonseca employee’s notes of a meeting with the bank.

The files show that, starting in 2010, banks also began transferring some companies out of the banks’ names and into the names of individual bank employees. It is not clear from the files why this happened.

In one example, a 2010 email from Mossack Fonseca to HSBC reported that the firm had put companies into the personal names of seven HSBC bankers, including Judah and Nessim el-Maleh. Nessim el-Maleh was later convicted along with another el-Maleh brother in a cannabis-for-cash scheme in Paris, where bags of money from drug deals were laundered through HSBC accounts. Judah el-Maleh, who was fired by HSBC in 2012, was singled out by Swiss prosecutors last year in a settlement reached by the bank in a money-laundering probe. Prosecutors said he was not covered by the settlement.

In another instance in 2010, HSBC transferred administration of a shell company called Hynamer SA to a bank employee named Axel Stern. Hynamer had been created in Panama in 2008 by Mossack Fonseca for HSBC’s Swiss Private Bank. It was one of multiple shell companies and numbered Swiss bank accounts owned by a Spanish business executive named Arturo del Tiempo Marques.

In 2009, authorities seized a cargo ship in the Dominican port of Caucedo that was said to be carrying granite to one of del Tiempo’s companies in Spain. Hidden on board was a ton of cocaine. A Spanish court sentenced del Tiempo to seven and a half years in prison in 2013. HSBC was still doing business with Hynamer as late as March 2013.

The files also reveal a certain wariness. In March 2010, one HSBC banker in Hong Kong told the firm, “do not call the office number of a banker for sensitive issues, as the phone (calls) are all recorded,” according to Mossack Fonseca’s notes of the meeting.

HSBC in 2012 agreed to pay $1.9 billion to the U.S. and admitted it violated money laundering and sanctions laws and “willfully” failed to conduct proper due diligence. It also agreed to a five-year probation with the U.S. to avoid criminal prosecution.

Reports of death premature

The files suggest that past obituaries written for the financial-secrecy business underestimated its resiliency.

As far back as 1991, Businessweek had reported “The Days Are Numbered for Secret Accounts.” A decade later Forbes had declared, “Private Banking: R.I.P.” As late as 2011, the Organization for Economic Co-operation and Development announced that “The Era of Bank Secrecy Is Over.”

But while the worldwide fight against offshore tax evasion and money laundering has intensified in recent years, the system adapts ingeniously, moving money to what are at any given time the weakest points in the financial system. That leaves authorities playing a game of whack-a-mole with banks and wealthy clients popping up in new locales, including the very countries leading the fight against offshore abuses.

In April 2013, for instance, a Mossack Fonseca employee met with a Credit Suisse banker named Philippe Dudler. According to notes of the meeting taken by Mossack Fonseca, Dudler told the firm that “German clients are moving their assets to Miami, as the banking secret there is solid, Delaware companies are not asking for the [true owner], and the U.S. government never has responded… regarding bank accounts that potentially could be used for tax fraud.”

Credit Suisse said it has toughed requirements in the past three years. It said that it “terminates the banking relationship” if clients fail to comply with requests for evidence of “tax compliance.”

In February 2013, the files show that UBS Private Banking Deutschland AG set up Venilson Corp. in Panama with a Brazilian named Milton de Oliveira Lyra Filho as its owner.

Lyra, a well-connected lobbyist who is close to Brazil’s Senate President Renan Calheiros, is being investigated in Congress as the alleged conduit for tens of millions of dollars in kickbacks funneled through offshore shell companies in a 2015 scandal that erupted last year involving the Postalis pension fund for Brazilian postal workers. UBS and Mossack Fonseca did business with Lyra even though his name had popped up in 2011 in a scandal involving graft at Brazil’s ministry of tourism. Lyra, who did not respond to requests for comment, has not been charged.

UBS says it stopped setting up offshore companies for its customers in 2010. The Mossack Fonseca files show the bank set up 25 offshore corporations for clients from 2011 to 2013.