With Hurricane Irma wrecking havoc across the Caribbean, some businesses in battered offshore financial centres have resorted to taking “extraordinary” steps to secure client data which may be targeted by fraudsters and transparency campaigners targeting sensitive information, law firms and private investigators told KYC360.
In just days, Irma has caused devastation across an area spanning over a thousand miles, including the British Overseas Territories (OTs) of the British Virgin Islands (BVI), Anguilla and the Turks and Caicos Islands.
Data security will be a key issue when chaotic situations arise, financial crime experts say, with fears that sensitive information could be looted, hacked and resold or end up as front-page news, as when firms in Panama and Luxembourg were targeted and became the major Panama Papers and Luxleaks scandals.
Developments in the BVI will be of special interest to the global investment community, especially in jurisdictions such as the US, UK and elsewhere in Europe, as well as for Asian business leaders and high-net-worth individuals, who it is estimated own and use more than 40 per cent of BVI corporate vehicles. According to June 2017 BVI government statistics, about 396,684 firms are registered in the BVI. The territory has a population of around 30,000 people. The businesses are responsible for an estimated $1.5 trillion of assets invested around the world, according to research conducted for BVI Finance. The BVI is popular with businesses for its low tax rates and corporate secrecy laws, which anti-corruption campaigners say makes it a top destination for criminals seeking to establish ‘anonymously-held’ shell companies to launder dirty cash and evade taxes. It has also been highlighted that over 50 per cent of the shell companies uncovered in the Panama Papers were set up in the BVI.
The jurisdiction has resisted growing calls to make the beneficial or true owners of its many firms publicly known, opting to share such information with government and law enforcement agencies instead.
The data in these offshore centres will be secured, in off-site centres, certainly, and mostly in off-jurisdiction back-up centres, too, bearing in mind the serious financial trades taking place, said Dr Frank Madsen, Cambridge University affiliated lecturer and former head of criminal intelligence, General Secretariat, ICPO-Interpol.
Although many firms registered in the BVI hold their key information externally, “opportunists will always look for vulnerabilities, and security vulnerabilities could be breached through the storm, such as power outages,” said Mike LaCorte, director of London-based Conflict International, a private investigation and security firm which has worked closely with firms in various locations, including the BVI.
“Some of these offshore centres such as the BVI and Cayman Islands are known for holding sensitive or secret data, such as the real or beneficial owners of firms,” LaCorte explained, “transparency activists or campaigners targeting such offshore centres might be able to target and reach the data.”
“Or it could be simply looting, someone picking up some computers. The data could also be stolen by individuals or groups who specialise in gathering intelligence on companies and use that for fraud purposes, for example, falsely represent yourself as the company and raise capital. Or they could use it for blackmailing – ordering victims to pay-up or sell the data onto others,” LaCorte said.
In addition to possible looting of gadgets such as computers, given the state of emergency, fraudsters may seek to beat financial compliance or regulatory rules, said Toronto-based Chris Mathers, whose risk consultancy firm covers cyber security and financial investigations.
“There’s a chance of financial criminals attempting to conduct transactions and skip know-your-customer (KYC) or due diligence checks, such as fraudsters coming up with scams from a third location targeting a location that’s lost its infrastructure,” said Mathers. “For instance, someone calling a bank or company and saying ‘I can’t get to my lawyers because of the storm, power outage, but I have the money … can I put it through?’”
“We took extraordinary measures even before the hurricane came, about two months ago, to secure our data so we were prepared,” said a partner at a key international law firm with offices in the BVI, who asked not to be named and could not elaborate further.
Another law firm with a presence in the BVI, Conyers Dill & Pearman, said it has also taken action. “We are aware that people would use a hurricane to take advantage of the situation, however, security is exceptionally important to us,” said Robert Briant, partner and head of the firm’s BVI office.
“We are very much aware of people trying to approach us and breach due diligence checks. But for us, it is business as usual, and that includes insisting on the full KYC process,” he said.
“We have a team of about 40 people in Toronto working mainly on our servers, queries and keeping ahead of all sorts of malware,” he explained, “With our server in Toronto, for example, when I type a letter on my computer here in the BVI, it registers in Toronto. Our computers are double-password protected. Meanwhile, our office in BVI is locked down and has regular security checks.”
Following the Panama Papers data leak, some offshore firms stepped up their data security systems, such as seeking to migrate their data from online platforms to physical storage, said risk and investigations analyst Mathers.
“We advise them to take their data off the internet and store it in servers that are not online, emptying information onto a hard drive, backing up already backed-up data and keeping it in a physical safe,” he said. “We [also] suggest that they only keep the most current information online, for example, if someone is travelling that week and they need to access important information remotely.”
On Wednesday afternoon, London-based George Hodgson, chief executive of the Society of Trust and Estate Practitioners (STEP), which has members located in hurricane-hit jurisdictions, said: “What we have seen in the last 48 hours is that most of [our members] seem to have had in place business recovery and contingency plans. For some of them, although their offices are damaged, they are managing to work remotely.”
DATA SECRECY HEADACHES RESURFACE
In recent years Britain has come under constant pressure from non-profit organisations, some local parliamentarians as well as sections in the European Parliament who accuse it of not doing enough to get its OTs to combat corporate secrecy by establishing publicly accessible beneficial ownership registers of firms.
This week, the UK announced that it has allocated millions of pounds in funding towards the crisis, sending aid as well as 1,000 UK military troops in the region to assist with the relief effort. It has also deployed 60 UK police, a government statement said. British foreign secretary Boris Johnson also visited the region, following criticisms that the government has reacted slowly to its OTs disaster. Meanwhile anti-corruption campaigners have stepped up calls for the UK to address the issue of corporate secrecy in its OTs alongside its hurricane disaster relief efforts.
“Victims in immediate need should be helped without any pre-conditions,” said Transparency International UK director Robert Barrington in a blog post on Tuesday, adding that “as the UK invests in rebuilding the BVI and other OTs it should be working with them on a plan about how to make sure those economies are not dependent on providing secret services that can easily be exploited by criminals.”
Efforts to reach the BVI government for a comment were unsuccessful. The UK Treasury did not respond with a comment. A Monday online statement from BVI premier D. Orlando Smith said while the immediate focus is humanitarian needs “we will also turn attention to our economy … some offices belonging to the business and finance sector survived as did the Financial Services Commission which houses other services such as the corporate registry.”