One morning in mid-2014, before the summer sun had reached its peak, two elderly men in Aleppo, Syria, sat on plastic chairs, chatting quietly and drinking black coffee. From his perch outside his food stall, Sabri Wahid Asfur and his friend Abu Yassin watched their neighbours go about their day.
Suddenly, bombs hit the ground, scattering bricks and debris. Seconds later, they exploded, sending thousands of pieces of shrapnel - nails, rebar - in all directions. The crudely made barrel bombs had been designed for maximum human damage.
As the smoke lifted, Asfur reached for Abu Yassin.
“I looked at my friend when I recovered my vision and saw his body in shreds,” Asfur remembers. “He was exhaling his last breath.”
The attack was one of hundreds of aerial bombings that Syrian President Bashar al-Assad’s regime has carried out during the country’s six-year civil war, killing thousands of its own people. The deadly air campaign would not have been possible, US authorities have charged, without a network of companies that dodged international embargoes by supplying the oil and gas that kept the military aircraft in sky.
Three of the companies that the US alleges helped supply the fuel were customers of a global law firm, Mossack Fonseca, which helped the companies incorporate and maintain offshore branches in Seychelles, a tax haven in the Indian Ocean.
The law firm continued doing work for at least one of these closely-linked companies after the three of them were blacklisted by the American government for supporting Syria’s war machine - joining dozens of other Mossack Fonseca customers sanctioned by the US Treasury Department’s Office of Foreign Assets Control (Ofac).
Mossack Fonseca, which is based in Panama but has offices around the world, has worked with at least 33 individuals or companies that have landed on the Treasury Department's Ofac list, according to an analysis of the firm's internal files by the International Consortium of Investigative Journalists, the German newspaper Süddeutsche Zeitung and other media partners.
In some cases, individuals and companies had ceased to work with Mossack Fonseca before being sanctioned. In other cases, the entities were active customers when the sanctions were put in place.
The reporting partners reviewed more than 11 million documents - emails, client accounts and financial records - that show the inner workings of Mossack Fonseca from 1977 to December 2015.
For years, the records show, Mossack Fonseca has earned money creating shell companies that have been used by, amongst other clients, suspected financiers of terrorists and war criminals in the Middle East; drug kings and queens from Mexico, Guatemala and Eastern Europe; nuclear weapons proliferators in Iran and North Korea, and arms dealers in southern Africa.
"It sounds almost like a corporate death wish taking on that many horrible people," said Jason Sharman, a political scientist at Australia's Griffith University and co-author of a groundbreaking study of anonymous companies. "You'd think that, even if they were cynical, they'd be reluctant dealing with US sanctioned entities and taking on the United States. "
Mossack Fonseca denies wrongdoing.
A spokesman told ICIJ that the firm relies on intermediaries such as banks and other law firms to review the backgrounds of the customers that they refer to Mossack Fonseca. These middlemen are supposed to notify the firm “as soon as they have knowledge of a client of theirs having been either convicted or listed by a sanctioning body,” the spokesman said. “Likewise, we have our own procedures in place to identify such individuals, to the extent it is reasonably possible.”
The time it takes to resign varies by jurisdiction, the spokesman said, and some authorities require the agent to remain in place to prevent interference with an investigation.
The spokesman added that Mossack Fonseca has "never knowingly allowed the use of our companies by individuals having any relationship with North Korea, Zimbabwe, Syria and other countries" that have been listed as sanctioned. If it did discover it had unknowingly represented a company that was being used for unlawful purposes, he said, the law firm would take "any measures that are reasonably available to us" to deal with the issue.
Fuel for War
Ofac, the US Treasury Department’s blacklist enforcement unit, announced a series of sanctions in 2014 barring US citizens from dealing with individuals and companies suspected of supporting the Syrian regime.
One of the companies was Pangates International Corporation Limited, a petroleum products specialist headquartered in the United Arab Emirates that had been a Mossack Fonseca customer for more than a decade.
Ofac put Pangates on its blacklist in July 2014, charging that Pangates had supplied the Syrian government with 1,000 metric tons of “avgas” - aviation fuel necessary to operate military aircraft.
“Certainly any armed Syrian Air Force aircraft will be using avgas,” said Jane’s Defence Weekly Europe Editor Nick de Larrinaga.
Pangates is part of the Abdulkarim Group, a sizeable Syrian company with offices in Damascus. Ofac also sanctioned two other Mossack Fonseca clients with alleged ties to the Abdulkarim Group or its directors - Maxima Middle East Trading Co and Morgan Additives Manufacturing Co.
In addition, it sanctioned two Syrian citizens linked to the companies.
Ofac identified Ahmad Barqawi as general manager of Maxima Middle East Trading Co and Wael Abdulkarim as Pangates' managing director. It said Wael Abdulkarim had "worked to arrange numerous shipments of base oils and aviation gasoline to Syria."
In June 2014, Pangates, Maxima and the Abdulkarim Group worked with a Russian oil and gas firm to obtain oil destined for Syrian government-controlled refineries, according to Ofac.
A representative of Morgan Additives told ICIJ that the basis of its blacklisting by Ofac was “in error.”
Barqawi resigned as the company’s manager before the Ofac listing and Wael Abdulkarim resigned when the sanctions were announced, the representative said. Morgan Additives is not currently owned or controlled by Wael Abdulkarim, the representative added.
None of the other companies or individuals sanctioned in connection with the Syrian air war responded to repeated requests for comments via email, registered mail and telephone.
In a previous comment to media, Pangates acknowledged delivering oil to Syria but claimed not to know about its ultimate destination or purpose.
"We are selling to non-Syrian firms who are not on the EU and US sanctions list," the company told Reuters. "We do not know exactly who is finally using the fuel but according to our information the product is used for civil humanitarian purposes."
The secret files show Pangates' relationship with Mossack Fonseca began in 1999, when the law firm incorporated Pangates in Niue, the Pacific island nation where Mossack Fonseca once had exclusive rights to incorporate offshore companies.
When authorities in Niue shut down the island's offshore registration industry in the wake of complaints about money laundering, Pangates moved to Samoa and, in 2012, to Seychelles. At one point, the company valued itself at $7.5 million.
Nine months after the US first sanctioned Pangates, Mossack Fonseca was still handling the company’s paperwork, certifying that it was a Seychelles company in good standing. Later still, Mossack Fonseca helped Pangates close its Seychelles business and sent it a bill for $1,100 to cover its fee for that service. It asked Pangates to pay online or through Mossack Fonseca’s bank account in New York.
It was not until August 2015 - more than a year after sanctions against Pangates had been announced - that Mossack Fonseca acknowledged the blacklisting and scrambled to find ownership details, utility bills or any other identifying information from the Dubai administrators of Pangates and Maxima Middle East. Mossack Fonseca finally reported that the companies were on international sanctions lists to Seychelles regulators in August 2015.
Assad’s Cousin
The files show that Mossack Fonseca also worked with Rami Makhlouf, a cousin of Syria's dictator, Assad. As early as 2008, US Treasury officials had flagged Makhlouf as a "regime insider" who "improperly benefits from and aids the public corruption of Syrian regime officials." Treasury froze Makhlouf's US assets and banned US companies or people working with him. Later that year, in a widely reported announcement, the US Treasury Department blacklisted some of his companies.
Although he had long been a customer of Mossack Fonseca, the firm's emails at the time record no mention of the sanctions. That changed in 2010, when British Virgin Island authorities demanded information on Drex Technologies SA, a company owned by Makhlouf that Mossack Fonseca had incorporated ten years earlier. Mossack Fonseca employees looked for - and quickly found - information that had circulated widely for years, including details of Makhlouf's political ties and alleged smuggling.
At this point, the files reveal, Mossack Fonseca’s head of compliance wanted to drop Makhlouf immediately. But one of Mossack Fonseca’s partners resisted, hoping the firm would not lose the business.
That partner, Chris Zollinger, wrote to colleagues that "there are allegations (rumours), but not any facts or pending investigations or indictments." He noted a colleague's earlier notes from a conversation between Mossack Fonseca and HSBC, the UK-headquartered bank that served as Makhlouf's financial manager, in which the bank assured the law firm that HSBC's Geneva and London offices "know about Mr Makhlouf and that they are comfortable with him."
If HSBC didn’t have an issue with him, Zollinger said, “then I think we can also accept him.”
However, he ultimately agreed with dropping the firm after further urging from his colleagues and mounting official investigations into Makhlouf’s business empire.
Zollinger recently told Süddeutsche Zeitung: "In retrospect my comment in the e-mail was wrong, which I regret." He added that, as registered agent, Mossack Fonseca had "no influence on the transactions or the business of the company" linked to Makhlouf. Makhlouf did not respond to requests for comment.
“This is dangerous!”
Mossack Fonseca took a more aggressive attitude toward Petropars Limited, a company controlled by the Iranian government that was sanctioned by the US Treasury in June 2010.
The relationship between Petropars and Mossack Fonseca began in 1998, nearly 20 years after the Iranian revolution, when Mossack Fonseca incorporated Petropars in the British Virgin Islands.
Petropars was known to watchers of Iranian politics as an intermediary between foreign companies and Iran’s oil ministry. With offices in Dubai and London, it was also a player in the development of Iran’s multibillion-dollar South Pars natural gas field.
Three years before Mossack Fonseca began work for Petropars, President Bill Clinton, citing Iranian support for terrorism and its quest for weapons of mass destruction, banned US involvement with Iranian oil. Not bound by the US prohibition, Mossack Fonseca helped Petropars to issue shares in a Tehran-based oil investment company in 1998.
Petropars' links to the Iranian government were highlighted as early as 2001 when Iranian authorities investigated and then charged board members of the company in connection with "irregularities" in lucrative gas contracts. By 2002, the news had made headlines in The Economist and the New York Times.
The 2001 corruption allegations "put Petropars on the map," says Georgetown University political scientist Paasha Mahdavi. "Even before any of the allegations emerged, it wouldn't have required too much digging to know this is a company whose majority, at the very least, is controlled by government officials."
Petropars remained a customer of Mossack Fonseca until 2010, when Jurgen Mossack, one of the firm's founders, learned that his company's British Virgin Islands post office box had been listed as Petropars' address in Ofac's blacklist entry for the company.
After an internet search, a company employee in the BVI office, Marcia DaCosta, recommended that the firm cut Petropars loose.
"It is a decision that may be 12 years too late," added another employee, Daphne Durand, "but one that must be taken in light of the circumstances."
The firm’s founders - Mossack and Ramón Fonseca - agreed.
"This is dangerous!" Mossack emailed. "Everybody knows that there are United Nations sanctions against Iran, and we certainly want no business with regimes and individuals from such places! Not because of Ofac, but out of principle. Anybody having had to do anything with this company, at absolutely all levels, should have realized immediately that the names associated with it were Iranian names. A red flag should have been raised immediately."
The firm resigned as registered agent of Petropars in October 2010. Mossack blamed the London office, which had processed Petropars’ paperwork and should have conducted what the financial industry calls “due diligence” - checking on customers’ identity and making sure they’re not involved in questionable activities.
“It would appear Mossack Fonseca UK are not doing their Due Diligence thoroughly (or maybe none at all),” Mossack said.
Early this year, as a result of the deal that lifted economic sanctions against Iran in exchange for that country’s disabling key parts of its nuclear program, the United States removed Petropars and other Iranian-controlled oil companies from the Ofac blacklist.
The companies they keep
The files show that despite repeatedly admitting internally that its existing checks and balances had failed, Mossack Fonseca did not introduce a comprehensive policy to comply with Ofac sanctions rules until July 2015.
"Global companies that don't have the appropriate compliance systems in place allow actors like terrorist organisations, drug cartels and human traffickers to continue operating and to engage in illicit and damaging behaviour," said Eric Lorber, senior associate at the Financial Integrity Network who advises financial institutions on complying with Ofac. "Between 2005 and 2007 is when any global company, especially one with interests in the US, should have really been paying attention. That's really when Ofac put the world on notice."
"It's like the accountant of Al Capone - a firm that clearly has chosen to service rogue regimes," said Emanuele Ottolenghi, senior fellow with the Foundation for the Defence of Democracies in Washington, DC, commenting not on Mossack Fonseca, which was not named at the time of the conversation, but on a description of its practices.
An Ofac spokeswoman declined to comment for this story, saying it is Ofac’s policy to not talk about current or future investigations.
In 2012 - years after Mossack Fonseca’s first brushes with sanctioned companies - the firm audited its London office. The final report concluded the UK office had “no procedure in place” for handling high-risk politicians, family and associates and “searches using search engines are not being conducted” to screen potential clients.
Audits of Mossack Fonseca offices in Singapore, Thailand, Brazil and Dubai faulted them on poor record keeping, background checks and procedures for handling politicians, family and friends. Each office scored poorly across every measure of performance, receiving ratings of "unsatisfactory" or "room for improvement," which indicated either "serious failings" or "some weaknesses."
The Dubai office, which represented Pangates and other companies sanctioned for aiding Syria’s air war, was rated “unsatisfactory” on every measure. Basic internet searches to check out customers’ backgrounds were not conducted, the audit said.
In 2009, for example, the firm admitted in internal communications that it had incomplete records on a company later sanctioned for “managing millions of dollars of transactions in support of the North Korean regime’s destabilising activities.”
Also in 2009, Mossack Fonseca ended its relationship with Zimbabwean businessman John Bredenkamp.
Bredenkamp, on the firm's books since 1997, had been described in 2002 by a United Nations expert panel as "experienced in setting up clandestine companies and sanctions-busting operations." In 2008, months before Mossack Fonseca cut ties, Bredenkamp was sanctioned by Ofac for allegedly being a "crony" of Zimbabwe dictator Robert Mugabe and a "well-known Mugabe insider."
Bredenkamp did not respond to requests for comment, but he has consistently denied allegations concerning him and his companies and has denied having supported President Mugabe. In 2012, Bredenkamp successfully overturned European Union sanctions against him and his companies.
One company, Tremalt Limited, purchased equipment for armies in the Democratic Republic of Congo, the United Nations alleged. It took seven years before a Mossack Fonseca employee reported internally that an Internet search implicated a separate company the law firm said was owned by Bredenkamp "in a series of allegations concerning arms deals."
The files also show that in April 2011, Mossack Fonseca learned that Ofac had accused financiers of Hezbollah - a Middle East terrorist group that has used child soldiers and fired rockets into populated towns - of using a Mossack Fonseca shell company.
The company was reportedly part of a "network linked to terrorism," the law firm's compliance chief, Sandra de Cornejo, wrote. It had taken Mossack Fonseca months to notice Ofac's listing. It cut ties with the company, Ovlas Trading SA, in May 2011.
“What I do not understand is why the initial Due Diligence did not reveal these issues to begin with!” Jurgen Mossack berated colleagues in an email. “Surely the Due Diligence process is flawed somewhere.”
Lawyers representing Ovlas Trading said the BVI company was formed for tax-saving reasons as part of a food import and export business. The company has been “mostly dormant,” the lawyers said.
“At no time was Ovlas BVI involved in any money laundering, terrorist financing, narcotics, or other illicit activity,” the company’s lawyers said.
A major international accounting firm conducted a forensic investigation into Ovlas’ business, the lawyers said, and found “no evidence” of any activity described by the US Treasury Department. The company’s owner has “publicly stated that he has not been and is not a supporter of Hezbollah,” and efforts to have the sanctions lifted are ongoing.
Mossack Fonseca did have guidelines for sanctions before 2015, including a risk matrix that included pariah states and countries under embargo as well as a "Mossfon Black List" of countries that required special attention.
But the files reveal Mossack Fonseca’s management did not follow up on recommendations that the firm introduce more stringent policies on Ofac screenings. In 2010, in response to the Petropars debacle, Marcia DaCosta, a compliance specialist, had suggested “a comprehensive Compliance Policy is needed in relation to our approach to sanctioned countries and individuals.”
In a 2015 memo, citing "recent changes in our organization" and "regulatory matters," Mossack Fonseca announced it would drop 35 potentially risky companies "as soon as possible." They included businesses purportedly dealing in oil in Belarus and Russia, mobile phones, juice, tomato paste and cheese in the Middle East, investment companies in Uganda and Guinea, shipping in West Africa and real estate in Lebanon and Zimbabwe.
Mossack Fonseca would not act as the agent for any companies with activities in countries on the Ofac list, such as Sudan and South Sudan, and would be more cautious in other countries subject to limited sanctions, the memo said.
Several offshore experts said that sanctions enforcers in the US and elsewhere haven’t paid enough attention to offshore middlemen like Mossack Fonseca, despite their key role in creating the companies that enable wrongdoing.
This is partly because of limited resources available to pursue cases, experts say, according to Daniel Reeves, former lead investigator for the Internal Revenue Service's offshore compliance initiatives.
But things can change, Reeves said.
"There was a time when people wouldn't go after banks, they wanted to go after their customers," he noted. Since then, investigations targeting banks such as HSBC and UBS produced historic fines punishing them for their work on behalf of criminals, sanctions-busters and tax evaders. "So maybe the next step is corporate service providers," he said.
Frederik Obermaier contributed to this story.
