The hacker, the tax haven, and what $200 million in offshore deposits can tell us

The global financial system is infected with dirty money. Despite decades of progress in strengthening policies aimed at stamping out cross-border tax evasion and money laundering, many of those looking to stash their money overseas to avoid taxation or prosecution can still do so with relative impunity. As the FinCEN Files scandal last year revealed, banks—themselves the tip of the spear in the fight against financial crime—often fail to catch the worst offenders in a timely manner. Tax authorities and financial intelligence units also struggle to keep up, due to the basic fact that it becomes very difficult to track what happens to money the minute it leaves your economy and goes offshore.

A lot of hidden wealth either ends up in or transits through tax havens: jurisdictions that offer low tax rates and high degrees of financial secrecy, including legal systems and regulations that make it easier for people to keep their wealth hidden from the prying eyes of their governments back home. In the past decade many governments have made a lot of progress in getting archetypal havens to start sharing information on the owners of offshore wealth. But while these efforts have succeeded in sending a lot of tax haven clients scrambling for new places to hide their money, they have given policymakers and researchers only a glimpse into who uses and benefits from tax havens.

Fighting dirty money is going to require a concerted effort by regulators, law enforcement, the press, civil society, and researchers around the world.

Occasionally, data leaks mean we get to fully rip back the curtain surrounding the offshore economy. In late 2019, Distributed Denial of Secrets, a quasi-anonymous, Wikileaks-style journalist collective, released a leaked cache of internal files and emails from the Cayman National Bank and Trust — a bank based in the Isle of Man, home of a large offshore financial industry. The leak appears to have been perpetrated by the anonymous hacktivist group known as Phineas Fisher. The group—whose only live interview to date is in the form of a sock puppet—made their name by hacking surveillance and spyware organizations like the Gamma Group and Hacking Team.

Thanks to the leak, investigative journalists around the world have highlighted several of the bank’s more questionable clients. These ranged from a Russian billionaire on the lam from the IRS for tax evasion, a former Armenian government official under investigation for corruption, and even companies connected to the German payments company Wirecard, which recently collapsed under the weight of a 1.9 billion euro accounting fraud scandal. But while the headline-grabbing cases are more salient, they don’t tell the whole story. In a new working paper, I use the data from the leak to start answering some fundamental questions about who stores their money in tax havens and how that should alter our approach to fighting dirty money, both abroad and at home.

After a year of going through the data, which at its peak covered about $200 million in offshore deposits, I made three discoveries.

Discovery #1: The rich will always be with us, but audit rates need to reflect that

The data in the leak allowed me to pinpoint where the bank’s clients were based: both those with their own account and those indirectly connected to the bank because they owned or benefited from an entity that held an account there. This made it possible to understand whether clients were more likely to come from richer parts of the world and if the amount of wealth they had—measured by their account balances—suggested they were likely to be rich themselves.

Clients of offshore banks appear to be wealthy by nearly any metric. Adjusted for each country’s population, there are nearly five times as many clients from countries with a GDP per capita of $50,000, such as Sweden, than there are for those with a GDP per capita of $5,000, such as Ghana. No matter what…