A shell company is not automatically unlawful. Companies with little current activity may be used legitimately to hold an asset, complete an acquisition, isolate a project or prepare a new venture. Compliance risk rises when the entity’s ownership, controllers, purpose or transactions cannot be reconciled with reliable evidence.
Define the entity by facts, not labels
Start with the legal name, registration number, jurisdiction, status, registered office, directors, shareholders and stated activity. Then establish whether it has employees, premises, contracts, customers, assets, tax registrations and operating expenditure. “Shell company” is a descriptive term, not a finding of money laundering or fraud.
Identify the natural persons who own and control it
Map every ownership layer to natural persons and record percentages, voting rights, appointment powers and other means of control. Compare registry information with constitutional documents, shareholder agreements, licences, bank onboarding records and the customer’s own declaration.
The FATF guidance on beneficial ownership of legal persons calls for adequate, accurate and up-to-date information available to competent authorities. A registry result is therefore a starting point, not a substitute for risk-based verification.
Where layers cross borders, use the structured approach in Trider’s guide to tracing ownership behind offshore entities. Also document discrepancies rather than silently choosing the most convenient source.
Test purpose, activity and money together
Ask why the entity exists, who benefits, how it is funded and what value it adds. Obtain contracts, invoices, bank statements, financial accounts, tax material and evidence of delivery. Compare expected activity with actual counterparties, jurisdictions, payment references and timing.
| Indicator | What must be tested |
|---|---|
| Nominee director or shareholder | Who gives instructions and exercises practical control? |
| Shared address or service provider | Is this routine administration or part of a connected network? |
| No obvious operations | Does the stated holding or project purpose explain the entity? |
| Rapid pass-through payments | What contract, asset or service supports each movement? |
| Frequent ownership changes | Who benefited before and after each dated transfer? |
No single indicator establishes misconduct. Risk is stronger when several inconsistencies combine—for example, unverifiable owners, no economic rationale, unrelated counterparties and funds transferred onward immediately.
Build an ownership and control timeline
Current records can hide who controlled the company when a transaction occurred. Create a dated schedule of incorporations, share transfers, director changes, mandates, bank-account openings, licences and material payments. This prevents today’s ownership from being projected backwards and helps analyse cross-border ownership trails.
Account for changing transparency rules
Requirements differ by jurisdiction and access may be limited. In the UK, Companies House identity-verification guidance describes the developing legal requirements for people setting up, running, owning or controlling companies. Identity verification can improve data reliability, but it does not prove that a declared person is the only practical controller or that transactions are legitimate.
Escalate proportionately and record uncertainty
When evidence conflicts, obtain certified or primary records, seek explanations, refresh due diligence and consider enhanced monitoring. Any reporting, account restriction or law-enforcement referral must follow applicable law and authorised internal procedures. The file should separate confirmed facts, unresolved discrepancies, allegations and analytical inferences.
For a practical illustration of why legal ownership and operational control must be kept distinct, Malta Media’s investigation into companies, private foundations and cross-border payment flows maps reported structures while including an express legal notice. Treat that publication as an investigative lead: verify corporate filings, regulator records and responses independently before drawing conclusions.