A shell bank is a bank that has no physical presence in the country in which it is incorporated and licensed, and that is not affiliated with a regulated financial group subject to effective consolidated supervision. It holds a banking licence, usually from a small offshore jurisdiction, but has no real office, staff or management there, and often nowhere else. Because nobody effectively supervises it, a shell bank can be used to move money while hiding who is behind it.
International standards treat shell banks as unacceptable. The FATF recommendations require countries to forbid them and require financial institutions to refuse them as customers. A shell bank should be distinguished from a shell company, which is a legal entity without significant operations but is not a bank and is not in itself unlawful.
Definition
The definition has two parts, and both must be met. The first is the absence of physical presence. The FATF describes physical presence as meaningful mind and management located within the country; a local agent, a registered address or junior staff are not enough. The second is the absence of affiliation with a supervised group. A branch or subsidiary that has no office of its own in a jurisdiction, but belongs to a banking group that is supervised on a consolidated basis, is not a shell bank for these purposes.
United States law uses similar wording. It defines physical presence as a place of business at a fixed address, other than a solely electronic address, where the bank employs at least one person full time, keeps operating records and is subject to inspection by its licensing authority.
Why shell banks are a risk
A bank's value to criminals lies in its access to payment systems. A shell bank that opens an account with a larger bank can send and receive international payments on behalf of customers whom nobody has identified. Since there are no premises to inspect, no local management to question and no records within reach of a regulator, investigators have little to work with. Shell banks featured in several large money laundering and fraud cases in the 1990s, when a number of small jurisdictions sold banking licences with minimal checks, and they were highlighted in a US Senate investigation of correspondent banking published in 2001.
Prohibitions
The rules against shell banks operate at three levels:
- Licensing. Countries should not approve the establishment of shell banks or allow existing ones to continue. The Basel Committee's guidance to banking supervisors makes the same point, and most former licensing centres have withdrawn such licences.
- Direct relationships. Financial institutions must not enter into or continue a correspondent banking relationship with a shell bank. In the United States this is required by section 313 of the USA PATRIOT Act; in the European Union it is set out in the anti-money-laundering directives.
- Indirect access. Institutions must also take reasonable steps to satisfy themselves that their foreign respondent banks do not allow their own accounts to be used by shell banks.
Due diligence in practice
Banks apply these rules through correspondent banking due diligence. Before opening an account for a foreign bank, the correspondent confirms that the respondent is licensed, has a real office and management, and is supervised, by checking the regulator's register, ownership records and, where the risk warrants, by visiting. US banks must obtain a certification from each foreign respondent stating that it is not a shell bank and does not serve shell banks, and must renew it periodically. Industry questionnaires for correspondent relationships ask the same questions.
The indirect route requires most attention. A shell bank may reach the international system through a respondent that offers downstream clearing, an arrangement discussed under nested correspondent banking, or through payable through accounts. Correspondents therefore ask respondents about their own bank customers and monitor payment flows for signs of undisclosed institutions. Relationships with banks in higher-risk jurisdictions are subject to enhanced due diligence.
Not every lightly staffed bank is a shell bank. Offshore subsidiaries of supervised groups, and digital banks whose staff sit in the licensing country, fall outside the definition. Harder cases are institutions that appear to meet the tests on paper while being controlled from elsewhere, and unlicensed entities that merely use the word "bank". Both are treated as high risk. More recently, supervisors have raised similar concerns about crypto-asset businesses with no identifiable home jurisdiction, and several regimes now require such firms to have a real management presence where they are licensed. Concern about hidden exposure of this kind has contributed to de-risking, in which large banks close correspondent accounts for small foreign banks altogether. Effective prudential supervision in the licensing country remains the main safeguard.