The Pandora Papers have confirmed just how little oversight we have over what kind of money comes into the UK, and what’s done with it.

Politicians and campaigners are now calling for further action to tighten the UK’s transparency and anti-money laundering procedures: the truth is that our existing mechanisms are failing.

One important area is knowing who actually owns companies based in the UK. The issue of beneficial ownership, where one person enjoys the benefits of owning an asset, even though it is legally registered to another name, regularly features in stories about money laundering and asset secrecy.

Since 2016, English law has required anyone who owns more than a 25% stake (or controls more than 25% of shareholder votes) in private limited companies and limited liability partnerships to disclose their identity. In 2017, Scottish Limited Partnerships had to start making the same disclosures.

Identifying what the law calls a Person of Significant Control (PSC) is supposed to make ownership more transparent. But if you thought these new laws meant an end to the secret ownership of UK companies, you’ll be disappointed.

Whether it is anonymously-owned Scottish shell companies holding large commercial interests in Uzbekistan, or the use of limited liability partnerships (LLPs) in large-scale money laundering operations, it is clear that the changes to the law have not worked. The Department of Business, Enterprise and Industrial Strategy recently called shell firm abuse “appalling”, and has promised new powers for Companies House, the UK’s business registry.

But thanks to ill-thought-out legislation, and poor enforcement, owners have found a variety of ways to evade the existing rules. Here are four of the most common.

1. Delay

The first mistake was that the people who drafted the 2016 law gave companies a set of ready-made excuses for failing to disclose details of their owners.

For example, the legislation states that a company does not have to disclose its PSC if it “has not yet completed taking reasonable steps to find out if there is anyone who is a registrable person or a registrable relevant legal entity in relation to the company”.

Currently, around 3,000 UK companies and partnerships report that they are yet to identify their PSCs, according to Companies House data. There are no penalties for failing to do so, even if the situation continues for several years.

Problems with identification can be persistent, and companies can go for up to five years without declaring their owners. Long-term identification difficulties currently afflict 700 UK companies and partnerships.

But even when companies report that they have identified their owners, there’s still a provision allowing time for collecting their names, addresses and dates of birth – which again can last for years. Seven hundred UK companies and partnerships currently claim to have a PSC who cannot say who or where they are based. One company has told Companies House that it cannot confirm its owner’s particulars every year since 2016.

That pushes our total in the ‘delay’ category well over the 4,000 mark.

For a register that now records the personal information of owners of 5,000,000 active companies, this sounds like chicken feed. But a single, anonymous British shell company can launder billions of dollars. Seabon Limited, for instance, handled $9bn transferred out of Russia.

2. Deny

Under the current legislation, UK companies can also declare that they do not believe they have an owner, if they have “reasonable cause” to conclude this.

This points to a diabolical problem with the law: if no single person has at least a 25% stake, then there is assumed to be no “person of significant control”.

The 25% threshold sounds reasonable, but in practice, it has the unfortunate effect that any company can claim that it has no PSC. To challenge such a claim, you would need to prove who ultimately owned what size stake in the company, but the details on shareholders collected by Companies House are insufficient.

For example, take a UK limited company without a PSC. It says its shares are held by another company registered in an offshore jurisdiction, such as the Marshall Islands, which allows ownership details to remain secret. The Marshall Islands company does not have to reveal who owns its shares, so there is no basis for challenging the UK company’s claim about whether or not it has a PSC.

This is also true of the law in Scotland. A Scottish limited partnership could have a general partner – again, for instance, a company registered in an offshore jurisdiction – yet it will simply deny that it has a PSC.

Some Scottish limited partnerships go to great lengths to show exactly why they have no PSC. This could include appointing multiple new general partners, which themselves are limited partnerships or companies without any identifiable human owner.

The above are all based on real-life examples. The point of these nonsensical corporate structures is not, of course, to record any kind of commercial relationship between these entities – there is none – but simply to defeat the UK’s disclosure rules. If a company declares it has five general partners, you would naturally assume each had 20% control, a figure below the 25% threshold, therefore removing the need to declare ownership.

Analysis of recent Companies House data indicates that over 250,000 British companies claim to have no PSC. There is no place to challenge them over it.

3. Deflect

Once you have your mystery entity, you can use it to conceal even more.

All you have to do is to declare that it is the PSC of other companies and partnerships – all secretly controlled, and all perfectly legal.

For instance, one limited company, the enigmatic Wallingford Projects Ltd, used to be the PSC of dozens of companies and partnerships. At the time of writing, however, it is registered as the PSC for only one company – and Wallingford Projects itself has been dissolved. The same trick of registering an anonymously-owned company as a PSC also works with limited partnerships and limited liability partnerships, which can also be registered as PSCs for multiple entities.

This is a scalable principle. Several years ago, one network of opaque British companies, interconnected by PSC disclosures and shared addresses, reached over 600 entities at its peak in 2018. After the US Treasury encouraged Baltic regulators to examine reports of large-scale money laundering activity at their banks, most of those 600 entities have since been dissolved.

Around half a million British entities have a PSC that is in fact another corporation. Not many are likely to be part of such baroque structures, however, since there’s a much easier way for companies to avoid declaring a beneficial owner.

Since a PSC has to own more than 25% of a company, or control more than 25% of shareholder votes, companies can avoid having to disclose details by splitting ownership between multiple shareholders who own less than a 25% stake each.

Some company formation agents in the UK advertise precisely this service, offering clients the option to register five nominee shareholders to hold 20% of a company’s shares each, avoiding the need to declare a PSC.

In turn, they will also offer signatures by their nominee directors for bank accounts, filings to Companies House and HMRC, power of attorney documents and trusts. These services are often advertised explicitly for the purpose of avoiding the need to declare ownership.

4. Play dirty

So far, we have dealt with the perfectly legal ways of concealing who controls a UK company. Another tactic is to rely on the UK’s vibrant tradition of non-enforcement.

You could declare as a PSC a company which is not, in theory, allowed to be registered as such. An “ideal” vehicle for this is an English limited partnership, which, unlike its Scottish equivalent, does not have a legal personality of its own. It can’t sign contracts, own property or hold bank accounts, and so cannot officially act as a PSC.

In practice, the lack of enforcement on which kinds of companies can be PSCs (and which cannot) means that you can just ignore the restriction and identify any old corporate entity as your PSC. The UK government has long promised investigatory and verification powers for Companies House, but is yet to provide a timetable.

For instance, a Scottish limited partnership could list its PSC as an English limited partnership, which in turn is controlled by a general partner in an undisclosed offshore jurisdiction. The English limited partnership doesn’t have a PSC, since it isn’t subject to disclosure rules, and so in the end you don’t know who controls the Scottish one, either. Many of the 900 or so entities that use this format have connections to the private equity world.

Irish limited partnerships can also be used in a similar way, despite the fact they do not have a legal personality, and therefore are not eligible. In 2017, two opaquely-owned Scottish limited partnerships were reported to have made a $165m investment in Uzbekistan’s textile industry in a deal that raised “serious red flags” for observers. As it turned out, they had declared Irish limited partnerships as their owners.

Up to 30,000 UK companies, LLPs and SLPs may have chosen companies that are not permitted as beneficial owners. This leaves us a total of 300,000 companies that have made no disclosure, according to Companies House data.

The ease with which the UK’s company registration system can be circumvented represents a resounding defeat for UK law. As pressure mounts for Parliament to finally consider an overseas property transparency register – to catch luxury property in London owned by kleptocrats and gangsters, for instance – it would be wise to bear the current loopholes in mind.

Otherwise, we will see the same workarounds, as well as new ones, being used to avoid declaring Mayfair pads, luxury apartment blocks and 5,000-acre Scottish estates. After years of revelations about how the global elite squirrels away its cash in the UK, that would be very depressing indeed.