The Panama Papers consist of 11.5 million documents from Panama-based law firm Mossack Fonseca. The papers apparently implicate a number of high-profile global figures in potentially illegal financial activities. (Deirdra O'Regan/The Washington Post)

People across the world, including world leaders, have been variously scandalized, enraged, and embarrassed by a massive leak of financial data from the Panamanian law firm Mossack Fonseca. Termed the Panama Papers, these data comprise millions of pages of files exposing over 200,000 offshore companies, many or most of which were likely used by their owners to conceal their wealth, or, in some cases, worse. Many are asking how tax havens like Panama and the British Virgin Islands (where over half the companies were formally incorporated) can get away with so much shady dealing, and how we can stop them.

They’re asking the wrong question. Research by Michael Findley, Daniel Nielson and myself suggests that Caribbean-style tax havens are only half the story. If you really want to understand the problem of of secret companies and dirty money, you should be paying at least as much attention to what big states, especially the United States, are doing, and not doing.

I wanted to know how offshore companies and bank accounts worked, so in 2009 I went shopping to see if I could buy my way into the financial system without having to prove who I really was, directly violating international financial transparency rules that require firms to “Know Your Customer.” I approached a mix of 54 firms which, like Mossack Fonseca, advertised that they were willing to form shell companies and set up bank accounts. Some of these firms were in classic tax havens like Panama, the Cayman Islands, and Liechtenstein, while others were located in the United States and other OECD countries.

The result I found was startling. It was much easier to set up a company without having to prove my identity in the United States and other “onshore” countries than in the offshore havens. One firm in Wyoming not only offered to sell me an untraceable shell company and a bank account held in the name of the company, but also suggested I pay for one of their employee’s Social Security numbers to further obscure the trail. In contrast, tax haven-based firms were much more likely to insist that I sent a scanned, authenticated copy of the picture page of my passport before they would do business.

An NPR journalist tried out my scheme again in 2012 by setting up a company in the tax haven of Belize (incorporated under the name Unbelizable), and another in Delaware (incorporated as Delawho?). The result was the same: the Belize firm followed the Know Your Customer rule, but the Delaware firm supplied the shell company no questions asked.

How can it be that the United States is more of a secrecy haven than Panama, the British Virgin Islands, etc.? Michael Findley, Daniel Nielson, and I decided to get to the bottom of this by shopping for shell companies on an industrial scale in a project called Global Shell Games. We impersonated a rogues’ gallery of 21 would-be money launderers, corrupt officials, and terrorist financiers, and sent over 7,000 emails asking firms like Mossack Fonseca to set up prohibited untraceable shell companies to shell in 180 countries.

We wanted to know whether these firms would require us to prove our identity in accord with international rules. This would help us to answer three important questions. First: how well do the global rules banning the formation of untraceable shell companies that hide the identity of the real owner work? Second: do incorporation firms respond differently to more or less risky customers? Third: which countries do a good, bad, or indifferent job of enforcing these Know Your Customer rules? The answers were counter-intuitive – and very worrying.

First, only about half of those firms that replied followed international rules by asking for the proper suite of ID documents from our fictitious ne’er-do-wells. Almost a quarter didn’t ask for any ID at all. Second, incorporation firms were generally just as willing to do business with high-risk customers as those with low-risk profiles, with the partial exception of customers who presented terrorism financing risks. Third –  getting back to Panama, we found that once again, firms in tax havens were actually much more likely to follow international Know Your Customer rules than those in the U.S. and other OECD countries.

Does this mean that Mossack Fonseca and other offshore firms are blameless? Hardly; if they facilitated real misdeeds, they deserve to be punished. But if this leak shows the damage that can be done with 200,000 offshore companies, remember that there are more than 15 million companies incorporated in the U.S. Then consider the advertising pitch of one U.S. incorporation firm: “A corporation is a legal person created by state statute that can be used as a fall guy, a servant, a good friend or a decoy. A person you control… yet cannot be held accountable for its actions. Imagine the possibilities!”

Jason Sharman is a Professor at the Centre for Governance and Public Policy, Griffith University