Shell company red flags in business onboarding: 12 patterns with real cases

A shell company has little or no operating business of its own. Many are legitimate: holding companies, special-purpose vehicles, a startup's first month. The onboarding risk is an entity used to borrow an identity, hide who controls the money, or give unrelated payments a plausible label.

Below are twelve patterns a KYB analyst sees in an application file, each with the check to run, what it can and cannot establish, and a public case from a court filing or enforcement release. "Alleged" and "charged" reflect the record's status, not a finding of guilt.

A red flag is a reason to ask, not proof of wrongdoing. Most applicants who trip one have an ordinary explanation; the job is to get it in evidence. For the full process, see How to verify a business for KYB.

The 12 patterns at a glance

1. Claims run far ahead of evidence

In the file: named partners, marquee customers and revenue figures backed only by a deck and press coverage.

The check: pick the two or three claims the business model depends on and ask for evidence that only the counterparty could produce: a contract, an invoice paid by that customer, bank statements showing the revenue.

The limit: a contract proves an agreement, not delivery. Press coverage proves a claim was published.

The case: the SEC charged in 2018 that Theranos claimed its products were deployed by the U.S. Department of Defense and that it would generate more than $100 million in 2014 revenue. According to the complaint, it was never deployed by the Department of Defense and generated a little more than $100,000 in operating revenue that year. In 2022 a federal jury convicted Elizabeth Holmes of conspiracy and three counts of fraud on investors. See the Fraud Files episode.

2. An investment vehicle that sells access, not operations

In the file: a new investment company whose product is access: exclusive deals, stakes in famous assets.

The check: ask what the entity itself owns or has signed, and confirm the named deals with those counterparties through contact details you find yourself.

The limit: a formation certificate proves the LLC exists. It says nothing about the deals it claims to reach.

The case: according to the U.S. Attorney's Office for the Southern District of Florida, Anthony Gignac and a co-conspirator formed a fraudulent investment company, Marden Williams International LLC, and used it to claim access to ventures including a casino in Malta and a stake in Saudi Aramco. He pleaded guilty to wire fraud, aggravated identity theft and impersonating a foreign official, and was sentenced in May 2019 to 224 months. See the Fraud Files episode.

3. Claimed identity or status contradicted by official records

In the file: a principal described by status (diplomat, royal, adviser) with letters that appear to come from officials.

The check: screen the principal under every name used, run adverse media, and verify any official letter with the issuing body through a channel you locate independently.

The limit: a zero-match screen is an observation about the lists searched, not a clearance. Aliases defeat screens run only on the name the applicant supplied.

The case: the same release records that Gignac bought fake diplomatic license plates, forged documents from high-ranking Saudi officials to support his claimed status, used five recorded aliases, and had been arrested or convicted eleven times since 1988 for prince-related schemes.

4. Documents that exist, but whose provenance fails

In the file: an official-looking certificate, deed or registry extract, sometimes one the applicant says you can find in a public archive.

The check: pull the record yourself from the issuing registry and compare it field by field with the copy supplied. Check that dates, formats and issuers are consistent with when the document claims to have been made. See what a certificate of good standing proves.

The limit: a record found in an archive can still have been placed there. Provenance is the chain from issuer to you.

The case: the University of New Mexico's archive of the James Addison Reavis court papers records that Reavis forged documents in archives in Guadalajara and Madrid to support the fictitious Peralta land grant. Investigators found the paper was too young to be authentic and that a metal pen had been used. The Court of Private Land Claims exposed the claim and Reavis was found guilty of fraud in 1896. See the Fraud Files episode.

5. A name that borrows a known institution's identity

In the file: an entity whose name closely matches a well-known company, fund or bank, but registered in a different jurisdiction from that institution.

The check: confirm the relationship from the known institution's side (its filings, subsidiary list, or direct confirmation) and compare jurisdictions and registration numbers.

The limit: as that complaint notes, an entity can register a mimicking name "without the need to prove any relationship".

The case: in the 1MDB civil forfeiture complaint, the Justice Department alleged that Aabar Investments PJS Limited, a British Virgin Islands entity incorporated on March 14, 2012, received about $1.367 billion of bond proceeds and had no genuine affiliation with the Abu Dhabi company it was named after. The complaint also alleges that an account renamed from Foreign FX Trading Limited to Blackstone Asia Real Estate Partners received $636 million from Aabar-BVI.

6. Owners who never appear on the paperwork

In the file: ownership that stops at a foundation, trust or corporate holder in a jurisdiction with no public ownership register.

The check: trace every layer to natural persons at your threshold (often 25%) and identify who controls the entity even if nobody owns that much. Ask for the documents that establish each layer, not a chart. See ultimate beneficial owner.

The limit: an ownership declaration records what the applicant asserts. A registry without ownership data cannot confirm it.

The case: a 2018 indictment unsealed in the Southern District of New York alleged that people linked to Mossack Fonseca created sham foundations that "owned" shell companies in Panama, Hong Kong and the British Virgin Islands, and that clients' names generally did not appear anywhere on the incorporation paperwork although they beneficially owned the assets.

7. Puppet officers and straw shareholders

In the file: officers with no background in the business, officer changes just before the application, or a ready-made company acquired with its history. See nominee director and shelf company vs shell company.

The check: research each officer, date the officer changes, and ask who actually signs contracts.

The limit: the registry records who was filed as an officer. It does not show on whose instructions they act.

The case: in 2016 the SEC alleged that two men created nine shell companies and sold seven. According to the SEC, an acquaintance was recruited as a "puppet CEO" who signed on instruction, shares went to recruited "straw shareholders", and some recorded shareholders were not real people.

8. A counterparty with no real premises or trade

In the file: a key supplier or customer that receives or sends large sums but has no findable premises, staff or trading footprint.

The check: verify the counterparty as you would the applicant, and look for its trade anywhere outside the applicant's own documents.

The limit: an address proves a place exists. It does not prove the business trades from it.

The case: according to the FBI, evidence at Tom Petters's trial showed that an associate created a sham company, Enchanted Family Buying Co., opened a business bank account, and passed Petters's funds through it and back, less a commission. The company did no real business, and its headquarters was above the associate's car wash. A jury convicted Petters in 2009 of wire fraud, mail fraud and money laundering.

9. Money that goes out as "investment" and comes back

In the file: large inbound funds described as investment from private families or funds, and outbound payments to related parties described as investments too.

The check: ask for source-of-funds evidence from the investor side, and map where outbound payments go. Funds that return to the same people under a new label are the pattern.

The limit: subscription documents record what the parties called the transaction. They do not show where the money came from.

The case: Mark Scott, a former law firm partner, was convicted at trial in 2019 and sentenced in 2024 to 10 years. According to the Justice Department, he disguised about $400 million of OneCoin proceeds as investments from "wealthy European families" into fake British Virgin Islands funds, layered it through the Cayman Islands and Ireland, and sent it back as outbound investments.

10. Stated merchandise that doesn't match the payments

In the file: a merchant whose website sells ordinary goods, while ticket sizes, volumes, customer geography or refund patterns look like a different business.

The check: compare the site with expected volume and average ticket, and test-purchase if your policy allows.

The limit: a working website proves a website. It does not prove the payments come from its customers. See transaction laundering.

The case: the 2011 indictment of the founders of PokerStars, Full Tilt Poker and Absolute Poker alleged that money from U.S. gamblers was disguised as payments to hundreds of non-existent online merchants purporting to sell jewelry and golf balls.

11. Assurance from a professional who did not do the work

In the file: audited statements, legal opinions or comfort letters that carry the application's credibility, issued by a firm you know nothing about.

The check: verify the firm's license and, for auditors, peer review or registration status. Confirm that the firm issued the document.

The limit: a signature and letterhead prove someone signed. They do not prove an audit took place.

The case: the SEC charged in 2009 that David Friehling and his firm purported to audit Bernard L. Madoff Investment Securities from 1991 to 2008 without performing a meaningful audit or confirming that customer securities existed. The SEC also alleged he told the AICPA he did no audit work, to avoid peer review. See the Fraud Files episode.

12. Account access and usage that don't fit the entity

In the file: after onboarding, many debit cards for a small company, online access by outsiders, or cash withdrawn abroad.

The check: reconcile early activity against the purpose recorded at onboarding. This is where KYB review meets fraud alert review.

The limit: onboarding evidence cannot predict use, so the first months of activity are part of the check.

The case: in 2023 the U.S. Attorney for New Jersey charged a bank employee with opening accounts in the names of shell companies with nominee owners, handing online access and dozens of debit cards to those who paid him, and cards later used for ATM cash withdrawals in Colombia.

Reading the flags together

A new company, a registered-agent address and a thin website describe many honest startups. What changes the decision is flags that reinforce each other and don't resolve when you ask. Record each signal with its source and its limit, so the decision-maker sees what was established and what was not.

Where Sweat AI fits

Sweat AI is an AI-native BPO for banks and fintechs, starting with back-office workflows like KYB, onboarding and fraud reviews. Our analysts work your queue around the clock, including the applications that show these patterns, and return each with its evidence, the limits of that evidence, one list of what remains to ask, and a recommendation. Your team makes the decision. See a sample KYB review, or business investigations for a single deep case.