Liechtenstein beneficial ownership register cyberattack: A potential new source of HMRC intelligence

The preliminary investigations indicate that data relates targeted relates to approximately 31,000 legal entities, including companies, foundations and trusts.

What Information Has Been Exposed?

The Register of Beneficial Owners was introduced in 2021 to implement European anti-money laundering requirements. The register records information relating to the individuals who ultimately own or control legal entities established in Liechtenstein.

The stolen data is understood to include personal information such as:

• Names
• Dates of birth
• Nationalities
• Countries of residence
• Beneficial ownership information

While investigations are ongoing, the breach has potentially exposed a substantial amount of information concerning the ownership and control of entities which are incorporated, owned or managed in Lichenstein.

Haven’t we been here before?

Almost. While not a data leak, in 2008 a series of tax investigations across the EU were undertaken where it was identified that trusts/foundations in Liechtenstein were being used to avoid paying taxes. This led to the Liechtenstein Disclosure Facility being opened by HMRC, which offered beneficial terms for disclosure.

Although Liechtenstein has undertaken significant financial reforms over the past two decades, it remains an important international financial centre with a long history of wealth structuring and private asset management.

What Could This Mean for HMRC?

Recent history demonstrates that major data breaches can become valuable sources of intelligence for tax authorities. HMRC has previously utilised information obtained through international information exchange agreements and data leaks, such as the 2021 Panama Papers, to identify taxpayers whose affairs may warrant further review.

It is likely that HMRC will monitor developments arising from this breach closely and should it come to possess the data, use it to identify individuals with undeclared offshore interests or inconsistencies in their UK tax reporting.

Importantly, the mere existence of a Liechtenstein structure does not indicate any wrongdoing. Many such arrangements have been properly disclosed and reported. However, taxpayers with offshore structures should ensure that their UK tax affairs remain fully up to date and pay particular attention to whether all reporting obligations have been met.

The Importance of Proactive Action

For individuals who may have concerns regarding historic offshore reporting, early engagement is always preferable to waiting for contact from HMRC.

Where a taxpayer identifies an inaccuracy before HMRC opens an enquiry, a disclosure will generally be treated as “unprompted”. This can have a significant impact on the level of penalties charged by HMRC, while it clearly earmarks a willingness to engage with bringing the position up to date.

It is worth noting that the Liechtenstein Disclosure Facility which provided favourable terms for settling certain offshore liabilities, closed on 31 December 2015. Taxpayers can therefore no longer rely upon that regime to regularise historic issues, however, other disclosure facilities, such as the Worldwide Disclosure Facility and the Contractual Disclosure Facility remain available to taxpayers.

As investigations into the cyberattack continue, further details regarding the compromised data and any subsequent dissemination may emerge. For taxpayers with interests in Liechtenstein companies, foundations or trusts, now may be an appropriate time to review existing structures and confirm that all UK tax reporting obligations have been satisfied.