Shell company red flags: how to check and weigh each one

The usual shell company red flags are a registered address shared with hundreds of other companies, directors who sit on dozens of boards, a filing history with no sign of trading, a website or phone number much younger than the business claims to be, ownership that runs through other companies without reaching a person, and no trace of staff, premises or customers. Each one has ordinary explanations, because formation agents, virtual offices, holding companies and special purpose vehicles are a normal part of business. To identify a shell company, check each flag against a primary source, work out what it is evidence of, and give weight to the flags that agree with each other and contradict what the company says about itself.

This piece takes the flags one at a time, with one invented counterparty throughout. Our guide to KYB verification covers the wider onboarding process. This one is about reading the signals.

The 2018 FATF and Egmont Group report on concealing beneficial ownership gives working definitions. A shell company is an "incorporated company with no independent operations, significant assets, ongoing business activities, or employees". A front company is a "fully functioning company with the characteristics of a legitimate business, serving to disguise and obscure illicit financial activity". A shelf company is registered and left dormant, often to be sold later.

Companies with no operations of their own are common in ordinary business. The Puppet Masters, a 2011 study by the World Bank and UNODC's Stolen Asset Recovery Initiative, lists mergers, joint ventures, separating liabilities and holding personal or family assets among their legitimate uses. It also found companies used to hide the proceeds of corruption in 128 of the 150 grand corruption cases it reviewed, and in more than half of the cases involving a company, the company was a shell. The FATF and Egmont report calls shell companies the most common type of legal person in schemes to obscure beneficial ownership, and more than half of its 106 case studies specifically referred to them.

So the useful question is whether the company's shape fits what it says it does. A holding company with no staff is normal. A wholesaler claiming seven years of trading, with no staff, no premises and a website registered last spring, needs a closer look.

These strengths are a starting point. A flag contradicting something the company told you counts for more than one that merely looks unusual, and two flags that come from the same fact count once.

The worked case is invented. In September 2026, Ferrowdale Trading Ltd, a UK private company, applies to a payments company to take card payments as a wholesale distributor of consumer electronics. It says it has traded since 2019 and expects about £350,000 a month in card payments. Its website is ferrowdale.example. The registry shows it as active.

Formation agents, accountants and virtual office providers lend their address to clients. The UK's Office for National Statistics notes that a formation agent "can register thousands of businesses at a single address", and the UK government's guidance on setting up a company suggests an accountant's or solicitor's address, or an agent who provides one, to anyone who does not want their home on the public register. In the FATF and Egmont report, the UK said that in practice about 75 percent of its companies are formed by gatekeepers, the professionals who set companies up for others.

The same report explains why the address still matters. Companies managed by a service provider "will often share the same bulk address", and large numbers of shell companies "will be registered to the same address and telephone number".

To check, search the address in the registry. Companies House's advanced search takes a full or partial registered office address and filters by incorporation date, which shows whether companies there were formed in batches.

A crowded address tells you an agent is involved. It does not tell you which of the agent's companies is the problem. It becomes evidence when the companies there share officers, phone numbers and formation dates with yours.

Ferrowdale's registered office is a formation agent's address in London, shared with about 2,300 active companies. On its own, that is context.

A nominee director appears on a company's records while someone else directs it. The OECD's 2001 report Behind the Corporate Veil describes nominees who "appear as a director on all company documents and in official registries" while the beneficial owner does the directing. Just under half of the FATF and Egmont case studies involved formal nominees, and the report's indicators note that some are "mass" nominees for large numbers of companies.

An appointment count is the quick check. Companies House shows a total number of appointments on each officer's page, and its public data API returns the same figure. The register also shows a director's month and year of birth, which helps separate two people with one name.

The count can understate. Companies House explained in a 2019 reply on its blog that it matches appointments on name, date of birth and residential address, and generally creates a separate record where the details differ significantly. Search the name as well as the record.

Then read the list. A family's property companies, a group's subsidiaries or an accountant's clients are ordinary. A run of short-lived companies formed at one address and dissolved within a year or two is a pattern.

The FATF and Egmont report adds two cautions. Shared nominees can create "false links between companies", so two companies with the same professional director may have nothing else in common. And scale says little about any one company: in a New Zealand case, one provider supplied nominee directors for over 1,000 companies, and the authorities suspected at least 73 of them of facilitating crimes abroad.

Ferrowdale's first director, appointed in 2019, holds about 640 appointments at the agent's address and resigned in June 2026, which fits a company formed for sale. The director appointed in June 2026 holds 23. Nineteen began in the last eighteen months, all at the same address, and eleven of those companies have been dissolved without filing accounts that show any trading. That list is worth keeping.

Read the filing history in date order. Dormant accounts say the company was not trading. The UK government says a company may be dormant if it is "not doing business ('trading')" and has no other income, and Companies House's list of activity codes includes 99999, "Dormant Company", and 74990, "Non-trading company".

A new name, new officers and a new activity code shortly before a company approaches you can mean a change of control. The FATF and Egmont indicators include "the resignation and replacement of directors or key shareholders shortly after incorporation". That is also the shape of a shelf company sale, after which, the report notes, a new owner can use the company's history "to help secure business relationships or lines of credit".

None of this is wrong in itself. Buying a ready-made company is an ordinary shortcut, and plenty of companies sit dormant before they trade. What matters is whether the filings agree with the story.

Ferrowdale was incorporated in March 2019 under another name and filed dormant accounts every year to 2025. In June 2026, three months before applying, it changed its name, its director and its activity code. The application says it has traded since 2019, and the filings say it has not, at least not through this company. That is the strongest finding so far, and it is a question the applicant can answer.

An operating business leaves traces that other people created. The Puppet Masters notes that a company engaged in business "will typically market itself, join a chamber of commerce, build a website", and "will have employees". The FATF and Egmont report lists the reverse among shell indicators: only a post-box address, a lack of personnel, and no taxes or social benefits paid.

Date the footprint as well as finding it.

• A domain's RDAP record usually carries a registration event, which the IANA registry of RDAP values defines as when "the object instance was initially registered". A re-registration event, where the registry records one, marks a domain registered again later, possibly by someone new.
• Certificate Transparency logs publicly record TLS certificates as they are issued, so a domain's first certificate gives a second date for roughly when the site went live.
• The Wayback Machine lists the dates on which it captured a URL.
• Search the phone number and email address. A number on several companies' websites links them; our guide to investigating a phone number covers dating one.
• Look for staff whose profiles predate the application, reviews built up over years, suppliers and job ads.

Front companies need the opposite reading. They have a footprint by design, so finding one settles nothing. What can give a front away is the FATF and Egmont indicator of "financial activities and transactions inconsistent with the corporate profile", which is often clearer in your own transaction data after onboarding.

ferrowdale.example was registered in May 2026, its first certificate was logged that month, and its first archive capture is from July. The warehouse address on the site is the agent's. No staff profiles mention the company, and there are no reviews or trade listings. The site's phone number also appears on the websites of two other companies where the new director sits, and it is not the number the agent publishes for itself. The footprint is about four months old, for a business claiming seven years.

The OECD found that the corporate vehicles misused most often are those that give their beneficial owners the greatest anonymity. Follow the chain until it reaches a natural person or a documented dead end, and note each border it crosses.

Where there is a register, start there. The UK lists people with significant control, usually anyone with more than 25 percent of the shares or voting rights, or who can appoint or remove a majority of the directors or otherwise influence or control the company. For a foreign parent, check its own registry. The ICIJ's Offshore Leaks database, covering more than 810,000 offshore entities, is worth a search, with the ICIJ's own caution that there are legitimate uses for offshore companies and trusts and that many people and entities share names.

Jurisdiction alone is a weak signal. In the Global Shell Games field experiment, reported in 2012, researchers posing as customers sent more than 7,400 requests to more than 3,700 company formation providers in 182 countries. Nearly half of the replies (48 percent) did not ask for proper identification, and providers in tax havens were significantly more likely to ask than those in OECD countries such as the United States and Britain.

Ferrowdale's register names the new director as holding 75 percent or more of the shares. The chain ends at a person straight away, so there is no layering flag. The register cannot say whether that person controls the company or lent it their name.

Two findings held up, each on independent sources.

• The trading history. Seven years claimed, against dormant accounts every year to 2025 and a domain, certificate and archive record that all start in 2026. The registry and the web are separate sources that agree.
• The new director's companies. A run of short-lived companies at the same address, and two of the director's current companies whose websites show the same phone number as Ferrowdale's. The appointments come from the registry and the phone match from the companies' websites, so this is two links.

Two flags were context: the crowded address, explained by the agent, and the first director's 640 appointments, explained by a company formed for sale. A search for adverse media on the company and both directors found nothing; our guide to adverse media screening covers resolving a hit.

Three things stay open: who controls Ferrowdale, where its stock is held, and where £350,000 a month would come from. That gives the analyst three requests: evidence of trading before June 2026, such as invoices or bank statements; who bought the company and why; and where the goods are stored. An honest business can answer all three, perhaps by explaining that it bought an aged company and overstated its history. The file records each flag, its source and the reason for its weight, so the decision can be checked later.

Most red flags describe normal business shapes, so a fair review checks the ordinary explanation first.

• A crowded address is a formation agent's or virtual office's normal output.
• Holding companies, special purpose vehicles and group subsidiaries have no staff by design. Judge them by whether the structure fits the group around them.
• New and small businesses are thin. Ask them for different evidence: contracts, a lease, the founders' own histories.
• What a central registry captures varies from jurisdiction to jurisdiction, and a thin result from a thin register says more about the register than the company.
• A register records what was filed. A name and a month and year of birth can separate two people, but they do not show that the person named is the one in control.

And flags that share a source count once. A long appointment list and a crowded address are often the same fact seen twice, because one agent supplied both.

In a busy queue, the check that gets skipped is often the one that would have contradicted the story. Sixtyfour's agent starts from what the application contains, such as a company name, a director or a website, and researches public sources such as registry filings and the business's web footprint. It links findings to the right company and people, returns every finding with its source, and reports what it could not establish as open rather than filling it in. The results go to your team, and a person decides. There is more on how financial crime teams use it on our financial institutions page.

Treat each shell company red flag as a question with a primary source behind it: count the companies at the address, read each director's appointment list, read the filing history against the story, date the footprint, and follow the ownership to a person. Give weight to independent flags that contradict what the company told you, record the ordinary explanation for the rest, and mark what you could not establish as open.