| SERIES | Methods · Block 07 · Corporate, financial & legal |
| TOOLS | ICIJ Offshore Leaks · OpenCorporates · Aleph · Companies House |
| LEVEL | Intermediate · about 60 minutes of practice |
| LAST TESTED | 26 October 2026 |
| BEFORE THIS | Tracking aircraft in sanctions investigations |
Independent investigative journalist, OSINT practitioner and digital forensics educator; chapter author in Eyewitness Textures (MQUP, 2024).
THE CASE
The leaks contain what registries will not tell you
The ICIJ Offshore Leaks database brings together records from the Offshore Leaks, Panama Papers, Bahamas Leaks, Paradise Papers and Pandora Papers investigations: more than 810,000 offshore companies, foundations and trusts. Many of them appear in no public registry, because they were designed not to. Used well, it is one of the strongest cross-reference tools available for financial crime, sanctions evasion and corruption work.
Its limits matter as much as its reach. Each dataset is a snapshot of the records at the time of the leak, and the newest records date from 2020. Entities may since have been dissolved, restructured or re-registered, and officers may have resigned or died. A name missing from the database is not evidence of clean hands; it only means the person does not appear in these particular leaked files.
This tutorial covers what each dataset holds, how to search it well, how to check findings against current registries, and how to use the results without overstating what they prove.
IN THE FIELD
In October 2021, ICIJ and more than 600 journalists from about 150 media partners, including AP and OCCRP, published the Pandora Papers: 11.9 million records from 14 offshore service providers. Reporters identified offshore holdings linked to 35 current and former world leaders.
Entity and officer records: Reporters traced companies and trusts to named people through officer, shareholder and beneficiary records that no public registry held.
Public declarations: Teams compared those records with what officials had disclosed in their home countries, looking for holdings that had not been declared.
Now open to you: ICIJ later added entity data from ten of the 14 providers to the Offshore Leaks database, so the same kind of record can be searched by anyone.
ICIJ and partners · Pandora Papers · October 2021
Learning outcomes
By the end of this tutorial you will be able to:
| • | Identify which ICIJ datasets cover a given jurisdiction or time period, and their limits |
| • | Search the database by name, jurisdiction and entity type |
| • | Interpret entity, officer and intermediary records and what each one proves |
| • | Check ICIJ findings against current registries to establish present-day status |
| • | Grade offshore leaks findings correctly under LST-001 |
The rest of this tutorial is for Signal subscribers.
What remains: the decision framework, the tool configuration, the failure modes, and the evidentiary standard required to use the finding defensibly.
Join SignalA Signal subscription gives you:
- Full OSINT Reference Card library, 21 domains
- Methods, every tradecraft tutorial in full
- AI in OSINT, every tutorial and field report
- OSINT Hub community access