certify it as a company in good standing, despite sanctions, until August 2015. More than 500 banks registered nearly 15,600 shell companies with Mossack Fonseca, with HSBC and its affiliates accounting for more than 2,300 of the total. Dexia and J. Safra Sarasin of Luxembourg, Credit Suisse from the Channel Islands and the Swiss UBS each requested at least 500 offshore companies for their clients. An HSBC spokesman said, "The allegations are historical, in some cases dating back 20 years, predating our significant, well-publicized reforms implemented over the last few years." Responses by Mossack Fonseca In response to queries from the Miami Herald and ICIJ, Mossack Fonseca issued a 2,900-word statement listing legal requirements that prevent using offshore companies for tax avoidance and total anonymity, such as FATF protocols which require identifying ultimate beneficial owners of all companies (including offshore companies) before opening any account or transacting any business. The Miami Herald printed the statement with an editor's note that said the statement "did not address any of the specific due diligence failings uncovered by reporters". On Monday, April 4, Mossack Fonseca released another statement: The facts are these: while we may have been the victim of a data breach, nothing we've seen in this illegally obtained cache of documents suggests we've done anything illegal, and that's very much in keeping with the global reputation we've built over the past 40 years of doing business the right way. Co-founder Ramón Fonseca Mora told CNN that the reports were false, full of inaccuracies and that parties "in many of the circumstances" cited by the ICIJ "are not and have never been clients of Mossack Fonseca". The firm provided longer statements to ICIJ. In its official statement April 6, Mossack Fonseca suggested that responsibility for any legal violations might lie with other institutions: approximately 90% of our clientele is professional clients ... who act as intermediaries and are regulated in the jurisdiction of their business. These clients are obliged to perform due diligence on their clients in accordance with the KYC and AML regulations to which they are subject. In an interview with Bloomberg, Jürgen Mossack said: "The cat's out of the bag, so now we have to deal with the aftermath." He said the leak was not an "inside job"—the company had been hacked by servers based abroad. It filed a complaint with the Panamanian attorney general's office. On April 7,