Shell Company Red Flags: How to Spot One Before a Deal

Vetting a counterparty and recognising a shell company are different jobs, and they get confused constantly. The first answers "what should I do before signing" — I covered that in the counterparty due diligence checklist. The second answers the question that arrives afterwards, when the deal has closed and a tax notice lands: "what was that, and what happens to me now?"

This article is about the second. The framing is defensive: see the risk before it becomes your loss, and understand the price of the mistake before someone else calculates it for you.

What a shell company actually is#

A shell company is an entity registered without the intent to conduct genuine business activity. Its job is to generate paperwork where no economic operation took place. From there the schemes diverge: claim a tax deduction nobody earned, move money out, or take a prepayment and vanish.

Two things matter for you as the buyer. First, all three scenarios hurt differently but equally. Second — and this is where most guidance goes wrong — the entity does not have to be short-lived.

"Shell" versus "technical" company#

The distinction is not cosmetic, and it explains why so much published advice is conceptually out of date.

"Shell" is everyday language about how long a company survives. Tax authorities and courts increasingly use a different concept: a technical company — an entity that conducts no real activity and lacks the resources to perform the specific transaction in question. In Russian practice this term comes from the Federal Tax Service guidance letter of 10 March 2021 no. БВ-4-7/3060@, which reframed the whole area. It rests on art. 54.1 of the Russian Tax Code — the provision that lets the authority strip a deduction when the obligation was performed by someone other than your counterparty.

The practical consequence: a company can be ten years old, file clean accounts and produce a spotless registry extract — and still be technical with respect to your contract, because it had no staff, no equipment and no licence to perform it. Screening for "shells" by age never catches that case. That is the case people actually get caught by.

Why this got sharper in 2026#

For anyone dealing with Russian counterparties, two changes this year altered the economics, and they are rarely connected in public commentary.

From 1 January 2026 the headline VAT rate rose from 20% to 22% under Federal Law of 28.11.2025 no. 425-ФЗ, and the income threshold for VAT exemption under the simplified regime dropped sharply — to RUB 20 million a year. No transitional relief was provided for the old rate.

Two consequences follow. Far more entities are now inside the VAT perimeter — including small businesses with no tax function and no habit of vetting suppliers. And every rouble of fictitious deduction became more valuable, so the incentive to buy "paper VAT" rose mechanically with the rate.

To be honest about causation: I cannot claim the number of technical companies has objectively grown — no published data supports that. The incentive grew. That is a different statement, and the difference matters.

The second change is judicial, and it removed the main safety net for anyone already exposed — see the reconstruction section below.

Red flags that mean nothing on their own#

This is where I part company with the standard treatment of the topic. Almost every published guide gives a flat list of indicators with no weighting. The reader gets a scorecard — and then makes two equally expensive mistakes: refusing perfectly good suppliers, and waving through an actual scheme because it scores clean.

Indicators fall into three classes.

Class A — meaningless in isolation#

None of these works alone. What matters is mismatch of scale: an entity incorporated two months ago proposing an RUB 80 million contract on deferred payment terms is a signal. The same entity quoting for a small one-off order is just a new supplier.

Class B — meaningful only in combination#

Two or more at once means dig, not decline:

• nil or minimal filings against claimed turnover;
• no personnel for a labour-intensive contract;
• pass-through pattern on the bank account;
• change of director shortly before the deal;
• no digital footprint at all — no site, no job ads, no mentions — despite claimed years of experience.

The last one is the most underrated. A company that has genuinely been building things for a decade leaves traces: tender records, reviews, hiring ads, site photographs. How to read those traces, and where to look for domain history and infrastructure, I covered separately in the piece on the digital footprint of a company.

Class C — disqualifying#

One is enough to end the conversation:

• a registry entry flagging the company's details as unreliable;
• a disqualified director;
• a high-risk marker from the central bank's risk platform (for Russian counterparties — see below);
• the entity already in a strike-off procedure;
• the director denying any involvement when contacted.

Where you can actually check#

For Russian counterparties there is one genuinely new free source, and it is barely described anywhere.

Since 1 October 2024 the Bank of Russia has opened public access to counterparty risk checks on its Know Your Customer platform — cbr.ru/counteraction_m_ter/platform_zsk/. Enter a tax number (INN); the answer takes a couple of minutes and the data refreshes daily. The regulator sorts entities into three groups by risk of involvement in suspicious operations — green, amber and red.

Now the ceiling, without which the tool is dangerous.

It answers one binary question — whether the entity falls into the high-risk group. The regulator's own wording in the launch announcement is about obtaining reference information on membership of the high-risk group. So "clean" here does not mean "green": it means "not red". The green and amber statuses stay inside the closed perimeter of the platform, available to banks rather than to you.

Second limit — subject matter. The platform is about money laundering, not tax. An entity can be green there and technical for tax purposes at the same time. Different coordinate systems.

Third — the bank decides, not the platform. The published level is for reference.

Use it as a fast disqualifying filter at the start of a check, never as absolution at the end. Red means the conversation is over. Not red means the check has just begun.

How a shell company is built#

The cycle is predictable: incorporation, fictitious contracts, funds moved, then the entity is abandoned or struck off. Typical lifespan runs to one or two years, often less.

Directors and shareholders are nominees — in the language of arts. 173.1 and 173.2 of the Russian Criminal Code, people whose details were entered into the register through deception or without their knowledge at all. This is not abstract: in Russia nominee directors receive genuine custodial sentences rather than suspended ones, and Federal Law of 24.06.2025 no. 176-ФЗ tightened liability for intermediaries in financial schemes further.

Which yields a practical filter that costs nothing: the director of a shell is usually someone who was used themselves. So insist on speaking to the principal rather than a "project manager", and listen for whether they can discuss the substance of the contract. A nominee cannot talk through methodology, lead times or subcontracting, because they do not know any of it.

The real cost of getting it wrong#

"You'll lose the deduction and pay a penalty" is true and useless for making a decision. The consequences arrive as a cascade, and the last layer lands personally.

Layer 1 — tax. Denial of the VAT deduction and of the expense for profit-tax purposes under art. 54.1 where the contractual obligation was performed by someone other than the counterparty. Plus interest. Plus a penalty under art. 122 of the Tax Code — 20% for negligence, 40% where intent is established. "Intent" here is not about wanting to evade: it is established through the "knew or should have known" test — that is, through failure to exercise commercial care.

Layer 2 — the money in the deal itself. The prepayment is gone, nothing was delivered, and there is no one to sue: a technical company has no assets and will be struck off within months. Where the size and structure of the deal justify it, this is solved not by vetting but by escrow — the money does not move until performance does.

Layer 3 — personal exposure of the director. A separate subject, but in short: courts increasingly hold that a director is obliged to build a counterparty vetting system, and recover losses personally where none existed.

Layer 4 — the criminal threshold. In Russia, criminal liability for corporate tax evasion begins above RUB 18,750,000 of unpaid tax across three consecutive financial years, with an aggravated tier above RUB 56,250,000. Full payment of the arrears, interest and penalty by a first-time offender is grounds for release from liability.

Here is the single most useful thing to take away. Risk is measured not against one transaction but against total deductions across three years with that counterparty. A RUB 5 million contract repeated fifteen times over three years is already past the criminal threshold, even though every individual deal looked immaterial. That is exactly how "the small reliable supplier we've used for years" turns into a criminal file.

Why tax reconstruction no longer saves you#

Until recently there was a safety net: even if the supplier turned out to be technical, the real costs could still be recognised by reference to the actual performer. That mechanism is called tax reconstruction.

By its ruling of 31 March 2026 no. 307-ЭС25-11805 in case no. А56-83561/2023, the Supreme Court closed that door for anyone who built the structure themselves. Tellingly, all three lower instances had sided with the taxpayer and allowed the costs documented by technical contractors — the Supreme Court overturned them.

The reasoning runs like this: funds transferred to technical organisations and to other persons operating outside lawful commercial circulation are not expenses necessary for carrying on business at all. And if they are not expenses, there is nothing for the calculation method to reconstruct.

What changes in practice: the right to recognise real costs now survives only for those who disclose the actual performer themselves, during the audit or in objections to the audit report. Staying silent and hoping for reconstruction is no longer a strategy.

When the notice arrives#

This is the moment people start searching in earnest. The sequence is predictable, and every step has a fork.

How they found you. The mismatch between your purchase ledger and your supplier's sales ledger surfaces automatically when invoices are reconciled: a deduction was claimed, but the corresponding tax was never paid into the budget. That is what a "gap" means. In Russian case law and professional usage the reconciliation engine is called ASK NDS-2; whatever it is called inside the tax service today is beside the point — what matters is that reconciliation runs across the board and without an inspector's involvement.

First contact — a request for documents or explanations. In Russia the deadline turns on which paragraph of art. 93.1 of the Tax Code the request came under, and confusing them is expensive: five working days under paragraph 1 (documents about your counterparty within an audit of that counterparty), ten working days under paragraph 2 (information on a specific transaction outside an audit). Silence is the worst option: it is penalised in itself and reads as confirmation.

The argument worth knowing in advance. A gap by itself is not proof of an offence. A discrepancy between filings is not in itself a hallmark of a tax offence, and a gap alone is not a ground for liability. Be honest about the state of play, though: appellate practice is split. Some courts treat a ledger mismatch as sufficient to deny the deduction; others expressly do not. You cannot count on an automatic win — but there is no reason to surrender at the first notice either.

Second contact — the invitation to "amend voluntarily". The inspectorate proposes that you file an amended return and pay the VAT attributable to the gap. The fork is genuine and both sides have a price. Agreeing is fast and avoids a dispute, but it is a de facto admission and no guarantee they will not return. Refusing preserves your position but raises the odds of a field audit. This decision belongs to the owner, not to the finance team: it is a choice between money now and risk later.

A separate scenario is a gap further down the chain, not at your own supplier. There is no statutory liability for third parties — the rule speaks of performance by the party to the contract, not by the whole supply chain. Yet claims over "complex gaps", where the immediate supplier is formally clean, are made routinely, and the outcome turns on whether the authority can establish that you knew and that the chain was under your control. This is not the category of dispute in which to economise on a tax lawyer.

What belongs in the file, and what does not work#

The standard is commercial care — the standard of reasonable counterparty selection applied in ordinary commercial dealings. The logic is straightforward: if you exercised that care and neither knew nor should have known that the supplier was technical, there is no offence.

The standard is graduated: the depth of vetting must match the size and significance of the deal. A routine stationery order and a nine-figure construction contract are not vetted the same way, and demanding identical files for both is an error in both directions. What this looks like on large transactions I covered in the piece on due diligence before a deal.

What demonstrably does not work: the constitutional documents pack on its own. Articles of association, a registry extract and a director's appointment order do not evidence care — that is the position of the Presidium of the Supreme Commercial Court in case no. 15658/09, not one commentator's view.

What does work is evidence of actual performance, gathered while everything was still fine:

• transport documents, delivery notes, site access passes;
• dated commercial correspondence, including negotiation over price and deadlines;
• named individuals on the counterparty's side, not just corporate details;
• photographs and stage-completion certificates;
• witnesses on both sides who can still be found in three years.

That last point is the real difficulty. A field audit arrives years later, when the staff have left and the messenger history went with someone's phone. The file is assembled at the time of the deal or it is never assembled at all.

Shifting the loss onto the counterparty#

What follows decides the outcome, and you will not find it in the published guidance on shell companies. That guidance ends at "vet your counterparty". But vetting reduces probability; it does not remove consequences. The contract does.

Two constructions do the work, and choosing between them decides the dispute.

Warranties as to circumstances — art. 431.2 of the Russian Civil Code. The counterparty warrants that it carries on real activity, records operations in its filings and pays its taxes. Recovery requires establishing the elements of a civil wrong — you will have to prove the warranty was untrue.

Indemnity for losses — art. 406.1. The parties agree directly that if you suffer losses because the supplier failed to remedy indicators that no source for the deduction was formed, the supplier compensates them. Recovery is not conditional on establishing a wrong and operates independently of breach. In practice this is the sturdier route: no need to prove fault.

The drafting must be express and unambiguous. A general sentence about complying with tax law does nothing at all. The Russian tax authority has published a model clause built around the supplier's failure to remedy identified indicators that no source for the VAT deduction was formed — that is the construction to work from.

And the mechanism without which the clause is dead. For you to learn about the gap at all and to make a claim, the supplier must file a consent to disclosure of tax secrecy — in Russia, the form in Annex 4 to the tax service order of 14.11.2022 no. ЕД-7-19/1085@, submitted through the taxpayer's personal account or an EDI operator. Without that consent, information about an unformed source along the chain cannot be disclosed, and your clause stays an elegant paragraph with no way to trigger it.

There is also a free integrity test built into the procedure itself: a real company signs the clause and files the consent without drama. A technical one starts explaining why this is unnecessary bureaucracy. It is the cheapest filter I know, and it runs before the money moves.

The case law favours buyers, but not automatically. In Russia the tax service itself recommends the clause as the way to pass an assessment back to the counterparty at fault, and courts do grant such claims: in the Moscow District Commercial Court ruling of 06.03.2024 no. Ф05-785/2024 the buyer succeeded precisely because the clause was drafted in detail rather than in a single line. The other side is worth knowing in advance: where the wording is vague, or the supplier's fault is not obvious, recovery is refused. The split in approach dates back to 2017 and is still unresolved, so drafting quality decides more here than the mere presence of a clause.

FAQ#

Is a young company with minimum share capital a shell company?#

No. Minimum share capital is a lawful statutory floor and most genuine small businesses have exactly that; every new business is under a year old at some point. What matters is the mismatch between the company's profile and the subject and size of the deal — two months of existence against a nine-figure contract on deferred terms is a signal; the same two months against a small one-off order is ordinary.

How can I check a counterparty for risk without paying?#

For Russian counterparties, the fastest disqualifying filter is the Bank of Russia Know Your Customer platform, publicly accessible since 1 October 2024. It answers only whether the entity is in the high-risk group: a "not red" result does not mean "reliable", and the amber zone is not shown. Treat it as the start of a check, not its conclusion.

What is the exposure if a supplier turns out to be a shell?#

Denial of VAT deductions and of deductible expenses under art. 54.1 of the Russian Tax Code, interest, a penalty of up to 40% under art. 122, loss of the money in the deal itself, and personal exposure for the director. In Russia, unpaid tax above RUB 18,750,000 across three consecutive financial years crosses into criminal liability.

Can assessed VAT be recovered from the counterparty?#

Yes, where the contract carries a properly drafted warranty or indemnity clause and the counterparty has filed a consent to disclosure of tax secrecy. Without that consent the mechanism never starts, because you will not learn of the gap in time.

Does tax reconstruction still help if the supplier was technical?#

Not for those who built the arrangement themselves. In its ruling of 31 March 2026 no. 307-ЭС25-11805 the Russian Supreme Court held that funds transferred to technical organisations are not expenses necessary for carrying on business. The ability to recognise real costs survives only for those who disclose the actual performer during the audit.

What to do with this#

It reduces to one rule: do not hunt for shells by checklist — test whether this specific counterparty could have performed this specific contract. Everything else is a derivative of that question.

Three things that cost little and change the outcome:

1. Run the tax number through the regulator's risk platform before the first payment — two minutes.
2. Talk to the principal about the substance of the contract, not to an account manager.
3. Put a properly drafted indemnity clause in the contract and obtain the disclosure consent — and read the counterparty's reaction as data in itself.

When a deal is large enough that the mistake cannot be absorbed, vetting stops being a finance-team task. At DAEMON Intelligence we check counterparties and their beneficial owners — including the layer no aggregator shows: the actual people behind the entity, their connections and their history. If what you need is not a report but certainty of performance on a specific deal, that is escrow support.