Irish Limited Partnerships enable financial fraud and money laundering
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Opaque Irish limited partnerships lack beneficial-owner disclosure requirements, enabling cryptocurrency scams like Bitsane and potentially money laundering and sanctions evasion.
Bellingcat's investigation into Irish Limited Partnerships (ILPs) reveals a corporate structure that lacks transparency and beneficial-ownership requirements, making it attractive to fraudsters and money launderers. The Bitsane cryptocurrency platform, which disappeared in 2019 with $7 million in daily trading volume and deposits from 250,000 users, exemplifies this risk: it was registered as an ILP in Dublin with partners in Lithuania, Hong Kong, and Belarus, yet authorities could not easily identify its true owners. ILPs are governed by century-old UK legislation (1907 Limited Partnerships Act) predating Ireland's independence, leaving them outside modern EU anti-money-laundering directives that apply only to incorporated entities. Since 2015, registrations have surged dramatically—2,400 ILPs formed between 2015 and 2021 versus just 1,000 from the 1900s to 2014—many registered at shared Dublin and Cork mailing addresses and controlled by general partners in secrecy jurisdictions (Seychelles, Belize, British Virgin Islands, Panama, Cayman Islands). Bellingcat's analysis identified one Seychelles-based individual as a general partner in nearly 150 ILPs and a Romanian national controlling over 370. Many ILPs appear connected to trade with Russia and Ukraine, and some were advertised for sale in Russian, targeting post-Soviet markets. The formation agent LAS Fiduciary and its UK counterpart LAS International (UK) registered hundreds of these vehicles, including Bitsane; both have since dissolved. Ireland's Department of Enterprise reports it is reviewing the 1907 Act to address beneficial-ownership transparency, but until regulatory changes are enacted, ILPs remain an effective vehicle for obscuring beneficial ownership and enabling financial crime.
Detection guidance
1 detection for this report is in the app — rules that match its indicators, converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, plus YARA and Suricata. Three days of it free, no card.
Source reporting: https://www.bellingcat.com/news/2022/06/18/inside-the-secretive-world-of-irish-limited-partnerships
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs