The Panama legal firm at the heart of a massive data leak kept clients who were subject to international sanctions, documents show.

Mossack Fonseca worked with 33 individuals or companies who have been placed under sanctions by the US Treasury, including companies based in Iran, Zimbabwe and North Korea.

One had links to North Korea's nuclear weapons programme.

The information comes from the leak of 11m of the company's internal files.

Mossack Fonseca registers companies as offshore entities operated under its own name. This meant the identities of the real owners were hard to trace because they were kept out of public documents.

Owners from Pyongyang

Some of the businesses were registered before international sanctions were imposed. But in several cases Mossack Fonseca continued to act as a proxy for them after they were blacklisted.

DCB Finance was established in 2006, with its owners and directors based in North Korea's capital Pyongyang. It was later put under sanctions by the US Treasury for raising funds for the North Korean regime and being linked to a bank helping to fund the regime's nuclear weapons programme.

The leaked files reveal the owners of DCB Finance were a North Korean official, Kim Chol Sam and Nigel Cowie, a British banker who was also CEO of the sanctioned Daedong Credit Bank.

Mossack Fonseca appears to have overlooked that the owners and directors of the company were based in Pyongyang until it was contacted by the British Virgin Islands (BVI) authorities in 2010, inquiring about another company Mossack Fonseca had set up with directors in North Korea.

Mossack Fonseca resigned as agents for DCB Finance in September 2010.

In 2013 the BVI authorities contacted Mossack Fonseca again, asking what checks they had carried out before opening DCB Finance in 2006.

An email from Mossack Fonseca's compliance department on 9 August 2013 says: "We have not yet addressed the reason we maintained a relationship with DCB Finance when we knew or ought to have known from incorporation in 2006, that the country, North Korea was on the black list."

It adds: "We should have identified from the onset that this was a high risk company."

Mr Cowie was not placed under sanctions. He has said that DCB Finance was established for legitimate business purposes and that he was "unaware, whether directly or indirectly, of any transactions being made with any sanctioned organisation or for any sanctioned purpose, during my entire tenure".

Assad's cousin

Another case involves Rami Makhlouf, who is the cousin of Syria's President Bashar al-Assad and has reported wealth of $5bn.

In 2008 the US Treasury imposed sanctions on him because it deemed him to be a "regime insider" and someone who "manipulated the Syrian judicial system and used Syrian intelligence officials to intimidate his business rivals".

Mossack Fonseca continued to front six businesses - including one company called Drex Technologies - for Mr Makhlouf after the restrictions were put in place.

The files also show the Swiss branch of HSBC provided financial services for the firm.

In 2010, two years after the sanctions were imposed, HSBC wrote to Mossack Fonseca saying it believed Drex Technologies was a company of "good standing".

An internal email from Mossack Fonseca's compliance department also suggests HSBC staff dealing with Drex Technologies knew who Rami Makhlouf was.

The email, dated 17 February 2011, says: "We have contacted HSBC who stated that they are very aware of the fact that Mr Makhlouf is the cousin of the President of Syria.

"The HSBC compliance department of the bank not only in Geneva but also in their headquarters in London know about Mr Makhlouf and confirm that they are comfortable with him."

HSBC said: "We work closely with the authorities to fight financial crime and implement sanctions. Our policy is clear that offshore accounts can only remain open either where clients have been thoroughly vetted where authorities ask us to maintain an account for the purposes of monitoring activity, or where an account has been frozen based on sanctions obligations."

War fuel

Mossack Fonseca cut all its links with Rami Makhlouf in September 2011, nine months after it was first recommended.

But the leaked documents reveal the firm also provided business services to another company that was registered on a US sanctions list in 2014.

The company is called Pangates International Corporation Limited. The US Treasury Department believes it supplied aviation fuel to the Syrian government to fly military aircraft during the current civil war. The files show Mossack Fonseca first incorporated the petroleum firm in 1999.

Nine months after the sanctions came into effect, it was still handling the paperwork for Pangates International Corporation and certified it was a company in the Seychelles of good standing.

It was not until August 2015 that Mossack Fonseca acknowledged the company was on a blacklist and reported it to financial regulators in the Seychelles.

Mossack Fonseca said: "We have never knowingly allowed the use of our companies by individuals having any relationship with North Korea or Syria. We have our own procedures in place to identify such individuals, to the extent it is reasonably possible."

Panama's President Juan Carlos Varela told the BBC his country was willing to contribute to any investigation in any country relating to the documents.

"We are an open country," he said.

(BBC)