Did the crackdowns work? An honest scorecard, and the people who paid for them

A decade of leaks, inquiries, fines and reforms produced real money and real change, and also a long list of disappointments. This is the scorecard, kept honestly. The largest single recovery took eight years of litigation. The largest source of leaked evidence saw the firm at its centre walk free. And the people who took the risks to make any of it possible were prosecuted before they were, in most cases, vindicated. The pattern that emerges is clear and uncomfortable: enforcement worked where it changed the rules, and failed where it relied on putting individuals in the dock.

The leaks and reforms in how we got here raise the obvious question: did any of it actually work? The honest answer is "partly, and not in the way most people assume." Below is what was recovered, what happened to the whistleblowers, and an even-handed verdict on each front.

The whistleblowers: real people, real risk, public record

The figures behind these leaks are a matter of public record, named in court judgments, regulators' files and their own published statements. We describe each by role here and keep the names in the sources, where the record sits.

The LuxLeaks whistleblowers. Both were former employees of one of the large accountancy firms in Luxembourg. The first, then around 28, copied tax rulings from the firm's servers in 2010 before leaving, and later passed them to an investigative journalist, whose 2012 documentary drew little attention until the ICIJ published the full dataset as LuxLeaks in November 2014. Both were tried in Luxembourg in spring 2016 and convicted; an appeal court confirmed the convictions in March 2017. Then the tide turned. Luxembourg's Court of Cassation quashed the first whistleblower's conviction in January 2018, and the Court of Appeal fully acquitted him in May 2018, recognising his whistleblower status under the European Convention on Human Rights. He was vindicated in 2018. The second whistleblower's path was longer: the European Court of Human Rights Grand Chamber ruled in February 2023 that his conviction had violated Article 10 of the Convention, and ordered Luxembourg to pay him EUR 55,000, a sum that includes his costs. The journalist who made the documentary was acquitted at first instance in June 2016. No multinational company was ever charged in connection with LuxLeaks.

The Panama Papers source. The source remains anonymous as of June 2026, known only by a pseudonym. In May 2016, the source published a statement offering to cooperate with investigations, condemning the prosecution of whistleblowers, and citing the example of a well-known US intelligence-agency leaker. The identity has never been confirmed.

The SwissLeaks whistleblower. A French-Italian IT specialist at the Geneva private bank of a major international banking group, he extracted data on about 130,000 clients in 2008 and began cooperating with European authorities. Switzerland convicted him in absentia and sentenced him to five years for economic espionage and breaching banking secrecy. France, Spain, Germany, Argentina and Belgium all used his data for tax investigations, treating him as a protected informant; Spain repeatedly refused Swiss extradition requests.

What was actually recovered

Panama Papers: over US$1.36 billion by 2021. Five years after publication, 24 countries had officially reported recoveries totalling more than US$1.36 billion in back taxes and penalties directly attributed to Panama Papers investigations (the tally had already passed US$1.2 billion by 2019). The leading reported recoveries were the UK at about US$252.8 million, Germany at about US$183.2 million, Spain at about US$164.1 million, France at about US$135.7 million, and Australia at about US$138 million. Hundreds of investigations remained open. Real money, but small against the scale of the avoidance it sampled.

The EU state-aid case against a US technology group: EUR 14.1 billion, confirmed after eight years. The European Commission ordered Ireland in August 2016 to recover EUR 13 billion (plus interest) from that company, finding that Irish tax rulings had granted illegal state aid by cutting its effective rate to near zero. The rulings in question dated from 1991 and 2007, with the recovery covering the period 2003 to 2014. The company and Ireland both appealed; the EU's General Court annulled the Commission's decision in 2020; the Commission appealed to the Court of Justice of the EU, which on 10 September 2024 issued a final, non-appealable judgment confirming the 2016 decision. Ireland is now obliged to recover about EUR 14.1 billion including accumulated interest. It is the largest single recovery in this whole story, and it took eight years of litigation to land.

UK Diverted Profits Tax and transfer pricing: billions, and a deterrent. The UK's Diverted Profits Tax, introduced in April 2015 at 25% and raised to 31% in April 2023, was built to deter artificial profit diversion. Direct DPT charging notices contributed £108 million in 2023 to 2024, up 170% from £40 million the year before. The broader transfer-pricing yield from HMRC interventions was £1.786 billion in 2023 to 2024, rising to £3.387 billion in 2024 to 2025, almost double year on year. HMRC's published statistics also show very large sums under active consideration in diverted-profits reviews and cumulative multi-year transfer-pricing yields in the billions; we cite the confirmed annual yields above and treat the multi-year totals as consistent with those releases rather than pinning a single figure. The most important effect here is not the direct yield but the behavioural change: the credible threat of a DPT charge moves companies to restructure before a notice is ever issued.

Pillar Two: projected billions, uncertain delivery. The OECD's January 2024 working paper projects the 15% global minimum will raise US$155 to 192 billion a year worldwide at full implementation; EU modelling estimates EU corporate income tax revenues would rise by roughly EUR 26 billion a year. Pillar Two took effect in over 50 jurisdictions in 2024. But the United States has not implemented it and has signalled opposition, which creates real uncertainty about the global rollout. The projection is large; the delivery is unsettled.

The honest scorecard

The pattern, in one finding

Enforcement worked best where it was structural, and worst where it depended on individual criminal prosecutions of complex offshore arrangements. The Diverted Profits Tax changed behaviour through the credible threat of a charge. Automatic information exchange changed what banks would shelter. Transparency rules outlasted the cases that prompted them. By contrast, the attempts to convict individuals, the founders of the Panama offshore law firm, and at first the LuxLeaks whistleblowers themselves, mostly failed, were reversed, or hit the wrong targets. The single largest recovery, the EUR 14.1 billion from the EU state-aid case against a US technology group, is both a vindication of EU enforcement and an illustration of why structural rules like Pillar Two and public country-by-country reporting are more efficient than fighting the same battle one company at a time over eight years. The lesson the scorecard teaches is the lesson of the whole site: change the rules, not just the defendants.

Key facts

• Panama Papers recoveries passed US$1.36bn across 24 countries by 2021 (UK ~$252.8m, Germany ~$183.2m, Spain ~$164.1m, Australia ~$138m, France ~$135.7m); real but small against the scale.
• The EUR 14.1bn recovery from the EU state-aid case against a US technology group was confirmed by the CJEU on 10 September 2024, eight years after the 2016 order; rulings dated 1991 and 2007, recovery period 2003-2014.
• UK transfer-pricing yield reached £3.387bn in 2024-25 (from £1.786bn); the Diverted Profits Tax's deterrent effect matters as much as its direct £108m yield.
• No multinational was prosecuted over LuxLeaks; the Panama offshore law firm's founders were acquitted in 2024. The two LuxLeaks whistleblowers (2018 and, at the ECtHR, 2023) were ultimately vindicated; the SwissLeaks whistleblower was convicted in Switzerland but protected abroad.
• Enforcement worked where it was structural (DPT deterrence, information exchange, transparency rules) and failed where it relied on prosecuting individuals.