This article, possibly deliberately because you can read the subtext of exactly what happened with this story, conflates several things knowing that readers won't know the difference.

Transferring assets from Cyprus to BVI? Legal, there is no issue with doing this. What the journalist did, likely upon discovering this was legal, suggested that it was for tax purposes knowing that readers would assume this was illegal in some way...when it is not relevant.

An opinion was then acquired from a KC which, to a normal person, would read as confirmation that something suspect was going on but, if you have experience with this thing, says that in a completely different, unrelated context this would be illegal (it is a bit sad that we live in a world where a journalist will get an opinion from a KC and they will both conspire to produce something that is obviously intended to be misleading to readers).

Backdating asset transfer from Cyprus to BVI? Again, legal. The role of an auditor is not to provide advice on the legality of the transfer. All that happens is that they get some paperwork saying the assets were transferred two years ago, they go...yes, the paperwork is correct. If you think they should be doing anything else, you don't understand what an auditor is supposed to do.

What would be more questionable is if the transfer didn't actually happen two years ago but the auditor would have no way to know if that was the case. This would be easy to determine in other cases but in the case of personal property, there is no way to know.

What likely happened with the story though is that the journalist put in a lot of time, realised at some point that they didn't actually have any evidence (implicating the people they wished to implicate) so wrote the story that Deloitte were to blame. Will be quite interesting to see what happens next because at several points in the article the journalist uses words that do not describe the role of an auditor i.e. Deloitte was "advising on the falsification of records"...when they show an email which clearly shows that Deloitte did not do this (and again, generally, this is not what an auditor is supposed to be doing).