How Governments Screen CBI/RBI Applicants
The Three-Tier Diligence Model
Most credible CBI/RBI programs now operate a layered screening architecture. While exact procedures vary by jurisdiction, the dominant model involves three tiers:
Tier | Conducted By | Scope |
Tier 1 — Automated Screening | Program unit or licensed agent | Global sanctions lists (OFAC, UN, EU), PEP databases, adverse media screening via platforms such as World-Check (LSEG) or Dow Jones Risk & Compliance |
Tier 2 — Enhanced Due Diligence (EDD) | Government-appointed third-party firms (e.g., Exiger, Kroll, S-RM) | Source-of-funds verification, corporate structure mapping, litigation history, tax compliance status, and criminal record checks across all jurisdictions of residence |
Tier 3 — Intelligence-Level Review | National security agencies or inter-governmental bodies | In-depth intelligence checks for high-risk profiles, PEPs, and applicants from sanctioned or high-risk jurisdictions (FATF grey/black list countries) |
Key point: The principal does not choose the diligence provider. In programs such as those administered by Caribbean nations (St Kitts and Nevis, Dominica, Grenada, Antigua and Barbuda), the Citizenship by Investment Unit (CIU) contracts directly with international due diligence firms. In Malta, the Community Malta Agency commissions checks independently of the applicant's legal counsel. The applicant's role is to prepare — not to manage — the process.
What Triggers Enhanced Scrutiny
Certain profile characteristics reliably escalate an application from standard to enhanced review:
- PEP status — Current or former politically exposed persons, and their immediate family members or close associates (RCAs), face the highest level of scrutiny across virtually all programs.
- Source-of-funds complexity — Wealth derived from private equity, cryptocurrency, natural resource extraction, or state-linked contracts requires granular documentation chains.
- Multi-jurisdictional corporate structures — Holding companies across three or more jurisdictions, particularly those involving low-transparency regimes (BVI, Seychelles, Ras Al Khaimah), attract additional layers of corporate registry verification.
- Adverse media — Even resolved litigation or historical media coverage can delay processing. Programs conduct open-source intelligence (OSINT) reviews that surface archived press.
- Nationality or residence in FATF grey-list jurisdictions — As of early 2026, this continues to be a dynamic list; applicants should verify the current FATF status of every jurisdiction in which they hold citizenship, residence, or significant business interests.
What "Source of Funds" Actually Means at This Level
Source of funds (SOF) and source of wealth (SOW) are related but distinct requirements, and conflating them is one of the most common errors in application preparation.
Concept | Definition | What Is Required |
Source of Wealth (SOW) | The origin of the applicant's entire net worth — how was the fortune built? | Business ownership records, share certificates, audited financial statements, inheritance documentation, property portfolios, investment histories |
Source of Funds (SOF) | The specific origin of the capital being deployed for the investment — where is this particular money coming from? | Bank statements (typically 12–24 months), wire transfer records, sale-of-asset documentation, dividend or distribution records linking the invested capital to a verifiable, legitimate origin |
For enterprise-level principals, the SOW narrative is often the more complex deliverable. It must present a coherent, documented history of wealth accumulation — from first business formation to current portfolio — in a format that a compliance officer with no prior knowledge of the applicant can follow without gaps.
Practical note: Most rejections tied to source of funds are not the result of illegitimate wealth. They are the result of incomplete documentation. A principal who liquidated a real estate portfolio across three jurisdictions over five years and consolidated proceeds into a single account needs to document every transaction in that chain. Missing a single link — a transfer between personal accounts, a currency conversion, an intermediary holding — can stall or derail an application.
The Compliance Landscape: What Has Changed
EU Pressure and Program Closures
The European Commission has maintained sustained pressure on investment migration programs within the EU and its periphery. Key developments include:
- Cyprus closed its CBI program in November 2020 following a series of compliance failures.
- Bulgaria terminated its golden visa in 2022.
- Portugal eliminated real estate as a qualifying investment category under its Authorisation of Residence for Investment (ARI) program, effective October 2023.
- Ireland closed its Immigrant Investor Program (IIP) in February 2023.
- The European Commission initiated infringement proceedings against Malta in 2022, arguing that the direct sale of citizenship undermines the essence of EU citizenship under Article 20 TFEU. As of early 2026, Malta's program continues to operate under revised due diligence standards, but the legal challenge remains unresolved. (Status requires verification for latest developments.)
FATF and CRS Implications
The Financial Action Task Force (FATF) and the Common Reporting Standard (CRS) create an overlay that CBI/RBI applicants must account for:
- CRS: Acquiring tax residence in a new jurisdiction triggers automatic exchange of financial account information between participating countries. This means the applicant's existing financial institutions will report account data to the new jurisdiction's tax authority — and vice versa. Any inconsistency between declared tax residence and CRS reporting raises red flags.
- FATF Recommendations 10 and 22: These require financial institutions and designated non-financial businesses and professions (DNFBPs), including real estate agents and trust service providers, to conduct customer due diligence (CDD) and enhanced due diligence (EDD) for PEPs and high-risk clients. A CBI/RBI applicant's downstream banking relationships are affected: obtaining new banking in the target jurisdiction post-approval is itself subject to institutional KYC/AML protocols that reference the same risk indicators.
The Banking Bottleneck
Approval of a CBI or RBI application does not guarantee access to banking services in the target jurisdiction. This is an increasingly critical — and frequently underestimated — operational risk.
International correspondent banking relationships have contracted significantly since 2014 (a process commonly referred to as “de-risking”). Banks in small CBI jurisdictions (particularly the Caribbean) face heightened scrutiny from their USD correspondent banks. As a result:
- Account opening timelines in CBI jurisdictions can exceed 3–6 months post-approval.
- Some banks in Malta, Portugal, and Greece require applicants to demonstrate physical presence and economic substance in the jurisdiction before granting full transactional banking.
- Applicants with connections to sanctioned jurisdictions, or those whose wealth profile involves sectors flagged as high-risk (e.g., extractive industries, defence, gambling), may face outright refusal from compliance-conservative institutions.
Strategic implication: Banking access should be assessed before program selection, not after. The residency or citizenship credential is only as useful as the financial infrastructure it unlocks.
Comparison: Caribbean CBI vs. Malta CBI — Due Diligence Standards
Factor | Caribbean CBI (St Kitts, Dominica, Grenada) | Malta Exceptional Investor Naturalisation (MEIN) |
Minimum Investment | USD 100,000–200,000 (donation) or USD 200,000–400,000 (real estate), varies by program | EUR 600,000 (contribution) + EUR 700,000 (property purchase) or EUR 16,000/yr (rental) + EUR 10,000 (philanthropic donation) |
Due Diligence Fees | USD 7,500–10,000 per applicant (non-refundable) | EUR 15,000+ (multi-stage, non-refundable) |
Processing Timeline | 3–6 months (standard); 45–60 days (accelerated, where available) | 12–36 months (includes mandatory 12- or 36-month residency period depending on contribution level) |
Diligence Provider | International firms contracted by CIU (e.g., Exiger, Thomson Reuters) | Community Malta Agency + independent international firm |
Physical Presence Requirement | None or minimal (varies by program) | 12 or 36 months of genuine residence required before naturalisation |
Tax Implications | Generally no personal income tax on worldwide income in Caribbean CBI jurisdictions (territorial tax or no income tax) | Malta's non-dom regime taxes foreign income on a remittance basis; minimum annual tax of EUR 5,000 under the Global Residence Program. Full fiscal residence triggers broader obligations under CRS |
Visa-Free Travel | ~140–155 countries (Henley Passport Index, subject to change) | ~185+ countries (EU passport) |
Rejection Risk Due to Diligence | Moderate — rejection rates have increased post-2020 reforms | Low for well-prepared applicants, but process is slow and granular |
Note: Figures are approximate and subject to program amendments. Applicants should verify current thresholds directly with the relevant authority or licensed agent at the time of application.
Preparing for Due Diligence: A Principal's Checklist
Effective preparation reduces processing time, lowers the risk of requests for additional information (RFIs), and minimises the chance of rejection. The following should be assembled before engaging with a program:
1. Wealth Narrative
A structured, chronological document (typically 5–15 pages) explaining how the applicant's net worth was accumulated. This should be supported by contemporaneous documents: company formation records, audited accounts, share sale agreements, inheritance probate records.
2. Source-of-Funds Documentation
A complete paper trail for the specific capital to be invested: bank statements (minimum 12 months, 24 preferred), wire confirmations, loan agreements if leveraged, and any currency conversion records.
3. Global Tax Compliance Confirmation
Tax clearance certificates or equivalent from every jurisdiction in which the applicant is currently or was recently tax resident. Any outstanding tax disputes should be disclosed proactively — concealment is a ground for automatic rejection in most programs.
4. Corporate Structure Chart
An up-to-date organisational chart of all entities in which the applicant holds a beneficial ownership interest of 10% or more. Each entity should include: jurisdiction of incorporation, registered agent, UBO register status, and primary business activity.
5. PEP Self-Assessment
If the applicant, or any family member or close associate, qualifies as a PEP, this should be disclosed upfront with a supporting explanatory memorandum. Attempting to obscure PEP status is invariably discovered during Tier 2 screening and results in adverse inference.
6. Adverse Media Pre-Screening
Engage an independent provider (Refinitiv World-Check, Dow Jones, or equivalent) to run a self-screening report. Any historical adverse media should be addressed in a pre-prepared response document attached to the application.
7. Banking Pre-Clearance
Initiate preliminary discussions with target-jurisdiction banks before or concurrently with the CBI/RBI application. Identify institutions with appetite for the applicant's profile and wealth source.
WorldPath View
Due diligence is not a hurdle to clear — it is the mechanism by which the value of a CBI/RBI program is maintained. Programs with rigorous screening protect the integrity of the credential: the passport or residence permit is only as valuable as the reputation of the jurisdiction that issues it. The collapse of Cyprus’s program and the EU’s action against Malta demonstrate what happens when diligence standards are perceived as insufficient.
For enterprise-level principals, the strategic approach is straightforward: invest in preparation before investing in a program. Assemble the documentation, run self-screening, resolve any legacy compliance issues, and secure banking pre-clearance. The principals who experience delays, rejections, or reputational risk are overwhelmingly those who treated due diligence as an administrative afterthought rather than the core of the process.
The right program is not the one with the lowest investment threshold. It is the one whose diligence standards, tax framework, and banking infrastructure align with the principal’s long-term wealth preservation and mobility objectives.
