What the CJEU ruling actually changed

On 29 April 2025, the CJEU held that Malta's 2020 investor citizenship scheme breached EU law on two grounds: Article 4(3) TEU (sincere cooperation) and Article 20 TFEU (Union citizenship). The Court characterised the scheme as commercialisation of nationality — incompatible with the bond of solidarity required between a Member State and its citizens.

Three points are notable for practitioners:

• The judgment reversed the Advocate General's October 2024 Opinion, which had supported Malta's sovereign position.
• Decisions taken under the 2020 framework remain valid; the ruling is prospective.
• Malta confirmed compliance and is amending the framework.

Bulgaria's CBI was already closed; Cyprus terminated its programme in 2020 after the Cyprus Papers investigations. The Malta ruling therefore extinguishes the last operational EU CBI scheme.

Which EU programmes remain operational in 2026

Twelve Member States have historically operated RBI schemes. The 2024–2026 cycle has materially reshaped the list:

What new due diligence obligations apply

The compliance perimeter has widened in three directions.

Enhanced due diligence under AMLD6 Article 41. RBI schemes are now subject to specific enhanced due diligence: source-of-funds verification, sanctions screening, and cross-checking against EU justice and home affairs IT systems. These are mandatory baseline obligations, not items left to national discretion.

OECD CRS overlay on financial institutions. Banks and wealth managers must factor the OECD's CBI/RBI risk analysis into onboarding for clients holding investment-derived nationalities. This shifts material risk onto intermediaries.

Operational drag. Tightened vetting has extended processing timelines. Portugal's AIMA (Agência para a Integração, Migrações e Asilo) reported a backlog of over 400,000 expressions of interest as of mid-2025, with multi-layered vetting now involving Interpol, Europol, and national intelligence agencies.

Two adjacent developments to track:

• ETIAS rollout. Expected late 2026; adds pre-travel authorisation for visa-exempt third-country nationals entering the Schengen Area — affecting the practical mobility value of non-EU CBI passports.
• Russia/sanctions overlay. The March 2022 Commission Recommendation on investor schemes in the context of the Russian invasion remains in force.

Portugal vs Greece: the two surviving anchor programmes

With Spain closed and Malta CBI extinguished, Portugal and Greece carry the bulk of EU-bound investor demand. The practical choice now turns on these variables:

Portugal offers the faster citizenship runway but is operationally constrained. Greece offers faster intake but a longer naturalisation track and a politically exposed real-estate route.

WorldPath View

The April 2025 Malta ruling is best read as a closing chapter, not an opening one. EU citizenship-by-investment is finished as a legal category. EU residence-by-investment survives, but on harmonised due-diligence terms that compress the historic margin between the cheapest and the strictest national programme.

This regime is best suited to clients whose primary objective is long-horizon EU access — residency, mobility, and eventual naturalisation through genuine connection — rather than fast-track passport acquisition. Clients indexed to speed should be redirected to Caribbean CBI; clients indexed to tax residency without EU access should be benchmarked against UAE, Singapore, or Switzerland routes.

For intermediaries, the value proposition has shifted from sourcing the cheapest entry point to managing compliance load. Advisory firms that can run defensible source-of-funds files and navigate AIMA-scale processing queues will take market share from those that cannot.