Investment Migration Due Diligence: Checks and Grounds for Refusal

A status bought by investment is sold only to someone the state is prepared to accept as a resident or citizen. Due diligence in investment migration answers exactly that question: whether the applicant is admissible under the rules of the programme and of the immigration and sanctions regimes, and whether the money being paid is clean. Several parties with different mandates check at the same time, and their conclusions end up in different databases.

Concept

The check is commissioned by a dedicated state body — a Citizenship by Investment Unit in the Caribbean, an immigration agency or an interior ministry in Europe. It is carried out by an independent due diligence firm under contract to that body; the applicant is not its client and has no say over the report. The decision is taken by the state within its own powers.

A second, independent check runs alongside it: the bank's. The investment money passes through a receiving bank that applies its own CDD and does not rely on the immigration body's approval. The UK Money Laundering Regulations 2017 expressly list as a higher-risk factor a customer who is a third-country national applying for residence rights in or citizenship of a state in exchange for transfers of capital, purchase of property, government bonds or investment in corporate entities (reg. 33(6)(a)(viii)). In the EU, from 10 July 2027, article 41 of Regulation (EU) 2024/1624 will require every obliged entity dealing with third-country nationals seeking residence rights in a Member State in exchange for investment to apply enhanced measures. Hence the double due diligence: the state and the bank examine the same file, each for its own purposes, and a positive decision by one binds the other to nothing.

The third party is the licensed agent, through whom the application is filed and who, in the EU from 2027, becomes an obliged entity in its own right. The fourth is the future servicing bank, with the same questions about wealth and tax residence.

The subject matter is broader than bank onboarding: identity and passport history, criminal records and investigations in every country of residence, sanctions lists and connected persons, politically exposed person status, source of funds and source of wealth, business reputation and adverse media, nationalities and higher-risk countries, and past refusals of visas and citizenship. The wider cluster is mapped in the investor hub.

The check at a glance:

Why the checks have hardened

Selling status creates an obvious risk: a person with a criminal or corrupt past buys mobility, a new banking profile and a new tax residence. In November 2023 the FATF and the OECD published a joint report on the misuse of CBI and RBI programmes: the programmes give criminals global mobility and help them hide their identity behind shell companies, and they attract corrupt officials seeking to evade justice. The vulnerabilities are reliance on intermediaries, blurred accountability between agencies, weak governance and the absence of information-sharing; the recommended response is multi-layered vetting of applicants, verification of source of wealth and source of funds, checks on the intermediaries themselves and coordination between authorities.

The European Commission named the same set of risks — security, money laundering, tax evasion and corruption — when in March 2022 it called on member states to end investor citizenship and tighten checks on investor residence. The OECD has worked the tax angle since the late 2010s: programmes without real presence let a person claim residence in a "convenient" jurisdiction and slip out of CRS exchange. In the Caribbean the pressure has taken the form of a series of roundtables with the US Treasury, at which the five states agreed common vetting principles; FATF standards provide the common vocabulary for all these bodies.

Who checks, and what

The state body and the external provider

The body hands the file to an external provider that works open and closed sources: corporate registries, court databases, sanctions and PEP lists, adverse media in the original language, and local enquiries in the country of origin. The legislation itself requires this outside check: regulation 14(2) of the Maltese MPRP Regulations requires due diligence to be performed also by third parties, including one or more internationally recognised specialised providers, alongside law-enforcement security checks and ML/TF risk assessments; in the Caribbean, providers are approved under the ECCIRA agreement. The provider takes no decision: it delivers a report with risk ratings and findings. In the Caribbean the file is also run through the programme country's financial intelligence unit — one of the six agreed principles.

The licensed agent

A Caribbean application cannot be filed directly with the unit; the only way in is through a licensed agent. The agreement establishing the Eastern Caribbean Citizenship by Investment Regulatory Authority (ECCIRA) hardens that arrangement. Antigua and Barbuda has implemented it as Act No. 18 of 2025: article 36 introduces mandatory pre-qualification — agents, local agents, sub-agents and marketing agents must be approved by the Authority and licensed under national law. Article 53 regulates independent due diligence providers as an approved company or specialised professional team carrying out full verification and background investigation; article 54 introduces oversight and audit of the vetting itself.

The roles are split: the agent assembles and files, the provider assesses, the body decides; the agent is not entitled to guarantee the outcome of the check.

The bank: the second independent check

The bank through which the investment passes treats the applicant as a higher-risk customer: it requests its own source of funds and source of wealth pack, runs sanctions screening across the whole capital chain, checks PEP status and tests the tax self-certification. A bank's refusal to accept the payment stops the case as surely as the body's refusal, although it stays inside the bank. The general mechanics of private-client onboarding are covered in AML/KYC for private clients.

What is checked

Stages of the check

The procedure consists of five distinct stages that operate before and after the decision:

1. The file. Application form, identity documents, police certificates from the country of nationality and every country where the applicant lived longer than a set period (usually six or twelve months after the age of 16), medical documents, references and the evidence behind the money.
2. Independent due diligence by the provider under contract to the body, and the FIU check.
3. Interview and biometrics. Since 2024 the interview has been a mandatory step in all five Caribbean programmes for the main applicant and, where required, for dependants aged 16 and over.
4. Information exchange on applicants, check results and past refusals between programmes and competent authorities where the law provides for it.
5. Checks after grant. Repeat sanctions screening, audit of approved files, revocation and retrieval of passports, re-enrolment of biometrics. It is this stage that makes the status revocable — see status risk in investment migration.

Preparation time depends on the number of countries of residence, the availability of police certificates and the length of the source of wealth chain; certificates, apostilles and translations each have their own validity periods.

Caribbean standards

The six principles and the US roundtables

The starting point is the six principles agreed by the five states with the US Treasury: collective treatment of denials, interviews, additional checks, programme audits, retrieval of revoked passports, and the treatment of Russian and Belarusian nationals. At the third roundtable, held in Grenada on 29 August 2024 and reported by the Eastern Caribbean Central Bank, Antigua and Barbuda, Dominica, Grenada, St Kitts and Nevis and St Lucia recorded four principles as fully implemented:

• not to process an application from a person refused by any of the other five jurisdictions;
• to interview applicants;
• to run checks on each applicant with the country's financial intelligence unit;
• to suspend applications from Russian and Belarusian nationals.

Programme audits and the retrieval of revoked passports were then still in progress. The fourth roundtable in Antigua and Barbuda, whose outcome the ECCB published on 1 December 2025, was attended by the United Kingdom, the European Commission, the OECS Commission, CARICOM IMPACS, the US State Department and the US Department of Homeland Security; the parties recognised significant progress, and ECCIRA was expected to become operational in 2026.

External partners are pressing in parallel. According to a statement by the Government of Antigua and Barbuda, a letter from Commissioner Magnus Brunner dated 25 June 2026 asked it to phase out its programme by 1 June 2028 and, no later than September 2026, to exclude fully individuals subject to EU restrictive measures and reinforce vetting for all nationalities. US Proclamation 10998 of 16 December 2025 partially restricted entry for nationals of Antigua and Barbuda and Dominica from 1 January 2026, stating expressly that each "has historically had CBI without residency". Its reasoning also describes the mechanism being closed: a national of a restricted country buys a second country's passport and uses it to apply for a US visa. Each such demand becomes an additional filter at the point of entry. The timeline and scenarios to 2028 are set out in Caribbean CBI under the EU deadline and US restrictions.

ECCIRA: regional supervision, biometrics and a shared database

The five states signed the ECCIRA agreement in Castries, St Lucia, on 23 September 2025; the Authority's headquarters is to be located in a participating state as agreed by the Heads of Government (article 7.1). The structure of the text shows what vetting is turning into:

• article 51 — collection and protection of biometric data; the definition in article 2 covers fingerprints, iris scans, facial images, voice samples and other physical, physiological and behavioural identifiers used for identity verification, background checks and security screening;
• articles 56–60 — the interview as a full procedure: requirements for interviews and interviewers, interviews of dependants, the record, oversight;
• articles 70 and 71 — revocation of passports and their physical retrieval;
• articles 73 and 74 — exchange of information on denied and withdrawn applications and a direct bar on processing them;
• articles 75–80 — the Eastern Caribbean Citizenship by Investment Database: content, transmission, access, protection, audit.

The Authority may impose fines and revoke licences. Entry into force is governed by article 95. All five states have enacted implementing laws, and in December 2025 the ECCB expected the Authority to become operational in 2026. The institutional side is covered in citizenship by investment.

No aggregate refusal rate across the programmes can be calculated: the published data sets use no common denominator. Country specifics are in the reviews of St Kitts and Nevis and Grenada.

The European Union

The Commission Recommendation of 28 March 2022

A month after Russia's invasion of Ukraine the European Commission issued a recommendation on immediate steps concerning investor citizenship and residence schemes. Investor citizenship schemes were to be terminated immediately, and member states were to assess whether citizenship previously granted to Russian or Belarusian nationals subject to EU sanctions or significantly supporting the war should be withdrawn. For investor residence schemes there were three demands: establish and conduct strict checks before issuing any permit, to address security, money laundering, tax evasion and corruption risks; immediately withdraw or refuse to renew permits held by Russian or Belarusian nationals subject to EU sanctions or significantly supporting the war; and suspend the issuance of investor residence permits to all Russian and Belarusian nationals. Member states were to report by the end of May 2022.

A recommendation is not legally binding (art. 288 TFEU), and member states implemented it through national measures of differing scope. What matters for due diligence is the standard itself — strict checks before a status is granted — which has since become the norm in European practice.

The C-181/23 judgment

On 29 April 2025, in Case C-181/23 Commission v Malta (press release No 52/25), the Court of Justice held the Maltese scheme incompatible with Union law. The bond of nationality with a member state rests on a specific relationship of solidarity, good faith and reciprocity of rights and duties. A state that grants nationality, and with it automatically Union citizenship, in direct exchange for predetermined investments or payments turns its acquisition into a commercial transaction. Such "commercialisation" infringes the rules on Union citizenship (art. 20 TFEU) and the principle of sincere cooperation (art. 4(3) TEU) and jeopardises mutual trust between member states.

For vetting there are two consequences. Inside the EU, investor citizenship as a model is closed: what remains are residence routes, where the status confers a right of residence and naturalisation follows the ordinary rules. Outside the EU, the same genuine-link test has become the basis for pressure on third countries through the visa-free regime.

The visa suspension mechanism

Regulation (EU) 2025/2441 rewrote the mechanism for suspending visa-free travel. According to the Council's press release of 17 November 2025, the EU may suspend the exemption where a country runs an investor citizenship scheme granting citizenship to people with no genuine link to it; the threshold for a "substantial increase" in problems falls from 50% to 30%, and the initial suspension is extended to 12 months with a possible 24-month extension. The weaker a programme's vetting, the greater the risk of losing visa-free access, so programmes tighten due diligence for their own survival. How the instrument works is explained in the EU visa suspension mechanism.

AMLR: the agent becomes an obliged entity

Regulation (EU) 2024/1624 classes "investment migration operators" as obliged entities in article 3(3)(l): persons providing intermediation services to third-country nationals seeking to obtain residence rights in a member state in exchange for any kind of investment. Under article 90 the regulation applies from 10 July 2027; the deferral to 10 July 2029 covers only points (n) and (o) — the football segment — so migration agents fall within the general date.

Article 41 is addressed to every obliged entity dealing with applicants for investor residence, banks included: the measures of article 34(4), points (a), (c), (e) and (f), apply — additional information on the customer and beneficial owners, information on the source of funds and source of wealth, senior management approval for establishing or continuing the relationship, and enhanced monitoring. The scope is wide: transfer, purchase or lease of real estate, government bonds, investment in corporate entities, donations to a public good, contributions to the state budget.

For an intermediary on the Greek golden visa or the Portuguese ARI this means five distinct obligations:

1. Risk assessment and controls. Article 10 — a documented assessment of ML/TF risk by customer, product, geography and channel; article 9 — proportionate policies and controls; article 11 — a responsible member of the management body and a compliance officer.
2. Enhanced due diligence on every applicant under article 41, with no discretion, including the beneficial owners of the structure through which the investment is made.
3. Retention. Article 77 — five years from the end of the relationship, completion of the transaction or refusal to establish a relationship, including records of the assessment of suspicions under article 69(2); a competent authority may extend this by a further five years. Even a deal that never happens leaves a file with the agent for years.
4. Suspicious activity reporting under article 69 — to the national FIU regardless of amount, including attempted transactions. In Greece the addressee is the Hellenic Anti-Money Laundering Authority under law 4557/2018; in Portugal, under article 43 of Lei n.º 83/2017, the report goes immediately and simultaneously to the Unidade de Informação Financeira of the Judicial Police and to the DCIAP. An FIU request must be answered within five working days, and in justified urgent cases that period may be cut to under 24 hours.
5. Stopping. Article 21 prohibits establishing the relationship or carrying out the transaction where due diligence measures cannot be applied and requires the entity to consider filing a report, while article 73 prohibits disclosing to the customer that a report has been made.

Elimination moves to the moment the intermediary assembles the pack, and the agent's refusal comes without reasons just as the state's does. The applicant passes the same check at least three times — at the agent, at the state and at the bank — and discrepancies between the three packs become the main source of questions. The EU package as a whole is covered in AMLR, AMLD6 and AMLA.

The OECD and CRS: status as an avoidance risk

The check at entry is not the last filter. The OECD states plainly that certain CBI and RBI schemes may be misused to hide offshore assets and undermine tax transparency. In its statement to the European Parliament's TAX3 committee in February 2019 the organisation set out the test: potentially high-risk schemes are those that give access to a low personal income tax rate on offshore financial assets and do not require an individual to spend a significant amount of time in the location offering the scheme. By then the OECD had analysed more than 100 schemes offered by CRS-committed jurisdictions and identified a few as potentially high-risk; financial institutions are required to take the outcome of that analysis into account in their CRS due diligence. The list is published on the OECD's page and updated, so it is checked as at the onboarding date.

In practice this comes down to four questions a bank puts to an account holder with residence from such a scheme. They are reproduced, for example, in a UAE Ministry of Finance circular to reporting financial institutions:

1. Whether residence rights were obtained under a CBI or RBI scheme.
2. Whether residence rights are held in any other jurisdiction.
3. Whether the account holder spent more than 90 days in any other jurisdiction during the previous year.
4. In which jurisdictions personal income tax returns were filed for the previous year.

A passport or residence card does not in itself create tax residence: that is decided by the national test — days of presence, a permanent home, the centre of interests. Self-certification based on status alone triggers an enquiry and, where the facts diverge, a report to the tax authority of the country of actual residence. Residence tests and their link to status are covered in golden visas and tax residence, and the forms in FATCA and CRS self-certification.

Source of funds and source of wealth

The most common reason for delay and refusal is lack of proof. Source of funds covers the specific money for the investment, source of wealth the origin of the whole fortune; definitions, packs by type of capital and verification levels are in source of funds and source of wealth. Article 34(4)(c) of the AMLR requires both levels. What distinguishes the migration file is its reader: the provider does not need to open an account and is in no hurry, so it follows every chain to the end and records any unclosed segment as a finding.

The rule of proof is single: every step from one state of wealth to the next is backed by a document, with no blank spots. A five-year gap is closed by a tax certificate, company accounts or a contract; an explanation without a document remains a finding. Declared wealth is compared with the public profile, tax returns and corporate registries, and a discrepancy of an order of magnitude is a finding in itself.

Sanctions and PEPs

Sanctions exposure is checked well beyond a direct match: connected persons, former employers, holdings in restricted companies, counterparties to the transaction from which the capital arose. PEP status triggers enhanced due diligence and management-level approval, lengthens timelines sharply and requires the wealth to be explained independently of the office held.

Nationality-based programme bars — the Caribbean suspension of applications from Russian and Belarusian nationals, one of the six principles, and the Commission's 2022 recommendation on investor residence permits — cannot be sidestepped with a second passport. In St Kitts and Nevis the bar is set by a separate order and extends to ordinary residence, and the forms require disclosure of all nationalities and former passports; false information is a ground for refusal and later deprivation of status in its own right. Beyond such bars, risk is assessed by country of residence and business, FATF lists and the sanctions proximity of the capital. The structural side is covered in sanctions-resilient structures, and the overall regimes in the sanctions map.

Grounds for refusal and typical failures

The grounds are set out most fully in the Caribbean instruments. Regulation 33(2) of the St Kitts and Nevis Citizenship by Investment Regulations, SRO 26 of 2023 declares an applicant not qualified to apply and not to be approved where he or she:

1. has provided false information on the application form;
2. has a criminal record;
3. is the subject of a criminal investigation;
4. is a potential national security risk to St Kitts and Nevis or to any other country;
5. has been declared bankrupt;
6. is involved in any activity likely to cause disrepute to St Kitts and Nevis;
7. has been denied citizenship of any country;
8. has been denied an entry visa by a country to which citizens of St Kitts and Nevis have visa-free travel.

Regulation 21(2) qualifies the visa limb: the refusal ceases to be a bar if the applicant has subsequently obtained a visa from the country that refused it. Under regulation 23 false information may lead to the application being declined, to deprivation of citizenship already granted under section 8(a) of the Citizenship Act, and to prosecution under the Perjury Act. European routes express the grounds through general immigration law — a threat to public order and security, an SIS alert, a conviction — but in substance check the same set.

The typical failures recur: an unproven source of wealth chain (inheritance, old property sales, crypto-assets), inconsistent versions given to the agent, the bank and the body, concealed visa and earlier refusals, undisclosed publications and litigation, a PEP connection without an explanation of wealth, and indirect sanctions proximity through partners and buyers of a business.

A refusal almost never comes with reasons: the body communicates the decision without findings, citing the protection of sources and security. The applicant does not know what triggered it and cannot prove to another programme that the cause was technical. In the Caribbean the bar on processing refused applicants has been carried into articles 73 and 74 of ECCIRA, with withdrawn applications treated as refused. Outside the region there is no automatic bar, but most programmes' forms ask about refusals and revocations under any visa or immigration procedure, and a false negative answer turns a viable file into one with established deception.

Review of refusals in the Caribbean

The right to challenge a refusal is not harmonised across the five, and a full procedure exists in one jurisdiction only.

In four of the five jurisdictions only judicial review in the High Court on procedural grounds remains, and it gives no access to the findings. The ECCIRA Appeals Tribunal (article 87) does not hear applicant refusals: it exists for disputes between licensees and the Authority, notably over fines, and allows 21 days from service of the notice.

The European residence routes: who checks, how long, how to challenge

In the European programmes vetting sits inside the ordinary immigration administration, and appeals are governed by general administrative law — except in Malta, which excludes them expressly. The periods in the table refer to the application as a whole; the Hungarian factsheet and the Maltese regulations set no separate deadline for background checks.

The sources are the rules themselves. In Portugal, article 82 of the consolidated Lei 23/2007 requires AIMA to consult SIS and VIS and to request security information from the UCFE — under the wording of Lei n.º 62/2026 of 10 September 2026, where this is necessary and justified; a refusal carries reasons, and article 87-B, added in October 2025, channels disputes into an administrative action. The Greek periods and fee come from the MITOS procedures registry, the Hungarian ones from the guest investor factsheet, and the Cypriot ones from the investor permit criteria. Regulation 19(1) of the Maltese MPRP Regulations makes Agency decisions final, and regulation 14 commits the checks to third-party providers and the police.

Portugal, Greece and Cyprus provide a real forum, although none promises access to the security services' findings. Hungary's appeal is short and closed to facts known in advance. Malta works like the Caribbean programmes: contracted providers, a board sign-off, no appeal, and a refusal record kept for up to ten years. Pre-assessment therefore matters most for Malta and Hungary.

After any refusal the following are recorded: the date of the letter, the exact wording (denied, withdrawn or delayed — three different regimes for data exchange), the documents filed in their versions as at the filing date, and the correspondence with the agent; for St Lucia the 60-day count starts at once. The bundle serves both a request for review and an honest answer on the next programme's form. Consequences for a status already granted are covered in status risk.

Preparation: the file before filing

A single source of wealth file

The file is designed for three reviewers at once: the immigration body, the bank receiving the investment and the future servicing bank. Their mandates differ, but the documents and the logic of the chain are the same. The working unit is a dated chronology of capital from the first earnings to the account the contribution leaves from, with a document for every step. Extracts for particular forms are drawn from it, and no figure in one contradicts another.

Consistency with bank KYC is tested before filing. The description of the source of capital in the programme form, in the receiving bank's questionnaire and in the agent's file is compared line by line: amounts, dates, company names, the applicant's roles. The tax self-certification reflects actual residence: a status still being processed creates no residence. A discrepancy the applicant regards as trivial is read by the provider as an attempt to mislead.

Pre-assessment

A pre-assessment reproduces the state check. Its subject matter is set by article 53 of ECCIRA: identity, criminal and civil history, financial integrity, source of funds and the applicant's political exposure. A full private report adds directorships and holdings, court databases, media in the original language and a comparison of what was declared against what was found; a report without local enquiries in the country of origin covers only sanctions and PEP screening and adverse media.

State due diligence tariffs give a cost benchmark: St Kitts and Nevis charges USD 10,000 for the main applicant and USD 7,500 for each dependant aged 16 and over (reg. 33(4) of SRO 26 of 2023); Dominica charges USD 7,500 and USD 4,000, plus USD 1,000 per person aged 16 and over for the interview; Antigua and Barbuda charges USD 8,500 for the main applicant and USD 5,000 for a spouse.

Findings before filing are handled in different ways. A factual finding that a document can close — a spent conviction, a discontinued case, a settled tax dispute — is disclosed on the form with the court decision and a certificate, moving the episode from "concealment" to "disclosed and explained". A namesake on a sanctions list or a false match in the media is cleared with a note giving identifying details. A finding that cannot be cured means the application should not be filed: a Caribbean refusal closes the other four programmes, while a pre-assessment report remains a private document.