Due Diligence in Investment Migration: What Is Checked and Why Files Fail

Concept: the check is commissioned by a state, not by a bank

Investment migration does not test whether you can pay. It tests whether you are admissible as a future resident or citizen. The customer is a dedicated government unit — a Citizenship by Investment Unit, an immigration agency, a ministry of the interior — and the work is done by an independent due diligence firm engaged by that unit under contract, not by the applicant. The subject matter is broader than any bank onboarding: source of funds and source of wealth, business reputation, litigation and tax history in every country of residence, sanctions screening, politically exposed person status, and the record of refusals under other programmes. The cost of error differs too. A bank that dislikes a file simply declines to open the account and nobody hears about it; a state records the refusal, and in the Caribbean it also passes that record to its neighbours. That changes the logic of preparation: the file is assembled once, against the strictest standard available rather than the requirements of one particular programme, because in that region there may be no second attempt. How the programmes themselves are built, and how residence routes differ from passport routes, is set out in the survey of investment migration models.

Five layers: the file, the independent check, the interview, data exchange, re-screening

A modern programme assembles its decision from five consecutive filters, and they fire at different moments.

The first layer is the file. Application forms, passports and the full history of their issuance, birth and marriage certificates, police clearance certificates from the country of nationality and from every country where the applicant lived longer than a set period (usually six or twelve months after the age of 16), medical documents, proof of address, professional and bank reference letters — and, above all, the evidence trail behind the money.

The second layer is the independent check. The unit hands the file to an external provider that works open and closed sources: corporate registries, court databases, sanctions and PEP lists, adverse media in the original language, and local enquiries on the ground in the country of origin. Industry monitoring names Exiger, S-RM and BDO among the firms engaged by Caribbean units; dedicated investment migration product lines also exist at LSEG Risk Intelligence. The provider decides nothing — it delivers a report with risk ratings and findings.

The third layer is the interview and biometrics. Since 2024 the interview has been a standing element in all five Caribbean programmes rather than an exception: the St Kitts and Nevis unit describes it plainly as a separate step in the process for the main applicant and, where required, for dependants aged 16 and over.

The fourth layer is information exchange between programmes. A refusal has stopped being a local event.

The fifth layer is re-screening after the status has been granted: audits of already approved files, retrospective screening against updated sanctions lists, retrieval of revoked passports, re-enrolment of biometrics. This is the layer growing fastest in 2026, and it is what makes a status obtained through an investment programme revocable — see the analysis of status risk in investment migration.

Who holds the filter: the licensed agent, the unit, the independent provider

Under most programmes you cannot file directly with the unit — the only way in is through a licensed agent. The draft agreement on a single Caribbean regulator hardens that architecture. Under the bill tabled in Antigua and Barbuda, article 36 introduces mandatory pre-qualification: agents, local agents, sub-agents and marketing agents must all be approved by the Authority and licensed under national law. Article 53 deals separately with independent due diligence providers, defined as a company or specialised professional team approved under the agreement and carrying out full verification and background investigation; article 54 adds supervision and audit of the vetting procedure itself.

The division of roles matters. The agent assembles and files but does not assess; the provider assesses but does not decide; the unit decides and the minister signs. An applicant who tries to "come to an arrangement" at agent level is buying an illusion: a commercial consultant has no influence over an independent firm's report, still less over the conclusions of a financial intelligence unit. The only thing that moves the outcome is the quality and completeness of the file — and a difficult detail disclosed up front is almost always cheaper than the same detail found by the provider unaided.

The Caribbean: six principles, the 2024 MoU and a shared refusals database

In three years the Caribbean has travelled from five independent programmes to something close to a common procedure, under pressure from the United States and the European Union.

The six principles and the bar on refused applicants

The starting point is the six principles agreed with the US Treasury. At the third US–Caribbean Roundtable in Grenada on 29 August 2024, reported by the Eastern Caribbean Central Bank, five states — Antigua and Barbuda, Dominica, Grenada, St Kitts and Nevis, St Lucia — recorded their implementation status. Four principles were reported fully implemented: collective treatment of denials (no processing of an application from a person refused by any of the other four jurisdictions), mandatory interviews with all applicants, additional checks through financial intelligence units, and the suspended treatment of Russian and Belarusian nationals. Two — programme audits and the retrieval of revoked passports — remained work in progress.

In parallel, four of the five states signed a memorandum on 20 March 2024 fixing the price floor: a minimum contribution of no less than US$200,000 from 30 June 2024, measured as the amount actually received and credited rather than the gross payment net of agent commissions. St Lucia did not sign. The same document commits the signatories to a regional body and to a digital portal for exchanging applicant data, built on the CARICOM IMPACS Joint Regional Communications Centre.

ECCIRA: biometrics, interviews and one database

The next step is the agreement establishing the Eastern Caribbean Citizenship by Investment Regulatory Authority (ECCIRA), signed by all five states on 25 September 2025 with its headquarters in Grenada. The shape of the text shows what vetting is becoming. Article 51 introduces the collection and protection of biometric data, and the definition in article 2 covers fingerprints, iris scans, facial images, voice samples and other physical, physiological and behavioural identifiers — collected specifically for identity verification, background checks and security screening. Articles 56 to 60 turn the interview into a full procedure: interview requirements, interviews of dependants, interviewer requirements, the record and content of the conversation, and compliance oversight. Articles 73 and 74 govern the exchange of information on refused and revoked applications and impose a direct bar on processing them. Articles 75 to 80 create the Eastern Caribbean Citizenship by Investment Database: what it contains, how data is transmitted, access and security, data protection, audit and reporting. Articles 70 and 71 deal with passport revocation and physical retrieval. The Authority may impose administrative fines and withdraw licences; alongside one representative per state, its board reserves seats for the Eastern Caribbean Central Bank, the OECS Commission and CARICOM IMPACS.

The agreement enters into force on the thirtieth day after the fifth instrument of ratification is deposited (article 95). As of August 2026 the thing to track is the ratification status in each of the five countries: industry forecasts pointed to early 2026, but that must be confirmed against national instruments rather than press releases. What already operates regardless of ratification is national measures. The St Kitts and Nevis unit, for one, has run a national biometric enrolment and passport modernisation programme since 14 April 2026, requiring citizens who obtained status through the programme to enrol by 31 July 2027. The practical meaning: biometrics ceases to be a one-off episode at filing and becomes a permanent tether.

The timings are averaged estimates from IMI Daily's monitoring of files actually completed in 2026, not the "three to six months" of sales decks; on the same count Grenada's refusal rate climbed to roughly 14% in the third quarter of 2025 against a historical 8%. Every payment is broken down in the total cost of investment migration, and the country detail sits in the programme reviews for St Kitts and Nevis and Grenada.

The EU: from 10 July 2027 the migration agent becomes an obliged entity

The most structural change is happening not in the Caribbean but in the European Union, and it rewrites the intermediary's status. Regulation (EU) 2024/1624 — the single AML/CFT rulebook — classes "investment migration operators" as obliged entities in article 3(3)(l): persons providing intermediation services to third-country nationals seeking to obtain residence rights in a member state in exchange for any kind of investment. Under article 90 the regulation applies from 10 July 2027; the deferral to 10 July 2029 covers only points (n) and (o) — the football segment — so migration agents fall inside the general date.

Article 41 is addressed not to the agent but to every obliged entity dealing with such clients: applicants for investor residence must be subjected to the enhanced measures of article 34(4), specifically points (a), (c), (e) and (f) — additional information on the customer and beneficial owners, information on the source of funds and source of wealth, senior management approval for establishing or continuing the relationship, and enhanced monitoring of that relationship. The scope is drawn widely: transfer, purchase or lease of real estate, investment in government bonds, investment in corporate entities, donations to a public good, and contributions to the state budget.

Two practical consequences follow. First, an agent working European residence programmes must maintain its own risk assessment, apply enhanced due diligence, retain records and file suspicious transaction reports — it stops being a pure sales channel and becomes a second independent filter whose "no" arrives before the state's. Second, the applicant now passes essentially the same check at least three times: at the agent, at the state, and at the bank the money travels through. Discrepancies between those three document packs are the single largest generator of questions.

Pressure on the institution itself: the CJEU judgment and the visa suspension mechanism

Alongside tighter vetting, the very idea of citizenship for money has come under attack. On 29 April 2025 the Court of Justice of the European Union, in Case C-181/23, held Malta's investor citizenship scheme incompatible with EU law: granting the nationality of a member state, and with it Union citizenship, in exchange for predetermined payments or investments amounts to the commercialisation of the status and is irreconcilable with the principle of sincere cooperation.

The second instrument is the revised visa suspension mechanism. The Council of the EU approved the new rules on 17 November 2025, and Regulation (EU) 2025/2441 names for the first time, as an express ground for suspension, the operation of an investor citizenship scheme granting status to persons with no genuine link to the state. It also lowers the threshold for a substantial increase in entry refusals, overstays and asylum applications from 50% to 30%, and lengthens the initial suspension from 9 to 12 months, extendable to 24. The consequences are already tangible: on 7 July 2026 the government of Antigua and Barbuda responded publicly to a European Commission communication demanding the programme be wound down by 1 June 2028, stating that vetting had been strengthened for applicants of all nationalities and that persons under EU restrictive measures were excluded outright. How this plays out across the region is treated separately in Caribbean CBI programmes on the 2028 horizon and in the review of the EU visa suspension mechanism.

Source of funds and source of wealth: what exactly has to be proved

The commonest cause of delay and refusal is not criminality but a failure of proof. Two concepts have to be kept apart. Source of funds is the origin of the particular money paying for the investment: how it reached the remitting account and by what payment it will leave. Source of wealth is the origin of the whole fortune: how the person came to accumulate capital of that size at all. The first is closed out with a statement and a contract; the second takes a 10-to-20-year history. The duty to prove both levels is written directly into article 34(4)(c) of the European regulation and reproduced in the application forms of the Caribbean units.

One rule of evidence governs everything: every unit of currency must show a documented transition from one state to the next, with no blank spots. A five-year gap is closed by a document — a tax certificate, company accounts, a contract — not by an explanation. Consistency is tested separately: declared wealth is measured against the public profile, tax filings and corporate registries, and a discrepancy of an order of magnitude is itself a finding. The full method for assembling the pack is set out in the material on source of funds.

The tax layer: why the OECD treats the schemes as CRS circumvention

Vetting at the gate is not the only filter. Since 2018 the OECD has regarded some of these schemes as a potential tool for circumventing automatic exchange of information: a tax residence certificate from a convenient jurisdiction is handed to a bank in place of the country where the person actually lives. The high-risk criteria are stated plainly: the scheme gives access to a personal income tax rate below 10% on offshore financial assets and requires no significant physical presence — meaning at least 90 days in the jurisdiction. Where doubt arises, financial institutions are advised to put four further questions to the account holder: whether the residence rights were obtained through a CBI or RBI scheme, whether they hold residence rights in other jurisdictions, whether they spent more than 90 days in another jurisdiction in the preceding year, and where they filed personal income tax returns.

For the holder of a status the conclusion is direct: a passport or residence card does not by itself create tax residence, and using one as a self-certification to a bank leads to enquiries and, where the answers diverge, to a report to the local tax authority. The mechanics of exchange are covered in the review of CRS, and the link between status and tax residence in the material on golden visas and tax residence.

Sanctions, PEPs and applicants with a Russian connection

Three categories account for most problem files. The first is sanctions overlap, and not only direct: connected persons, former employers, stakes in restricted companies, and counterparties to the transaction from which the capital arose are all screened. The second is politically exposed person status: being a PEP is not a bar but a trigger for enhanced due diligence and senior management approval, and it lengthens timelines sharply while requiring the origin of wealth to be explained irrespective of office. The third is the country of origin itself: since 2024 the suspension of applications from Russian and Belarusian nationals has been fixed as the sixth Caribbean principle and confirmed as implemented. This is not a matter of "harder" but an institutional exclusion, and there is no point routing around it through second citizenship elsewhere: the forms require disclosure of every nationality and every previous passport, and concealment is itself a ground for refusal and later revocation. The point generalises for readers with no Russian connection at all — it is the clearest demonstration that nationality-level exclusions now travel between programmes as a matter of agreed policy, so any cohort can be added to such a list at short notice. The specifics of this group are treated separately in Russian applicants in investment migration, and the structural side in the review of sanctions-resilient structures.

Refusal: what it means and what it does to other programmes

A refusal in investment migration almost never comes with reasons. The unit communicates the decision but not the findings, citing security and the protection of sources. That creates two problems: the applicant does not know what triggered the outcome and cannot correct the specific detail, and cannot prove to another programme that the cause was technical.

As for what a refusal does next. In the Caribbean there is a direct bar on processing an application from a person refused by any of the five jurisdictions — the principle fixed in 2024 and carried into articles 73 and 74 of the regional regulator agreement together with the shared database. Outside the region there is no automatic bar, but the forms of most programmes ask about refusals and revocations under any immigration or visa procedure of any country, and a false negative answer turns an otherwise viable file into a file with established deception. Withdrawing an application before a formal decision is no universal escape: the Caribbean rules treat refused and withdrawn applications alike for information-exchange purposes.

What is actually done about it. Before filing — a pre-assessment commissioned by the applicant from the same class of provider that works for the states. It is a paid service, and it lets you see the findings before the unit does and prepare a documented explanation. Where there is an old problem — a long-spent conviction, a tax dispute, a closed criminal case, a namesake on a sanctions list — it is wiser to disclose it yourself with court records and certificates attached than to bet on inattention. After a refusal — record the date, the jurisdiction and the stage reached, and build the next strategy outside the connected perimeter, without refiling under a variant spelling of the name.

Questions and answers