The Financial Action Task Force issued guidance on residence- and citizenship-by-investment programmes in 2022 that marked a structural shift in how international standard-setters approach the sector. What had been treated as a niche immigration product was now formally identified as a channel through which the integrity of anti-money laundering and counter-terrorism financing frameworks could be undermined. The practical consequence is that CBI programmes operating today do so in an environment where FATF's risk assessments directly influence the viability of those programmes — through the threat of grey listing for non-compliant host states, through banking access for approved applicants, and through the reputational exposure of advisers who do not understand what enhanced due diligence now requires.
The Five Risk Factors FATF Identifies in CBI Programmes
FATF's 2022 guidance identifies five structural vulnerabilities in CBI and RBI programmes that create money laundering and illicit finance risk. Understanding these risk factors is essential for any adviser who wishes to assess whether a programme's controls are adequate:
- Inadequate customer due diligence by programme agents: Intermediaries and authorised agents are the first line of screening for CBI applications. Where agent incentive structures reward volume rather than quality — as is common in commission-based models — the thoroughness of due diligence is compromised.
- Insufficient background checks on wealth and funds: CBI programmes that accept investment without adequately verifying that the source of funds is lawful provide a vehicle for laundering criminal proceeds through a legitimate investment structure.
- Absence of information sharing between agencies: Where a CBI programme's due diligence unit does not systematically exchange information with immigration authorities, financial intelligence units, and foreign counterparts, adverse intelligence about applicants may not reach the decision-maker.
- Politically exposed person risk: PEPs are a recognised high-risk category because of their exposure to corruption and abuse of public function. CBI programmes that do not have robust PEP screening and enhanced procedures for PEP applications create obvious vulnerabilities.
- Programme transparency deficits: FATF notes that where a programme's approval criteria, due diligence standards, and rejection rates are not made publicly available, meaningful external accountability is absent.
What Enhanced Due Diligence Means in Practice
Enhanced due diligence for high-risk CBI applications goes beyond standard identity verification. A file that meets current FATF-aligned standards will contain documented evidence of the following:
Source of wealth — not merely source of funds for the investment itself, but a narrative account of how the applicant accumulated their wealth over time, supported by documentation such as tax returns, company accounts, transaction records, and professional history. Where the applicant's wealth originates from a jurisdiction with weak AML controls, additional corroboration is expected.
Source of funds — specific documentation tracing the investment funds from a verified source account to the programme's designated payment channel. Wire transfers, bank statements, and confirmation from the sending institution that the funds originated from the named account are all standard. Where funds pass through intermediate accounts or are aggregated from multiple sources, each leg of the chain should be documented.
PEP and adverse media screening — using reputable commercial databases, not manual internet searches. PEP status must be determined not just for the primary applicant but for beneficial owners of structures through which the investment is made, and for close associates where relevant. Adverse media screening should cover multiple languages and jurisdictions.
Beneficial ownership — where the applicant invests through a company, trust, or fund vehicle, the ultimate beneficial owner must be identified and the structure documented. A CBI application submitted in the name of a holding company without disclosure of who controls and benefits from that company does not meet FATF standards.
Grey Listing Risk and Correspondent Banking
FATF's mutual evaluation process assesses member states' AML/CFT regimes against its standards. A jurisdiction whose CBI programme is assessed as creating systemic risk — because its due diligence is inadequate, its supervision is weak, or its transparency is insufficient — may find itself listed on FATF's grey list. Grey listing carries serious consequences: increased correspondent banking scrutiny, restrictions on international financial transactions, and in some cases the termination of correspondent banking relationships altogether for banks in the listed jurisdiction.
For CBI programme states, correspondent banking access is essential. Approved applicants who obtain citizenship in a grey-listed state may find that the passport they have acquired carries banking restrictions that were not present at the time of application. This is a risk that advisers must disclose and monitor.
What Advisers Must Do to Stay Compliant
An adviser who facilitates CBI applications is themselves a reporting entity for AML purposes in most jurisdictions. The obligations that follow from that status include conducting customer due diligence on clients, filing suspicious activity reports where there are grounds to do so, and maintaining records in accordance with applicable legislation. An adviser who submits an application without conducting their own independent due diligence — relying entirely on the programme's verification process — may not satisfy their own reporting obligations.
The practical requirements are: document your own client due diligence file independently; do not rely on the programme agent's checks as a substitute for your own; confirm PEP status and screen for adverse media before submission; and if a client's file raises red flags that cannot be adequately explained, withdraw from the engagement rather than file with unresolved concerns. Our due diligence guide covers the documentation standards we apply to every engagement.
Does FATF grey listing mean a CBI programme is shut down?
Not automatically, but it creates significant practical consequences. A grey-listed jurisdiction faces enhanced scrutiny from international financial institutions, potential restrictions on correspondent banking, and pressure from partner jurisdictions and visa-waiver partners to reform its AML/CFT framework or face further consequences. Some grey-listed states have accelerated programme reforms to exit grey listing status; others have seen visa-waiver access restricted during the period of listing. Advisers should monitor the grey list status of every programme they work with as an ongoing risk management task.
Are PEPs automatically refused in CBI programmes?
No. PEP status is a risk indicator that triggers enhanced scrutiny, not an automatic ground for rejection. A PEP applicant whose source of wealth is thoroughly documented and whose background screening is clean may be approved, though the standard of due diligence applied will be higher and processing may take longer. What is not acceptable, under current FATF-aligned standards, is processing a PEP application without enhanced due diligence or without disclosure of PEP status at the outset. Programmes that routinely approve PEP applications without enhanced procedures are failing their compliance obligations.
What documentation standard is required for source of funds in a CBI application?
The standard is a clear documentary trail from an identified source account to the programme investment. Bank statements showing the balance of funds at the sending institution, wire transfer confirmations, and bank confirmation letters are the minimum. Where funds originate from asset sales, property transactions, or investment liquidations, documentation of those transactions is also required. Advisers should ensure the chain is complete and that there are no unexplained intermediate transfers. Funds that cannot be traced to a verified legitimate source should not be included in the application.
How does FATF compliance affect an adviser's own legal obligations?
Advisers who facilitate CBI applications — lawyers, consultants, and migration advisers — are typically classified as designated non-financial businesses or professions under AML legislation and are subject to customer due diligence and reporting obligations. These obligations are the adviser's own, independent of whatever the programme operator does. An adviser must maintain their own KYC file, conduct their own screening, and file suspicious activity reports where applicable law requires them. Failure to comply can result in regulatory sanction and, in serious cases, criminal liability for the adviser personally.