The FATF and OECD has published a join report Misuse of Citizenship and Residency by Investment Programmes. The report examines in detail money laundering and financial crime risks associated with investment migration programmes, including bribery, fraud and corruption and how such schemes are prone to exploitation by financial criminals.
According to FATF, Illicit actors may obtain a visa or citizenship through investment programmes as an insurance policy before committing crimes (or before these offences are discovered) or as a tool to enable future crimes. Criminals have exploited a range of vulnerabilities in CBI/RBI programmes to perpetrate massive frauds and launder proceeds of crime and corruption reaching into the billions of dollars, while also hiding assets in less compliant or effective jurisdictions, facilitating organised crime and evading law enforcement.
Corruption is another problem. Corrupt Public Officials operating in jurisdictions offering
CBI/RBI programmes with inadequate programme integrity or governance provisions may be able to profit illicitly from these programmes (for example, by demanding or profiting from bribes, either monetary or any other undue advantages, in exchange for CBI/RBI-related services).
Illicit actors are able to exploit CBI/RBI programme when there is:
- minimal or weak vetting conducted by the government or third-party service providers;
- weak monitoring or due diligence on individuals granted favourable citizenship allowing access to new bank accounts and company formation;
- non-existent or inadequate procedures to suspend or revoke passports if the holder’s risk profile changes;
- insufficient transparency, accountability, oversight and control in the governance of the programmes;
- the opportunity to evade capture and prevent asset recovery; and
- lack of information sharing between the public and private sectors.
CBI Vulnerabilities
CBI/RBI programmes with insufficient transparency, accountability and oversight are at risk
of cross-border corruption, including bribery and fraud. CBI programmes are attractive to illicit actors because they allow enhanced freedom of movement; ability to incorporate businesses in additional jurisdictions; and provide potential access to banking in multiple jurisdictions, particularly those with weak anti-money laundering and countering the financing of terrorism (AML/CFT) regimes and little financial transparency. Alter identity, including birth and nationality, making it challenging for compliance professionals at FIs or other businesses to engage in accurate due diligence at =onboarding.
RBI Vulnerability
RBI programmes, although they do not grant direct access to a passport,
are attractive to illicit actors because they provide illicit actors’ opportunities to:
- Move themselves, their family members, and associates to the issuing jurisdiction,
which can enable evasion of arrest and complicate investigations. - Purchase and access high value goods and services that require a physical presence,
- for example sending children to private schools or using real property.
Key Vulnerabilities
Name change – Identity laundering applicants could acquire a passport under a different name, or with information that is slightly different from their other identity documents, which may prevent database searches from identifying known derogatory information about that individual through poorly governed CBI programme . some individuals may provide fraudulent identity documents
No Sharing – immigration authorities often set up information sharing and collaboration mechanisms with law enforcement, Financial Intelligence Units (FIUs), as well as tax authorities and national security agencies. However, in some instances, these agencies are prohibited by law from sharing information for CBI/RBI programmes, which can hinder government’s ability to conduct adequate screening.
Discounts – Non-genuine investment options and fraudulent products that are often marketed as “discount” investment products.
Law enforcement data – due diligence firms do not have access to information held by law enforcement agencies (LEAs), the FIU or other closed information sets that may hold derogatory information on the applicant.
Identity Ambiguity – If an illicit actor obtains a new identity via a CBI programme prior to committing an offence, this may enable the individual to keep their original identity unaffiliated with the crime. Even where a person’s biographical details such as name and date of birth stay the same, an undisclosed new citizenship enables an individual to create ambiguity around their identity, which can prove challenging to law enforcement. CBI programmes that do not maintain a record of the applicants and their previous identifying information make it particularly difficult for financial institutions and law enforcement to link criminals to their new identities, especially when that individual has multiple citizenships and residencies.
CBI to RBI – Holding multiple passports and visas/residence permits is a common practice seen across CBI and RBI programmes. It has been observed that the trend of using a CBI document to then obtain an RBI visa coincided with reported incidences of discrepancies in biographical details. Obtaining multiple passports and visas/residence permits enables illicit actors to leverage the attributes of different programmes.
Lead application family – High-risk individuals to gift wealth to their spouse or other family members who will make the lead application, with the high-risk individual then applying as a family dependent. This typology can be particularly common in the case of corrupt actors. Where the source of wealth or funds associated to an applicant is derived from a particular third-party associate or extended family member, it is important that they are also subject to vetting.
Extradition abuse – One appealing feature to criminal actors is where a jurisdiction has no extradition agreement with a jurisdiction where an applicant is committing offences or is under investigation or prosecution. Criminals may be able to take advantage of countries offering CBI/RBI programmes and which do not extradite their own nationals. Once a person is ensconced with new citizenship or residency, the country which granted it may have difficulty removing that person, including for prosecution, even if it were inclined to do so. Finally, there may be an opportunity to obtain an official or diplomatic post in the new country, which may come with certain privileges or immunities that place the person even further beyond the reach of law enforcement.
Limited law enforcement – If the jurisdiction in question has limited or no law enforcement co-operation with foreign counterparts, this makes a jurisdiction more appealing to a criminal actor. Criminals may also select a jurisdiction for citizenship/residency because that country has no jurisdictional basis, practical opportunity, or interest in conducting their own investigations into the individual and their asset.
NCBC – Criminal users of CBI/RBI can leverage the lack of mutual legal assistance treaties or the lack of recognition among many countries of non-conviction based confiscation (NCBC)., and, correspondingly, the lack of international assistance such countries would be willing to provide as related to NCBC cases. This can hinder efforts to recover criminal proceeds ongoing in third countries.
Identity laundering – Criminal users of CBI/RBI programmes will look to use portfolios of visas and citizenships for a range of reasons including to launder their identities, hindering their removal by obtaining access to additional treaty rights or privileges, achieve novel offending opportunities, or to conceal their full travel histories from any given party. This can also enable the evasion of travel bans and alerts implemented in third countries, or possible efforts to include such persons on sanctions lists.
Cloaking – In situations where a “new identity” is not assumed, the applicants may be able to rid themselves of the cloak of their prior citizenship and any additional scrutiny or reputational impact that may have entailed. This opens opportunities for “layering activity” in money laundering, as well as for further concealment of criminal assets through countries and complex structures that are more difficult for investigators in other jurisdictions to unravel.
Misuse New Citizenship – After citizenship or residency is granted, jurisdictions should have systems in place to ensure participants are not misusing their new citizenship. This includes conducting a periodic review of applicants for changes in their risk profile to include warrants for arrest, sanctions listing, bankruptcy, etc . many countries offering CBI/RBI do not consider monitoring the activity of their new citizens/residents as part of their programme. This creates an opportunity for misuse. once a new citizenship is obtained, the individual can access new bank accounts or products and can create legal entities in the new jurisdiction, further obscuring their true identity and potential links to criminal activity.
Abuse – Legal and regulatory constraints were noted as an obstacle for revoking citizenship when an investor is found to be abusing their citizenship or to have committed an unrelated offence. Another challenge noted by project participants is the inability to physically retrieve a passport, particularly if the applicant never lives in the issuing jurisdiction. This is a concern as financial institutions and trust and company service providers (TCSPs) outside CBI jurisdictions may not have the capability to identify a revoked passport in the same way travel authorities at international airports can.
Property Fraud – Real estate investments provide several risks for CBI/RBI programmes. One vulnerability faced by programmes which permit property as a qualifying investment requirement is they are susceptible to over/under valuation. Property has long been a desirable vehicle for storing criminally obtained wealth and as such this investment class is particularly attractive both for money laundering and for holding wealth once funds have been laundered. Key threat modalities observed include two broad categories: over-valuation and fraud. Frauds can include schemes to cheat the programme by reducing the amount of money invested to below that of what is intended by the programme via methodologies such as the artificial over valuation of company shares/assets that are purchased or via money merry go round schemes where the same money is invested repeatedly by different investors.
Sidestepping – Several marketing agencies have openly promoted the desirability of using CBI/RBI programmes and resulting documentation as a means for users to sidestep home jurisdiction regulations around virtual asset activities. This practice, paired with weak or non-existent AML/CFT requirements at many VASPs, may offer cybercriminals, including money launderers, particular advantage in achieving greater anonymity and evading detection.
Adequate vetting and screening of applicants is key to a robust CBI/RBI programme. Due consideration should be given to the risk that an applicant may be seeking entry into a programme and the resulting document as a preparatory step before they go on to commit crimes. Initial due diligence checks will not be able to identify offences which have not yet taken place.
“Multilateral law enforcement co-operation can be a key element of most countries CBI or RBI programmes. “
FATF and OECD
FATF Recommendations
The FATF and the OECD have identified specific areas where effective implementation is critical, including: responsibility and oversight, adequate vetting, continued monitoring, and corrective measures. The FATF Recommendations set out a comprehensive framework of AML/CFT measures for jurisdictions to apply to counter ML and TF effectively.
1. Issuance of passports, visas, and/or residence permits is made subject to cross checks against applicable law enforcement, intelligence and immigration systems for adverse information.
2.Any documents issued are based on original and true name and place of birth to reduce the risk of identity laundering.
3.Number of qualifying applicants are limited to ensure adequate resources capabilities for vetting and to mitigate risk by creating a culture of focusing on quality over quantity of applicants.
4.Agencies ensure that the application processing time is sufficient to allow for thorough background checks and that mechanisms exist for cases to be moved out of the usual service standard if they are particularly complex and require further slower time enquires.
5.Jurisdiction should also not offer time limited discount investment offers. This prevents sudden surges and ensures a focus on quality applications over volume. Discount sales also promote a “race to the bottom” for all countries in terms of value and standards. In the long term, this behaviour can harm all industry participants including those operating the sale.
6.Multiple and independent due diligence providers could be used to produce reports for the same individual. This is a quality control feature. There is currently no regulatory regime for third party due diligence providers, so it is beneficial to test performance of providers by periodically duplicating checks to test the quality of due diligence service providers and to manage the risks of conflicts of interest.
7.Reasonable target times are important to allow for thorough background checks and building in flexibility mechanisms to move complex/higher risk cases outside of service standards and into an open-ended consideration process enables caseworkers to make careful, well-reasoned decisions rather than being obliged to make quick ones.
8.To enhance transparency, jurisdictions could consider publishing an annual report with statistical information about the programme, including number of applicants, number of passports issued, demographic information of applicants (percentages), and number of denied applications.
9.Jurisdictions could consider restricting the volume of applications to an annual cap. Application cap can ensure that case-working teams are not overwhelmed and put under pressure if an application surge is experienced.
10.CBI/RBI Programmes should consider imposing a requirement to disclose all current and previous identities and nationalities imposed on applicants, so that if an applicant deliberately conceals additional identities this may be grounds to revoke any issued passport or visa and facilitate inter-agency and international cooperation where necessary.
11.Use of biometric checks against international and local law enforcement databases are encouraged. These unique physical characteristics, such as fingerprints, could be collected, stored electronically, and used for recognition. Data is stored in a shared secure database that is accessible to international oversight and partner nations is another good measure. The use of fingerprints when running checks against law enforcement databases is a valuable fail safe where individuals have committed offences in concealed identities including potentially through other previously obtained investment migration obtained identities.
13.Jurisdictions are encouraged to review approved applicant names annually against available international law enforcement co-operation systems such as Interpol and international sanctions lists to ensure there are no active investigations or sanctions. This could also include the regular refreshes of checks for all active beneficiaries of investment visas or passports against global sanctions registers. I
14.It is important that PEP applicants are identified, and the fully understood, and where necessary risk mitigated. Jurisdictions should have appropriate risk-management systems to determine whether the customer is a PEP in line with FATF Recommendation 12. This would include obtaining senior management approval from the financial institution for considering applicants who are PEPs and conduct enhanced ongoing monitoring of the applicant once citizenship or residency is granted.
15.CBI issued passports could include all past names or aliases used by the individual. Placing all other known past aliases and maiden names into either the front biodata page or official observations in both the issuing jurisdiction’s language and other commonly used languages, prevents a CBI document from being used to change and conceal alternative identities.
16.Issuing jurisdictions should consider how to present information so that it is readily apparent and robustly protected from identity laundering or document tampering. CBI passports could be marked as acquired through investment. A clear note in the document identifying that it has been obtained via a CBI programme on the front cover and either on the biodata page or the remarks page, could allow all regulated entities to establish that the document they are considering is a CBI issued document. This would allow financial institutions can apply appropriate due diligence to individuals that acquired CBI without subjecting all citizens from an issuing jurisdiction to unnecessary or unwarranted enhanced diligence.
17.Jurisdictions could consider imposing a ban on changing of names used in CBI issued documents to include during the application process or after the issuing of the document. This would ensure that illicit actors are not utilizing programme to create new identities to conceal offending or evade capture. Where a surname is changed due to marriage/civil partnership the document should clearly contain reference to any previous maiden name on the biographical data page in addition to the new surname. Jurisdictions that publish naturalizations or residence permits (e.g., in the official gazette) should identify if a nationality or residency is acquired through an investment.
Transparency
Without clear and transparent frameworks for accountability and governance for the management of CBI programmes and revenues, there is a high risk of misappropriation or misuse of the funds invested in, and raised by, CBI/RBI programmes. Public communication on policy outcomes is a good practice in any policy domain and CBI/RBI is no exception. Publishing the number of passports, residence permits, or visas issued – as for other migration programmes – could be considered. Programme-wide figures on numbers of documents issued would also provide the public and civil society with a broad annual indication of how much money is flowing through a programme. Publishing the countries of origin associated with applications granted is also something that could be considered. This would help provide civil society with information on the geographic exposure for their programme and potentially identifying associated money laundering risks. 168. Publishing the volume of applications and outcomes (e.g., granted, refused, withdrawn), broken down by jurisdiction of application could be considered. This information provides civil society with an indication of how robust vetting controls are in practice. 169. Publishing accounts showing revenue generation, cash held on deposit and spending destinations is useful. This provides for transparency over the amount of funds
Robust Vetting
Law enforcement checks are an important part of the vetting process. Applicant identification documents could be sent to local, regional, and international law enforcement authorities for background and criminal checks, including for suspicious financial activity. Secondary review protocols and/or automatic disqualifiers should be considered for applicants with criminal histories or other derogatory law enforcement information. It is also encouraged that governmental programme operators identify, consider and if appropriate reject applicants with histories of serious civil action taken by law enforcement or regulators. This should include civil recovery and asset freezing procedures related to corruption/unexplained wealth or regulatory censor actions (such as being struck off as a director or banned from providing financial services due to malpractice).
Due Diligence Team (DDT)
The creation of a Due Diligence Team (DDT) within the relevant competent authority provides for in house vetting and Due Diligence related case decision making capabilities. This team can review statutory forms and supporting documentation for correctness, authenticity, and certification, where applicable, as well as evaluating wider DD products such as any reports provided by external due diligence providers as well as collating any “inhouse” intelligence products and open-source checks carried out by the authority or associated law enforcement/intelligence agencies. It is encouraged that the DDT conduct a peer review of every application. If appropriate (meaning, for high-risk applicants), the application could be presented to a board for a final review before a recommendation is made to the approving authority. The DDT can also play a key role in helping in the oversight of vetting conducted by Agents (by identifying agents associated to excess high-risk cases). DDT may include aggregating and processing application documents through a risk matrix with a risk assessment report produced. The risk matrix should include key risk evaluation information such as the origin of the applicant, their professional background, identifying whether the person is a PEP, or someone exposed to high-risk individuals and the source of wealth. This could also include whether the person has been charged or convicted of a crime. Assessments of source of wealth in addition to source of funds provides a useful means to identify where criminal actors may be using legitimate funds to obtain a document but then use this status to facilitate the movement of wider criminally obtained wealth into the issuing jurisdiction or thirdparty countries. It is strongly encouraged that the immigration authority conduct training for their casework staff to assist them in conducting in due diligence, audit and risk, or compliance. Whilst programme operators may commission due diligence reports from private sector providers, the ultimate decision on whether to grant a case always sits with the immigration authority
Vetting systems and processes are intended to prevent fraud and misuse and deter and prevent criminal/illicit actors from obtaining CBI or RBI. Jurisdictions are encouraged to consider the good practices listed below to further enhance vetting procedures. 139. Creating a multi-tier vetting process to conduct CDD by a licensed Agent, the Agency and any third-party recipient of associated funds (i.e., financial institution, property developer etc) independently of each other helps verify customer identity using reliable, independent source documents, data, or information. Each layer should be explicitly required to independently screen applicants, and should not rely on screening already undertaken by other layers. For example, types of CDD measures can include ensuring that biographical information such as place of birth and all current citizenship holdings are verified to identify high-risk jurisdictions. Adverse media searches are helpful for identifying negative news reporting, and consideration should be given to ensuring search tools and protocols allow for checks to be made in the language (or languages) of the jurisdiction of origin and any other countries that are closely associated with the applicant. Professional background checks help confirm source of wealth and funds associated with CBI investment. Open-source screening to identify adverse information/news reporting is valuable, particularly when tools and capabilities are enabled to carry out searching against media in the language/languages of the jurisdiction of origin. Identifying indications of potential criminal activity from media is helpful when an individual may have cover from prosecution or where the necessary information from law enforcement cannot be obtained.
Agencies should consider conducting in-person or virtual interviews to verify information, to test the credibility of submitted documents and gain accounts against adverse media. It is also an opportunity to better understand why a subject wants the citizenship and a passport, and what they plan do with it. Effective interviewing is a specialised skill and appropriate training in semi structured and dynamic interviewing for immigration and financial crime detection purposes should be considered.
