Citizenship and Residency by Investment: AML Risks and the FATF-OECD Report

Programmes that grant citizenship or residency in exchange for investment, often called golden passports or golden visas, are attractive to genuine investors and families. They are also attractive to people who want to put distance between themselves and their past. On 22 November 2023 the Financial Action Task Force (FATF) and the Organisation for Economic Co-operation and Development (OECD) published a joint report on the misuse of citizenship by investment (CBI) and residency by investment (RBI) programmes. This guide explains what the report says and what accountants, tax advisers and other professionals can take from it.

What the report covers

According to the FATF's publication page, CBI and RBI programmes grant citizenship or residency to foreign investors by expediting or bypassing normal migration processes. The report accepts that they can support growth through foreign direct investment. It also finds that they attract criminals and corrupt officials who want to evade justice and launder money. It links the programmes to money laundering, fraud, foreign bribery and corruption, and to wider effects on public integrity, tax and migration.

The OECD Secretary-General was quoted as describing criminal exploitation of these schemes as a multi-billion-dollar business to launder the proceeds of fraud and corruption. The FATF page does not give detailed statistics, so be cautious about quoting precise numbers from secondary commentary.

Why these programmes are attractive to criminals

The report explains the appeal in two ways. First, a new passport or residence permit can give a person global mobility, and in some cases a fresh identity trail. Second, criminals can hide their identity and activities behind shell companies in other jurisdictions, which makes it harder for authorities to see who is really behind the money.

The vulnerabilities the report identifies

• Intermediaries. Applications often go through agents, lawyers, advisers and promoters. The more parties involved, the more places a problem can be missed.
• Several government agencies. When responsibility is spread across immigration, finance, justice and other bodies, gaps can open between them.
• Professional enablers. The report notes abuse by professionals who knowingly or negligently facilitate criminal applicants.
• Weak programme governance. Inconsistent checks, limited transparency and poor oversight raise the risk further.

The report stresses that the elevated risk relates not only to applicants but also to the professional enablers and intermediaries involved. That point matters to anyone in practice who is asked to help with an application, structure an investment or advise on tax.

What the report recommends for governments

Based on the FATF's summary, programme operators and governments are urged to analyse in depth how criminals could exploit their schemes, to build risk mitigation such as multi-layered due diligence into the design, and to administer programmes in a risk-sensitive way with safeguards. They are also urged to apply due diligence, transparency and integrity mechanisms, and to clarify the roles and responsibilities of all parties so that fraudulent activity can be detected.

The page does not set out specific recommendations for obliged entities and professionals. If you want the full detail, read the report itself rather than relying on summaries.

What it means for accountants and advisers

An accountant is unlikely to run a CBI or RBI programme. A practice may, however, meet one in several ways: a client may be applying, may already hold a passport obtained this way, or may ask for tax or structuring advice that touches the programme. The report does not prescribe a checklist, so the following are our practical suggestions built on standard anti-money laundering (AML) controls, not requirements taken from the report.

1. Treat the engagement as higher risk until you have evidence otherwise. Record why in your client risk rating.
2. Test source of funds and source of wealth. The investment is often large, so you need to understand where the money came from and be able to evidence it. Our guide to source of funds and wealth checks sets out the approach.
3. Screen for politically exposed persons. Applicants from positions of public influence, and their relatives and close associates, need enhanced attention. See our guide to politically exposed persons.
4. Look through structures. If the investment is made through companies or trusts, identify the real owners and controllers.
5. Check who else is involved. Ask which agents and intermediaries are acting and whether you have independently verified them.
6. Document your reasoning. If you proceed, keep a clear record of the checks and the judgement you reached. If you cannot get comfortable, consider whether to decline the work and whether a suspicious activity report is appropriate.

Frequently asked questions

Are all citizenship and residency by investment applicants suspicious?

No. The report recognises that the programmes can support legitimate investment. The point is that they carry an elevated risk that needs managing, not that every applicant is a criminal.

Does the report create new legal obligations for accountants?

The FATF and OECD report is a typologies and risk document. It does not itself create legal duties, although it informs how countries and supervisors think about risk. Your obligations come from your national law and supervisor.

What should I do if a client's wealth cannot be explained?

Do not proceed on assumption. Escalate internally, consider whether the concerns amount to a suspicion, and follow your firm's reporting procedure.

Where can I read the full report?

It is published on the FATF website under the title Misuse of Citizenship and Residency by Investment Programmes.

Next steps

Check whether your client risk assessment has a prompt for investment-migration work, and add one if it does not. Make sure your team knows how to handle large, structured investments. For wider context, see our overview of the KYC and source of wealth checks used in private banking, and explore Learnsignal's CPD courses for ongoing AML training.