9.3.1 Administration of DD in CBI

The administration of due diligence in CBIs is conducted by various entities including licensed agents, state-controlled Citizenship by Investment Units (CIUs), Financial Intelligence Units (FIUs), and third-party due diligence service providers. Licensed agents play a pivotal role in the preliminary evaluation of applicants at the onboarding stage. They liaise with the applicant, conduct comprehensive initial screenings, verifying personal documents such as identity papers, proof of income, and financial statements. This approach aims to ensure that only candidates who meet the stringent criteria proceed to the next stage.

CIUs implement a hierarchical risk-based framework and conduct customer due diligence (CDD) on applicants. They are supported with financial intelligence provided by FIUs. FIUs are mainly responsible for gathering, analysing, and disseminating financial intelligence, which aids CIUs in identifying and screening high-risk applicants. FIUs and CIUs play a crucial role in mitigating AML/CFT and tax reporting compliance risks. According to the FATF, these collaborative efforts are essential in ensuring compliance with international standards to prevent the misuse of CBI programmes (FATF, 2012). It can be argued that the effective sharing of information between FIUs and CIUs, facilitated by AI tools for the administration of CDD, can ensure that individuals seeking citizenship are thoroughly vetted and that any illicit activities are detected early in the process.

Enhanced DD (EDD) is administered when CIUs engage independent third-party firms to perform in-depth background checks on applicants who are deemed high risk after CDD is performed. Outsourcing EDD obligations encourages CIUs to delegate certain EDD AML functions to third-party service providers while maintaining ultimate responsibility for compliance. EDD encompasses a more thorough and in-depth background check of biometrics, family background, financial history, source of funds, political exposure, and criminal records, ensuring a comprehensive assessment and verification of information provided from applicants. This multi-layered approach underscores the programme’s commitment to thoroughness and integrity (Joseph and Turksen, Reference Joseph and Turksen2022).

A key component of CBI DD is the identification of ultimate beneficial ownership (BO) assets owned by applicants. Obliged entities are required to establish and maintain written procedures to identify and verify these individuals and their assets. This practice prevents malfeasant applicants from misusing companies to disguise their illicit activities and launder their criminal assets via CBI programmes (Complete Professional Services, 2016). Accessing public repositories of BO data, such as the UK Companies House (Companies House, 2023), bank account information and the EU’s Beneficial Ownership Registers (Court of Justice of the European Union, Reference 251Thomas2022), enables CIUs and third-party service providers to verify applicant legitimacy. Additionally, paid services like Orbis (Bureau van Dijk) (Moody’s, Reference Vaseashta, Rocha and Vaseashita2025), Dun & Bradstreet (Dun & Bradstreet, 2011), Sayari (Sayari, 2025), and LexisNexis (LexisNexis, n.d.) offer comprehensive company structure data, aiding in the identification of complex corporate networks and hidden ownership structures.

Compliance with these standards involves reporting suspicious activities and maintaining records to demonstrate adherence to legal requirements (Kenton, Reference Uyar2024). Non-compliance with international standards can result in significant penalties and reputational damage for a CBI practicing country and its citizens (OECD, Reference Vurubindi, Narahari, Maheswari and Aluvalu2023b). For instance, banks may refuse services to CBI passport holders due to perceived risks of money laundering even when no wrongdoing has occurred, leading to further banking and regulatory challenges for their jus soli and jus sanguinis citizens. By implementing rigorous DD protocols, agents, CIUs, and governments can ensure that only individuals of reputable standing are granted citizenship.

In summary, the structured and thorough DD processes in CBI programmes reflect a strong commitment to security, integrity, and international compliance, thereby offering a secure pathway for qualified investors to obtain citizenship. The analysis of the CBIs reveals how current DD processes are typically multi-tiered and facilitated by the CIU using a hierarchical framework (Joseph, Reference Joseph and Bielicki2021). The DD modus operandi operates as shown in Table 9.1, but is not standardised across programmes.

Table 9.1CBI DD process

Table 9.1 Long description

The table outlines the due diligence stages, processes, actors, and actions leading to the creation of an applicant risk profile. Stage 1 covers K Y C processes and initial screening by agents. Actions include confirming applicants’ identity, searching sanctions and international criminal watchlists, and assessing the applicants’ source of funds before the application is submitted to government authorities. Stage 2 includes investigations by both national and international intelligence and law enforcement, carried out by government Citizenship by Investment Units (C I Us). Checks include searches in national databases, criminal records, outstanding warrants, failed visa applications, suspicion of international criminal activity, and requests to foreign partners, Interpol, and other agencies. Stage 2 also includes enhanced due diligence conducted by third-party providers, who examine litigation records, P E P (politically exposed persons) status, regulatory issues, reputation and trustworthiness, adverse media, validation of documents, and undisclosed businesses. These steps contribute to the creation of an applicant risk profile. Stage 3 is the creation of a consolidated risk assessment by the government C I U, drawing on the findings from earlier stages.

The eventual standardisation of DD processes across various CBI programmes provides a solid foundation for establishing AI-facilitated minimum standards for all involved stakeholders. The European Parliament has highlighted the need for comprehensive security checks and DD in CBI schemes, noting that Member States must have adequate vetting processes and should not solely rely on intermediaries (third-party service providers) (Sophia, Reference Sophia2022). There are no publications illustrating that this is currently being maintained across all CBI practicing countries considered in this chapter.

Nevertheless, the OECD’s DD Guidance for Responsible Business Conduct offers practical support for implementing responsible business practices, providing clear explanations of DD recommendations and associated provisions (OECD, Reference Wang, Xu and He2023c). Geographic risk is a critical factor in assessing exposure to financial crime. Financial institutions must carefully evaluate jurisdictions, not limited to CBI, with weak AML/CFT frameworks, particularly those flagged by the FATF as high-risk or under increased monitoring. Moreover, countries viewed as having high levels of corruption, as indicated by Transparency International’s Corruption Perceptions Index, pose additional financial crime risks (Transparency International, 2023).

9.3.2 Anti-money Laundering Compliance

As financial crimes increasingly transcend national borders, international organisations such as the EU, FATF, and OECD have established international standards designed to combat money laundering and terrorist financing. These standards require states to harmonise AML/CFT practices (FATF, 2012; OECD, Reference Vurubindi, Narahari, Maheswari and Aluvalu2023b).

The FATF 40 Recommendations emphasise transparency and BO disclosure, particularly in contexts like investment migration schemes where anonymity and asset mobility can be exploited for illicit purposes (FATF, 2022; OECD, Reference Vedrenne2018b). Nonetheless, the practical implementation of these standards is often complicated by the reliance on private intermediaries. Many CBI and RBI programmes outsource due diligence processes to third-party agents or firms, which introduces substantial regulatory ambiguity. These agents may operate under varying levels of scrutiny and with differing standards of compliance, thereby generating inconsistencies in risk assessment and exposure to reputational and financial harm (Joseph and Turksen, Reference Joseph and Turksen2022).

In light of these minimum international standards, the EU enacted the Sixth Anti-Money Laundering Directive (AMLD6) (Directive (EU) 2018/1673), which outlines stringent due diligence requirements for obliged entities, particularly in contexts involving high-risk third-country nationals seeking citizenship or residency via financial contributions. Articles 18a to 24 of the Directive establish the necessity for EDD, obligating financial institutions to implement robust KYC mechanisms and report suspicious transactions that may indicate IFFs, especially in sectors vulnerable to abuse such as luxury real estate, shell companies, and cross-border capital movements (European Commission, Reference Turksen2023; FATF, 2022).

The EU AMLD6 attempts to mitigate inconsistent approaches to risk assessment by expanding the scope of due diligence obligations to include non-EU-based entities engaging with EU markets. Notably, Articles 3(3)(l) and 18 of the AMLR6 impose compliance duties on foreign legal professionals, real estate agents, and service providers involved in high-risk transactions or schemes with an EU nexus (European Commission, 2021). However, the enforcement of these provisions remains fragmented. Diverging jurisdictional mandates, coupled with limited cross-border supervisory cooperation, have led to regulatory arbitrage where high-risk individuals strategically exploit legal loopholes and weak oversight in certain jurisdictions to secure residency or citizenship under opaque conditions (Shachar, 2017; OECD, Reference Vurubindi, Narahari, Maheswari and Aluvalu2023b). This problem is exacerbated by disparities in national enforcement capacities and the voluntary nature of FATF compliance, which renders some states more vulnerable to becoming safe havens for illicit financial actors (Strange, Reference Strange1996; Keohane, Reference Vaigandla, Karne, Siluveru and Kesoju1984). As such, there is an urgent need for a more centralised and uniform enforcement architecture, accompanied by international data-sharing frameworks and real-time risk profiling technologies, to prevent the circumvention of global AML/CFT efforts.

Complementing this effort, the newly established EU Anti-Money Laundering Authority (AMLA) strengthens transparency requirements, particularly in relation to BO disclosures and high-risk third-country transactions (European Commission, 2024b). The AMLA is expected to have a significant impact on CBI, subjecting them to more uniform and stringent EU-wide AML/CFT standards. In line with broader regulatory trends, both the European Commission and the Court of Justice of the EU have increased their scrutiny of CBI schemes that confer nationality without a demonstrable connection between the applicant and the Member State. The AMLA framework therefore represents a shift toward centralised enforcement, compelling Member States to either reform or discontinue CBI schemes that do not align with EU legal principles and AML expectations (European Commission, 2024b), as illustrated in Malta.

To mitigate the vulnerabilities associated with inconsistent regulatory oversight, there is a compelling need for the establishment of binding minimum standards within global CBI AML/CFT frameworks, particularly concerning the registration and supervision of third-party onboarding agents involved in high-risk financial transactions. A harmonised multilateral approach would require these agents, whether legal professionals, real estate intermediaries, or investment consultants to register with national AML supervisory bodies, thereby ensuring uniformity in compliance expectations and facilitating cross-border regulatory cooperation (FATF, 2022; OECD, 2023a). Such registration would not only promote transparency but also help in closing the enforcement gaps that currently allow regulatory arbitrage and the exploitation of weak jurisdictions by high-risk individuals (Joseph and Turksen, Reference Joseph and Turksen2022; Shachar, 2017).

The establishment of a unified CBI DD infrastructure aligns with the normative expectations embedded in major international legal instruments. For instance, the United Nations Convention Against Corruption (UNCAC, 2003) explicitly encourages states to enhance cooperation, share financial intelligence, and implement robust preventive measures, including effective oversight of financial intermediaries (UNODC, 2005). Similarly, the 1999 International Convention for the Suppression of the Financing of Terrorism mandates state parties to criminalise the financing of terrorism and to establish mechanisms that ensure the accurate identification of parties involved in financial transfers (United Nations, Reference Yun and Wood1999). These conventions reflect a growing international consensus that AML/CFT regimes must transcend national boundaries and include institutionalised provisions for international coordination and mutual legal assistance.

Moreover, the FATF’s 40 Recommendations emphasise the need for a risk-based approach to supervision, including the regulation of Designated Non-Financial Businesses and Professions (DNFBPs), such as those acting as intermediaries in investment migration schemes (FATF, 2012). However, enforcement remains uneven, particularly in jurisdictions where regulatory capture or institutional weakness undermines compliance. As argued by Strange (Reference Strange1996), the diffusion of power to non-state actors complicates the capacity of individual states to assert effective regulatory control. Therefore, embedding multilateral DD frameworks and minimum DD standards is not merely desirable, it is essential for ensuring integrity and safeguarding against the misuse of CBI routes for illicit purposes.

9.3.3 Tax Compliance

At first, we must highlight that the obtention of residency and citizenship rights through CBI regimes can be perfectly legitimate insofar as it does not undercut the ability of other countries to levy tax on activities and individuals that are in substance based in those other countries. In that sense, even if a jurisdiction decides not to levy tax on income generated in its territory, it is illegitimate for a jurisdiction to hinder the enforcement of legitimate taxing rights arising in other jurisdictions. Furthermore, it is important to note that fair taxation of individuals with complex economic activities spanning multiple jurisdictions and types of businesses can only be attained through good-faith administrative cooperation and taxpayer disclosure. In this section, we review domestic and international tax features that interact with CBI regimes creating risks of tax abuse, to derive a set of minimum standards that jurisdictions offering CBI regimes can follow to minimise such risks.

CBI regimes interact with domestic an international tax regulation in different ways. The most immediate interaction is with the host jurisdiction tax system, where loopholes in personal income tax may allow newly admitted residents to escape their tax obligations in the places of actual physical residence. The tax compliance risk is two-sided in this regard.

On the one hand, CBI regimes that enable tax residency for individuals who do not physically reside at least half of the year in the jurisdiction (United Nations, 2025; OECD, Reference Wang2025), effectively undermine the tax systems of other countries where CBI applicants may have more substantial economic and social presence. It is important to note that although CBI or RBI regimes provide concrete avenues to obtain the right to reside and work in a jurisdiction, the determination of tax residency is in principle a separate matter which depends on the facts and circumstances regarding the presence and activities within the jurisdiction, beyond the mere right to reside. Of course, the obtention of a physical address and the development of different types of investments in the host jurisdiction are factual circumstances that can lead to the tax residency determination. However, jurisdictions that offer CBI regimes may also have lax domestic tax residency regulations or facilitate the obtention of tax residency through poor enforcement of appropriate rules.

On the other hand, when a CBI applicant obtains tax residency from the host jurisdiction, the key question is: What would be the taxes levied on the individual? Absence of personal income tax (PIT), availability of lump-sum payment systems, or broad exemption of certain revenue streams are tax system characteristics with strong negative spillovers. These characteristics can play a determinant role in the decision of an individual to apply for a CBI regime to legally transfer its tax residence to the host jurisdiction and escape tax obligations in the places where the applicant has stronger social and economic ties. This is particularly the case for high-net worth individuals (HNWI) whose income predominantly derives from capital gains and passive investment income (Advani et al., Reference Advani2023; Scheuer and Slemrod, 2019).

Indeed, because the taxing rights for these types of income are commonly assigned to the country of residence of the individual receiving such income, or ‘realising’ capital gains, securing tax residency in a jurisdiction that does not impose tax on these types of income, and that does not enforce customary physical presence requirements – is a particularly straightforward way to escape PIT obligations arising in other countries. Beyond jurisdictions that simply do not have PIT (and therefore may not even require the declaration of income sources and amounts), jurisdictions that allow lump-sum payments provide functional equivalent to full exemptions, insofar as the effective tax rate can be arbitrarily close to 0 per cent where income levels are sufficiently high. Territorial tax systems can also have very similar effects, by exempting all income from foreign sources, which is likely to be the principal (or only) source of income for individuals admitted through CBI regimes.

In addition to tax abuse risks derived from the host jurisdiction’s domestic regulations, the nature of international tax regulations applicable to the country delivering CBI rights may also result in substantial tax compliance risks. Although international tax features interact with domestic regulations, they are different in the sense that the former can directly affect other countries’ ability to enforce legitimate taxing rights and regulatory safeguards, while the latter may only affect other countries to the extent that such other countries sovereignly choose to forego taxation or enforcement. Specifically, we review interactions that CBI regimes can have with AEOI under the OECD CRS, and with tax treaties.

Under the CRS, financial institutions must establish an account holder’s tax residency to share relevant financial information with the appropriate jurisdiction. If an individual obtains citizenship or residency documents without a genuine intention to relocate but instead to mislead their bank regarding their residency status, their financial details may either be reported incorrectly or not collected at all (OECD, 2017). For instance, a Brazilian citizen and longtime tax resident in Brazil that obtains CBI rights and a tax residency certificate from Seychelles can open bank accounts in that jurisdiction, or in any other third country, claiming to be a Seychelles tax resident.

The financial institutions where the newly admitted Seychelles resident has accounts will have an obligation to report financial data to the Seychelles, but the information will not be reported to Brazilian authorities. Even if Brazilian tax authorities consider that their citizen continues to be a tax resident or otherwise has tax obligations in the country, they will cease to receive CRS data, and may not even know the jurisdiction to which request tax cooperation, insofar as there is no legal obligation for a country operating a CBI regime to communicate the admission of an individual to his or her previous country of residence. International tax risks are further increased for jurisdictions having chosen ‘voluntary secrecy’ under Annex A of the Multilateral Competent Authority Agreement (MCAA), such as the United Arab Emirates (UAE) (OECD, Reference Wang2025).

In this case, for instance, if Brazilian citizen obtains CBI rights in the UAE and thereafter opens bank accounts in various countries as a UAE tax resident, then financial institutions subject to MCAA obligations will not even have to report financial account data, because the UAE refuses to receive CRS information regarding its tax residents. Therefore, in this case, even if Brazilian authorities request relevant data to the UAE through administrative cooperation, the UAE will have no financial account data to share. According to the Tax Justice Network, at least twenty-eight jurisdictions have chosen voluntary secrecy under MCAA Annex A, eighteen of which offer CBI regimes (Tax Justice Network, Reference Xue and Zhang2022).

Another aspect of CBI regimes interacts with CRS exchange of information. Indeed, research indicates that although CRS decreases offshore tax evasion at the bilateral level, a large number of tax evaders do not repatriate their funds. They rather find other ways to hide their money (Johannesen and Zucman, Reference Unger2014). For instance, a 2022 study shows that the introduction of CRS is associated with a significant increase of UK real estate investment from companies incorporated in highly exposed tax havens, suggesting a dynamic of asset substitution to ensure secrecy is maintained (Bomare and Le Guern Herry, Reference Bomare and Le Guern Herry2022). It is also evident that CRS has triggered a significant reaction in terms of taxpayer behaviour, particularly in countries with e-filing systems and stronger CRS enforcement (Alstadsæter et al., Reference Alstadsæter, Casi, Miethe and Stage2023). Tax evasion in CBIs can be achieved either through the offshoring of cash deposits into a CBI economy, and the investment of cash in other investments such as real estate.

Otherwise, bilateral tax treaties may also heighten tax compliance risks associated with CBI regimes. Individuals can use CBI regimes to obtain tax residency in a jurisdiction that has tax treaties facilitating tax avoidance and/or treaties that do not provide for assistance in tax collection. Indeed, CBI regimes hosted by low or no tax jurisdictions may in addition have treaties in force that prevent source taxation of important revenue streams. For instance, a jurisdiction that imposes no PIT at all, or that exempts foreign source interests, royalties, or services payments from income tax, may at the same time prevent the country where that income is generated from imposing tax. Way beyond the prevention of double taxation, these aggressive tax planning strategies ensure double non-taxation and undermine domestic resource mobilisation in source countries – where real economic activity takes place.

Another example of tax abuse risks would be tax treaties that restrict source taxation of capital gains resulting from indirect disposal of shares, under Article 13 of UN and OECD model tax conventions (OECD, Reference Venema2019; United Nations, 2021). For instance, an individual may obtain tax residency in a CBI economy such as Mauritius to prevent source taxation of capital gains derived from shareholdings in India, Ghana or Namibia (Hearson, 2022). Furthermore, anticipating disputes between tax authorities, nefarious actors may strategically choose CBI jurisdictions whose treaties do not provide for assistance in tax collection, such as those that Mauritius has with Bangladesh, Madagascar, or Eswatini (Hearson, 2022).

In terms of minimum standards, we derive a set of regulatory practices that can be implemented by FIUs, CIUs, and service providers, ideally through top-down harmonisation mechanisms complemented with bottom-up calibration of processes and compliance costs. We must underline that available technology can reduce ongoing compliance costs significantly, even if this may require punctual investments in data architecture and process setup.

First, CBI applicants should declare any jurisdiction in which tax residency status has been claimed or obtained in the last five years. False declaration should trigger asset freezing and economic/criminal sanctions. This could take the form of a declaration to the relevant CIU which is shared with the tax authority. Alternatively, tax residency information could also be submitted to the CIU service provider, insofar as it presents clear disclaimers of the relevance of this data and liabilities that the applicant may incur in case of false declaration and shares this information with the CIU in due course. Along the CBI application process, it is important to consider the moment in which tax residency declared data is shared with supervisory authorities beyond the CIU. It is suggested that such information is shared with tax authorities whenever declared assets or residency indicate potentially competing tax residency claims before the application is accepted or rejected. This may allow proactive administrative cooperation with relevant foreign authorities, as well as valuable opinion from domestic tax authorities on flagged applications (which may or may not be binding but should in any case be documented). FIUs should have access to the entirety of the CBI application file upon acceptance of an individual.

Second, upon acceptance of the CBI applicant, the host country should issue an automated notification to all relevant jurisdictions (e.g. all those where the newly admitted citizen/resident has investments). The host country should allow for exceptional non-reporting to any jurisdiction for which the individual can demonstrate unfair prosecution (political, racial, religious) or other risks to its personal or family integrity. While this exceptional treatment should ensure legitimate protection of unfairly prosecuted individuals, it should be meticulously documented and the (confidential) decision recorded indefinitely on public authority records.

Third, minimum standards must ensure clear distinction between CBI rights and tax residency determination, together with strict enforcement of the 183-day tax residency rule. Ongoing monitoring of passenger, vehicle and telecommunications data can distinguish individuals which appear to fulfil physical residency requirements from more complex or illicit practices. The determination of tax residency and tax obligations for highly mobile individuals who do not spend 183 days in any jurisdiction should be determined through good-faith administrative cooperation with other relevant jurisdictions – following the principles of economic substance and source taxation of domestic activities.

Fourth, host countries should participate in the MCAA to implement automatic information of bank account information, without choosing to be listed under MCAA Annex A. The Convention on Mutual Administrative Assistance in Tax Matters (MAA, amended 2010) is also an important instrument for effective cooperation upon request. Host countries should sign and ratify both treaties and seek third country technical assistance and capacity building if considered necessary.

Finally, host countries should conduct a comprehensive review of tax treaties in force, to identify provisions that unfairly restrict source tax rights for income that is not subject to tax in the CBI economy. In addition, the review should flag any treaties which do not ensure mutual assistance for tax collection, and for which such assistance is not ensured through multilateral treaties (e.g. MAA). The United Nations Fast-track instrument allows for streamlined amendment of tax treaties, to modify all necessary provisions (United Nations, Reference Zhang2024). If bilateral relations constrain tax treaty amendment, it is possible to terminate bilateral treaties while ensuring administrative cooperation (via multilateral treaties such as the MCAA and the MAA) and avoiding double taxation (e.g. foreign tax credit system). Under domestic law, it is possible to provide a comprehensive definition of permanent establishment, and also to designate preferential tax treatments or regimes for foreign-based companies that are conditional upon the reciprocal implementation of such regimes by foreign counterparts.

9.5.1 Identity Verification

AI can streamline identity verification by integrating biometric analysis, facial recognition, and document authentication technologies. ML algorithms can detect forgery, tampering, or inconsistencies in passports, national IDs, and supporting documents. By cross-referencing applicant biometrics with government and international databases, AI enhances the detection of identity fraud and impersonation. This ensures that CBI applicants undergo stringent authentication before proceeding with the investment process, reducing the risk of fraudulent applications slipping through weak due diligence checks. AI-driven identity verification solutions can leverage deep learning-based computer vision to authenticate passports, government-issued IDs, and residency documents.

Using OCR (Optical Character Recognition) and facial biometrics, AI can detect forgery, digital manipulation, or deepfake identity fraud. These tools integrate with government databases, PEP lists, and international watchlists to validate applicant authenticity in real time. Finally, AI-powered Natural Language Processing (NLP) can scan news sources, court filings, leaked financial reports, and regulatory databases for negative news, financial crimes, or corruption links associated with applicants. Advanced sentiment analysis and named entity recognition (NER) can help classify high-risk individuals.

9.5.2 Source of Funds Analysis

AI can also improve source of funds and BO verification by analysing financial transactions, banking records, and investment histories for suspicious patterns. Anomaly detection models can flag inconsistencies, rapid asset movements, or offshore structuring indicative of money laundering or tax evasion. AI-powered KYC and AML compliance systems can cross-check applicant financial data with sanctions lists, PEP databases, and global financial intelligence networks. This automation not only reduces human error but also accelerates decision-making, ensuring CBI applicants comply with international financial regulations.

These tools use ML to detect deviations from normal financial behaviour, flagging transactions linked to high-risk jurisdictions or sanctioned entities. Distributed ledger technology (DLT), combined with AI, can enhance transparency in CBI applications by securely recording due diligence findings, financial transactions, and approval decisions on an immutable ledger. AI can automate smart contract execution, ensuring compliance with minimum due diligence requirements before citizenship applications are approved. This approach reduces document fraud, ensures auditability, and strengthens trust between governments, financial institutions, and international regulators.

From a tax compliance perspective, the analysis of the source of funds is closely related to the applicant’s activities across different jurisdictions. Automated processes can allow for the identification of key countries where the applicant conducts business and requests additional information from relevant authorities, using appropriate document templates. In addition to streamlining international cooperation processes, information resulting from them can be used to undertake enhanced verification of third country activities and assess the nature of funds.

9.5.3 Compliance Monitoring

AI can automate compliance with key international standards such as FATF’s 40 Recommendations, EU’s AMLD6, and OECD’s CRS to counter financial crimes. By integrating AI-driven risk assessment dashboards, CBI authorities can align investment migration policies with evolving international obligations and avoid grey/blacklisting risks. Sanctions Scanner’s AI-driven compliance system (Sanctions Scanner, 2026) continuously updates sanctions lists, terrorist financing risks, and PEPs, ensuring CBI applicants are screened against real-time global intelligence sources.

Given the fact that most CBI programmes grant citizenship relatively quickly, DD should not stop once citizenship is granted. AI-powered continuous monitoring systems can track post-naturalisation activities to identify red flags such as financial crimes, sudden wealth transfers, or suspicious travel patterns. AI can integrate with international policing organisations (e.g., Interpol and Europol), FIUs, and border security databases to ensure that CBI recipients remain compliant with host country laws. If post-citizenship risks arise, AI can trigger alerts to initiate further investigation by competent authorities.

More specifically in relation to tax compliance, the effective residence of an individual in the host jurisdiction can be assessed with automated tools, for example by monitoring passenger arrival/departure data and/or telecom signal. AI processes can allow to red-flag individuals whose presence in the host jurisdiction appears to be below 183 days, in order to perform additional verifications to determine tax residence.

9.5.4 Predictive Analysis

AI can develop predictive risk models by aggregating data from past applicants, compliance failures, and global enforcement actions to generate applicant risk scores. These models consider factors such as economic background, geopolitical risk, past financial activity, and business affiliations to determine the likelihood of an applicant being involved in illicit financial activities. It is important to distinguish the various ways in which AI technologies can contribute to risk assessment models.

First, it is possible to train an AI model with as much data as is available and allow it to determine by way of probabilistic and statistical process which are the risk parameters that are indicative of illicit activities. These techniques are not only prone to bias because they may exploit variables that should not be used such as religious affiliation, but also because they are limited by the type of data used for training, which may be biased in favour of certain activities due to difficulties in monitoring or prosecution of specific types of financial crimes (thus rendering available data insufficient to identify suspicious patterns). Practitioners at national AML supervisory authorities warn against the usage of unsupervised AI models, noting that it is not possible to understand all the reasons why the algorithm has flagged a specific entity or transaction (García Fresno, 2022).

Second, supervised learning models can allow for the calibration of risk assessment techniques that use multiple indicators which are considered relevant to the illicit activity in question. In this case, a variety of algorithmic and probabilistic techniques are available to evaluate how relevant each risk indicator is for the prediction of certain activities. Beyond the choice of the mathematic calibration technique, the most important aspect is to define and obtain relevant data on the outcome variable that should maximised. This can be the choice of an obliged entity to issue a suspicious transaction report (STR), the decision to open an investigation by the FIU, the obtention of a conviction by prosecutorial authorities, or even the amount of funds recovered.

Third and perhaps most important, AI can help making the most out of predictive analysis and facilitating the interpretation of complex risk assessments with the automated production of written summaries and figures that highlight the importance of specific risk indicators. These outputs could assist compliance officers in drafting STRs or supervisory authorities to motivate judicial requests. Ideally, risk assessment technologies would combine risk features related to particular entities, activities, and transactions – with risk features related to the regulatory environment in which activities take place (geographic risk). With increasingly complex risk assessment methods, the capacity of AI technology to make the output of those methods understandable is essential both for human use and method improvement, and for its consideration in legal proceedings (e.g., audits and trials) (Sachoulidou, 2023). AI-generated risk scores allow CBI regulators to allocate resources more effectively, ensuring that higher-risk cases undergo deeper scrutiny while low-risk applicants experience faster processing.

Supervised learning models trained on historical compliance data can generate applicant risk scores based on:

• Geopolitical risk (home country of applicant);

• Past business activities and corporate affiliations;

• Tax compliance and financial disclosure; and

• Cross-border financial behaviour.

For example, AI models trained with information on jurisdiction’s tax systems and the level of secrecy in financial services sectors may be able to identify substantial differences between the applicant jurisdiction(s) of origin and the host jurisdiction. These differences can help identifying individuals that seek to obtain CBI for tax evasion or avoidance.

9.5.5 Automation of Reporting

AI-driven due diligence solutions can revolutionise CBI programmes by ensuring higher compliance standards, fraud detection, and risk mitigation. By integrating ML, NLP, and blockchain technologies, CBI jurisdictions can establish minimum due diligence standards that meet international AML/CFT standards. However, for AI to be fully effective, CBI regulators must develop standardised governance frameworks, ensuring ethical AI deployment, robust data collection and protection, and human oversight in IM screening processes. In this context, it is very important that FIUs implement strict format requirements to ensure that a minimum set of information fields are systematically made available in a predefined structured data format.

Furthermore, in the case of spontaneous or upon request communications between public authorities, automated processes should allow the minimisation or elimination of cumbersome paperwork, making inter-institutional and international cooperation as efficient as possible. Leveraging existing data on international cooperation treaties (Tax Justice Network, Reference Xue and Zhang2022), authorities of a given jurisdiction can automatically generate a document addressed to another jurisdiction which identifies available legal bases for information sharing, judicial cooperation, or assistance in tax collection.