Notes | "Going beyond the FATF/OECD Report to Assess Key Risks"

Kristin Surak's February 2024 Working Paper makes really good points about the recent FATF-OECD Report on Misuse of CBI/RBI. Among all, my favourite is her reflections on the scope and definition the words "Citizenship by Investment" (CBI) and "Residency by Investments" (RBI). She makes really unsugarcoated observations about the cultural and Western bias behind specifically targeting these passport/visa channels, as opposed to others like citizenship by descent or entrepreneurial visas (more below). The premise of the bias is that naturalisation or residence obtained solely via a cash disbursement "does not entitle its beneficiaries to the same rights as natural-born citizens [whose rights] are guaranteed by supranational agreements". This is a "North-Atlantic bias [...] based on Western philosophical assumptions and debates about statecraft". To simplify this, the idea of the nation-state that arose in 19th century Europe gave rise to concepts like nationality, sovereignty and citizenship, which are all directly challenged by the concept of immigration. The idea of an outsider becoming an insider by passively paying for it, as opposed to actively earning the right to (via language or culture tests) disrupts this long-established model of statecraft. It challenges the status quo. And that's the visceral reason why CBI is constantly under scrutiny.

Now, in terms of practical risks. Often, in the context of CBI/RBI, risks are attributed to the possibility of criminals using access to new jurisdictions for nefarious purposes. And that's the problem - unless approved applicants are constantly monitored for the rest of their lives, there is no way to really know. With this in mind, Surak proposes that policy-making address actual harms rather than supposed risks. The key harm is profile-building and the production of documentary and legal evidence. As written in the report, due diligence firms and financial institutions "rely heavily on documentary evidence indicating legal substance" in order to determine whether applicants are trustworthy.

To date, the incidence rate of money laundering or other financial crimes carried out via CBI/RBI is unknown. No empirical study has assessed or established a reasonable estimate of the scale or incidence rate of people with criminal backgrounds or criminal intents who have been approved by CBI or RBI programmes, alongside studies on the actual use of CBI/RBI to carry out criminal activities. The root cause is not the CBI/RBI schemes themselves; rather, it's the surrounding ecosystem's level of due diligence carried out on the produced documentary evidence (or lack of). Take financial institutions for example; they are the gateway for CBI/RBI qualifying funds to enter a jurisdiction.?The bank's procedures for verifying an identity or a tax residence can significantly increase risks associated with profile-building. Online bank? One could purchase a fake identity off the darkweb. Tax residence? Basically everywhere it's self-certified and supporting documents are not always requested.

Within the same ecosystem, critical aspects of conflicts of interest within due diligence firms are also highlighted, such as the fact that CBI-issuing governments "may appoint small, boutique due diligence firms whose main source of income is the contract to screen for an investment migration programme, which can render the firm vulnerable to bribery or collusion".

Here's some practical examples cited in Surak's report:

"Adjacent phenomena" to CBI and RBI (i.e. channels to obtain citizenship or residence that are not as demonised but ironically might actually have less due diligence requirements)

• Business investor visas: open or invest in a business in the target jurisdiction
• Independent means visas and freelancer/digital nomad visas: prove that you have sufficient funds to support yourself in the target jurisdiction without working locally
• Illegal visa sales: eg Poland's 2021 cash-for-visa scandal
• Discretionary economic citizenship: Peter Thiel (Paypal) in New Zealand, Evan Spiegel (Snapchat) in France, Steve Wozniak (Apple) in Serbia, Pavel Durov (Telegram) in the UAE and France
• Citizenship by descent and the grey market: in 2018, Hungary naturalised 45,000 individuals based on ancestry and only around 400 based on immigration; in the same year, Bulgaria was found to accept €5,000 bribes each to issue fake documents proving Bulgarian origins

Annual approval numbers for CBI applications (2019 data, some estimates)

• Turkey, the market leader by volume: +12,000
• Vanuatu: +8,000
• Malta: +6,000
• Cyprus: +6,000
• Saint Lucia: +4,000
• Grenada: +4,000
• Antigua: +4,000
• Dominica: +4,000
• Saint Kitts: +2,000

What about RBI? Well, "global figures on the far more numerous RBI programmes have not yet been systematically collected. Such an exercise presents challenges as many countries do not regularly release details about the number of residence permit issuances in any visa category".

Areas for future research:

• Statistics on the criminal history of CBI/RBI applicants
• Actual detection of criminal activity after issuance of citizenship or residence (continued monitoring)
• Whether having a formal CBI programme provides a degree of cover and offer a post-hoc justifications for passports issued to individuals that eventually committed crimes
• Problematising opportunities to commit fraud in profile-building rather than problematising CBI/RBI programmes themselves
• Identifying scale and scope of risks