Golden passports and visas grant mobility, a fresh identity layer and banking access in exchange for investment — a combination the FATF and OECD found attractive to criminals and corrupt officials seeking to outrun justice and launder proceeds.
The rating above is indicative — it reflects inherent risk as assessed in the published frameworks, not a verdict on any business. Entire industries serve these sectors as business as usual; the rating your firm actually applies comes from its own business-wide risk assessment, where the sector factor combines with your customer base, controls and risk appetite.
The joint FATF/OECD report on the misuse of citizenship and residency by investment programmes (2023) sets out the vulnerabilities: heavy reliance on intermediaries, professional enablers, weak programme governance, and the ability a new citizenship gives a criminal to hide their identity and activities behind shell companies in other jurisdictions while moving freely.
The EU dimension has hardened: the Court of Justice held in 2025 that Malta's citizenship-by-investment scheme was incompatible with EU law, and Cyprus terminated its own investment programme in November 2020. Investment-linked residency routes continue across the EU, and every professional file that touches one carries elevated exposure and demands genuine source-of-wealth work, not programme paperwork.
Obliged entities acting in investment-migration files — lawyers, service providers, developers selling qualifying assets, banks onboarding new residents — must apply enhanced due diligence, establish source of wealth and funds independently, screen for PEP status and sanctions, and report suspicion. Sector risk combines with geography, the customer’s profile and the product to set the overall rating — and every client still needs sanctions, PEP and adverse-media screening on the parties themselves.
