Economic Passports Outlive Their Programs: A Controls Playbook

The Problem: Why This Matters Now

Suspending Citizenship by Investment (CBI) programs doesn't invalidate existing passports. Passports from Saint Kitts & Nevis, Antigua and Barbuda, Dominica, Saint Lucia, and Grenada still allow visa-free access to the EU. Some holders reside in high-risk or sanctioned jurisdictions. These passports remain valid until they expire, with the last possible expiry in 2028. Backdated applications have been reported, so this date isn't fixed.

Three main risks arise. First, holders from high-risk areas retain access. Second, forgers can alter expiry dates or create new passports. Third, a resale market for used passports will continue, as systems like ETIAS accept an EC passport without checking the holder's birthplace. Without an authoritative issuance database, your controls must function independently.

This playbook assumes you manage your AML/CFT Framework's onboarding and Customer Due Diligence controls and can adjust screening logic, risk rules, and document verification workflows.

Preparation: What You Need Before Starting

• Inventory Access: Ensure you can query your customer database, including document type, issuing country, nationality, place of birth, and expiry fields.
• Data Field Discipline: Store place of birth and country of residence as structured fields.
• Document Verification Tools: Use an ID verification vendor or in-house tools that support security feature checks, NFC chip reads (ICAO 9303 e-passports), and expiry validation.
• Name Screening Platform: Must have configurable fuzzy matching and custom risk attributes.
• Transaction Monitoring Rules: Should reference customer attributes.
• Escalation Path: Have a clear path to your MLRO and a documented decision owner for exits.
• Counterparty Contacts: Maintain contacts at peer banks and your financial intelligence unit for information sharing.

Step-by-Step Implementation

Step 1: Build the Exposure List. Query your customer base for passports from the five countries. Identify records where nationality or document-issuing country matches. Then, identify customers with a Caribbean passport but a non-Caribbean birthplace or residence. A mismatch indicates likely passport acquisition rather than inheritance.

Step 2: Assign a Customer Risk Rating Attribute. Use a discrete flag like CBI_ECARIB_ACQUIRED to highlight these cases. This allows for tuning, reporting, and auditing. Default to enhanced due diligence until proven otherwise.

Step 3: Re-paper Flagged Files. For each flagged customer, document:

• Prior nationalities and other passports
• Source of funds and wealth tied to the CBI investment
• Tax residence and physical presence
• Agent or intermediary used for the application
• Reason for seeking second citizenship

Refusal to disclose prior nationality should trigger escalation to the MLRO.

Step 4: Screen Against Original Nationality. Run Name Screening using all name variants, transliterations, and prior-nationality contexts. FATF Recommendations 6 and 7 require sanctions to apply to the person, not the travel document.

Step 5: Harden Document Verification. Configure your workflow to:

1. Read the NFC chip and compare it to the visual data page.
2. Validate machine-readable zone check digits.
3. Manually review documents where chip read fails, photo shows substitution, or expiry date is suspicious.
4. Automatically review any passport claiming issuance after program suspension.

Without an issuer database, rely on physical and cryptographic checks plus corroborating data.

Step 6: Corroborate with Independent Data. Require a second identity source for flagged customers, such as a national ID or earlier passport. Compare device, IP, and phone signals against stated residence.

Step 7: Tune Transaction Monitoring Rules. Add rules for rapid fund movement, third-party payments without links, and activity with high-risk jurisdictions. File a Suspicious Activity Report if patterns fit, maintaining SAR Confidentiality.

Step 8: Use Cross-Border Channels. Share typologies and document-alteration indicators through your financial intelligence unit and peer-bank mechanisms. Egmont Group supports FIU-to-FIU exchange. Keep records of fraudulent document features.

Validation: How to Verify It Works

• Back-test the Flag. Ensure your queries return known test records, including edge cases.
• Seed Test Documents. Test altered-expiry and cloned-chip samples to confirm they fail or route to review.
• Sample Reviewed Files. Check that prior-nationality data, source of wealth, and screening evidence are present.
• Check Screening Coverage. Confirm hits resolve across name variants and that your freeze process executes promptly.
• Measure Alert Quality. Track whether new rules produce manageable volumes and document tuning decisions.

Maintenance: Ongoing Tasks

• Periodic Review Cadence: Set shorter review cycles for flagged customers; trigger reviews on passport renewal or new-document submission.
• Diary the Horizon: Monitor the expiry tail through 2028 and beyond, revisiting assumptions quarterly.
• Refresh Typologies: Update training with new forgery and resale indicators.
• Review Vendor Performance: Test your document verification vendor against altered samples annually.
• Report to Governance: Provide senior management with metrics on flagged populations, exits, and escalations.

The issuance stops, but the exposure doesn't. Build your controls once, tune them continuously, and plan for the long game.