Skip to main content
Promotional banner for the pentest readiness checklist
EU Regulation 2025/2441 Just Killed Caribbean Passport MillsSanctions Lists & Screening
6 min readFor AML Compliance Officers

EU Regulation 2025/2441 Just Killed Caribbean Passport Mills

Antigua's Prime Minister Gaston Browne announced this week that his country may suspend its Citizenship by Investment program on November 12, 2026, to comply with EU Regulation 2025/2441. This isn't just one island nation making a policy adjustment. It's the first domino in what will likely be five Caribbean states choosing to preserve their citizens' visa-free EU access over the revenue from selling passports to economic criminals, sanctions evaders, and nationals from terrorist states.

If you're an AML compliance officer, this suspension timeline gives you 18 months to prepare for a regulatory shift that will ripple through customer due diligence, name screening protocols, and risk-rating frameworks. But suspension doesn't mean termination, and that gap creates operational risk you need to address now.

Why This Matters to Your Program

Caribbean Citizenship by Investment programs have been issuing travel documents to individuals with no residential, economic, social, or cultural connection to the issuing country. These passports grant visa-free entry to the EU and simplify U.S. visa applications. For financial institutions, this creates a persistent identity verification problem: the passport tells you nothing about the holder's actual origin, source of wealth, or criminal history.

The United States has identified Antigua as a major offender in issuing economic passports to wanted criminals and sanctions evaders. These aren't edge cases. When your customer due diligence process encounters an Antigua passport holder with no address history in Antigua, no business ties to the Caribbean, and a wire transfer pattern originating from Russia or Belarus, you're not looking at a legitimate dual citizen. You're looking at purchased access to the global financial system.

EU Regulation 2025/2441 addresses this by establishing that citizenship requires a genuine connection to the issuing state. Caribbean governments now face a choice: maintain visa-free status for their native-born citizens or continue selling passports. The economic calculation favors suspension, but the compliance risk doesn't end there.

What You Need Before Starting

Before you adjust your CDD protocols and customer risk profiles, gather these resources:

Regulatory context:

  • Full text of EU Regulation 2025/2441
  • Current list of Caribbean CIP jurisdictions: Antigua, Dominica, Grenada, St. Kitts and Nevis, St. Lucia
  • Your institution's existing enhanced due diligence triggers for economic citizenship

Operational inventory:

  • Count of current customers holding Caribbean passports
  • Breakdown by country of passport issuance
  • Cross-reference with known CIP issue dates (most programs launched between 2013-2015)
  • Transaction monitoring rules currently flagged to Caribbean jurisdictions

Internal stakeholders:

  • Your MLRO or designated compliance officer
  • Customer onboarding teams who conduct initial CDD
  • Ongoing due diligence analysts responsible for periodic reviews
  • Sanctions screening team leads

You'll also need access to your customer risk rating methodology documentation. You're about to add a new risk factor.

Step-by-Step Implementation

Phase 1: Identify Affected Customers (Months 1-2)

Run a portfolio screen for all customers presenting passports from Antigua, Dominica, Grenada, St. Kitts and Nevis, or St. Lucia. Don't limit this to current onboarding. Review your entire customer base.

For each flagged customer, pull their initial CDD file and check:

  • Date of passport issuance
  • Declared country of birth
  • Residential address history
  • Source of funds documentation
  • Business registration jurisdictions

If the passport was issued after the CIP program launch date and the customer has no documented connection to the issuing country, flag for enhanced review.

Phase 2: Risk-Rate Economic Citizenship (Month 3)

Add "Economic Citizenship Indicator" as a discrete risk factor in your customer risk rating model. This isn't about nationality discrimination. It's about the absence of verifiable identity anchor points.

Assign elevated risk scores when:

  • Customer presents a Caribbean passport but was born elsewhere
  • Passport issue date falls within known CIP operating periods
  • No residential, employment, or business ties to the passport-issuing country appear in CDD documentation
  • Source of wealth involves jurisdictions with active sanctions programs or high corruption indices

Document this methodology change in your AML/CFT framework and train your analysts on the distinction between native-born citizens and economic passport holders.

Phase 3: Enhanced Due Diligence Protocol (Months 4-5)

For customers flagged in Phase 1, initiate enhanced due diligence:

Request additional documentation:

  • Birth certificate or naturalization certificate
  • Proof of residence in the passport-issuing country (utility bills, lease agreements, tax filings)
  • Business registration documents if claiming commercial ties
  • Previous passports showing nationality history

Expand beneficial owner identification: If the customer is a legal entity, verify that beneficial owners haven't used economic citizenship to obscure their actual nationality or residence.

Review transaction history: Look for patterns consistent with layering: wire transfers routing through the Caribbean jurisdiction with no economic rationale, use of correspondent banking relationships in the passport-issuing country despite business operations elsewhere.

Don't accept the passport alone as proof of bona fide citizenship. The EU regulation's core principle applies to your CDD: citizenship requires a genuine connection.

Phase 4: Update Transaction Monitoring Rules (Month 6)

Modify your transaction monitoring rules to flag activity involving Caribbean CIP jurisdictions after the November 12, 2026 suspension date.

Specific scenarios to monitor:

  • Inbound wires from Antigua, Dominica, Grenada, St. Kitts and Nevis, or St. Lucia sent after the official suspension date
  • Customers updating their address to Caribbean jurisdictions post-suspension
  • New account applications presenting Caribbean passports with issue dates after November 12, 2026

These patterns suggest backdated passport issuance or covert program continuation. Caribbean governments have previously issued passports to Russian and Belarusian purchasers covertly, even when prohibited by local law. Your monitoring rules should assume this practice will continue.

Phase 5: Diplomatic Passport Screening (Ongoing)

The Vienna Convention limits diplomatic passport eligibility to government officials conducting official state business. Caribbean states have historically issued diplomatic passports outside these parameters.

Add a screening step for diplomatic passports from Caribbean CIP jurisdictions:

  • Cross-reference the passport holder against public diplomatic registries
  • Verify the stated diplomatic function matches the customer's declared occupation
  • Escalate to your MLRO if the customer's business activity contradicts their diplomatic status

A "diplomat" conducting private commercial transactions through your institution warrants a Suspicious Activity Report.

Validation: How to Verify It Works

After implementation, test your new protocols:

Sample file review: Pull 20 customer files flagged for economic citizenship indicators. Verify that analysts requested additional documentation and that risk ratings were elevated appropriately.

Transaction monitoring alert audit: Review alerts generated by your new Caribbean jurisdiction rules. Confirm that alerts triggered on post-suspension activity and that analysts investigated the source of funds.

MLRO escalation check: Count the number of cases escalated for potential Suspicious Activity Report. If you identified dozens of economic passport holders but escalated zero cases, your enhanced due diligence isn't penetrating the risk.

False positive rate: Track how many customers successfully provided documentation proving genuine ties to the Caribbean jurisdiction. If your false positive rate exceeds 40%, refine your initial screening criteria to exclude customers with clear residential or business connections.

Maintenance and Ongoing Tasks

Monthly monitoring: Track new account applications presenting Caribbean passports. Any passport issued after November 12, 2026 requires immediate enhanced due diligence and MLRO notification.

Quarterly risk assessment: Review your customer risk rating distribution. If the percentage of high-risk customers from Caribbean CIP jurisdictions remains static six months post-suspension, you're missing ongoing program activity.

Annual procedure update: Caribbean governments may switch to issuing diplomatic passports to former CIP clients. Update your procedures annually to reflect emerging circumvention tactics.

Regulatory tracking: Monitor whether the other four Caribbean CIP states announce similar suspensions. If St. Kitts and Nevis or Dominica continue operating programs, adjust your jurisdiction risk ratings accordingly.

Training refresh: Conduct semi-annual training on economic citizenship red flags. Include case studies of backdated passports and covert issuance schemes.

The suspension of Caribbean CIP programs removes a financial crime vector, but only if you treat suspension as a transition period requiring heightened vigilance, not a problem solved. Your CDD protocols need to distinguish between a passport and a genuine national identity. The EU just forced that distinction into law. Your compliance program needs to enforce it in practice.

Application Security Isn’t Optional Anymore.

You Might Also Like