Citizenship by investment due diligence

A citizenship by investment programme grants a passport in return for a contribution to a state fund or an approved investment, at least 200,000 US dollars in the five Eastern Caribbean programmes. What decides the application is the due diligence report: a file on the applicant and on every family member in the application, assembled by the government's citizenship unit and by outside due diligence firms, that establishes who the person is, where the money comes from, and whether anything on record bars them. Below is what real programmes require that report to contain, an example of its screening section, and what the sanctions lists now say about it. On the US sanctions list today, 49 people hold a passport of St Kitts and Nevis, Dominica, Vanuatu, Antigua and Barbuda or Saint Lucia, 36 of them added since January 2025.

What the programmes require

The five Eastern Caribbean programmes, in Antigua and Barbuda, Dominica, Grenada, St Kitts and Nevis and Saint Lucia, have rewritten their rules since 2023 under pressure from the US, the UK and the EU. Under a 2024 memorandum of agreement they set the 200,000 dollar floor, share information on applicants with the US Treasury, interview applicants and do not process anyone another of the five has denied.

The most detailed statement of what the report must cover is the treaty they signed in September 2025 to create a regional regulator, ECCIRA. Article 50 of the agreement, which applies to applications made once it is in force, requires a review of the main applicant and of every dependant aged 12 or over before any approval: identity and nationality checked against watch lists, politically exposed persons databases and sanctions lists, OFAC's and the UN's among them; every previous name and alias; criminal records from every country of residence or citizenship in the last ten years; proof that the investment came through a licensed financial institution that did its own due diligence; biometrics; adverse media; source of funds and wealth, with an independent financial analysis; and employment and business interests.

National law adds named checks and a price. In St Kitts and Nevis, regulation 24 of the Citizenship by Substantial Investment Regulations 2024 sends the details of the applicant and of every dependant over 15 to the Financial Intelligence Unit, a government due diligence unit, CARICOM's Joint Regional Communications Centre and at least one international due diligence firm, for 10,000 dollars per applicant and 7,500 for each family member aged 16 or over. In Dominica the Financial Intelligence Unit commissions the firms and examines every report, and every Iranian applicant goes through enhanced due diligence. Malta, whose investment route closed after an EU Court of Justice ruling in 2025, still requires due diligence "of a four (4) tier nature or more" for naturalisation.

Few programmes say how often the report ends in a refusal. Saint Lucia denied 355 of the 2,633 applications it decided in the year to March 2025 (annual report), and Grenada 62 of 557 in 2025 (statistics). St Kitts and Nevis, Dominica and Antigua and Barbuda publish no such count.

The report, section by section

Whoever writes it, a citizenship unit, a due diligence firm or a bank asked to take the investment, the report answers the same questions in roughly the same order.

1. Identity and civil status. Every passport and citizenship the applicant holds or has held, birth and marriage certificates, and every name used, with the documents for any change of name. Names matter more here than elsewhere: in 2024 the European Commission found that all five Caribbean programmes let a new citizen change name, with the earlier name kept on the passport's observations page. The ECCIRA agreement bars any change for five years after citizenship is granted, marriage, divorce and a few other cases aside.
2. The family. Each dependant is checked like the main applicant above an age threshold: 16 for the standard checks in St Kitts and Nevis and Dominica, 12 for Dominica's enhanced checks and under the ECCIRA agreement, which also requires an interview for every dependant aged 18 or over.
3. Criminal record. Police certificates from the country of birth, of citizenship, and of every country lived in for more than six months in the past ten years, as Dominica asks, with any pending investigation disclosed. St Kitts and Nevis refuses an applicant under criminal investigation; Dominica refuses one who knew of an investigation and did not disclose it.
4. Sanctions, politically exposed persons and adverse media. The applicant, the family and the companies they control, screened against the sanctions lists, PEP databases and the press, under every name and nationality from the first section. A close relative of a politically exposed person is a finding in its own right: in March 2026 Dominica revoked the citizenship of a man it said had concealed his father's political ties when he applied, OCCRP reported. The example below is this part of the report.
5. Source of funds and source of wealth. Where the money for this investment comes from, and how the applicant came to have it: twelve months of bank statements, a bank reference letter, employment or business records, company accounts, a declaration of tax residence, and an independent analysis that the two stories agree.
6. The investment payment. The payment itself should say who paid. The ordering customer, field 50 of an MT103, is the Debtor (Dbtr) of an ISO 20022 pacs.008, and ISO 20022 adds an Ultimate Debtor (UltmtDbtr), the party on whose behalf the debtor pays. A Debtor or Ultimate Debtor that is neither the applicant nor a source the report has explained is a question for the report, not a detail.
7. Travel and immigration history. Visas refused, citizenships refused, residence permits held. St Kitts and Nevis, Dominica and Malta all refuse an applicant who was denied a visa by a country their own citizens can visit without one.
8. Interview and conclusion. The interview is recorded and kept for fifteen years under the ECCIRA agreement, and the interviewer's report goes into the file. The conclusion states what was verified, what was not, every discrepancy between the documents and the checks, and a recommendation. A denial is shared with the other four programmes within three business days, and none of them may then accept the applicant without the regulator's written approval.

Example of a due diligence report

Most of the file is documents the applicant brings. The screening is the part the desk produces itself, and the part a bank, a regulator or another programme most often has to take on trust, so its report has to stand on its own. It should hold:

• The subject as screened: every name, with the date of birth, nationality and document numbers used.
• When: the date and time of the screen, which fixes the editions of the lists it ran against.
• The lists: every list searched, by name, rather than "global sanctions lists".
• The result: which lists matched, and each potential match with what in the entry matched.
• The decision on each match: confirmed, or cleared and why, by whom and when.
• A way to verify it: a reference and a fingerprint that a third party can check with whoever issued it.

Here is an example (PDF, 5 pages): the report Ohmyfin's sanctions screening produces, run on a subject built from public list data. The subject is the identity on the Dominica passport of Mohammad Hossein Shamkhani, whose oil shipping network the US Treasury sanctioned in July 2025, saying he did business under aliases, among them Hugo Hayek, "the false name listed on his Dominica passport". The screen used that name, the date of birth 19 April 1984, Dominica nationality and the passport number his US list entry records. Dominica revoked that citizenship in August 2025, according to OCCRP; the US entry still records the passport, which is what a screen needs. The report is marked as an example on every page; it is not in our records, so it will not verify.

Of the 318 lists searched, two matched. On the US list Hugo Hayek is an alias of Shamkhani's entry, and the passport number, the date of birth and the nationality all agree with it. New Zealand's Russia sanctions register carries the same alias but no date of birth or passport, so that match rests on the name and on the US entry. His UK and EU entries do not carry the name, and neither list matched. Each match then carries the reviewer's decision, a reason from a fixed list ("Confirmed sanctioned party"), the written why, and who decided it and when. A namesake cleared on a different date of birth is recorded in the same table, with that reason instead.

The last pages name every list searched and carry the report's ID and SHA-256 hash. Whoever is handed a report can enter both at ohmyfin.ai/sanctions/verify, which confirms the screen, its date, its number of matches and its list coverage, and offers the PDF as it was first generated, to set beside the copy they were given.

Investment programme passports on the sanctions lists

Shamkhani is one of 49. We read the four main sanctions lists as published in mid-October 2026, the US Treasury's list of Specially Designated Nationals (OFAC), the UK Sanctions List, the EU's consolidated list and the UN Security Council's, and took every nationality, citizenship and passport each entry records.

The US list names 49 people holding the citizenship or a passport of a country with a citizenship by investment programme: St Kitts and Nevis (24), Dominica (17), Vanuatu (6), Antigua and Barbuda (1) and Saint Lucia (1). None holds Grenada's. Every one of the 49 entries records at least one other nationality as well: Iran on 24 of them, China on 7, Cambodia and Cyprus on 6 each. The entries do not say how or when the second passport was obtained.

People on the US sanctions list holding a St Kitts and Nevis, Dominica, Vanuatu, Antigua and Barbuda or Saint Lucia passport, by the year they were added

Before 2025: 13

 

2025: 15

 

2026, to 15 October: 21

 

The pattern itself is not new. In 2014 FinCEN told US banks that "several Iranian nationals designated by OFAC" had obtained St Kitts and Nevis passports through its programme, and asked them to verify identity with another document as well; it rescinded that advisory in February 2026. What the lists show now is its scale, and how recent it is. Of the people OFAC has added since January 2025 and still lists, about 1 in 26 holds one of these passports (36 of 948); of those added earlier, about 1 in 500 (13 of 6,568).

Two kinds of action account for 26 of the 36 added since then. 18 were designated under Executive Order 13902, which since October 2024 also reaches Iran's petroleum and petrochemical trade, all of them from April 2025 on. All 17 Dominica entries date from that period too, and 16 of them sit beside an Iranian nationality. In 2023 and 2024 Iranians were the largest group among successful applicants to the five Caribbean programmes, 1,918 of them, and every Iranian application reported was processed by Dominica, according to the figures the countries gave the European Commission. The other 8 were designated under OFAC's programme against transnational criminal organisations, 5 of them on 14 October 2025, when the US and the UK acted together against the Prince Group network in Cambodia.

The lists also disagree about who holds such a passport: the UK list records one for 7 people, the EU list for 2 and the UN list for none, and of the 12 people we found on both the US and the UK lists, 5 have only their other nationality on the UK entry, Shamkhani among them. The ECCIRA agreement names the OFAC and UN lists among those to screen, and makes listing on one of them, or on a comparable list, a ground to revoke a passport the programme issued.

What this changes in the screening section

• Screen against more than one list. The same person can carry the investment passport, or the name printed on it, on one list and not on another, and each list holds people the others do not.
• Screen every citizenship, passport number and name. Ask the applicant and each dependant for every citizenship held now or before, with its passport numbers and the name on each, and screen all of them. 40 of the 49 US entries carry the investment passport's own number, which matches whatever name is printed on it.
• Do not clear a match on nationality alone. OFAC's guidance on judging a match asks whether the party has a different date of birth, identification number or nationality. For someone who holds an investment passport, a different nationality is weak evidence: the passport in front of you may be exactly the one the list leaves out. Let the date of birth and the document numbers decide.
• Screen again after approval. The five Caribbean programmes committed in their 2024 agreement to run due diligence on citizens after approval, and 36 of these 49 people were added to the US list since January 2025. A report that was clear on the day of approval says nothing about the lists today.

A name can be screened against the sanctions lists, with its date of birth and nationality, on Ohmyfin's sanctions screening page.