# Due Diligence and Source-of-Funds Checks

What enhanced due diligence covers, what documents you need for source-of-funds verification, and how the process differs across residence and citizenship by investment programmes.

Updated 2026-11-01. Also on the [web page](https://goldenvisas.fyi/guides/due-diligence-and-source-of-funds).

Due diligence (DD) and source-of-funds (SOF) verification are mandatory for every residence-by-investment and citizenship-by-investment application. The depth varies by programme.

## What is checked

| Check | Citizenship by investment | Residence by investment (golden visa) |
|-------|---------------------------|----------------------------------------|
| **Identity** | Certified passport, birth certificate, national ID | Passport, national ID |
| **Criminal record** | Police certificates from all countries of residence (10+ years); Interpol/World-Check screening | Police certificate from country of residence; sometimes from all countries (5+ years) |
| **Sanctions/PEP** | World-Check, Dow Jones, Refinitiv screening; PEP declaration | Sanctions list screening; PEP declaration (EU programmes) |
| **Source of funds** | Full audit trail for investment amount + fees; 3–5 years bank statements; tax returns | Audit trail for investment amount; 1–3 years bank statements; proof of legal income |
| **Source of wealth** | How you accumulated the capital (business sale, inheritance, salary, investments) | Often required for EU programmes; less detailed for UAE/Türkiye |
| **Adverse media** | Global news, court records, regulatory actions search | Basic adverse media search |
| **Business background** | CV, company registry extracts, shareholder records, financial statements | Business registration, tax compliance certificate |

## Citizenship by investment: enhanced due diligence

Caribbean CBI programmes (Antigua, Dominica, Grenada, St Kitts, St Lucia) use **multi-tier due diligence**, as did Malta's MEIN before it closed in 2025:

1. **Agent pre-screening** — Authorised agent collects documents and runs preliminary checks.
2. **Government DD unit review** — Dedicated unit (e.g. CIU in St Kitts, CBIC in Grenada) reviews the file.
3. **Third-party provider** — Firms like CRIF, Thomson Reuters Risk & Compliance, or local providers (e.g. FSRC in St Kitts) run global database searches.
4. **Interview** — Mandatory for the main applicant (and sometimes dependants 16+) in St Kitts and increasingly others. Conducted virtually or in person.
5. **Committee/Board decision** — Final approval by Citizenship Board, Investment Committee or Minister.

**Mandatory documents (typical):**
- Certified passport copy (bio page + all visa/entry stamps)
- Certified birth certificate
- Marriage certificate (if applicable)
- Divorce/death certificates (if applicable)
- Police certificates from country of birth, country of citizenship, and all countries resided in for 6+ months in the last 10 years
- CV/resume
- Bank reference letter (2+ years relationship)
- 3–5 years personal bank statements
- 3–5 years tax returns or tax residency certificates
- Proof of source of funds for the **exact investment amount + fees**
- Proof of source of wealth (business sale agreement, inheritance grant, salary slips, investment portfolio statements)
- Professional references (2)
- HIV/test medical certificate (some programmes)
- Passport photos

## Residence by investment: standard AML/KYC

EU golden visas (Portugal, Greece, Italy, Malta MPRP, Cyprus) follow **EU AML directives (5AMLD/6AMLD)**:

1. **Agent/lawyer KYC** — Your authorised agent or lawyer identifies you under national AML law.
2. **Bank KYC** — The receiving bank (for property purchase or capital transfer) runs its own AML checks.
3. **Immigration authority review** — Checks police certificates, sanctions lists, and document authenticity.
4. **No separate government DD unit** — Unlike CBI, there is no enhanced multi-tier review.

**Mandatory documents (typical):**
- Passport copy
- Police certificate from country of residence (sometimes all countries 5+ years)
- Proof of investment (property deed, bank transfer receipt, capital transfer confirmation)
- Proof of funds for investment (1–3 years bank statements)
- Health insurance covering the country
- Tax number (NIF in Portugal, AFM in Greece, NIE in Spain, Codice Fiscale in Italy)
- Proof of address

## Source-of-funds: what an audit trail looks like

| Source | Typical evidence |
|--------|------------------|
| **Salary/bonus** | Employment contract, 3–5 years payslips, tax returns, bank statements showing credits |
| **Business profits** | Company registration, shareholder register, audited financials (3 years), dividend resolutions, bank statements showing dividends |
| **Business sale** | Sale/purchase agreement, completion statements, bank statements showing proceeds, tax clearance |
| **Inheritance** | Grant of probate, will, estate accounts, bank statements showing receipt, tax clearance |
| **Gift** | Gift deed, donor's SOF/SOW evidence, donor's bank statements, tax compliance (donor and recipient) |
| **Investment returns** | Brokerage statements (3–5 years), trade confirmations, bank statements showing withdrawals |
| **Real estate sale** | Sale agreement, completion statement, land registry extract, bank statements showing proceeds |
| **Crypto** | Exchange KYC records, wallet addresses, blockchain analysis report (Chainalysis, CipherTrace), tax returns declaring gains |

## Common pitfalls

| Pitfall | Consequence | Solution |
|---------|-------------|----------|
| **Gaps in bank statements** | DD provider flags unexplained periods | Provide statements for every month; explain gaps in writing |
| **Round-number transfers without context** | Suspected layering | Annotate each transfer with purpose and source |
| **Third-party payments** | May be treated as gift (needs donor SOF) | Disclose all third parties; provide their SOF |
| **Offshore companies without UBO declaration** | Rejection | Declare ultimate beneficial owners (UBOs) with full KYC |
| **Tax non-compliance** | Rejection (especially EU) | Provide tax residency certificates and returns for all relevant jurisdictions |
| **Name discrepancies** | Delays or rejection | Ensure all documents match passport exactly; provide name-change deeds |

## Programme-specific notes

- **Malta (MPRP)**: Multi-tier DD including FIAU (Financial Intelligence Analysis Unit) screening. The capital assets declaration (EUR 500,000, of which EUR 150,000 financial, or EUR 650,000, of which EUR 75,000 financial — residencymalta.gov.mt, checked 2026-11-01) is verified.
- **Portugal**: Bank KYC is the main gatekeeper. Tax compliance in Portugal and country of origin is checked.
- **Greece**: Lawyer files application; lawyer's AML obligations are primary. Property registry checks ownership.
- **Spain**: The investor route closed in April 2025; existing permit holders keep standard AML obligations on renewal.
- **USA EB-5**: USCIS adjudicates I-526 with full background check. Source of funds must be "lawful" — documented to original source.
- **UAE**: Bank KYC and ICA/GDRFA security screening. Less documentation than EU/US.
- **Türkiye**: Tapu (title deed) registry and bank transfer receipt are primary. Police clearance from home country.
- **Vanuatu**: DSP conducts DD; simpler than Caribbean OECS but tightening.

## After approval: ongoing obligations

- **CBI**: Some programmes require post-approval compliance (oath, biometric enrolment).
- **Golden visa**: Maintain the investment (property, capital, job creation) for the required hold period (usually 5 years). Renew residence permit on time.
- **Tax**: Golden visa may create tax residence after 183 days/year. CBI citizenship alone does not.

## Using the check helper

See the **Authorised Agent Check Helper** tool on this site to get direct links to each programme's official authorised-agent list and due-diligence requirements page.

## Questions

### Who conducts the due diligence?

For CBI, the government's due-diligence unit, often with third-party screening firms and a mandatory interview. For golden visas, the immigration authority and your bank conduct AML/KYC checks.

### Can I use the same due-diligence report for multiple programmes?

Generally no. Each programme requires its own forms and may use different providers. Some Caribbean CBI units accept a recent report from another OECS programme, but this is case-by-case.

### What if my funds come from crypto?

Some programmes accept crypto-sourced funds if you can show a complete audit trail: exchange records, wallet addresses, a blockchain analysis report and tax compliance. Others do not. Confirm with the programme authority or an authorised agent before you rely on crypto-derived funds.

### How long does due diligence take?

CBI: 1–3 months. Golden visa: 2–6 weeks (often parallel with application). EB-5: 6–12 months for I-526 adjudication including background checks.