What the OECD’s CRS-Avoidance Warnings Actually Say About CBI

Bitcoiners are used to being treated as suspects by default. Move six figures out of an exchange and a compliance officer who has never met you wants to know where every satoshi came from, a scrutiny nobody applies to the same six figures sitting in a checking account. So there is a strange kind of validation in learning that the OECD extends roughly the same courtesy to an entire industry: citizenship and residency by investment. Ask around online and you will hear that the OECD keeps a running blacklist of shady passport sellers, a list that has only grown since 2018 and spans continents. Pull the primary documents instead of the secondhand summary, and the actual picture is close to the opposite.

The Test, Stated Exactly

Since October 2018, the OECD has published guidance built to help banks catch one specific move: someone buys residence or citizenship somewhere with a low tax bill and no requirement to actually live there, then tells their bank that new jurisdiction is their tax home, so the Common Reporting Standard (CRS), the OECD system under which banks automatically report a customer’s account details to that customer’s declared country of tax residence once a year, sends the file to the wrong country, or nowhere at all. The OECD’s own guidance states the test in one sentence, unchanged since it was first published: schemes are “potentially high-risk” if they “give a taxpayer access to a low personal income tax rate of less than 10% on offshore financial assets and do not require significant physical presence of at least 90 days in the jurisdiction offering the CBI/RBI scheme.” Both halves have to be true. A country with a real minimum-stay rule does not qualify no matter how low its tax rate runs, and a country that taxes offshore assets normally does not qualify no matter how easy the residence card is to get.

One qualifier matters more than most recaps let on. The OECD states plainly that this analysis covers citizenship and residency by investment (CBI/RBI) schemes offered by jurisdictions that have themselves committed to the CRS. A program run by a country that never signed on to CRS at all is not being screened by this framework. It is not eligible for screening. Hold that distinction; it is the entire reason one of the two programs 21 CBI actually represents has never appeared on any version of this list, for a very different reason than the other one came off it.

The List That Kept Shrinking

Here is the part every recap that treats this as a fixed blacklist leaves out: the list has been shrinking almost since the day it was published, and it has not stopped. The first version, live October 16, 2018, named twenty-one jurisdictions spanning the Caribbean, the Gulf, Southeast Asia, the Mediterranean, and the Pacific: Antigua and Barbuda, the Bahamas, Bahrain, Barbados, Colombia, Cyprus, Dominica, Grenada, Malaysia, Malta, Mauritius, Monaco, Montserrat, Panama, Qatar, Saint Kitts and Nevis, Saint Lucia, Seychelles, the Turks and Caicos Islands, the United Arab Emirates, and Vanuatu. Four of those, Colombia, Mauritius, Monaco, and Montserrat, were gone within a week; Monaco’s removal reportedly followed the country giving the OECD additional information about how it actually exchanges information on applicants. By October 2021, Malaysia and Qatar had also come off, leaving fifteen. As late as May 2024, those same fifteen jurisdictions were still listed, spread across more than twenty individually named schemes.

Sometime in the two years since, the OECD cut the entire list down to one country. As of today, the page names exactly one jurisdiction, Panama, and exactly three of its programs: the Reforestation Investor Permit, the Economic Solvency Permit, and the Friendly Nations Permit. Every other name that has ever appeared on this table, Malta, Cyprus, every Eastern Caribbean program, the UAE, and Vanuatu, is gone. The OECD has not published anything explaining the change, or exactly when it happened. A claim that this list “spans several continents” today is describing 2018 through 2024. It is not describing the document that currently exists.

Six Years On The List: The Honest Vanuatu Account

This is the part a firm that actually represents Vanuatu does not get to skip past. Vanuatu’s Development Support Program, the same program serviced through 21 CBI’s cbi.vu vertical, sat on the OECD’s high-risk table continuously from October 16, 2018, through at least May 2024, alongside three other Vanuatu schemes named on the same list: its Self-Funded Visa, Land-Owner Visa, and Investor Visa. That is not a rumor pulled from a competitor’s sales deck. It is what six years of archived OECD pages show.

The mechanical reason is straightforward once separated from the “list of shady countries” framing. Vanuatu’s citizenship program has historically carried no personal income tax and no requirement that an applicant actually live there, precisely the two-part combination the test is built to flag. Vanuatu itself is not, and never has been, hiding from the CRS: it signed on in 2018, in a wave of fifty-one jurisdictions committing to a first-exchange date that year, and Vanuatu participates in CRS, meaning financial account information tied to accounts there is automatically exchanged with account holders’ countries of tax residence every year, and has been since. The flag was never about Vanuatu’s own transparency as a country. It was about an individual using the passport to claim a tax residence that does not match where they actually live, and the two-part test cannot tell that person apart from someone who genuinely relocated, so it flags the structure and leaves the distinguishing to the bank.

Sometime in the two years since, Vanuatu came off the list, along with every jurisdiction except Panama. No public statement from the OECD, the Vanuatu government, or anyone else pins down exactly when, or explains why. The honest position is that nobody outside whoever maintains that page knows what changed, and pretending otherwise would be the kind of unearned confidence this firm does not deal in.

Why El Salvador Never Showed Up, And Structurally Cannot

El Salvador’s Freedom Passport has never appeared on any version of this list, and the reason is not that the program was reviewed and cleared. It is that the program is not eligible for review under this framework at all. Recall the qualifier from above: the OECD’s high-risk analysis covers CBI/RBI schemes offered by CRS-committed jurisdictions. El Salvador is not one. The OECD’s current commitments list places it among forty-two developing countries that have never been asked to commit to a CRS exchange date, a separate bucket entirely from the 130 jurisdictions that have committed to one. El Salvador is Non-CRS, meaning its financial account information is not automatically shared with foreign tax authorities in the first place, so there is no CRS integrity for a scheme there to threaten in the sense this framework measures.

That is a structural fact about the jurisdiction, not a verdict on the program, and the two should not be confused. Separately, and worth naming on its own rather than folded into that same point, El Salvador is one of five jurisdictions the OECD’s Global Forum names as “relevant to” the newer Crypto-Asset Reporting Framework (CARF) without having committed to implement it, a different classification under a different standard entirely. What that actually means for a Freedom Passport holder’s exchange activity is its own subject, and it gets the depth it deserves in El Salvador’s Non-CRS Standing: What It Means When CARF Lands in 2027.

A Flag, Not A Verdict

Nothing about appearing on the OECD’s table has ever made a passport illegal, void, or unusable, and nothing about coming off it makes one newly legitimate. The framework’s own language is explicit about what it actually does: under the CRS rules, a bank “may not rely on a self-certification. . . if the Financial Institution knows or has reason to know” that it is incorrect, and in making that call it should weigh “the results of the OECD’s CBI/RBI risk analysis” among other relevant information. The same guidance hands compliance officers a specific set of follow-up questions for an account holder who claims residence through a flagged scheme: did you obtain that residence through a CBI or RBI program, have you actually spent more than ninety days somewhere else, and where did you file your income tax returns.

A flagged jurisdiction does not lose the right to sell citizenship. Its citizens lose the presumption that a bank will take their tax-residence claim at face value.

That is the entire mechanism: enhanced due diligence at the bank, triggered by a self-certification that does not match a published risk profile. No government loses the authority to run the program it chooses to run. No court strikes anything down. It is a due diligence flag for financial institutions, not a legal prohibition on the schemes themselves.

The November 2023 Report, Read Accurately

You will also see a claim, repeated confidently enough that it nearly made it into this article unchecked, that the OECD conducted a fresh review in November 2023 that re-screened over a hundred residency and citizenship schemes from scratch. A real document from that month exists: a joint report from the Financial Action Task Force (FATF) and the OECD, approved by the FATF Plenary in late October 2023 and published under the OECD that November, titled Misuse of Citizenship and Residency by Investment Programmes. It is a sixty-page look at money laundering, corruption, and fraud risk across the whole CBI/RBI industry, not a narrow CRS exercise, and its one relevant passage does not describe a fresh re-screening. It cites the OECD’s own ongoing, continuously maintained website figure, that the OECD has analyzed more than a hundred CBI/RBI programs and currently flags a subset as high-risk, the same running tally that had already been sitting on the OECD’s site for five years by the time this report quoted it. The “over a hundred analyzed” number is real. Treating November 2023 as the date a fresh review happened is not.

What This Actually Means If You Hold One Of These Passports

None of this was ever a substitute for correct tax residency reporting, and the OECD built the entire framework on the assumption that some people would try to make it one. Your bank does not check the OECD’s table before opening your account. It asks you to self-certify where you are a tax resident, and the table exists so a compliance officer has a documented reason to ask follow-up questions when your citizenship, your stated residence, and your actual life do not line up. If you genuinely live where you say you live, spend real time there, and file where the law requires, the flag was never describing you, whether or not your passport’s country of origin happens to be on the list this month. If you were counting on the passport itself to do the work that only an honest residence and a clean paper trail can do, the table was never going to save you, and its disappearance from a country’s row would not save you either.

For a US citizen, none of this changes the harder fact underneath it: citizenship-based taxation and FATCA reporting apply regardless of any second passport you hold. That is a separate, heavier framework, and the mechanics of US exit are covered in full elsewhere on this site.

Low time preference does not mean no action. It means building a residence and reporting record that would survive scrutiny even if every OECD list vanished tomorrow, because the table was only ever describing what a bank might ask, never what you actually owe.

This is general information about an OECD due-diligence framework that the OECD itself updates on an ongoing basis, not tax or legal advice for your situation. The jurisdiction list, the criteria it applies, and the CRS and CARF commitment figures referenced here reflect the primary sources available as of this writing and are subject to change; confirm the current list and your own reporting obligations with a qualified tax advisor before relying on any of it.