Regulatory Arbitrage and Its Limits: Why CBI Isn’t a Loophole

Bitcoiners navigate regulatory differences before they ever use the phrase. A miner prices power, curtailment rules, and political risk before choosing a site. A founder chooses where to incorporate based on company law, banking access, and reporting duties. A holder chooses which regulated exchange or custodian will touch fiat based on licensing jurisdiction, disclosure rules, and counterparty risk. Different rulebooks produce different outcomes, so rational people choose among them.

Then citizenship enters the conversation and the same choice gets called a loophole.

That accusation collapses two very different acts. One is cross-border planning that lawfully uses differences among rulebooks: understanding the rules, changing the facts that legally matter, disclosing those facts, and accepting every duty that remains. The other is concealment or evasion: hiding the real facts, making a false tax-residence claim, using illicit funds, or assuming a new passport makes an old obligation disappear. The first may be lawful regulatory arbitrage. The second is misconduct.

The argument over regulatory arbitrage in citizenship by investment starts there. Citizenship by Investment (CBI) is a statutory route under which a sovereign state may grant citizenship after prescribed screening and a qualifying contribution or investment. It is not an exemption from law. It is an express use of law, and its value stops exactly where another applicable rule begins.

Arbitrage Is A Choice Between Rulebooks

The Bank for International Settlements has described regulatory arbitrage as the search for jurisdictions where the regulatory burden is lightest. It is one tool inside broader jurisdiction selection, not a synonym for every cross-border choice. The choice can involve where you live, where a company is managed, where an account is held, or which citizenship you acquire. The word “arbitrage” does not make the conduct evasive. The substance, disclosures, and applicable rules decide that.

Nationality law begins from sovereign competence. Article 1 of the 1930 Hague Convention on nationality states that each state determines under its own law who its nationals are, subject to international conventions, custom, and generally recognized principles of law. A CBI statute works inside that allocation of authority. The state writes a qualifying route. The applicant meets it. The state still decides whether to grant citizenship.

CBI is not a hidden gap in the rule. It is a route the law expressly creates: an applicant who satisfies defined financial, documentary, and diligence conditions may be naturalized. The OECD itself acknowledges that people use investment-migration programs for legitimate reasons, including mobility, business, education, and political stability, while warning that the same programs can be abused.

Both halves matter. A statutory route can be legitimate, and a person can still misuse it. Lawfulness depends on the express structure, the substance behind it, accurate disclosure, and every other rule that still applies.

Five Ledgers People Collapse Into One

Most bad advice in this market treats one passport as if it rewrites five ledgers at once. It does not.

01 / Citizenship. This is the legal bond between a person and a state. A successful CBI file changes this ledger. It may add a nationality, a passport, entry rights, political status, and the ability to pass citizenship under the issuing country’s law.

02 / Physical and immigration residence. Citizenship may give you the right to live somewhere. It does not prove that you actually live there, satisfy a minimum-presence rule, or cease residing somewhere else.

03 / Tax residence. Tax residence follows domestic law and, where relevant, treaty tie-breakers, which may examine days present, domicile, a permanent home, center of vital interests, or other statutory connections. A citizenship certificate may be relevant evidence in some systems. It is rarely the whole test.

04 / Banking domicile. An account is governed by the institution, booking entity, customer file, and reporting rules attached to it. Showing a different passport to a bank does not teleport an existing account into a different legal system.

05 / Entity residence and control. A company’s place of incorporation is one fact. Where it is managed, where its owners live, and where it earns income can create separate reporting and tax consequences. A founder’s new citizenship does not move the company by itself.

A second passport can change which state recognizes you as a citizen. It cannot rewrite a fact pattern that still points somewhere else.

This is the central limit. Regulatory arbitrage works only on the ledger you have legally changed. If you buy citizenship but leave your home, management, accounts, and tax residence untouched, you have changed citizenship. Nothing more should be assumed.

Disclosure Is Necessary, Not Sufficient

Full disclosure is a necessary screen for lawful arbitrage. It is not the whole legal analysis. Would the structure still produce the claimed result if every relevant government, bank, exchange, and advisor saw the same accurate facts?

If yes, you may have a defensible jurisdictional structure, but disclosure alone does not cure a prohibited arrangement, a missing-substance problem, or an applicable anti-abuse rule. If the result depends on one institution not knowing where you really live, which passport you also hold, who controls an entity, or where the contribution came from, the structure has already failed the first screen.

The joint FATF and OECD review of investment migration makes the same distinction in operational terms. It recognizes legitimate applicants and legitimate capital, then documents how illicit actors can abuse CBI and residency programs to obscure identity, move criminal proceeds, evade tax, or escape sanctions. Its answer is not to pretend every applicant is clean or every applicant is guilty. It recommends risk-based, multi-layer due diligence.

Those recommended controls can reach the person and the money. Identity and criminal-history checks. Politically exposed person and sanctions screening. Adverse-media review. Separate source-of-funds and source-of-wealth analysis. Corporate ownership. Family-member exposure. Re-screening after approval where the risk requires it. National program law determines which controls are mandatory, and a lawful applicant does not get to skip the controls that apply because the route itself is lawful.

Bitcoin makes the distinction sharper. An on-chain trail can document transfers between addresses. It cannot, on its own, identify every person behind those addresses, prove the lawful economic origin of the wealth, explain an undocumented over-the-counter purchase, or cure a tax filing that should have existed. The passport application and the reporting structure must both survive the same factual record.

CRS Follows Tax Residence, Not The Passport

The Common Reporting Standard (CRS) is the OECD framework under which participating jurisdictions automatically exchange financial-account information with the jurisdictions where account holders are tax resident. It is not a citizenship registry.

The OECD’s tax-residence guidance is unusually direct: holding citizenship or a right to reside somewhere does not automatically make you tax resident there, and it does not automatically extinguish tax residence somewhere else. For CRS self-certification, an account holder must disclose every tax residence that applies.

That means a newly issued passport cannot turn a false self-certification into a true one. A Reporting Financial Institution may not rely on a self-certification or documentary evidence when it knows or has reason to know the evidence is incorrect or unreliable. CBI documentation can therefore create more questions, not fewer, when the claimed residence does not match the client’s home, filings, contact details, or transaction history. Our earlier analysis of the OECD’s CBI and CRS warnings covers that narrower mechanism in depth.

The Crypto-Asset Reporting Framework (CARF) is separate. It is designed for standardized reporting and automatic exchange of tax-relevant information collected by reporting crypto-asset service providers. The OECD’s current commitment list groups jurisdictions by planned first exchanges in 2027, 2028, or 2029, subject to domestic implementation. CARF follows reportable transactions and taxpayer residence data through participating service providers. A different passport does not change the residence facts those providers are required to collect.

CRS sees reportable financial accounts. CARF is built for reportable crypto-asset transactions. Neither asks which citizenship story sounds most convenient.

US Citizenship Is A Hard Anchor

For a United States citizen, the limit is more direct. The Internal Revenue Service states that US citizens abroad generally remain subject to US tax on worldwide income and must report taxable income under the Internal Revenue Code. The Foreign Account Tax Compliance Act (FATCA) separately requires reporting by certain US taxpayers and foreign financial institutions. A second passport does not switch either system off.

It may improve mobility. It may create a place to live or the prudent fallback nationality most people want before they consider expatriation. Those are substantial outcomes. They are not an exit from US citizenship-based taxation.

Renunciation is a separate legal act with separate tax and immigration consequences. It should never be smuggled into a CBI claim as if acquiring one citizenship silently cancels another. The US Exit Tool models that distinct question. Use it as a starting framework, then work with qualified legal and tax advisors before treating any result as a plan.

The Program Itself Has A Perimeter

Sovereign authority is broad. It is not unlimited.

The qualification in Article 1 of the Hague Convention matters: nationality rules operate alongside international conventions, international custom, and generally recognized principles. Regional legal orders can add another layer. Other states control their own visa policies. Banks control their risk appetite. Courts can decide that a particular program conflicts with law above it.

The brief historical example is the former Maltese Citizenship by Naturalisation for Exceptional Services by Direct Investment framework. On 29 April 2025, the Court of Justice of the European Union held in Case C-181/23 that Malta’s transactional grant of nationality in direct exchange for predetermined payments or investments was incompatible with EU law. The judgment did not create a worldwide ban on CBI. It established that an EU member state’s nationality competence had to be exercised consistently with its Union-law obligations, and that this specific model crossed that line.

That is regulatory arbitrage reaching its institutional boundary. A state can design a route under domestic law. The route still has to survive every superior or overlapping rule that legally binds that state. The buyer carries that program-level risk even when the buyer’s own file is perfect.

Read Each Profile On Its Own Terms

El Salvador is a Non-CRS jurisdiction. The OECD’s status list dated 27 July 2026 places it among developing jurisdictions that have not been asked to commit to a first CRS exchange date. That means financial-account information is not automatically exchanged by El Salvador through the CRS network. It does not put the country outside tax cooperation on request, make an applicant invisible, stop accounts held elsewhere from reporting, or release a US person from FATCA and worldwide-income rules. The Freedom Passport is one legal citizenship route inside a broader structure; passport.sv documents that Non-CRS profile and its limits on its own terms.

Vanuatu participates in CRS and has exchanged financial-account information under the standard since 2018, as the OECD’s 2025 peer review records. The OECD currently marks Vanuatu’s CBI and residency documentation as presenting a high risk of misuse for CRS-circumvention analysis. That is a program-risk flag for due diligence, not an accusation against every applicant. A Vanuatu passport does not itself determine which jurisdictions receive a report. The account holder’s applicable tax residences do.

The same profile shows how quickly external rights can move. The Council of the European Union ended Vanuatu’s visa exemption in December 2024, and the United Kingdom imposed a visa requirement in July 2023, in each case citing concerns tied to investor citizenship. The citizenship remained. The destination countries changed how they treated the passport. The program, diligence process, and CRS posture are documented separately at cbi.vu.

Both examples make the same analytical point without turning them into a league table: read the citizenship rule, the residence rule, and the reporting rule as separate instruments. Do not ask a passport to perform work assigned to another part of the structure.

Four Questions For A Structure Check

Before calling any move regulatory arbitrage, run four questions against it.

First: which legal rule are you changing? Citizenship, immigration residence, tax residence, account location, and entity residence are different answers. Name one.

Second: what fact anchors the old rule? Citizenship, days present, a permanent home, central management, beneficial ownership, or an account relationship may keep the original jurisdiction in the structure.

Third: what fact must become true under the new rule? A certificate, physical presence, a filed return, a real home, an operating company, or a new account may be required. Intention is not evidence.

Fourth: what disclosure survives, and does the result survive it? Where applicable, CRS, CARF, FATCA, sanctions screening, beneficial-ownership reporting, and source-of-wealth questions do not disappear merely because another jurisdiction enters the picture. Show the same facts to the old jurisdiction, the new one, the bank, and the advisor. If the claimed benefit disappears when everyone sees the truth, it was never a durable structure.

CBI is strong when the goal is the thing CBI actually delivers: citizenship. It can support mobility, family continuity, and jurisdictional optionality. It can form one layer of a broader residence, banking, entity, or tax plan. It cannot substitute for those other layers, and it cannot launder a fact you never changed.

A paid Sovereignty Strategy Session gives you one hour with Adam Juchniewicz, CEO, to separate those ledgers before a government file exists. It is $475 through BitSettle or $500 through Stripe, and the amount paid credits toward professional fees if you retain 21 CBI within 90 days. Book through advisory; there is no obligation to proceed.

Name the rule. Trace the facts. Test the Structure.

This article is general information, not legal, tax, or immigration advice. Nationality laws, tax-residence tests, reporting standards, program rules, and court interpretations change. Confirm the current law in every jurisdiction that touches your facts, and consult a qualified tax advisor regarding your specific situation before acting.