Bitcoin source of funds is the hardest part of CBI. We built the Method.
Bitcoin source-of-funds work is not a standard fiat-document exercise. Deferring it until after engagement can expose gaps during review. 21 CBI makes the evidence package a defined workstream from the start.
Citizenship by Investment (CBI) is a legal pathway in which a sovereign nation grants citizenship in exchange for a government-approved financial contribution. Applications undergo identity, due-diligence, and financial-source review under the selected program’s rules. For a Bitcoin-funded file, assembling evidence that connects the funding history to the applicant is often a substantial part of the engagement.
This page is the public version of how 21 CBI assembles that package. It is not a teaser. It is the methodology, written so a Bitcoiner can audit our approach before engaging and so a Financial Intelligence Unit can verify our discipline after submission. Show, do not tell.
PDF, ~38 KB. Ungated. Same content as this page, formatted for offline reading.
Why source of funds is the hardest CBI step for Bitcoiners.
The standard CBI source-of-funds package was built for fiat wealth. Bank statements, salary records, audited business accounts, inheritance documentation, real-estate sale records. Each of those is a known artifact with a counterparty that can attest to it. Financial Intelligence Units (the government bodies that conduct due diligence on CBI applications) have decades of pattern-matching on what a fiat source-of-funds package looks like.
Bitcoin changes those assumptions. There is no centralised counterparty for self-custody. The blockchain records transactions, but it does not by itself identify the lawful source or controller of an address. Early-cycle exchanges may no longer exist, and their records may be incomplete. Solo-mined rewards originate in coinbase transactions; pool earnings usually arrive as ordinary payout transactions. Off-chain trades and peer-to-peer purchases can lack durable third-party records. UTXOs are consolidated and split across years; the audit trail is real, but it needs supporting evidence and explanation.
The result is a format mismatch. A Bitcoiner may be able to verify control of a position on-chain in minutes while still lacking the records an authority needs to establish lawful origin, tax treatment, and counterparty context. That gap can produce follow-up questions or delay. The chain proves movement and control; it does not replace the documentary source-of-funds record.
Closing the format gap is the work. That is what this methodology documents.
What Financial Intelligence Units actually look for.
CBI applications undergo due-diligence review through a government authority or its designated screening process. Vanuatu uses the Vanuatu Financial Intelligence Unit (VFIU). El Salvador routes through The Bitcoin Office of El Salvador with sanctions and adverse-screening checks at the General Directorate of Migration and Foreigners. Bespoke work is reformatted for the authority governing the selected jurisdiction. The receiving body and its requirements change by route.
Across routes, reviewers commonly need five parts of a Bitcoin source-of-funds package:
- A complete and verifiable origin trail. Where did the Bitcoin come from? Purchase, mining, peer-to-peer transfer, business income, inheritance, hard fork. Every entry point named and documented.
- A custody chain from origin to current control. Exchange to self-custody, wallet consolidations, multisig setups, hardware-wallet rotations. Every meaningful movement explained.
- Reconciliation between disclosed positions and on-chain reality. What you say you hold matches what the chain shows you control. Unexplained discrepancies can trigger questions, delay, or rejection.
- Risk-screened counterparties. The relevant funding addresses are checked against available risk indicators. Where a counterparty raises a flag, it is named and contextualised before submission to the receiving authority.
- Tax and reporting compliance in your jurisdiction of tax residence. Filed returns, where applicable. Required FBAR and Form 8938 filings for US persons. Equivalent disclosures where another jurisdiction’s rules apply.
That is the evidentiary frame. A self-custody position with documented purchases and a coherent audit trail is easier for an authority to evaluate. Missing records, opaque wallet transitions, and unresolved inconsistencies increase the risk of questions, delay, or rejection. Documentation strengthens the file; the authority still decides the outcome.
The 21 CBI seven-step source-of-funds process.
This is the working sequence for a Bitcoin-funded engagement. Each step produces evidence or analysis for the package submitted to the receiving authority.
- Origin discovery.We map every entry point through which Bitcoin entered your control. Exchange accounts (active and defunct), mining payouts, peer-to-peer purchases, business income, gifts, hard-fork claims, airdrops, OTC trades. Each entry point is timestamped and documented to the most authoritative record available.
- Custody mapping.We chart the wallets, hardware devices, multisig setups, and Lightning channels that have held or moved the engagement funds. The initial map stays tied to the funding path; the receiving authority may request additional evidence where its rules or review require it.
- Documentation collection.We collect available exchange exports, account statements, bank records showing fiat outflows to exchanges, contemporaneous purchase records, mining-pool payout histories, operating-cost evidence, and applicable tax filings. The required set depends on how the Bitcoin was acquired and what the receiving authority requests.
- On-chain analysis.Where the scope calls for commercial blockchain analytics, Chainalysis Reactor can map transaction flows and available entity attribution, while TRM Labs can screen wallet risk indicators. We document the returned analysis, name relevant flags, and prepare contextual explanations for the receiving authority. Tool output is evidence, not an approval decision.
- Reconciliation.We tie documented acquisitions to the current on-chain position. Bitcoin included in the package is matched to available transaction evidence and proof of present control. Unresolved balances are documented separately or removed from the proposed funding scope. The output is a reconciliation table designed for efficient authority review.
- Pre-audit package.We compile the origin trail, custody map, documentation pack, on-chain analysis, and reconciliation table into a single submission package formatted to the destination program’s requirements. We attach a signed cover memo summarising the package and naming the analyst (Adam personally signs every package). We pre-audit the package against current document requirements and identified risk criteria before submission.
- Submission and iteration.We submit through the program’s authorised channel (direct for our El Salvador agency, through licensed partners for other programs) and stand by for follow-up questions. Review-cycle count and timing depend on the authority and the evidence. We target a response to authority questions inside seventy-two hours of receipt.
The output of steps one through six is a reviewable evidence package. Step seven puts that package before the authority; it does not predetermine the authority’s decision.
On-chain analysis: what we run, what it shows, what it does not.
Where included in the engagement scope, Chainalysis Reactor provides transaction tracing, fund-flow visualisation, and available entity attribution. We use those outputs to map relevant movements from identified funding addresses. Coverage and attribution depend on the addresses, assets, and data available to the tool.
TRM Labs wallet screening can return address-level risk indicators and attribution. We document relevant flags and the available context for the receiving authority. A tool label or score is not itself a conclusion about the applicant, and the authority decides what weight to give it.
Where the position predates institutional analytics coverage (early-cycle addresses from 2013 to 2016, addresses on chains or custom explorers that were never indexed by Chainalysis or TRM), we build the analysis manually against the public blockchain. We use public block explorers, archived web pages of defunct services, and contemporaneous Bitcoin Talk forum threads to reconstruct the origin context. The output is a written analyst narrative attached to the package as supporting documentation.
Product references: Chainalysis Reactor capabilities and TRM Wallet Screening.
Tooling is an input. The judgement that assembles a defensible narrative is what makes a package reviewable. A reviewer may accept a documented risk explanation or challenge an unexplained flag; neither outcome can be promised in advance. The package is a written argument, not a screenshot dump.
Exchange records and US reporting evidence.
US tax filings can provide useful third-party and contemporaneous evidence, but income-tax reporting, FBAR, and Form 8938 have different scopes. The 21 CBI workflow uses the records that actually apply alongside the on-chain history tying exchange or broker withdrawals to self-custody addresses.
The inputs we pull from existing US filings:
- Form 8949 and Schedule D. These records can document reportable Bitcoin dispositions, cost basis, and disposition dates. We compare applicable filed records with the on-chain transaction history.
- Form 1099-DA from reporting brokers. US digital-asset brokers subject to the current reporting rules began reporting gross proceeds for covered 2025 transactions on Form 1099-DA. A form that applies to the applicant is useful third-party evidence; the receiving authority decides its weight.
- FBAR (FinCEN Form 114) for reportable foreign financial accounts. The $10,000 threshold applies to the aggregate value of reportable foreign financial accounts. Under FinCEN’s current virtual-currency notice, an account holding only virtual currency is not automatically reportable solely for that reason; an account holding other reportable assets may be. Confirm the current classification and filing duty with qualified US counsel.
- Form 8938 (FATCA Statement of Specified Foreign Financial Assets). Form 8938 is separate from FBAR and uses different asset definitions and thresholds. Whether an exchange or custodial relationship is reportable depends on the facts and current guidance.
- Self-employment Schedule C or business returns. Where Bitcoin acquisition is via business income or mining operated as a trade, the corresponding business return is the income source documentation.
Official references: IRS Form 1099-DA, IRS Form 8938 and FBAR comparison, and FinCEN’s virtual-currency FBAR notice.
Some of this evidence overlaps with information already filed with US authorities, but a CBI source-of-funds package has a different purpose and scope. If required gains, FBARs, or Form 8938 assets were not reported, we tell the prospect to address the underlying issue with a qualified US tax attorney before filing. We do not paper over compliance gaps; an authority can treat them as source-of-funds risk.
For US persons whose endpoint is renunciation of US citizenship after the second passport is in hand, the source-of-funds package built for the CBI engagement is the same package that will support the IRC Section 877A mark-to-market analysis through Exitly when it launches in Q3 2026. Build it once, use it twice.
UTXO-level documentation for self-custody positions.
Self-custody can provide strong proof of present control: the applicant holds the keys, signs the proof, and demonstrates control on-chain. It does not establish lawful origin by itself. UTXOs that have been consolidated, split, and re-consolidated across years need to be reconciled to the underlying source records.
The standard documentation we build for a self-custody position:
- UTXO inventory at engagement. A complete list of UTXOs that will fund the CBI contribution, with the address (or xpub-derived address path) for each.
- Per-UTXO provenance chain. For each UTXO, the chain of transactions back to the documented origin event. Where intermediate transactions are coin consolidations or wallet rotations, the analyst memo explains the operational reason.
- Signed message proofs. Where the address type and wallet support a compatible signing method, a signed message can support proof of present control. A test transaction or other proof may be needed when message signing is unavailable.
- Multisig descriptor evidence. Where the position is held in a multisig setup, an appropriate descriptor or other wallet-policy evidence can help the reviewer understand the control structure without exposing unrelated private keys.
- Lightning channel documentation. Where engagement funds move via Lightning, channel-state documentation and counterparty identification.
UTXO-level documentation gives the reviewer verifiable evidence of the funding path and present control. It does not prove lawful origin by itself; the transaction history must reconcile to exchange, income, mining, gift, inheritance, or other source records.
Documenting mining income.
Mining income has a verifiable on-chain starting point: the coinbase transaction creates the block subsidy and assigns the subsidy plus fees to the address or addresses selected by the block producer. For pool mining, later pool-payout records are still needed to connect the block reward to the applicant. The chain proves the transaction path; it does not prove who operated the miner or how the income was reported.
The complication is income reporting and operating-cost evidence. A program authority may ask whether mining proceeds were reported where required and whether the operation matches the applicant’s declared business activity. CRS is a separate financial-account reporting framework; it is not the channel through which a CBI application is reviewed.
Standard documentation for a mining-origin source-of-funds package:
- Pool payout records. For pool miners, the pool’s per-payout history with timestamps and per-payout amounts.
- Solo mining coinbase mapping. For solo miners, the list of blocks mined and the coinbase transactions, with the mining-pool field decoded where applicable.
- Operating-cost evidence. Electricity bills, hardware purchase invoices, hosting-facility contracts, and other operating records can corroborate that the declared mining activity existed.
- Income reporting. Applicable filed returns can connect the declared mining income to contemporaneous tax records. The required form and treatment depend on the taxpayer’s jurisdiction and facts; qualified tax counsel should confirm them.
- Jurisdiction-specific compliance. Where a licensing, registration, or operating-permit regime applied to the mining activity, include the relevant record.
A program authority can treat documented mining as a legitimate source of income. The work is proving that the operation, tax treatment, and on-chain proceeds match what the applicant claims.
The pitfalls we see most often.
The same evidence gaps recur in Bitcoin source-of-funds work. Naming them publicly lets prospects pre-screen their own positions before they engage.
- Pre-2017 acquisitions on now-defunct exchanges. Bitcoiners who bought through Mt. Gox, BTC-e, Cryptopia, or QuadrigaCX have legitimate origin events with no operating-exchange records to retrieve. The mitigation is contemporaneous bank-transfer records, email confirmations, claim-process documentation, and chain-analysis tying on-chain receipt to addresses the applicant controls. This is workable; it is just more work than a clean Coinbase 1099-B.
- Mixer or CoinJoin history without context. A CoinJoin transaction is not automatically disqualifying, but it can prompt enhanced review. We document each relevant CoinJoin with the tool used, the stated rationale, and the analyst’s risk assessment. The authority evaluates that context and can request more evidence or decline the file.
- OTC trades without counterparty records. Over-the-counter purchases through Bitcoin Talk forum threads, Discord groups, or peer connections in 2013 to 2017 often have no surviving counterparty. Bank statements showing the fiat transfer, contemporaneous communications, and on-chain receipt records strengthen the evidence. Missing records increase the risk of questions, delay, or rejection.
- Exchange-KYC gaps from 2017 to 2019. Many Bitcoiners traded on early-cycle exchanges that no longer exist or have incomplete KYC archives. The relevant FIU or program authority may consider circumstantial evidence such as bank statements showing fiat outflows, archived account screenshots, and timestamped trade histories. Build the package now; archived data degrades.
- Unreconciled balance discrepancies. The applicant says they hold X BTC; the chain shows Y BTC at the disclosed addresses; the difference is unexplained. The fix is the reconciliation step (Section 03, step 5). Every disclosed BTC must be accounted for, and balances at addresses within the engagement map must be reconciled to the stated scope.
- Stale tax compliance. For US persons especially, unfiled FBARs, missing Form 8938, or unreported Form 8949 lines create a tax-side exposure that the FIU may surface as a source-of-funds risk. Fix the tax compliance first; then file the CBI application. The order matters.
- Engagement letters signed before the position is screened. We review the available evidence before a wider engagement is scoped. If the file has material gaps, we name them first. The authority still makes the final decision.
Source-of-funds FAQ.
How long does the 21 CBI source-of-funds package take to assemble?
For a clean self-custody position with documented exchange purchases, four to six weeks of focused work. For positions with pre-2017 acquisitions, defunct-exchange origins, or mixer history, eight to twelve weeks. We tell you the realistic timeline on the first call after we have seen the position; we do not quote a generic "couple of weeks" number that bends under reality.
Do I have to disclose every wallet I have ever held?
The initial working scope covers wallets that hold or moved the engagement funds and the funding-source wallets needed to document their origin. Self-custody can help prove present control, but it does not establish lawful origin on its own. The receiving authority may request additional records or addresses when they are relevant to its review.
My exchange is defunct. Can the package still clear?
Potentially. A defunct exchange can still be documented through contemporaneous bank-transfer records, archived account screenshots, claim-process documentation, and chain analysis tying on-chain receipt to addresses you control. The receiving authority decides whether that evidence is sufficient; there is no guaranteed clearance.
I have mining income. Is that harder or easier?
Different, not necessarily harder. Solo-mined rewards can be connected to coinbase transactions; pool earnings usually arrive through separate payout transactions. Neither proves the operator’s identity, lawful origin, or tax treatment on its own. We assemble pool records, operating-cost evidence, applicable filed returns, and the on-chain history for the receiving authority’s review.
I am a US citizen with FATCA and FBAR exposure. Does that change the process?
Yes. US tax filings can provide useful third-party and contemporaneous evidence, but FATCA, FBAR, and income-tax reporting have different scopes. We use applicable filed returns and broker records alongside the on-chain history that ties withdrawals to your self-custody addresses. If required filings are missing, we tell you to resolve the issue with a qualified US tax attorney before filing the CBI application.
What chain-analysis tools does 21 CBI use?
We work with the Chainalysis Reactor product for transaction-graph analysis and TRM Labs for risk scoring on counterparties. Where the position predates institutional analytics coverage (early-cycle addresses, custom-built explorers from 2013 to 2016), we build the analysis manually against the public blockchain and document our reasoning. Tooling is an input to the package; the analyst judgement is what assembles a defensible narrative.
Will 21 CBI take the engagement if my source of funds will not clear?
We pre-screen the available evidence before signing an engagement letter. If the record is not ready for submission, we identify the gaps before a wider engagement is scoped. The receiving authority makes the final decision, so pre-screening is not an approval guarantee.
Two productized paths. Bespoke when needed.
The methodology above is jurisdiction-agnostic. The package we assemble is reformatted to the destination program’s requirements at the submission step. El Salvador and Vanuatu are productized; other jurisdictions, where available and appropriate, are scoped through bespoke advisory.
Begin Your Sovereignty.
We tell you whether the available evidence is submission-ready and name the gaps before a wider engagement is scoped. The authority makes the final decision.
Adam Juchniewicz, CEO, 21 CBI