Most CBI firms treat Bitcoin wealth as a compliance problem they will deal with after the engagement letter is signed. That posture is why most Bitcoin files stall at the Financial Intelligence Unit. 21 CBI documents Bitcoin source of funds as the engagement, not as a hurdle inside it.
Citizenship by Investment (CBI) is a legal pathway in which a sovereign nation grants citizenship in exchange for a government-approved financial contribution. Every CBI program in the world requires a verified source-of-funds package; without it, the application does not enter government screening. For Bitcoiners, the source-of-funds package is the largest single piece of work in the engagement.
This page is the public version of how 21 CBI assembles that package. It is not a teaser. It is the methodology, written so a Bitcoiner can audit our approach before engaging and so a Financial Intelligence Unit can verify our discipline after submission. Show, do not tell.
PDF, ~38 KB. Ungated. Same content as this page, formatted for offline reading.
The standard CBI source-of-funds package was built for fiat wealth. Bank statements, salary records, audited business accounts, inheritance documentation, real-estate sale records. Each of those is a known artifact with a counterparty that can attest to it. Financial Intelligence Units (the government bodies that conduct due diligence on CBI applications) have decades of pattern-matching on what a fiat source-of-funds package looks like.
Bitcoin breaks every assumption in that pipeline. There is no centralised counterparty for self-custody. The bank statement is the blockchain, and the bank statement is the address you do not want to disclose by default. Early-cycle exchanges where many Bitcoiners first acquired position no longer exist; their records went down with the entities. Mining income arrives as coinbase transactions, not as W-2 line items. Off-chain trades, peer-to-peer purchases, and atomic swaps leave no third-party trail. UTXOs are reorganised, consolidated, and split across years; the audit trail is real but it is not the format a CBI compliance officer was trained to read.
The result is predictable. A Bitcoiner who can document a $5M position to themselves in five minutes (here is the seed, here is the descriptor, here is the chain) submits a CBI application and watches it sit in due diligence for six months while the FIU asks questions that have no clean fiat-shaped answer. By the time the file clears, the price has moved, the program threshold has moved, or the applicant has moved on. The friction is not regulatory hostility. It is a format mismatch.
Closing the format gap is the work. That is what this methodology documents.
Every CBI program operates under an FIU or an equivalent due-diligence body. Vanuatu uses the Vanuatu Financial Intelligence Unit (VFIU). São Tomé routes through the Unidade de Cidadania por Investimento e Doação (UCID), based in Dubai. Türkiye routes through the Ministry of Interior with Provincial Directorate oversight. El Salvador routes through The Bitcoin Office of El Salvador with sanctions and adverse-screening checks at the General Directorate of Migration and Foreigners. Malta runs the Residency Malta Agency four-tier review and (for Citizenship by Merit) the Community Malta Agency. The body changes; the standard does not.
Every one of those bodies is looking for the same five things in a Bitcoin source-of-funds package:
That is the standard. It is not designed to fail Bitcoin-native applicants. It is designed to fail bad actors. A clean self-custody position with documented exchange purchases and a coherent audit trail clears the standard. A position assembled over a decade with no records, opaque wallet transitions, and no persistent metadata fails it. The difference is documentation, not the position itself.
This is what we do, in order, on every Bitcoin file we take. Each step has an output document that goes into the final FIU submission package.
The output of step seven is a cleared file. The output of step one through six is what makes step seven possible.
Chainalysis Reactor handles transaction-graph analysis. We feed in the engagement custody addresses and trace funds back to their origin counterparties. The output is a directed graph of fund movements, annotated with entity labels where Chainalysis has them (exchanges, payment processors, custody providers). For most CBI submissions the Reactor output is the on-chain backbone of the package.
TRM Labs handles risk scoring. The same addresses are checked against TRM's risk indicators (sanctions exposure, darknet markets, mixer activity, scam patterns). The output is a per-address risk profile that we surface to the FIU pre-emptively. Where TRM flags a counterparty, we document the context (a flagged exchange address may simply be the exchange's hot wallet, not a risk indicator on the applicant).
Where the position predates institutional analytics coverage (early-cycle addresses from 2013 to 2016, addresses on chains or custom explorers that were never indexed by Chainalysis or TRM), we build the analysis manually against the public blockchain. We use public block explorers, archived web pages of defunct services, and contemporaneous Bitcoin Talk forum threads to reconstruct the origin context. The output is a written analyst narrative attached to the package as supporting documentation.
Tooling is an input. The judgement that assembles a defensible narrative is what makes a package clear. We have seen FIU reviewers wave through positions with mixer history because the context was named cleanly; we have seen FIU reviewers reject clean positions because the analyst memo waved through a flag without explanation. The package is a written argument, not a screenshot dump.
US citizens and Lawful Permanent Residents start from a position of strength on the source-of-funds package, even where the FATCA (Foreign Account Tax Compliance Act) and FBAR (FinCEN Form 114) regimes feel like a burden in daily life. The IRS already holds a documentary trail for any Bitcoin position the applicant has reported correctly. The standard 21 CBI workflow for US persons reuses that paper trail as the backbone of the source-of-funds package.
The inputs we pull from existing US filings:
The CBI program wants the same information the IRS already has on file, presented in a different format. If there are unreported gains, unfiled FBARs, or missing Form 8938 disclosures, we tell the prospect to fix the underlying tax issue with a qualified US tax attorney before we file the CBI application. We do not paper over compliance gaps; the FIU finds them and rejects the file, and the prospect now has both a rejected CBI file and a known tax exposure.
For US persons whose endpoint is renunciation of US citizenship after the second passport is in hand, the source-of-funds package built for the CBI engagement is the same package that supports the IRC Section 877A mark-to-market analysis Exitly performs at renunciation. Build it once, use it twice.
Self-custody is the strongest source-of-funds posture available. The applicant holds the keys, signs the proof, and demonstrates control on-chain. The challenge is that self-custody hides the audit trail by default. UTXOs that have been consolidated, split, and re-consolidated across years do not show their origin without the analyst doing the work.
The standard documentation we build for a self-custody position:
UTXO-level documentation is the part of the package that earns the most "we have not seen a package like this before" responses from FIU reviewers. That response is a good sign, not a bad one. It means the package is providing the verifiable proof that the FIU framework was designed to accept but rarely receives.
Mining income has the advantage of clear on-chain provenance: coinbase transactions (the first transaction in every block, which creates new Bitcoin and pays the miner) are unambiguous. The Bitcoin came into existence at that block height; the address that received it is the miner's address. There is no counterparty to attest to, because the chain itself attested.
The complication is income reporting and operating-cost evidence. The CBI program wants to see that the mining income was reported in the jurisdiction of tax residence (where the program is also exposed to that jurisdiction's tax authority through CRS) and that the mining operation was a legitimate business, not a front for laundered fiat.
Standard documentation for a mining-origin source-of-funds package:
The Bitcoin Office of El Salvador, the Vanuatu Financial Intelligence Unit, and the UCID in Dubai all have stated frameworks for mining-origin funds. Each treats mining as a legitimate income source. The work is in proving the operation was what the applicant claims it was.
Most rejected Bitcoin source-of-funds packages fail for the same handful of reasons. Naming them publicly lets prospects pre-screen their own positions before they engage.
For a clean self-custody position with documented exchange purchases, four to six weeks of focused work. For positions with pre-2017 acquisitions, defunct-exchange origins, or mixer history, eight to twelve weeks. We tell you the realistic timeline on the first call after we have seen the position; we do not quote a generic "couple of weeks" number that bends under reality.
You disclose every wallet that holds funds that will be used for the CBI engagement, every wallet that received the funds that are being used, and every funding-source wallet up the chain. Wallets that have never touched the engagement funds are out of scope. Compartmentalization is preserved at the wallet level, not at the position level. Self-custody best practice (separate wallets per purpose) is an advantage here, not a problem.
Yes, with effort. Defunct exchanges (Mt. Gox, BTC-e, Cryptopia, QuadrigaCX, and several smaller venues) are recognised by Financial Intelligence Units as legitimate origin points; the obligation shifts to circumstantial evidence. We assemble contemporaneous bank-transfer records, archived account screenshots, claim-process documentation, and chain analysis tying on-chain receipt to addresses you control. The package is more work, but it clears more often than not.
Different, not necessarily harder. Mining income has the advantage of clear on-chain provenance (coinbase transactions are unambiguous) and the disadvantage of fragmented tax documentation across years and jurisdictions. We assemble pool-payout records, electricity bills as operating-cost evidence, and the income reporting you have already filed. The Bitcoin Office of El Salvador, FIU Vanuatu, and the UCID in Dubai all have stated frameworks for mining-origin funds.
Yes. US persons start from a position of strength because the IRS already holds a documentary trail for any Bitcoin position reported on Form 8949, Schedule D, FBAR (FinCEN Form 114), and Form 8938. We use that existing paper trail as the backbone of the source-of-funds package: filed returns, exchange Form 1099-B records, and the on-chain history that ties exchange withdrawals to your self-custody addresses. The CBI program wants the same information the IRS already has on file, presented in a different format. If there are unreported gains or unfiled FBARs, we tell you to fix that with a tax attorney before we file the CBI application; we do not paper over compliance gaps.
We work with the Chainalysis Reactor product for transaction-graph analysis and TRM Labs for risk scoring on counterparties. Where the position predates institutional analytics coverage (early-cycle addresses, custom-built explorers from 2013 to 2016), we build the analysis manually against the public blockchain and document our reasoning. Tooling is an input to the package; the analyst judgement is what assembles a defensible narrative.
No. We pre-screen every prospective engagement against the source-of-funds standard before we sign an engagement letter. If we cannot get your position cleared, we tell you on the first call and we do not bill for a doomed file. This is a reputation business; we do not get a second chance with a Financial Intelligence Unit that has seen us submit packages they had to reject.
The methodology above is jurisdiction-agnostic. The package we assemble is reformatted to the destination program's FIU template at the submission step. The six programs we currently advise on:
If your position will clear, we will tell you on the first call. If it will not, we will tell you that too, and we will not bill for a doomed file.
Adam Juchniewicz, CEO, 21 CBI
