Chain of custody, GDPR data handling and validity windows for 21 CBI and Golden Visa programmes
Reference material for licensed CBI, RBI and Golden Visa agents: risk framing, chain of custody, applicant data handling, validity windows, the supplier-to-sub-agent boundary, and scale.
The real risk
Applications fail on the paperwork, not on the investment.
In the Eastern Caribbean the licensed agent is the submitter of record. The regional regulatory agreement enacted in 2025 makes furnishing a materially false or misleading document an offence committed knowingly OR recklessly - with the licence, not just a fee, on the line. Three things put a file there.
A document nobody can vouch for
The client sends a scan. It goes into the file. If it later proves altered, the question the regulator asks is not who forged it - it is what you did to verify it before you submitted it.
The wrong authentication chain
Apostille where legalisation was required, a notary's certificate without the apostille, or documents apostilled in a bundle where the receiving mission accepts them only individually.
A validity window that closed
Police certificates and bank references age out while the rest of the file is still being assembled. A five-applicant family multiplies every window by five.
Malta's agency handbook names the mechanism precisely: an incomplete-application report can be triggered by "documents missing authentication/certification", and the agency's own 120–150 day window explicitly excludes any time spent on agent interventions.
Chain of custody
Every document arrives with its own evidence attached
This is the part of the service that is actually being bought. Not speed - provenance. For every document in every file we record and hand you the same five facts.
- 01
Source
Which issuing authority produced it, in which jurisdiction, and under which reference - not "the client sent it".
- 02
Verification
Where the issuing authority runs a public register - several apostille authorities do - we check the document against it, so the record reads confirmed rather than obtained.
- 03
Date
Date of issue and the validity window that applies to the programme you are filing to, so expiry is scheduled rather than discovered.
- 04
Authentication route
The exact chain applied - notary, apostille or the full consular sequence - with the competent authority named at each step.
- 05
Handling
Who touched the original, where it physically travelled, and against which tracking reference.
- 06
Retention
Where the record is stored, under whose access control, and for how long - set to the retention floor your programme requires, not ours.
The Eastern Caribbean regulatory agreement sets its own technical standard for the regional applicant database - encryption in transit and at rest, multi-factor access control, continuous monitoring, and access that is logged and auditable. We hold our own handling to that same bar rather than to a marketing claim.
Applicant data
An RCBI file is not ordinary personal data. It is the hardest category there is.
A single application stacks criminal-conviction data, health data and source-of-wealth material on a client who is frequently a politically exposed person. Under the GDPR that combination has no easy consent route, and your own regulator, your professional body and your client's counsel will all test it separately.
Criminal records sit under Article 10
Police conduct certificates are conviction data. Article 10 has no consent gateway of the kind Article 9 offers - processing has to rest on a lawful basis with real safeguards, not a tick-box.
Every notary and translator is a sub-processor
Article 28(2) means a distributed supply chain has to be disclosed, not assumed. We name ours, and you get an objection right rather than a surprise.
Deletion is not always the safe answer
The Eastern Caribbean framework sets a fifteen-year retention floor for due-diligence records. A vendor promising to erase everything after ninety days is failing your compliance review, not passing it.
Written terms, audit rights, named contact
A data processing agreement with the Article 28(3) terms including audit and inspection, a disclosed sub-processor list, a stated breach-notification clock, and a named security contact who answers.
Validity windows
The file expires while you are still assembling it
This is the arithmetic that breaks multi-applicant families. Windows are short, they differ per programme, and the residence test that decides how many police certificates you need is different in almost every one. We schedule the collection order backwards from your filing date across the whole family.
| Document | Window | Where the rule comes from |
|---|---|---|
| Police certificate | Under 3 months at lodgement | Antigua & Barbuda application form |
| Police certificate | Issued within 3 months | Dominica CBIU application guidance |
| Conduct certificate | Original required; issued in the 6 months preceding application | Malta agency handbook (naturalisation route) |
| HIV test | Within 3 months of the medical examination | Grenada prescribed medical form |
| Medical certificate | No more than 3 months old | Dominica CBIU application guidance |
| Bank reference | Not older than 3 months | Antigua & Barbuda application form |
| Professional reference | Not older than 6 months | Antigua & Barbuda application form |
| Proof of residential address | Two originals, not older than 3 months | Antigua & Barbuda application form |
| Photographs | Taken within the past 6 months | Antigua & Barbuda application form |
And the residence test is different in every programme
Malta
Every country of at least 6 months' cumulative residence in the last 10 years, applicants aged 16 and over
Antigua & Barbuda
Every country lived in for 6 consecutive months or longer since the age of 18
Grenada
Every country of more than one year's residence, plus countries of citizenship
Dominica
Country of birth, current country of residence, and any country of more than 6 months' residence in the last 10 years
A file built to one programme's test fails another's. Rules cited from the programmes' own published forms and handbooks; they change, and we re-check them per file rather than per year.
Scope boundary
We are your supplier. We are never your sub-agent.
This matters more than it sounds. Caribbean frameworks license agents, promoters, due-diligence providers, developers and escrow agents - and define a sub-agent as anyone engaged in the promotion, referral or facilitation of an application. A supplier that drifts across that line has to be licensed, and contaminates the licence of the firm that engaged it.
- We supply document services to your firm. We do not promote, refer or facilitate applications.
- We do not advise on migration law, programme selection or eligibility, and nothing we produce is legal advice.
- We never contact your client except where you instruct it in writing, and never under our own name where you have engaged us white label.
- We make no representation about the outcome, timing or approval of any application by any authority.
It is written into the engagement, not just stated here - so it survives your compliance review rather than your account manager's memory.
Scale
Built for the family of five, and the portfolio of two hundred
Most firms in this industry run under ten people. The document arithmetic does not scale with the headcount, and hiring for a seasonal spike is how practices break.
One submission per family
Five applicants, five sets of civil-status records, five police-certificate maps - filed as one job with one due date, not five parallel threads.
Portfolio-wide window scheduling
Collection order sequenced backwards from each filing date, across every open file, so nothing ages out in the queue.
A manager who knows your programmes
One named contact who already knows which units you file to and what each one rejects. Escalation path in writing.
Consolidated billing
One invoice across offices and files, itemised per document so you can rebill your own client cleanly.
Status without asking
Every document's current step visible in the cabinet, so an account manager can answer a client the moment they ask.