Chain of custody, GDPR data handling and validity windows for 21 CBI and Golden Visa programmes
Reference material for licensed CBI, RBI and Golden Visa agents: risk framing, chain of custody, applicant data handling, validity windows, the supplier-to-sub-agent boundary, and scale.
The real risk
Licensed agent liability for a defective document
In the Eastern Caribbean the licensed agent is the submitter of record. The regional regulatory agreement enacted in 2025 makes furnishing a materially false or misleading document an offence committed knowingly OR recklessly - with the licence, not just a fee, on the line. Three things put a file there.
A document nobody can vouch for
The client sends a scan. It goes into the file. If it later proves altered, the question the regulator asks is not who forged it - it is what you did to verify it before you submitted it.
The wrong authentication chain
Apostille where legalisation was required, a notary's certificate without the apostille, or documents apostilled in a bundle where the receiving mission accepts them only individually.
A validity window that closed
Police certificates and bank references age out while the rest of the file is still being assembled. A five-applicant family multiplies every window by five.
Malta's agency handbook names the mechanism precisely: an incomplete-application report can be triggered by "documents missing authentication/certification", and the agency's own 120–150 day window explicitly excludes any time spent on agent interventions.
Chain of custody
Every document arrives with its own evidence attached
This is the part of the service that is actually being bought. Not speed - provenance. For every document in every file we record and hand you the same five facts.
- 01
Source
Which issuing authority produced it, in which jurisdiction, and under which reference - not "the client sent it".
- 02
Verification
Where the issuing authority runs a public register - several apostille authorities do - we check the document against it, so the record reads confirmed rather than obtained.
- 03
Date
Date of issue and the validity window that applies to the programme you are filing to, so expiry is scheduled rather than discovered.
- 04
Authentication route
The exact chain applied - notary, apostille or the full consular sequence - with the competent authority named at each step.
- 05
Handling
Who touched the original, where it physically travelled, and against which tracking reference.
- 06
Retention
Where the record is stored, under whose access control, and for how long - set to the retention floor your programme requires, not ours.
The Eastern Caribbean regulatory agreement sets its own technical standard for the regional applicant database - encryption in transit and at rest, multi-factor access control, continuous monitoring, and access that is logged and auditable. We hold our own handling to that same bar rather than to a marketing claim.
Originals in transit
What a carrier actually owes you for a lost original
Firms buy tracked, insured carriage and assume the document is covered. It is not, and the gap is not small. This is what the terms say, and what we do instead of promising around them.
Three things the paperwork already says
Liability is capped at the paper, not the document
Carrier terms value a shipment of documents at the cost of replacing the media the content sits on. The apostille, the notarial act and the translation are not in that number. Neither is the month it takes to obtain them again.
No carrier will deliver to a named person
Terms reserve the right to deliver to the address rather than the addressee. A shipment to a firm, a registry or a consulate is discharged at its central receiving area.
Insurance for documents is not insurance for the loss
Cargo cover excludes deeds and evidence of debt by name. The products built for documents pay a fixed sum without proof of value. That is the honest shape of a policy that cannot price a certificate with no market.
Two failure modes that end the document, not just delay it
The certificate comes apart
An apostille detached from its document is invalid, and a receiving authority may reject it on that ground alone. Every carrier also reserves the right to open a shipment for customs. Packaging has to survive a lawful inspection, not only the journey.
Nobody answers the customs hold
An undeliverable shipment can be disposed of after a short silence from the shipper. An institution that did not order the parcel will not answer a clearance query about it. This is the only failure mode where the original stops existing.
What we do instead
- 01
Register particulars captured at issuance
Each apostille is entered by its issuing authority into a public register under a number and a date. Anyone may verify it, no interest has to be shown, and it does not expire. We record both the moment the certificate is issued, which is what makes a lost apostille provable and re-obtainable rather than gone.
- 02
Electronic issue where the state supports it
A growing number of authorities issue apostilles electronically. Where the issuing state does, we route that way and no original is exposed to a courier at all.
- 03
Split by dependency, not by postage
One waybill for a whole family is cheaper and converts several small risks into one total loss. Documents that are useless without each other do not travel together, and we do not consolidate across unrelated clients.
- 04
A named consignee, and the hold worked the same day
Every consignee we file carries a named contact and a phone number, because a clearance query sent to a building goes unanswered. A hold is worked the day it appears, not the day someone notices.
None of this makes an original safe to send. It makes a loss recoverable, which is the honest version of the same promise.
Applicant data
An RCBI file is not ordinary personal data. It is the hardest category there is.
A single application stacks criminal-conviction data, health data and source-of-wealth material on a client who is frequently a politically exposed person. Under the GDPR that combination has no easy consent route, and your own regulator, your professional body and your client's counsel will all test it separately.
Criminal records sit under Article 10
Police conduct certificates are conviction data. Article 10 has no consent gateway of the kind Article 9 offers - processing has to rest on a lawful basis with real safeguards, not a tick-box.
Every notary and translator is a sub-processor
Article 28(2) means a distributed supply chain has to be disclosed, not assumed. We name ours, and you get an objection right rather than a surprise.
Deletion is not always the safe answer
The Eastern Caribbean framework sets a fifteen-year retention floor for due-diligence records. A vendor promising to erase everything after ninety days is failing your compliance review, not passing it.
Written terms, audit rights, named contact
A data processing agreement with the Article 28(3) terms including audit and inspection, a disclosed sub-processor list, a stated breach-notification clock, and a named security contact who answers.
Validity windows
Validity windows: 3 and 6 months
This is the arithmetic that breaks multi-applicant families. Windows are short, they differ per programme, and the residence test that decides how many police certificates you need is different in almost every one. We schedule the collection order backwards from your filing date across the whole family.
- Police certificate
- Window
- Under 3 months at lodgement
- Where the rule comes from
- Antigua & Barbuda application form
- Police certificate
- Window
- Issued within 3 months
- Where the rule comes from
- Dominica CBIU application guidance
- Conduct certificate
- Window
- Original required; issued in the 6 months preceding application
- Where the rule comes from
- Malta agency handbook (naturalisation route)
- HIV test
- Window
- Within 3 months of the medical examination
- Where the rule comes from
- Grenada prescribed medical form
- Medical certificate
- Window
- No more than 3 months old
- Where the rule comes from
- Dominica CBIU application guidance
- Bank reference
- Window
- Not older than 3 months
- Where the rule comes from
- Antigua & Barbuda application form
- Professional reference
- Window
- Not older than 6 months
- Where the rule comes from
- Antigua & Barbuda application form
- Proof of residential address
- Window
- Two originals, not older than 3 months
- Where the rule comes from
- Antigua & Barbuda application form
- Photographs
- Window
- Taken within the past 6 months
- Where the rule comes from
- Antigua & Barbuda application form
And the residence test is different in every programme
Malta
Every country of at least 6 months' cumulative residence in the last 10 years, applicants aged 16 and over
Antigua & Barbuda
Every country lived in for 6 consecutive months or longer since the age of 18
Grenada
Every country of more than one year's residence, plus countries of citizenship
Dominica
Country of birth, current country of residence, and any country of more than 6 months' residence in the last 10 years
A file built to one programme's test fails another's. Rules cited from the programmes' own published forms and handbooks; they change, and we re-check them per file rather than per year.
Scope boundary
We are your supplier. We are never your sub-agent.
This matters more than it sounds. Caribbean frameworks license agents, promoters, due-diligence providers, developers and escrow agents - and define a sub-agent as anyone engaged in the promotion, referral or facilitation of an application. A supplier that drifts across that line has to be licensed, and contaminates the licence of the firm that engaged it.
- We supply document services to your firm. We do not promote, refer or facilitate applications.
- We do not advise on migration law, programme selection or eligibility, and nothing we produce is legal advice.
- We never contact your client except where you instruct it in writing, and never under our own name where you have engaged us white label.
- We make no representation about the outcome, timing or approval of any application by any authority.
- Every status notification routes to you, never to your applicant. What a client is told about a delay or a review is your call to make, and under anti-money-laundering rules it has to be.
It is written into the engagement, not just stated here - so it survives your compliance review rather than your account manager's memory.
Scale
Built for the family of five, and the portfolio of two hundred
Most firms in this industry run under ten people. The document arithmetic does not scale with the headcount, and hiring for a seasonal spike is how practices break.
One submission per family
Five applicants, five sets of civil-status records, five police-certificate maps - filed as one job with one due date, not five parallel threads.
Portfolio-wide window scheduling
Collection order sequenced backwards from each filing date, across every open file, so nothing ages out in the queue.
A manager who knows your programmes
One named contact who already knows which units you file to and what each one rejects. Escalation path in writing.
Consolidated billing
One invoice across offices and files, itemised per document so you can rebill your own client cleanly.
Status without asking
Every document's current step visible in the cabinet, so an account manager can answer a client the moment they ask.