The 7 flags framework for location-independent entrepreneurs

Your country of birth is the most expensive subscription you never signed up for.

Same person. Same company. Same $1.2M in revenue. Tax bill in the EU: $564K. Tax bill in Switzerland: $28K. Tax bill in Paraguay: $0.

The difference isn’t talent, effort, or luck. It’s where you put your flags.

Most entrepreneurs think about jurisdiction as a single choice: “Where should I live?” Wrong question. The right question: how do I distribute my life across jurisdictions to maximize freedom and minimize what I owe to governments I didn’t choose?

Key takeaways:

The original 3-flag theory from the 1960s is obsolete — CRS, CFC rules, and digital assets demand 7 flags
The 7 flags: citizenship, tax residency, business, banking, physical assets, digital security, digital assets
Territorial taxation countries (Panama, Paraguay, Costa Rica) don’t tax foreign-source income
Place of Effective Management (PoEM) is what kills most offshore structures — substance matters
Start with the 2 flags costing you the most, not all 7 at once

The original 3 flags (and why they’re not enough)

Harry D. Schultz came up with the “Three Flags Theory” in the 1960s:

Get a passport from a country that doesn’t tax foreign income
Reside in a tax haven
Keep your assets somewhere else

Elegant for 1965. Useless in 2026. CRS means 100+ countries auto-share your bank account data. CFC rules let your home country tax companies you own abroad. Substance requirements mean you can’t just register a shell and call it a day.

Three flags aren’t enough. You need seven.

The 7 flags

Flag	What it controls	The question that matters
🏴 1. Citizenship	Passports, nationality, CBI	Where can you go — and who can tax you just for existing?
🏠 2. Tax Residency	Day counting, PoEM, vital interests	Where does the taxman think you sleep at night?
🏢 3. Business	Incorporation, substance, CFC exposure	Where is your company actually run — not just registered?
🏦 4. Banking	Accounts, EMIs, CRS reporting	Who knows about your money?
🏗️ 5. Physical Assets	Real estate, gold, vaults	Where are the things that can’t be frozen with a mouse click?
🔒 6. Digital Security	Email, servers, comms, VPN	Where does your data live — and who can subpoena it?
₿ 7. Digital Assets	Crypto, DeFi, cold storage	Where are the assets that shouldn’t have a jurisdiction at all?

Flag 1: Citizenship

Your passport is your baseline constraint. Everything else flows from it.

The US taxes citizens globally regardless of where they live. Renouncing costs $2,350 and an exit tax on unrealized gains. Most other countries don’t do this — but they make it annoying enough that people never think to leave.

CBI programs (Citizenship by Investment) exist for a reason. $100K gets you a Caribbean passport. $350K gets you Malta. These aren’t escape plans — they’re insurance policies. Get them before you need them, because when you need them you can’t get them. For a cheaper path: Dominican citizenship costs ~$3,500 and takes 3 years. The Golden Visa is another option at $200K.

Flag 2: Tax residency

This is where most people focus. It’s also where most people screw up.

Day counting is a trap. Yes, 183 days matters. But most countries use a cocktail: center of vital interests, habitual abode, nationality, family ties. Spain will call you resident if your spouse lives there, even if you’re on the road 300 days a year. France looks at where your economic interests are. The UK has a statutory residence test that reads like a logic puzzle.

Territorial taxation is the answer most accountants don’t mention. For a full ranking: 29 countries that don’t tax foreign income. Panama, Paraguay, Costa Rica, Guatemala — they only tax local-source income. If your SaaS customers are in the US and EU, your income isn’t local-source. Your tax on foreign revenue: zero.

Exit taxes will bite you. France, Germany, Norway, Spain, and others tax your unrealized capital gains when you leave. You haven’t sold anything. You just moved. They tax you anyway. Plan your exit before you need one.

Flag 3: Business

Where your company is registered is one thing. Where it’s managed is what the taxman cares about.

Place of Effective Management (PoEM) is the rule that kills most offshore structures. You register a company in a zero-tax jurisdiction. You manage it from your apartment in Zurich. Switzerland says: that’s a Swiss company, pay Swiss corporate tax. And they’re right.

PoEM is why substance matters. You need board meetings in the jurisdiction. Decision-making documented there. Ideally, local directors. A PO box and a registered agent isn’t substance — it’s a flag for auditors.

Structures that work: Wyoming LLC for US-facing revenue (tax-transparent, no state income tax). Estonia OÜ for EU market access with 0% on retained earnings. UAE freezone company for tax-free operations with real substance.

Flag 4: Banking

CRS killed banking secrecy. Over 100 countries now auto-report your account balances to your country of tax residence. There’s no hiding. The question isn’t whether they know — it’s how many jurisdictions have your data.

EMIs are not banks. Wise, Mercury, Revolut — they’re payment processors wearing a banking costume. Convenient for operations. Terrible for storing serious capital. When things go wrong (and they do), you’re not a depositor. You’re an unsecured creditor.

Multi-jurisdictional banking isn’t suspicious — it’s rational. A Swiss account for stability. A Singapore account for Asia exposure. A US account for dollar operations. Declare everything, and nobody cares.

Flag 5: Physical assets

Real estate creates nexus. Own property in Portugal, and Portugal has a reason to call you resident. This is a feature or a bug depending on your strategy. Either way, know the rules before you buy.

Gold and precious metals in private vaults — Switzerland (LBMA vaults), Singapore (Freeport), Dubai — sit outside the banking system. No CRS reporting on allocated, segregated metal. Not a bank account. Not a financial asset. A physical object in a box.

The rule: never put everything in one country. The whole point of flag theory is distribution. If one government goes hostile, your life doesn’t collapse.

Flag 6: Digital security

The flag nobody thinks about until it’s too late. Your data has a jurisdiction, and that jurisdiction has laws.

Email: ProtonMail (Swiss law, strong privacy protections) vs Gmail (US jurisdiction, CLOUD Act — any US court can compel Google to hand over your data regardless of where the server sits).

Communications: Signal, not WhatsApp. Meta is a US company. Your WhatsApp messages are one government request away from being evidence.

VPN and hosting: A VPN in Panama doesn’t log. A VPN in the UK does. Your server in Germany is subject to German law. This matters if you’re doing anything that might attract attention.

Flag 7: Digital assets

Crypto added a dimension that didn’t exist before. Cold storage doesn’t have a jurisdiction. Nobody can freeze it, seize it, or report it under CRS.

Tax treatment is a mess. Germany: tax-free after 1 year hold. Portugal: was tax-free, then they killed it. US: taxes everything, always, including staking rewards the moment you receive them. Your crypto strategy is inseparable from your tax residency strategy.

Self-custody is sovereignty. Your keys, your coins. No freeze orders, no account closures, no “suspicious activity” holds. This is Flag 7 working as designed.

Where to start

Don’t try to optimize all 7 flags at once. That’s a recipe for analysis paralysis and a $50K consulting bill.

Pick the two flags that are costing you the most:

Getting crushed by taxes? → Flag 2 (tax residency) and Flag 3 (business structure). This is where the money is.
Privacy concerns? → Flag 6 (digital security) and Flag 4 (banking). Control who sees what.
Want optionality? → Flag 1 (citizenship) and Flag 5 (physical assets). Build escape hatches before you need them.

The goal isn’t perfection. It’s intentional distribution — making conscious choices about where each part of your life sits, instead of defaulting to wherever you happened to be born.

Because that default? It was designed for employees. And we’re not employees.

FAQ

How many flags do you need?

Seven. The original 3-flag theory from the 1960s doesn’t account for CRS, CFC rules, or digital assets. The modern framework adds banking, physical assets, digital security, and crypto — each with its own jurisdictional considerations.

What is territorial taxation?

A tax system where only income earned within the country is taxed. Panama, Paraguay, Costa Rica, and Guatemala use this system. If your SaaS customers are in the US and EU, your revenue isn’t local-source income — your tax on foreign revenue is zero.

How much does a second passport cost?

Caribbean CBI programs start around $100K (Dominica, St. Kitts). Malta costs ~$350K. The Dominican Republic offers citizenship through residency for ~$3,500 total after 2 years. The cost varies wildly depending on the path.

What is Place of Effective Management (PoEM)?

The rule that determines where a company is actually taxed based on where it’s managed — not where it’s registered. If you register a company in a zero-tax jurisdiction but manage it from London, HMRC considers it a UK company and taxes it accordingly.

Can you have multiple tax residencies?

Technically yes, which is the problem. Most countries use a cocktail of tests — day counting, center of vital interests, habitual abode — and two countries can both claim you. Tie-breaker rules in double tax treaties resolve this, but prevention is better than cure.

Every setup is different — especially the interaction between origin country rules and destination rules. The framework gives you the right questions. A good international tax advisor gives you the numbers for your specific case.

Want to run this analysis on your own setup? The Flag Theory skill on GitHub does exactly that — a scored, personalized report using Claude Code.