Now you see me, now you don’t: using citizenship and residency by investment to avoid automatic exchange of banking information