FATCA and CRS Reporting: A Practical Guide

A practical guide to FATCA and CRS classification, due diligence, reportable accounts, controls, and evidence.

A practical guide to FATCA and CRS classification, due diligence, reportable accounts, controls, and evidence.

The Global Push for Tax Transparency

The international tax landscape shifted dramatically with the introduction of the US Foreign Account Tax Compliance Act (FATCA) in 2010 and the OECD Common Reporting Standard (CRS) in 2014. Together, these frameworks created a broad regime for automatic exchange of financial account information. The institutions, accounts, and exchange relationships in scope depend on the relevant classification, local implementation, and current authority guidance. For compliance teams, the challenge is not just understanding the rules but operationalizing them at scale. This guide breaks down the practical requirements of both frameworks, common pitfalls, and controls for a sustainable reporting program.

Classification is a maintained fact

Most reporting failures begin before the report exists—when a classification, self-certification, or change of circumstances was never owned.

The reporting population needs reconciliation

FATCA and CRS work is data governance wearing a tax label. The teams that perform well under review are the ones that can explain how an account entered the population, why it was classified, who reviewed it, and what was filed.

Understanding FATCA: The US Framework

FATCA requires foreign financial institutions (FFIs) to identify and report information about financial accounts held by US persons to the Internal Revenue Service (IRS). The framework operates through a network of intergovernmental agreements (IGAs) that determine how institutions in each jurisdiction comply. Under Model 1 IGAs, FFIs report to their local tax authority, which then exchanges data with the IRS. Under Model 2 IGAs, FFIs register directly with the IRS and report account holder information subject to local privacy law consent provisions.

  • Registration and GIIN Acquisition: An FFI should determine whether registration and a Global Intermediary Identification Number (GIIN) are required for its classification and applicable FATCA arrangements. This GIIN must be validated by withholding agents before payments are made to the institution.
  • Due Diligence on Pre-existing and New Accounts: Institutions must apply specific identification and documentation procedures to both pre-existing accounts (those opened before FATCA's effective date) and new accounts. Thresholds and procedures differ based on whether the account holder is an individual or an entity.
  • Withholding obligations: A non-participating or non-compliant FFI can be subject to 30% withholding on certain U.S.-source withholdable payments when the statutory conditions apply. The exact payment types, exceptions, and documentation requirements must be checked in the current IRS and IGA guidance.
  • Entity Classification: FATCA introduces critical distinctions between financial institutions, active Non-Financial Foreign Entities (NFFEs), passive NFFEs, and excepted NFFEs. Passive NFFEs require look-through to identify controlling US persons, a process that demands careful analysis of ownership structures.

The Common Reporting Standard: FATCA Goes Global

The OECD developed CRS as a global standard for the automatic exchange of financial account information, modeled heavily on FATCA but with important differences. CRS has been adopted across many jurisdictions, but the obligations that apply to an institution still depend on local implementing law and the exchange relationships in force.

  • Multilateral Scope:
  • Self-Certification Requirement:
  • Wider Institutional Coverage:
  • No Withholding Mechanism:

Due Diligence Procedures: Getting Classification Right

The due diligence process is the foundation of both FATCA and CRS compliance. Errors at this stage cascade through the entire reporting chain, leading to incorrect filings, missed accounts, and regulatory exposure. Financial institutions must establish systematic procedures for both individual and entity accounts.

  • Individual Account Due Diligence: For new individual accounts, institutions must obtain self-certification at account opening and validate its reasonableness against other information collected during onboarding (address, telephone number, standing instructions). For pre-existing accounts, institutions apply residence address tests, electronic record searches, and paper record searches based on account value thresholds.
  • Entity Account Due Diligence: Entity classification requires determining whether the entity is a financial institution, an active NFE, or a passive NFE. Active NFEs include entities where less than 50% of gross income is passive income and less than 50% of assets produce passive income. Passive NFEs require identification of controlling persons and determination of their tax residency.
  • Change of Circumstances: Both frameworks require institutions to monitor for changes in circumstances that affect an account holder's status, such as a change of address to a reportable jurisdiction or new information suggesting a different tax residency. Institutions must have procedures to detect these changes and request updated self-certifications within a specified timeframe.
  • Undocumented Accounts: Accounts where valid self-certification cannot be obtained present a particular challenge. Under CRS, the treatment of undocumented accounts depends on local implementing rules and the account facts; track them for review rather than assuming a universal reporting outcome. Under FATCA, recalcitrant account holders may trigger withholding. Institutions must track and escalate undocumented accounts systematically.

Reportable Accounts and Filing Mechanics

Once due diligence identifies reportable accounts, institutions must compile and submit detailed information to the relevant tax authority. The data elements required are largely harmonized between FATCA and CRS but differ in important specifics.

  • Account Holder Information: Name, address, jurisdiction of tax residence, taxpayer identification number (TIN), date and place of birth for individuals. For entities, the entity name, address, and TIN, plus the same details for each controlling person of passive NFEs.
  • Account Information: Account number (or functional equivalent), account balance or value at year-end (or at closure if the account was closed during the reporting period), and the total gross amounts of interest, dividends, other income, and gross proceeds paid or credited to the account during the calendar year.
  • Filing Formats: FATCA reporting uses the IRS XML schema (Form 8966 equivalent), while CRS uses the OECD CRS XML schema. Both require precise formatting, including correct use of TIN types, country codes, and currency codes. Schema validation errors are a leading cause of rejected filings.
  • Filing deadlines: Deadlines and filing channels are set by the relevant tax authority and IGA. CRS deadlines commonly fall after year-end, but the month varies; FATCA dates also vary by jurisdiction, reporting method, and IRS extensions. Verify the current authority calendar for each filing rather than relying on a global March, May, or September rule.
  • Nil Returns: Some jurisdictions require nil returns (confirming no reportable accounts) while others do not. Institutions operating across multiple jurisdictions must track these requirements carefully to avoid inadvertent non-filing penalties.

Penalties and Enforcement: What Is at Stake

The penalty landscape for FATCA and CRS non-compliance has matured significantly since the early adoption years. Regulators are increasingly moving from education-focused approaches to active enforcement.

  • FATCA and FBAR penalties: The 30% FATCA withholding rule applies to certain withholdable payments when the statutory conditions are met; it is not a universal penalty on every account. Separate FBAR and tax-reporting penalties depend on the filer, violation, willfulness, and the current inflation-adjusted statute. Use the latest IRS guidance for the specific filing.
  • CRS penalties by jurisdiction: Domestic penalties differ widely and can include fixed fines, daily penalties, assessments for inaccurate data, or criminal sanctions for deliberate conduct. Cite the relevant tax authority's current rules for each entity and reporting period instead of copying a penalty amount from another country.
  • Reputational and operational consequences: Beyond direct financial penalties, non-compliance can result in enhanced scrutiny, loss of correspondent relationships, withholding exposure under the applicable IGA and statute, and reputational damage that undermines client confidence.
  • Peer Review and Global Forum Pressure: The OECD Global Forum on Transparency and Exchange of Information conducts peer reviews of jurisdictions' implementation of CRS. Poor ratings can lead to jurisdictions being placed on EU or FATF lists, creating downstream compliance obligations for institutions operating in or dealing with those jurisdictions.

Control Strategies: Building a Sustainable Compliance Program

Manual FATCA and CRS work becomes difficult to control as the reporting population grows, particularly when classification, self-certification, and filing evidence sit in separate places. The volume of data, the complexity of entity classification, and the evolving regulatory requirements demand a technology-driven approach.

  • Self-Certification Collection and Validation: Digital onboarding workflows capture self-certification data at account opening, validate completeness and reasonableness in real time, and flag inconsistencies for human review before the account is activated.
  • Rules-Based Entity Classification Engine: Structured classification of entities as financial institutions, active NFEs, or passive NFEs based on source data, reducing unsupported manual judgment and keeping classification criteria consistent across the institution.
  • Ongoing Monitoring and Change of Circumstances Detection: Account holder data is checked for changes that trigger re-classification or updated reporting obligations, including address changes, new payment instructions to reportable jurisdictions, and updated corporate ownership information.
  • Multi-Jurisdiction Report Generation: FATCA and CRS XML reports for each reporting jurisdiction need schema validation, TIN format checking, and reconciliation against source data to minimize filing rejections.
  • Centralized Audit Trail and Documentation: Detailed logging of due diligence steps, classification decisions, self-certification receipts, and filing confirmations provides a defensible compliance record for regulators and internal audit.

Browse all Blog & Insights articles

Loading...