CRS: Automatic Exchange of Tax Information — How It Works

The Common Reporting Standard works as a duty placed on financial institutions by national law: a bank, broker, custodian, insurer or investment vehicle establishes the tax residence of its client and the client's controlling persons, reports once a year to its own tax authority, and that authority forwards the data to the holder's country of residence. For a licensed institution, CRS means due diligence procedures, reporting fields, deadlines and penalties; for the client, it means a self-certification form, questions about tax identification numbers and roles in a structure, and an understanding of exactly what will be sent abroad.

The wider map of transparency regimes — from exchange on request to CARF and DAC9 — is set out in the tax transparency hub. This article covers CRS mechanics from inside the financial institution.

Concept

CRS closed the era of banking secrecy. The Common Reporting Standard, developed by the OECD, requires financial institutions worldwide to establish their clients' tax residency and to report account data once a year to the account holder's country of residence. 129 jurisdictions have committed to exchange — the figure recorded in the Statement of Outcomes of the Global Forum plenary of 2–4 December 2025; Zambia, the last of them, joins from 2028. The 2025 intake was Armenia, Rwanda, Senegal and Uganda; Georgia, Kenya, Moldova and Ukraine started a year earlier, and Kazakhstan has been exchanging since 2021. Hiding an account in a participating country has become practically impossible: it is known both where it is opened and where its holder lives.

The design has two tiers. The lower tier is domestic law: the duty to collect information and report sits with the Reporting Financial Institution and is imposed by the law of the country where the institution is located (in the EU by Directive 2014/107/EU, known as DAC2; in the UK by the International Tax Compliance Regulations 2015). The upper tier is intergovernmental: tax authorities exchange what has been collected under the multilateral competent authority agreement (CRS-MCAA) or, within the Union, under the directive on administrative cooperation. The client never deals with a foreign authority at all: whatever goes out about them is collected and sent by their own bank.

How Banking Secrecy Gave Way to Automatic Exchange

The idea of mass automatic exchange grew out of a run of scandals. Swiss banking secrecy was considered inviolable for decades, until in 2009 UBS admitted that it had helped Americans hide income and handed over client data. The United States responded with FATCA (2010): under threat of sanctions, it required banks worldwide to disclose accounts held by Americans. Others quickly adopted the logic — in 2014 the OECD approved the Common Reporting Standard, the G20 states backed it, and the first automatic exchanges took place in 2017–2018. In the EU the rules have applied since 1 January 2016, and the directive set the first exchange, for 2016, for no later than 30 September 2017. Within ten years the regime turned from a political slogan into a routine annual procedure.

How Automatic Exchange Works

The logic is simple. When an account is opened, the bank or broker determines which countries the holder is a resident of (and, for structures, the controlling persons as well). Once a year the institution reports a set of data to its tax authority: name, address, tax identification number, account number, year-end balance, interest, dividends and proceeds from asset sales. The tax authority passes this to its counterparts in the holder's country of residence. This is AEOI — automatic exchange of information: no request is needed, the data flows by itself, every year.

The annual cycle runs as follows:

1. Throughout the year — due diligence: a self-certification is collected at account opening, pre-existing accounts are searched for indicia of foreign residence, and the form is refreshed when circumstances change.
2. 31 December — the account balance or value and the year's payments are fixed; under the amended standard, whether a valid self-certification is held is fixed on the same date.
3. Spring of the following year — the report goes to the national tax authority. In the UK the deadline is 31 May following the reporting year.
4. By the end of September — the tax authority sends the data to its partners. In the EU the exchange takes place within nine months of the end of the calendar year.
5. Afterwards — the receiving administration matches what it has received against its residents' tax returns.

CRS and FATCA: What's the Difference

FATCA is the American predecessor of CRS: from 2010 the United States required banks worldwide to report accounts held by its taxpayers. CRS took the same idea and made it multilateral. The fundamental difference lies in the trigger: CRS rests on tax residency, whereas FATCA rests on a connection to the United States (citizenship and the green card). The United States itself does not take part in CRS and shares data back only to a limited extent, which is why American accounts are sometimes called a hole in global transparency. For the rest of the world the network is almost seamless. How a single form covers both regimes, and which fields on it are mandatory, is covered in the note on FATCA/CRS self-certification.

Who Reports: the Reporting Financial Institution

The reporting duty falls on a financial institution of a participating jurisdiction, unless it is on the list of exempt entities (Non-Reporting Financial Institutions); an ordinary operating company does not play this role. The Standard recognises four types of financial institution.

Non-Reporting FIs are government entities, international organisations, central banks, broad participation retirement funds and a number of other categories that national law treats as low risk. For private wealth the reverse direction matters more: a personal investment company or a trust with a professional trustee can easily become a Reporting FI itself — see the sections on classification and trusts below.

What Falls Under Reporting

Reportable accounts are those whose holder is a tax resident of another participating jurisdiction. The Standard treats as a financial account a depository or custodial account, an equity or debt interest in an Investment Entity, and a cash value insurance or annuity contract. The exchange also reaches passive structures — companies and trusts, through which the controlling individuals are visible. A separate list of excluded accounts takes low-risk products out of reporting — above all pension accounts and certain savings accounts, on conditions set by national law.

CRS rests on tax residency; citizenship is irrelevant to it. A sound structure therefore starts with an honestly determined residency, and in the age of automatic exchange, attempts to conceal it do not work.

What Exactly Goes into the Report

The reporting fields are set by Section I of the Standard. The original 2014 text and the changes made in the EU by Directive (EU) 2023/2226 (DAC8) add up to the following picture.

For pre-existing accounts, the TIN and date of birth may be missing from the file. The Standard then requires the institution to use reasonable efforts to obtain them by the end of the second calendar year following the year in which the account was identified as reportable. That is why a client with an old account receives a letter asking for a tax number — the bank is performing a direct obligation under the Standard.

Due Diligence: Four Review Regimes

The core of the Standard is its review procedures. How strict they are depends on two forks: whether the account existed on the date CRS was introduced (pre-existing) or was opened afterwards (new), and whether it belongs to an individual or an entity. Pre-existing individual accounts have a further threshold of USD 1 million, dividing them into lower value and high value accounts.

New entity accounts follow the same logic as new individual accounts: a self-certification for the entity itself and, if it is passive, for each controlling person.

Pre-⁠existing Individual Accounts: Lower Value

For an account up to USD 1 million the institution has two routes. The first is the residence address test: if the file holds a current residence address supported by documentary evidence, the client may be treated as resident in the country of that address. The second is an electronic search for indicia. There are exactly six:

1. The client is identified as a resident of a reportable jurisdiction.
2. A current mailing or residence address in that jurisdiction.
3. A telephone number in that jurisdiction and no telephone number in the bank's own jurisdiction.
4. Standing instructions to transfer funds to an account in that jurisdiction (other than a depository account).
5. A currently effective power of attorney or signatory authority granted to a person with an address in that jurisdiction.
6. A "hold mail" instruction or an "in-care-of" address in that jurisdiction, where the file holds no other address.

Place of birth is not on the list: under CRS it is not an indicium, whereas under FATCA a US place of birth triggers a U.S. person review. An indicium that has been found can be cured by obtaining a self-certification and documents rebutting residence in the jurisdiction concerned; otherwise the client is treated as resident in every jurisdiction for which indicia were found.

A special case arises where the file holds only a "hold mail" instruction or an "in-care-of" address, with no other address and no other indicia. The institution must then carry out a paper record search or request a self-certification or documentary evidence and, if neither succeeds, report the account as an undocumented account. Such an account does not drop out of sight: it goes to the national tax authority with a separate flag, and the next question is asked by the authority.

Pre-⁠existing Individual Accounts: High Value

For an account above USD 1 million the review is enhanced. Beyond the electronic search, the institution carries out a paper record search — reviewing the client's master file and the documents obtained over the past five years, including AML/KYC material, the account agreement and powers of attorney — where the electronic databases do not capture all the required fields. In parallel the relationship manager is asked about actual knowledge: if the manager knows that the client is resident in another country, that knowledge counts as an indicium found. An account that becomes high value later is put through the enhanced review by the end of the following year.

For the client the practical point of the relationship manager inquiry is simple: what was said to the banker over lunch about a move, a second passport or a house abroad becomes part of the file. An attempt to get round the form through an informal understanding with the manager works against the client.

New Individual Accounts

At account opening the institution must obtain a self-certification that allows it to determine every country of tax residence, and must confirm its reasonableness against the information collected at opening, including AML/KYC documentation. A form with no tax number, an address that contradicts the passport, or a single country of residence despite obvious ties to another is not reasonable.

At the entry point, the self-certification is checked against indicia, the markers of a connection to a particular country — address, telephone number, standing payment instructions, powers of attorney. A discrepancy between the declaration and the file triggers a query, and sometimes a freeze on transactions. For passive structures, the institution looks through the company or trust and records the controlling individuals — the same beneficial owners who appear in registers and under the exchange.

The same test has a side that works for the client. Until the bank knows, or has reason to know, that a self-certification is unreliable, it is entitled to rely on it; it is under no duty to give the client tax advice or to run a legal analysis on their behalf. A self-certification that lists every jurisdiction of residence with its TIN, is filed on time, is supported by residency documentation and carries an undertaking to notify any change therefore settles the reasonableness test and shifts the burden onto whoever wants to dispute it. The OECD notes expressly that an undertaking to notify changes, built into the form, reduces the burden on the financial institution (CRS-related FAQs, December 2025 update, questions 9–13).

Entity Accounts

A pre-existing entity account with a balance of up to USD 250,000 at 31 December need not be reviewed until the balance exceeds that threshold. Above it, the institution determines whether the entity itself is reportable (from its place of incorporation and the address on file) and classifies it: financial institution, Active NFE or Passive NFE. For a Passive NFE, the controlling persons are identified; for accounts up to USD 1 million the institution may rely on information collected under AML/KYC procedures. New entity accounts are opened only with a self-certification.

Controlling persons under CRS are determined consistently with the FATF Recommendations, which makes them the same people as the beneficial owners under AML law: the individuals who control the entity through ownership or by other means. For a trust these are the settlor, trustee, protector, the beneficiaries or class of beneficiaries, and any other individual exercising ultimate effective control; for other legal arrangements, persons in equivalent positions. That is why the data on the CRS form and in the KYC file have to match: the bank compares them.

Classification: Who Ends Up in the Report, and How

The look-through mechanics rest on the classification grid of Section VIII of the Standard. To a bank, every corporate client is either a financial institution or an NFE (non-financial entity). An Active NFE is an operating business; the test is twofold: less than 50% of gross income for the preceding period is passive (dividends, interest, rent) and less than 50% of assets produce passive income or are held to produce it. Fail either threshold and the entity is a Passive NFE: the bank reports the account and every controlling person to their countries of residence.

A separate category is the Investment Entity under the managed-by test: 50% or more of gross income comes from investing in or trading financial assets, and the assets are run on a discretionary basis by another financial institution. Such an entity becomes a Reporting FI in its own right and reports its equity holders. If it sits in a jurisdiction outside CRS, the Standard flips the optics: it is treated as a Passive NFE, and the custodian bank reports its controlling persons on a look-through basis.

The consequence for the classic personal investment company under a bank or EAM mandate: almost always an Investment Entity or a Passive NFE — hiding behind the company does not work. For calibration: a holding living on rental income is a Passive NFE (rent is passive); a portfolio company under a bank's discretionary mandate is an Investment Entity with reporting duties of its own.

Trusts and Foundations Under CRS

A trust is classified on the same grid as a company and does not stay invisible. Where the trust's assets are mostly financial and are managed by a professional trustee with financial institution status, or by a bank under mandate (managed-by), the trust itself becomes a Reporting FI and reports its equity interest holders: the settlor — always, whether the trust is revocable or not; mandatory beneficiaries — always; discretionary beneficiaries — in the year they receive a distribution (a treatment jurisdictions may allow as a matter of choice); the protector and the trustee are inside the perimeter too. The trustee-documented trust route removes the Reporting FI status from the trust, but not the reporting: the professional trustee, itself a Reporting FI, files for all of the trust's reportable accounts.

If the trust is a Passive NFE (say, it holds real estate directly), the bank where the account sits collects controlling persons across every role — settlor, trustee, protector, beneficiaries — regardless of whether the role carries actual control. Hence the key planning conclusion: discretion does not take the settlor out of the report — the settlor stays reportable in every configuration; what changes is who reports the beneficiaries, and when. Private foundations (Stiftung) are read through the same logic, with founder and council mapped onto the trust roles. The groundwork on the structure itself is in the trusts primer.

The Wider Approach and the Anti-Avoidance Rule

The Standard lets a jurisdiction go beyond the minimum. Under the wider approach, the institution collects and keeps tax residence information on all account holders, not only on residents of countries with which exchange is already in place. The UK has adopted this approach expressly. The practical point is to avoid re-papering clients every time the list of partners grows: a client from a country that joins later already has their residence documented, and their account goes into the report in the very first year of exchange.

Section IX requires a jurisdiction to have rules that secure real implementation of the Standard: against practices designed to circumvent the procedures, on keeping records of the checks performed, on supervising institutions and on effective sanctions. The UK anti-avoidance rule is drawn broadly: where a person enters into arrangements aimed at avoiding obligations under the Regulations, the Regulations apply as if those arrangements had not been entered into. Obvious candidates for it are moving a balance out before the reporting date to get below a threshold, splitting an account, or switching products to leave the perimeter.

Reporting Format and Deadlines

The report is filed electronically under the OECD XML schema. For the amended standard, the OECD published an amended CRS XML Schema in October 2024; HMRC warns that from 1 January 2027 CRS and FATCA reporting in the UK are filed separately: CRS under the new OECD schema, FATCA under the IRS schema published in January 2017. Filing runs through a portal on the Government Gateway.

The first reporting year for CRS 2.0 in the UK is calendar year 2026, reported to HMRC by 31 May 2027. For accounts opened before 1 January 2026, HMRC allows a transitional regime: for 2026 and 2027 the controlling person's role need only be reported if it is already held in the institution's electronically searchable systems. The UK Regulations do not apply penalties automatically: HMRC considers reasonable excuse and mitigation, and failure to notify reportable clients that their data is being passed on carries a penalty of up to £100 per person, followed by up to £100 a day. The national detail of the UK regime, and how HMRC uses what it receives, is covered in the article on CRS and FATCA data at HMRC.

Where the System's Limits Remain

The network is dense, but not seamless. The United States itself collects data under FATCA yet shares back sparingly, so an account at a US bank is less visible to the global system than most. CRS covers financial accounts, but direct real estate, art, gold in a safe and stakes in closely held companies without a banking intermediary pass it by. The quality of the exchange also depends on how a jurisdiction implements the standard: the OECD runs peer reviews and publicly names the laggards. Some of these gaps are closed by the amended standard that applies from 2026.

The "US Gap": Why the United States Is a Special Case

The United States has not signed the CRS-MCAA and exchanges through its own network of FATCA agreements. Even under the "reciprocal" Model 1A, the US side sends the partner considerably less than it receives: the name, address and TIN of the partner's resident, the account number and the details of the US institution, gross interest on a depository account, and US-source dividends and other US-source income. The account balance is not on that list, and neither is look-through disclosure of the controlling persons of passive structures. In Article 6 of the agreement the United States merely acknowledges the need to achieve "equivalent levels" of reciprocal exchange.

Hence an asymmetry that structures with a US element exploit. An investment company or trust established in the United States sits, for CRS purposes, in a non-participating jurisdiction: if a financial institution manages it, a non-US bank treats it as a Passive NFE and discloses its controlling persons; if the account is opened in the United States itself, information on them does not enter CRS at all. The gap is closing in part: under CARF the United States has committed to begin exchange by 2029, and American citizens abroad face a regime of their own — see banking for U.S. persons abroad.

What CRS 2.0 Changes

The amended standard introduced a reporting field that did not exist before: the reporting financial institution states whether a valid self-certification was obtained — separately for the account holder and separately for the controlling persons (Section I(A)(1)(a)–(b) of the amended CRS). The OECD has fixed the determination point as the end of the calendar year, or the closure of the account if that comes first (CRS-related FAQs, December 2025 update, question 12). This is the most consequential change in the standard: the absence of a valid self-certification stopped being an internal bank marker and became an element of international exchange.

The second new field is the role of the controlling person. Settlors, trustees and protectors used to dissolve into the single controlling person category — the role is now transmitted expressly, and the receiving administration sees in what capacity an individual sits in the structure. Added alongside it: a joint-account indicator with the number of holders, a new/pre-existing flag and the account type.

The perimeter now extends to specified electronic money products, central bank digital currencies and indirect investments in crypto-assets through derivatives and investment structures. Direct crypto-asset transactions are picked up by CARF, while CRS completes the perimeter on the side where crypto exposure is wrapped in a conventional financial product. In the other direction the perimeter has narrowed: accounts of genuine non-profit organisations have been moved into excluded accounts.

The exchange instrument for the amended standard is the Addendum to the CRS-MCAA: 81 signatories as at 26 August 2026. The 2026 intake is Bahrain, Moldova, Macau, Antigua and Barbuda, Saudi Arabia, Montserrat, Anguilla, Kuwait, Armenia and the BVI, which signed on 7 August 2026. Global Forum members are moving to exchange under the amended CRS from 2027, with transitional mechanisms where they are needed.

National timing diverges more than the headline schedule suggests.

The directive itself is in force in the EU, but transposition has lagged behind it: on 30 January 2026 the Commission sent letters of formal notice to twelve member states for failing to fully transpose DAC8. The set of fields a bank actually collects for 2026 therefore still differs across the Union.

Outside the EU the dividing line is the Addendum signatory list as at 26 August 2026: the UK, Switzerland, Singapore, Israel and the UAE are on it; Hong Kong, Türkiye, Kazakhstan and Russia are not, and keep exchanging under the original standard on the dates in the Global Forum's status of commitments. Until both ends of an exchange relationship run the amended standard, the new fields — the valid-self-certification flag and the controlling person's role — do not travel on that relationship, even where the sending bank already collects them. What a resident of each country sees arriving, and files in addition, is set out country by country on tax transparency.

MDR: Disclosure of CRS Avoidance Schemes

An exchange standard creates demand for avoidance: moving assets to a non-participating jurisdiction, repackaging an account into a product outside the perimeter, an opaque chain through which the beneficial owner cannot be seen. The answer was the OECD Model Mandatory Disclosure Rules for CRS Avoidance Arrangements and Opaque Offshore Structures, approved on 8 March 2018. They require promoters and advisers to disclose such arrangements and their users to the tax authority, and the data is passed to the clients' countries of residence.

In the EU the same result is delivered by the category D hallmarks of DAC6: D1 — an arrangement that may undermine the reporting obligation on automatic exchange of financial account information (a non-reportable account or product, a transfer to a jurisdiction without exchange, reclassification of income, a structure that removes beneficial ownership reporting); D2 — an opaque chain with no real activity that obscures the beneficial owners. The filing deadline is 30 days and the rules apply from 1 July 2020. After leaving the EU, the UK replaced DAC6 with its own MDR on the OECD model: they have applied since 28 March 2023, replaced the 2020 regulations (SI 2020/25) and reach arrangements made available for implementation from 25 June 2018, while arrangements involving accounts with balances below USD 1 million are not reportable. The multilateral agreement for exchanging such disclosures still stands at nineteen signatories, so outside the EU and the UK the mechanism works piecemeal. The hallmarks and disclosure practice are covered in the article on DAC6 hallmarks.

How Tax Authorities Use the Data

A tax authority matches the data it receives against tax returns: whether declared income agrees with the interest and dividends in the report, whether the account has been declared at all, whether the balance is consistent with the income declared. The scale is already industrial: for 2024 partners exchanged data on 171 million accounts holding EUR 13 trillion (Global Forum Statement of Outcomes, December 2025). A mismatch becomes grounds for a letter, an enquiry or an audit, and the new CRS 2.0 fields — the flag that no valid self-certification is held and the role in the structure — hand the administration a ready-made list for prioritisation.

The typical response is an invitation to correct the past voluntarily before an enquiry opens. In the UK this is the job of the Worldwide Disclosure Facility, whose guidance cites CRS among the reasons to disclose offshore income on one's own initiative. How voluntary disclosure programmes work, and why they cost less than waiting for a letter, is covered in the article on voluntary disclosure.

CARF: Crypto-Assets in the Same Perimeter

Direct transactions in digital assets are taken by a separate standard, the Crypto-Asset Reporting Framework. Its schedule runs in waves: on the OECD commitment list in its edition of 14 September 2026, 46 jurisdictions run their first exchanges by 2027, another 27 by 2028 and four by 2029 — Argentina, Azerbaijan, Mexico and the United States. In total, 77 jurisdictions have committed. Four jurisdictions found relevant — El Salvador, Georgia, India and Vietnam — have made no commitment. Reporting crypto-asset service providers caught by national rules collect the same client data a bank does. In the EU the rules are implemented through DAC8 and apply from 1 January 2026, with data transmitted within nine months of the year end, so 2026 data goes into the exchange during 2027. The national mechanics — provider registration deadlines, reporting and penalties — are covered in the note on CARF in practice.

What the Client Is Asked, and Where Onboarding Breaks

For an HNW client CRS comes down to a handful of documents and questions, and almost every onboarding failure repeats itself.

1. Every country of residence, with its TIN. Dual residence is declared in full; pointing out that under a double tax treaty the client is resident in only one country does not replace the form. A form without a TIN is acceptable only in the cases the Standard allows — for example, where the country of residence does not issue tax numbers.
2. Address and documents. The address on the form has to match the address in the KYC file; a "correspondence address" at a lawyer's or manager's office with no residential address is a classic red flag.
3. Role in the structure. For a company or trust the bank will ask who the settlor, trustee, protector and beneficiaries are, and from 2026 it transmits each person's role.
4. Classification of the structure. A personal investment company has to know whether it is an Investment Entity or an NFE; a classification error breaks the whole reporting chain.
5. Change of circumstances. A move, a new passport or a new tax number requires the form to be updated; under the amended standard, the absence of a valid form at 31 December goes into the exchange in its own right.

Onboarding usually breaks on a contradiction between the form and the file: the client declares UAE residence, while the telephone number, address and standing payments point to another country. The bank will not argue tax law in that situation: it records the indicia and reflects both jurisdictions until the client produces residence documents. A tax residence certificate, proof of residence and an explanation of the ties to the former country settle the matter faster than any negotiation. The system sees where an account is opened and where the client is tax resident in any case, so those facts must match what is declared at home.