FATCA, FBAR and Form 8938

FATCA is the US statute that made banks around the world search their client books for US taxpayers and report them to the IRS. FBAR and Form 8938 are the two annual filings in which the US taxpayer personally reports foreign accounts and assets. Together they form a system in which the IRS sees a US person's money abroad from two sides: from the bank's report and from the person's own return. Most problems start where the two disagree.

For a licensed financial institution outside the United States, FATCA means registration with the IRS, client identification procedures, annual reporting and the personal accountability of a designated Responsible Officer. For a client with US citizenship, a green card or a US beneficiary in a structure, it means a Form W-9 at onboarding, questions about place of birth and, sometimes, a refusal of service.

Concept

The United States taxes its citizens and residents on worldwide income wherever they live. Who counts as a US person is covered in the article on US tax residency. The weak point of such a system is obvious: the IRS knows about income only if someone reports it. At home, banks and brokers do so on the 1099 series of forms; abroad, before 2010, nobody did.

Three regimes close that gap in different ways. FATCA (Foreign Account Tax Compliance Act) is chapter 4 of the Internal Revenue Code, §§1471–1474, which requires foreign financial institutions (FFIs) to identify US accounts and report them on pain of 30% withholding. The same Act added §6038D to the Code — the basis for Form 8938, a tax return attachment on which the taxpayer lists specified foreign financial assets. FBAR (FinCEN Form 114) is older and sits in a different statute: it is a Bank Secrecy Act report filed with FinCEN and covering foreign financial accounts above a US$10,000 threshold.

The regimes do not substitute for one another. The IRS states on its comparison page that filing Form 8938 does not remove the FBAR obligation. A single account in Zurich can appear on both of the client's filings and on the bank's FATCA report at the same time, and all three documents have to tell the same story.

Key parameters of the system as at September 2026:

The first three rows describe the institution's side; the rest describe the taxpayer's own obligations.

Why FATCA exists

FATCA was enacted as part of the Hiring Incentives to Restore Employment Act (HIRE Act), Pub. L. 111-147 of 18 March 2010. The Act solved a problem that a direct order cannot: Congress has no power to make a bank in Geneva or Singapore disclose its clients. It can, however, make access to the US capital market expensive for anyone who refuses to cooperate. Almost every large financial institution receives interest and dividends from the United States on Treasuries and US equities. Those flows became the pressure point.

The lever: 30% withholding

Section 1471(a) requires a withholding agent to withhold 30% of any withholdable payment to an FFI that has not taken on the reporting obligations. Regulation 1.1471-2 applies the rule to payments made after 30 June 2014 unless the agent can reliably associate the payment with documentation of a participating FFI, a deemed-compliant FFI or an exempt beneficial owner.

Under Publication 515 (2026), a withholdable payment is US-source FDAP income: interest, dividends, rents, royalties. The statute originally also covered gross proceeds from sales of US securities, but proposed regulations REG-132881-17 of 18 December 2018 removed withholding on sale proceeds, and the IRS allows taxpayers to rely on them until final regulations are issued (Form 1042-S instructions).

The withholding is designed to be hard to recover. Under §1474, a beneficial owner obtains a credit or refund only by disclosing its US owners to the IRS, and an FFI that is itself the beneficial owner can recover only the amount attributable to a treaty rate reduction, without interest. For a bank, 30% of gross income on a US portfolio means leaving the market. Almost everyone therefore chose to participate.

The FFI Agreement

An institution that agrees to cooperate signs a participating FFI agreement with the IRS. The current version is published in Rev. Proc. 2017-16 and takes effect for a given FFI on the date the IRS issues its GIIN. Its content follows §1471(b): determine which accounts are US accounts; apply verification and due diligence procedures; report annually; withhold 30% on certain payments to clients who refuse to be documented (recalcitrant account holders) and to non-participating FFIs; and close an account where local law prevents disclosure and the client has not given a waiver.

The report on each US account contains the holder's name, address and TIN, the account number, the balance or value, and gross receipts and withdrawals (§1471(c)). A participating FFI outside an intergovernmental agreement files it itself on Form 8966 by 31 March of the following year (section 6.03(A) of Rev. Proc. 2017-16).

Responsible Officer and periodic certification

The agreement makes accountability personal. The FFI appoints a Responsible Officer (RO), a senior officer who establishes the FATCA compliance programme or appoints designees to do so, and who personally signs the certifications to the IRS (section 8.02). There are two certifications:

1. Certification of preexisting accounts (COPA): the RO confirms that due diligence on accounts opened before the agreement took effect has been completed.
2. Periodic certification: once every three calendar years, by 1 July of the year following the end of the period, the RO certifies effective internal controls or files a qualified certification disclosing failures identified and the steps taken to remedy them (section 8.03(B)).

According to the IRS FAQs, periodic certification is required of participating FFIs (including Reporting Model 2 FFIs), registered deemed-compliant FFIs, sponsoring entities and direct reporting NFFEs. Reporting FIs in Model 1 jurisdictions do not certify, except on behalf of branches operating outside Model 1 jurisdictions. Missing the deadline is a failure to comply with FATCA and can end in revocation of status and removal of the GIIN from the FFI List. Only an RO with access to the entity's account in the FATCA Registration System can sign.

Intergovernmental agreements: Model 1 and Model 2

A direct contract between a foreign bank and the IRS ran into local law: banking secrecy and data protection rules in many countries prohibited passing client information to a foreign agency. The answer was intergovernmental agreements (IGAs) of two types.

The diagram shows how an account report travels under each model.

Under Model 1, registration is the institution's only direct contact with the IRS. Under the UK agreement (Article 4), UK reporting FIs are treated as complying with §1471 and are not subject to withholding; the United States also does not require them to withhold on recalcitrant accounts or close them while the information is received. The tax authorities exchange information within nine months after the end of the calendar year (Article 3), that is, by 30 September.

In return, the partner state takes over supervision: in a case of significant non-compliance it has 18 months to resolve the problem, after which the IRS may treat the institution as non-participating (Article 5(2)). Some Model 1 agreements are reciprocal, with the United States sending the partner a limited set of data on its residents' accounts at US banks.

Under Model 2, the institution signs the FFI Agreement and reports to the IRS itself, while the local government undertakes to remove legal obstacles. For clients who have not consented to disclosure, the bank reports aggregate data, and the IRS then sends a group request through the tax authority. Switzerland still works this way: the Federal Tax Administration publishes notices of FATCA group requests, the latest in 2025 and 2026.

The map of agreements

The Treasury list as at September 2026 covers more than 110 jurisdictions. Model 2 is in force in nine: Armenia, Austria, Bermuda, Hong Kong, Japan, Macao, Moldova, San Marino and Switzerland. All other agreements in force are Model 1, including every EU member state except Austria, the United Kingdom, the UAE, the Cayman Islands and the British Virgin Islands. The most recent to enter into force were those with Cabo Verde (7 February 2024) and Thailand (29 April 2024).

A jurisdiction's status on the list is one of three: in force, signed (not yet ratified) or agreement in substance. Signed but not in force are the agreements with the Philippines, Seychelles and Uzbekistan, and the Model 2 agreements with Chile and Taiwan. Agreed in substance are those with China, Indonesia, Vietnam, Peru and Haiti, plus Model 2 with Iraq, Nicaragua and Paraguay.

Switzerland and Russia deserve separate mention. On 27 June 2024 Switzerland signed a new Model 1 agreement with reciprocal automatic exchange, but its entry into force is planned for 1 January 2029 at the earliest; until then Swiss banks operate under Model 2. Russia does not appear on the Treasury list. A Russian financial institution is therefore under the general chapter 4 regime: either an agreement with the IRS directly or 30% withholding on US payments.

GIIN and the FFI List

On registration in the FATCA Registration System an institution receives a GIIN (Global Intermediary Identification Number) in the format XXXXXX.XXXXX.XX.XXX. The IRS collects approved entities in the FFI List, which is compiled monthly and published on the first day of each month with the legal name, GIIN and country.

The FFI List works as a pass. A withholding agent receiving Form W-8BEN-E from a foreign institution verifies the GIIN against the published list; where the form says "applied for", the entity has 90 days to supply the number, after which the form ceases to be valid for chapter 4 purposes. Removal from the list for a missed certification means counterparties will start withholding 30% or stop dealing.

TIN relief for Model 1

The weak spot of the early years was the lack of US TINs on old accounts: many clients of Model 1 banks opened accounts long before FATCA and never supplied a number. Notice 2023-11 granted temporary relief: for reporting years 2022, 2023 and 2024 the IRS will not treat missing TINs on preexisting accounts, by themselves, as significant non-compliance, provided the institution reports the client's date of birth, requests the TIN annually, searches its electronic records annually and uses the correct reason code. Notice 2024-78 extended the relief to 2025, 2026 and 2027 and added conditions: for each client without a TIN the institution reports the city and country of residence and any foreign TIN held in its systems, and keeps the documentation until the end of 2031. For the client this means recurring letters from the bank asking for an SSN.

What the IRS sees about a US person abroad

The picture is built from several independent channels. Each is incomplete on its own; together they let the IRS match data.

The ownership threshold for passive structures is set in §1473: a substantial US owner holds more than 10%, and for investment-type institutions the threshold is replaced with zero. The IRS's FBAR powers rest on 31 CFR 1010.810(g): FinCEN has delegated the assessment and collection of civil penalties to the tax authority.

The main consequence for the client: the IRS learns of a large foreign account from the bank whether or not the client has filed. A blank Form 8938 or a missing FBAR next to a bank report is a ready-made reason for a letter. The wider picture of data exchange, including CRS, in which the United States does not participate, is set out in the articles on tax transparency and the CRS overview.

Reporting by US persons

FBAR

An FBAR is filed by a US person with a financial interest in, or signature or other authority over, a foreign financial account where the aggregate value of such accounts exceeded US$10,000 at any time during the calendar year. US persons for this purpose are citizens and residents, as well as US companies, partnerships, trusts and estates.

The threshold is aggregate. Three accounts of US$4,000 each on different days trigger the obligation if on any day their total exceeded US$10,000. The report shows the maximum value of each account during the year; the 31 December balance is irrelevant for FBAR. A dormant account with no income is reported like an active one: FBAR is a reporting regime and does not depend on income.

The report is filed only electronically through FinCEN's BSA E-Filing System and is not attached to the tax return. The deadline is 15 April of the following year, with an automatic extension to 15 October without a separate request. Account records are kept for five years from the due date.

The IRS lists exceptions: accounts reported on a parent's consolidated FBAR; a joint account for which the spouse files with Form 114a authorisation; foreign accounts inside IRAs and retirement plans for their owners and participants; and employer accounts over which an employee has signature authority only.

FBAR penalties and Bittner

Penalties are set in 31 U.S.C. §5321(a)(5) and indexed for inflation each year. Current amounts are published in 31 CFR 1010.821.

Criminal sanctions are in 31 U.S.C. §5322. In practice the key question for most people is how the non-wilful penalty is counted. Until 2023 the government argued that it accrued for each unreported account. On 28 February 2023 the Supreme Court decided Bittner v. United States: Alexandru Bittner held accounts in Romania, Switzerland and Liechtenstein; for 2007–2011 the government counted 272 unreported accounts across five annual reports (between 51 and 61 a year) and sought US$2.72 million, and the Court limited the maximum to US$50,000 — US$10,000 for each of five annual reports. The Court treated the failure to file a compliant report as a single violation with a single maximum, however many accounts it omits.

Bittner changes nothing for wilful violations: the 50% is calculated on each account's balance. A civil FBAR penalty must be assessed within six years of the violation, and a suit to collect must be brought within two years of assessment (§5321(b)).

Form 8938

Form 8938 is filed by specified individuals — US citizens, residents and certain non-residents — and by specified domestic entities whose specified foreign financial assets exceed the threshold. It is attached to the Form 1040 return and filed by its due date, including extensions. If no income tax return is required for the year, no Form 8938 is required either (IRS instructions).

The threshold depends on filing status and residence. A taxpayer counts as living abroad if a bona fide resident of a foreign country for an uninterrupted period including a full tax year, or present outside the United States for at least 330 full days in any 12 consecutive months.

Exceeding either figure is enough. Specified foreign financial assets are accounts at foreign financial institutions and assets held outside accounts: foreign shares and bonds held directly, interests in foreign companies and partnerships, and contracts with foreign issuers or counterparties. An account maintained by a US payer, such as the US branch of a foreign bank, is not reported; nor is a foreign state pension of the social security type.

The penalty for failure to file is US$10,000; if the form is still not filed 90 days after IRS notice, a further US$10,000 accrues for each 30 days, up to US$50,000 on top of the base penalty. An underpayment linked to an undisclosed asset attracts a 40% penalty in place of the usual 20%.

Where an asset is already reported on Form 3520, 3520-A, 5471, 8621 or 8865, it need not be repeated on Form 8938, but the form must state which forms were filed and how many.

FBAR and Form 8938: which assets go where

The two reports cover different sets of assets. The comparison below follows the IRS table:

The table shows where mistakes cluster: an interest in a foreign company or fund held outside an account goes only on Form 8938, while signature authority over an employer's or family company's account goes only on the FBAR. Foreign real estate is not reported on either as such, but if it is owned by a foreign company, the interest in that company goes on Form 8938 at a value that includes the property.

Compared with other countries' own-declaration forms, the American pair is unusual in one respect: it follows citizenship as well as residence, so it travels with the person wherever he lives. The mechanics elsewhere are familiar. Spain's Modelo 720 is triggered at €50,000 per asset category (RD 1065/2007), France asks for each foreign account on Form 3916 with no threshold, Italy collects foreign assets in quadro RW inside the income tax return, and Germany under § 138(2) AO requires notice of acquiring or disposing of foreign participations where the holding reaches 10% or the aggregate acquisition cost exceeds €150,000. What all of them share with the FBAR is that the penalty is imposed for the missing form itself, whether or not any tax is due. The side-by-side table is in tax transparency, and the Spanish regime in Modelo 720.

Forms for structures and funds

An entity's account and the entity itself are separate reporting objects. An FBAR filed for a foreign company's account does not cover reporting on the company. The main forms in brief:

The penalties follow §6677 for trusts and §6038(b) for corporations. Forms for foreign partnerships and disregarded entities are covered in the article on Forms 8865, 8858 and 926.

Statute of limitations

The general period for assessing tax is three years from filing. International forms stretch it. Under §6501(c)(8), where information required under §6038D (Form 8938), §1298(f) (Form 8621), §6038 (Form 5471), §6048 (Form 3520) and several other sections is not furnished, the time to assess any tax on the related return does not expire until three years after the IRS receives it. Where the failure is due to reasonable cause, only items related to the missing form stay open.

Separately, §6501(e)(1)(A)(ii) allows six years where income of more than US$5,000 attributable to assets reportable under §6038D is omitted. The practical result: a missing Form 8938 or 8621 keeps the year open indefinitely until the form is filed.

Correcting past years

An American who has lived abroad for years and first hears of the FBAR from a bank letter is a typical case. The IRS maintains a set of procedures for it; the current line-up is listed on the page Options available for U.S. taxpayers with undisclosed foreign financial assets (reviewed 30 June 2026): the Voluntary Disclosure Practice, the Streamlined Filing Compliance Procedures and the Delinquent International Information Return Submission Procedures.

Streamlined Filing Compliance Procedures

The streamlined procedures remain open with no announced end date. The entry condition is non-wilful conduct: the taxpayer certifies under penalties of perjury that the failure resulted from negligence, inadvertence, mistake or a good-faith misunderstanding of the law. The procedures are closed to anyone whose returns are already under IRS civil examination or who is under criminal investigation. Three years of returns and six years of FBARs are filed, and tax and interest are paid in full.

SFOP requires certification on Form 14653, SDOP on Form 14654. For an American living abroad, SFOP is the only track without a penalty, but it closes the moment the IRS opens an examination.

Delinquent procedures

The Delinquent International Information Return Submission Procedures are for those who missed only information returns, are not under examination and have not been contacted by the IRS about those returns. They give no automatic penalty relief: a reasonable cause statement may be attached to each form, but a penalty may be assessed during processing without it being considered. For Forms 3520 and 3520-A, the statement is considered before assessment.

A separate set of Delinquent FBAR Submission Procedures no longer appears in the current IRS line-up. A late FBAR is still filed through BSA E-Filing, and any penalty question is decided under the general reasonable cause rules of §5321.

Voluntary Disclosure Practice

Where there are signs of wilfulness, income from illegal sources or criminal exposure, the route is IRS Criminal Investigation's Voluntary Disclosure Practice: a two-part Form 14457 submission and disclosure for the six most recent years. On 22 December 2025 the IRS published proposed updates with a standardised penalty framework and took comments until 22 March 2026; while not adopted, the proposal creates no rights for taxpayers. The former OVDP is closed. Approaches in other countries are compared in the article on voluntary disclosure, and the logic of US settlement is covered in US tax enforcement and offshore cleanup.

The licensee's view outside the US

For a bank, broker, fund manager or insurer, FATCA is a standing process with its own cycle. In a Model 1 jurisdiction it runs as follows:

1. Self-classification: whether the entity is an FFI and, if so, a reporting FI, deemed-compliant or exempt under Annex II of the IGA.
2. Registration in the FATCA Registration System and receipt of a GIIN.
3. Account due diligence: self-certification at opening for new accounts, a search for US indicia in the records for existing ones.
4. Annual reporting to the local tax authority, which passes the data to the IRS by 30 September.
5. Monitoring changes in circumstances: a new US address, telephone number or citizenship requires fresh documentation.

Due diligence thresholds are set in Annex I to the agreement (using the UK IGA as an example). Preexisting individual accounts up to US$50,000 (US$250,000 for insurance contracts) need not be reviewed; accounts above US$1,000,000 are high-value and require an enhanced search, including paper records and a relationship manager enquiry. Preexisting entity accounts up to US$250,000 need not be reviewed until the balance exceeds US$1,000,000.

The US indicia that trigger questions to the client are: US citizenship or residence, a US place of birth, a US residence or mailing address, a US telephone number, standing instructions to transfer funds to a US account, a power of attorney or signatory authority granted to a person with a US address, and an "in-care-of" or "hold mail" address as the sole address. How the bank documents the client, which W-8 and W-9 forms it accepts and how it classifies structures is covered in detail in the article on FATCA and CRS self-certification.

Under Model 1, supervision rests with the local tax authority, which checks the completeness of reports, the quality of self-certifications and the presence of TINs. The UK example is set out in the article on HMRC data under CRS and FATCA. Under Model 2 and outside an IGA, the Responsible Officer's direct accountability to the IRS is added. Typical failures in reviews: self-certifications accepted without a reasonableness check, US indicia missed in client files, missing TINs without a reason code, untracked changes in circumstances, and passive structures classed as active without grounds.

The client's view

Why the bank asks for a W-⁠9

For a bank outside the United States, Form W-9 is how it records that a client is a US person, obtains the TIN and includes the account in its report. The request comes in three situations: the client has declared US citizenship or residence; US indicia have been found in the file; or the client's structure turns out to be passive and one of its controlling persons is a US person.

A US place of birth is the most painful indicium. Under the IRS instructions for requesters of Forms W-8, a bank may accept a W-8BEN from someone born in the United States only with documentary evidence of another citizenship and either a Certificate of Loss of Nationality or a reasonable written explanation of why the person renounced US citizenship or did not obtain it at birth. People who left the United States as children and never thought of themselves as American meet this question with every new account. Renunciation and its tax consequences are covered in the article on US expatriation and exit tax.

Why the bank says no

FATCA does not prohibit serving US persons, but it makes them more expensive. Every US account requires documentation, annual reporting, TIN monitoring and handling of tax authority queries. For a small bank, or a private bank with a narrow client base, it is simpler not to take such clients at all. There is a product side as well: the foreign funds and ETFs a bank offers are PFICs for an American, with a punitive tax regime. Which banks still open accounts for Americans, and on what terms, is covered in the article on banking for US citizens abroad.

A structure with a US owner

A company, trust or foundation with a US participant goes through FATCA classification. If the structure is passive (a Passive NFFE under US rules or a Passive NFE under an IGA), the bank discloses its US controlling persons. That information goes to the IRS even when the structure itself holds no US assets. For the owner this means that the return must carry both Form 8938 and the forms for the structure itself, and the figures must match what the bank reported. A typical onboarding failure is a structure set up before the beneficiary moved to the United States or obtained a green card: the bank learns of the change of status at the annual file refresh, while the structure is missing from past returns.

Risks and typical mistakes

A separate risk is inconsistent positions. A client who tells a bank in a self-certification that they are not a US person and then files a US return, or the reverse, leaves a documentary trail of contradiction. The bank finds it at the annual file refresh, or the IRS finds it when matching the FFI report against the return. The mirror risk for the institution is accepting a self-certification that contradicts information in the file without asking for an explanation — a standard finding in a tax authority review.