Tax Transparency: CRS, FATCA and Financial Information Exchange

Tax transparency is the set of channels through which a country of residence learns about its taxpayer's foreign accounts, crypto-assets, structures and rulings: exchange on request, FATCA, CRS, CARF, the EU's DAC directives, group country-by-country reporting and beneficial ownership registers. Each channel is covered in depth in its own article; this page sets out the overall picture — how the channels appeared, what each of them shows about a private client and their structure, and where the system is heading.

Concept

In fifteen years, the global system has turned upside down. Banking secrecy as a planning tool is dead; in its place stands an infrastructure of automatic exchange. CRS can provide tax authorities with foreign-account information automatically, but the account and person must be reportable and an applicable exchange relationship must exist. Private wealth planning has become a compliance discipline: structures are evaluated by whether they can withstand full visibility. The presumption an administration starts from has shifted with it: the opening position used to be “there is no data”, and the prudent starting point is now to establish which information was reportable or exchanged and whether it matches the return.

The system has two audiences. A licensed financial institution — a bank, broker, asset manager, trustee or crypto provider — acts as the data collector: it classifies the client, obtains the self-certification, keeps the beneficial ownership file and reports to its tax authority, while supervisors and correspondent banks check how carefully it does so. The client — an HNW individual, a family, a foundation or a business — is the subject of reporting: they are asked about their countries of residence and tax numbers, their roles in trusts and companies, and the source of funds, and everything they say flows into several channels at once. Onboarding runs predictably when the client's answers on different forms agree with one another and with what the client declares at home.

How Banking Secrecy Disappeared

The programme for this rebuild was set by the OECD's 1998 report “Harmful Tax Competition”. It named four features of a harmful tax haven: no tax or only a nominal one; no effective exchange of information; a lack of transparency; and registration of structures with no requirement to carry on real activity. The next quarter-century closed each feature in turn — which is why transparency was built in the order it was: data exchange came from FATCA and CRS, opacity was stripped away by beneficial owner registers, the real-activity requirement was fixed by economic substance laws, and artificial profit shifting was hit by BEPS and the European directives.

The collapse began in 2009: Swiss bank UBS, under U.S. pressure, paid $780 million and for the first time handed over client names — the symbolic end of absolute banking secrecy. In 2010, Congress passed FATCA and obliged banks worldwide to report on U.S. taxpayers. The OECD picked up the approach: CRS appeared in 2014, with the first automatic exchanges taking place in 2017–2018. Leaks — Panama Papers (2016), Paradise Papers (2017), Pandora Papers (2021) — only accelerated the political consensus.

By the mid-2020s exchange had reached industrial scale: data on 171 million accounts holding EUR 13 trillion was transmitted for 2024, and 129 jurisdictions have committed to exchange (Zambia from 2028) — figures from the Statement of Outcomes of the Global Forum plenary, December 2025. Hiding capital "outside the exchange" is technically possible only in a few relic locations, and the price is disconnection from normal banking: banks from opaque jurisdictions lose correspondent accounts. Full visibility has become the backdrop against which all planning is now built.

The Logic of Evolution: From Requests to Automation

Each new generation of instruments closed a weakness in the previous one. Exchange on request required the administration to know already whom to ask about — automatic exchange removed that condition. Automatic exchange on accounts could not see crypto-assets or rulings — CARF and the expanded DAC followed. Account data ran into opaque companies — beneficial ownership registers were added. Reporting by individuals did not show where groups earn their profits — country-by-country reporting appeared.

In parallel the EU built its own line — the directive on administrative cooperation and eight amendments to it. On the Commission's list it looks like this.

On 24 June 2026 the Commission proposed a recast — a consolidated rewrite of the whole directive; what it changes and where it stands is covered in the article on the tax omnibus and DAC recast.

What the State Sees About a Private Client and Their Structure

The client's practical question is which information will end up with the tax authority of their country of residence without their involvement. The answer depends on where the accounts are, what the client owns and through which structures.

Here is how it adds up in a typical structure: a resident of an EU member state holds a portfolio at a Swiss bank through a UAE holding company, and the family assets in a discretionary trust. The bank treats the holding as a Passive NFE or an Investment Entity and reports the client as a controlling person; the trustee, if the trust is a Reporting FI, reports the settlor and beneficiaries together with their roles; a residence ruling, if the client obtained or renewed one after 1 January 2026, travels under DAC8; an adviser who put together an arrangement with features of reporting avoidance discloses it under DAC6. The tax authority of the country of residence ends up with a picture missing only one thing — an explanation that matches the tax return, and that has to come from the client.

What the System Consists of Today

CRS: Automatic Exchange on Accounts

129 jurisdictions have committed to exchange under CRS: banks annually transmit balances, income, and data on controlling persons to the tax authority of the client's country of residence. The updated standard (CRS 2.0) applies from 2026, with first reports under it going out in 2027; in the EU it is implemented through DAC8 from 1 January 2026, and the Addendum to the multilateral agreement had 81 signatories as of 26 August 2026. The perimeter is wider than usually reported: alongside specified electronic money products and CBDCs it now covers indirect exposure to crypto-assets through derivatives and investment structures.

New fields appeared as well: whether a valid self-certification was obtained for the account holder and the controlling persons, the role of the controlling person, whether the account is joint and how many holders it has. A financial institution must take into account the OECD guidance on high-risk citizenship and residence by investment schemes. Reporting is built on self-declaration of residence: incorrect self-certification does not stop the exchange anyway and leaves discrepancies that banks and tax authorities later reconcile. The mechanics of the standard from inside the financial institution — due diligence thresholds, indicia, undocumented accounts, formats — are in the CRS overview, and the form itself is covered in the note on FATCA/CRS self-certification.

FATCA: The American Vertical

The U.S. does not participate in CRS — it has its own vertical. FATCA (since 2010), FBAR, and Form 8938 turn any contact with a U.S. person into a separate compliance circuit: its own reporting thresholds, penalties for silence, the IRS's special view of foreign trusts (Form 3520) and PFICs. The paradox of the system is that the U.S. itself remains one of the most opaque jurisdictions for non-residents: it collects data on its citizens worldwide, yet even under the reciprocal Model 1A it sends back only interest, U.S. dividends and other U.S.-source income — without account balances. The American circuit is covered in the material on FATCA, FBAR and Form 8938; how HMRC uses CRS and FATCA data is covered in a separate article.

CARF: Crypto Ceases to Be a Blind Spot

The Crypto-Asset Reporting Framework transfers CRS logic to crypto assets: exchanges, custodians and decentralised venues report on clients wherever there is an identifiable operator; a pure software provider stays outside the perimeter. The schedule is split into waves: under the Global Forum commitment list in its edition of 14 September 2026 there are 77 jurisdictions, of which 46 exchange first by 2027, 27 by 2028 and four by 2029 — Argentina, Azerbaijan, Mexico and the U.S.; El Salvador, Georgia, India and Vietnam took no commitment at all.

Under the OECD monitoring update, domestic legislation must be in force from 1 January 2026 for the first wave and from 1 January 2027 for the second. The second wave includes Switzerland, Singapore, the UAE, Hong Kong, Turkey, Panama and the British Virgin Islands; Switzerland has deferred its crypto part: under the Federal Council decision of 26 November 2025 the crypto-asset provisions are in the law from 2026 but will apply from 2027 at the earliest. The Hong Kong bill on CARF and the amended CRS, gazetted on 22 May 2026, provides for CARF from 1 January 2027 and is still before LegCo.

The OECD keeps revising the named composition of the waves, so it is checked against the current Global Forum commitment list. CARF transmits aggregates of transactions over the period; wallet balances, which CRS reports for accounts, are not part of this exchange. In the EU, the same rules are introduced by DAC8 (Directive 2023/2226). The tax consequences for holders are examined in the analysis of CARF in practice.

DAC7: Income Through Platforms

Directive (EU) 2021/514 has required digital platform operators since 1 January 2023 to report on sellers across four activities: rental of immovable property, personal services, sale of goods and rental of any mode of transport. The tax authority that receives the operator's report passes it to the seller's state of residence within two months of the end of the reporting period. Sellers of goods with fewer than 30 transactions and no more than EUR 2,000 in the period are excluded; for an owner letting flats through a platform there is no threshold. For a private client this is a channel that is rarely remembered: income from short-term letting of a villa in another EU country reaches the tax authority of the country of residence without any bank involved.

Beneficial Owner Registers: the EU and the U.S. Have Diverged

Beneficial owner registers, after the EU Court decision of 22 November 2022 (cases C-37/20 and C-601/20), lost their public access regime: the court deemed the openness of UBO data a disproportionate interference with private life. Directive (EU) 2024/1640 established access by “legitimate interest” instead — for banks, tax authorities, obliged entities, journalists, and NGOs. Its deadlines run in four stages: access by legitimate interest — 10 July 2025; further development of beneficial ownership registers — 10 July 2026; the general transposition deadline with repeal of AMLD4 and AMLD5 — 10 July 2027; the single access point for real estate data — 10 July 2029.

Implementation is uneven. As of September 2025 fourteen member states had opened access by legitimate interest, and eleven more faced infringement procedures for missing the 10 July 2025 deadline. Legitimate-interest criteria, fees (from zero to EUR 200) and application procedures are not harmonised; refusals were recorded in Ireland and Hungary. Tax authorities do not depend on this unevenness: since DAC5 they have direct access to AML beneficial ownership data.

The U.S. moved the other way. The final FinCEN rule was issued on 11 August 2026 and published in the Federal Register on 14 August: it permanently exempts all domestic reporting companies from BOI reporting and removes the obligation to report beneficial owners who are U.S. citizens or residents. Only foreign reporting companies — formed under foreign law and registered to do business in a state — must still file. The original CTA rule covered roughly 32 million entities. The UK Register of Overseas Entities moves in the opposite direction: since 2025 trust information is available through a public application procedure, and non-compliance blocks property transactions.

The EU AML Package: Regulation, Directive, Supervisor

The 2024 package consists of three acts, and the register directive is only one of them. Regulation (EU) 2024/1624 (AMLR) applies from 10 July 2027, and for certain categories of obliged entities under Art. 3(3)(n) and (o) from 10 July 2029. It sets a single beneficial ownership threshold: 25% of direct or indirect holding, with indirect holdings computed by multiplying shares along the chain, plus control by “other means” — the right to appoint and remove corporate bodies, veto rights, decisions on profit distribution. For trusts the beneficial owners are the settlor, trustee, protector, beneficiaries and any other persons exercising control; for foundations, the founder and the members of the governing bodies. Verification cannot rely on the central register alone.

The regulation's operational thresholds reach the private client directly: a cash ceiling of EUR 10,000 per single or linked transactions, a due diligence threshold of EUR 10,000 for occasional transactions and EUR 1,000 for crypto-asset service providers, and an obligation on non-EU structures to disclose beneficial owners when entering into a business relationship in the EU, acquiring real estate there, buying vehicles from EUR 250,000 and vessels or aircraft from EUR 7.5 million, or receiving public contracts. Operators of investment migration schemes were added to the list of obliged entities. The package is examined in detail in the material on AML and KYC for the private client and in the article on the EU AML package.

Supervision is being centralised. AMLA (Regulation (EU) 2024/1620) applies from 1 July 2025, with headquarters in Frankfurt. Direct supervision starts in 2028 and will cover forty high-risk financial entities and groups; draft technical standards on the risk assessment methodology and the selection criteria for those forty were published on 18 December 2025, and the selection itself runs in 2027.

Scheme Disclosure: DAC6, the Legal Privilege Ruling and MDR Stagnation

DAC6 obliges intermediaries to disclose cross-border arrangements by hallmarks within 30 days; GAAR and the principal purpose test allow tax authorities to ignore structures without business purpose. Category D is aimed squarely at circumventing automatic exchange: D1 covers arrangements that undermine CRS reporting, D2 opaque chains that obscure beneficial owners. In case C-623/22 (judgment of 29 July 2024) the CJEU upheld the validity of the directive as a whole — the breadth of taxes covered, the precision of the terms “arrangement” and “intermediary”, the hallmarks themselves and the main benefit test — and narrowed its earlier position in C-694/20: the notification exemption based on professional privilege is reserved for lawyers practising under the titles of Directive 98/5/EC. Other professionals bound by national professional secrecy fall outside the exemption.

On 24 June 2026 the Commission tabled a proposal for a DAC recast (COM(2026) 308 final) alongside a tax omnibus (COM(2026) 560 final). For DAC6 it proposes deleting the generic hallmarks of category A, extending the filing deadline from 30 to 90 days, replacing the reference in hallmark C1 to the OECD work on non-cooperative jurisdictions with a reference to the work of the Code of Conduct Group, and setting out the substance criteria in hallmark D2 through a Council implementing act; a narrow carve-out is introduced for groups within the Pillar Two perimeter, operating only where no member of the group receives benefits that lower taxation below 15%. For now this is only a Commission proposal: the legal basis is Arts. 113 and 115 TFEU and Council unanimity is required. Building a scheme on the assumption that category A is gone is premature.

Outside the EU the equivalent mechanism has not travelled. The multilateral agreement on the exchange of information on CRS Avoidance Arrangements and Opaque Offshore Structures still stands at nineteen signatories — the document on the OECD site is dated 26 November 2024 and has not been reissued since. The UK replaced DAC6 with its own MDR on the 2018 OECD model (SI 2023/38, in force from 28 March 2023), keeping DOTAS for domestic arrangements. For a scheme with non-EU participants the disclosure obligation arises piecemeal, under the rules of particular jurisdictions, with no common exchange channel underneath it.

Ruling Exchange Has Reached Individuals

DAC8 rewrote the definition of an advance cross-border ruling so that it expressly covers rulings determining whether a person is resident for tax purposes in a member state. Transposition was due by 31 December 2025 and the rules apply from 1 January 2026. Not every ruling travels: the exchange reaches a ruling issued, amended or renewed after 1 January 2026, and then only where either the amount of the transaction or series of transactions exceeds EUR 1,500,000, if the ruling states an amount, or the ruling determines a person's tax residence. The second limb knows no threshold: a residence ruling is exchanged whatever the amount, and for residence regimes that is the standard case.

An old confirmation stays outside the perimeter for as long as nobody touches it. A 2021 ruling that simply continues to run is not exchanged — it enters the perimeter at the moment it is renewed or amended, and it enters in full. That makes the expiry date and the renewal mechanics of a special-regime confirmation part of the planning. Each document has to be assessed on its own. An advance clarification issued by a member state's tax administration at the request of a specific person — the Italian interpello and its analogues — falls squarely within the ruling definition. Registration under the Portuguese IFICI is structured as an administrative procedure and needs checking against national practice. A UK non-statutory clearance sits outside the DAC perimeter, since the UK left the EU, which does not stop such a document from surfacing through exchange on request. A client holding all three usually assumes one confidentiality regime for all three.

Group Reporting Has Gone Public

Country-by-country reporting grew out of BEPS Action 13: the OECD's final report of October 2015 introduced three-tier documentation — master file, local file and country-by-country report — for groups with consolidated revenue of EUR 750 million or more. At first only tax authorities saw the report, exchanging it under DAC4 and multilateral agreements. Directive (EU) 2021/2101 requires groups with consolidated revenue above EUR 750 million over two consecutive financial years to publish a country-by-country report. EU-wide application covers financial years starting on or after 22 June 2024; for a calendar financial year the first publication falls due by 31 December 2026 for 2025.

Romania applied the directive earlier, and its early wave shows what to expect: on the EU Tax Observatory's assessment of 8 July 2026, of roughly 569 non-European groups within the perimeter only 20% published reports, 38% of the published reports are incomplete, and the aggregated “Others” category absorbs 71% of profit and 74% of revenue.

The minimum tax circuit is closing alongside. Directive (EU) 2025/872 (DAC9) was adopted on 14 April 2025, with first exchange from 1 December 2026 for the 2024 financial year; on 30 January 2026 the Commission sent letters of formal notice to ten member states for failing to fully transpose it. The international counterpart is the multilateral agreement on the exchange of the GloBE Information Return, with 39 signatories as of 8 September 2026, including Switzerland, the UK, Hong Kong, Singapore, Guernsey, the Isle of Man, Gibraltar and Liechtenstein.

Global Forum Peer Reviews: Who Checks the Checkers

Transparency standards work only where they are applied. That is the job of the OECD-hosted Global Forum on Transparency and Exchange of Information for Tax Purposes, which runs peer reviews against two standards. The review against the exchange of information on request standard (EOIR) looks at whether ownership, accounting and banking information is available in the jurisdiction, whether the tax authority has the power to obtain it, and how quickly and fully it answers its partners. The review against the automatic exchange standard (AEOI) checks whether CRS has been transposed into domestic law and whether financial institutions actually carry out due diligence and reporting, with the tax authority supervising them.

The results are published and carry consequences. Global Forum ratings are part of the screening criteria for the EU list of non-cooperative tax jurisdictions, alongside participation in automatic exchange under CRS, and listing in Annex I triggers defensive measures by member states. Banks generally build the same assessments into country risk: a jurisdiction with a weak transparency rating makes onboarding heavier for any structure registered there.

For the client the conclusion is practical: a jurisdiction chosen because "exchange does not reach it" is today itself under pressure from lists and assessments, and its banks are the first to lose correspondent relationships.

Three Lists with Different Consequences

“Blacklist” in a conversation about structures means one of three registers: the FATF lists, the EU list of high-risk third countries for AML purposes, and the EU tax list of non-cooperative jurisdictions. Different bodies maintain them against different criteria, and the FATF keeps two of its own with different consequences. The same jurisdiction can sit on two of them on unrelated grounds.

Russia sits on both EU lists on different grounds: on the tax Annex I under the Code of Conduct criteria, and on the AML list through a separate Delegated Regulation (EU) 2026/46, as a country whose membership of the FATF is suspended. The British Virgin Islands are absent from the tax Annex I — they are on Annex II — but have been on the AML list since 29 January 2026. Of the three registers it is that one which changes how a European bank services the client automatically: inclusion triggers enhanced due diligence as a matter of EU law, whereas the FATF grey list formally does not require it, and Annex I bites on deductions and withholding tax.

Resident by Resident: What Arrives and What the Person Files

The channels above describe what moves between administrations. For a person the useful cut runs the other way: the country of residence decides which exchanges feed its tax authority, on what timetable, and which return the resident must file about foreign assets in any case. The first table sets out the incoming side as at September 2026; the second, the resident's own filings where a country has one.

The years come from the Global Forum's status of commitments (update of 17 September 2026) and CARF commitment list (14 September 2026), and the CRS 2.0 column from the Addendum signatory list of 26 August 2026: Hong Kong, Türkiye, Kazakhstan, Russia and the United States are not on it. Singapore's dates come from the IRAS e-Tax Guide on CRS and the Ministry of Finance: the revised CRS Regulations apply from 1 January 2027, the first exchange under the amended standard takes place in September 2028, and CARF exchanges start in 2028.

The French amounts are those of article 1736 CGI as commented in BOFiP; the Italian €15,000 exemption for deposits is stated in the Redditi PF 2026 instructions (art. 2 of Law 186/2014); the Belgian double filing — a one-off notice to the Central Point of Contact of the National Bank of Belgium plus the account on every year's return (FPS Finance) — comes from the two authorities' own pages.

The Italian sanction ranges are in Article 5(2) of Decree-Law 167/1990, which the Italian finance-law portal marks as applicable until 1 January 2027. The NBB's CPC FAQ says that failing to report a foreign account may lead to a fine; it gives no fixed amount. Separately, the 2026 Belgian personal-tax form asks founders of a legal construction and recipients of a dividend or other benefit from one to declare it and attach form 276 CJC for each construction. FPS Finance describes this separate regime as the Cayman tax. The CPC account row alone does not determine whether the legal-construction rules apply.

Three conclusions follow. First, the returns and the exchanges measure different things, so neither replaces the other. Spain's threshold is €50,000 per block, tested separately for accounts and for crypto held abroad (arts. 42 bis and 42 quater RD 1065/2007), while the CRS report on the same account arrives regardless of the balance; Germany does not ask about accounts at all, only about foreign businesses and holdings of 10% or more or above €150,000 of cost (§138(2) AO). A resident who files nothing because a threshold was not reached is still visible, and one who files everything still has to reconcile the return with what the administration received.

Second, the timetable is not uniform even inside the OECD perimeter. An EU resident's crypto exchange data for 2026 moves in 2027; a Swiss, Emirati, Singaporean or Hong Kong resident's, a year later; an American's, in 2029. Residence rulings are exchanged only inside the EU. For anyone moving between these groups, the year of the move decides which administration sees which year's data — which is why the departure and arrival sequence on tax residency basics matters as much as the destination.

Third, the absence of a foreign-asset return is not the absence of visibility. The UAE, Singapore and Hong Kong ask their residents for nothing about foreign accounts, but they send their banks' data outward under CRS to the account holder's other countries of residence. The United States sits at the other extreme: it asks its citizens for FBAR and Form 8938 wherever they live and does not join CRS — the detail is on FATCA, FBAR and Form 8938, and the Spanish mechanics on Modelo 720.

What This Changes in Planning

Only three things work. First — lawful special regimes: non-dom, flat tax, and territorial systems provide low rates with full transparency. Second — substance: a structure with real presence — office, people, decisions on the ground — withstands both exchange and GAAR. Third — order in the past: voluntary disclosure and amnesties are almost always cheaper than waiting for a letter from the tax authority with already-received exchange data.

Presumptions shifted along with the infrastructure. The question used to be “will the administration find out”, and silence worked as a position. The starting point is now to establish what was reportable and what was actually exchanged, rather than presume transmission in every case. Hence the order of work: first reconstruct the relevant information about the client — residence from the self-certification, the role of the controlling person, a ruling under a special regime — and only then discuss the structure. It runs the other way too: formalised presumptions in the client's favour now exist, from the FATF's express statement that it does not call for enhanced due diligence on grey-list jurisdictions to the IRS relief under Notice 2024-78, extended through 2025–2027, for Model 1 FFIs unable to obtain a U.S. TIN on pre-existing accounts. A presumption that was never invoked in correspondence with the bank or the administration does not work.

For the licensee the conclusion is the mirror image. Its report reaches the tax authority next to data from other channels, and a mismatch — say, residence in the bank's CRS report and residence in a ruling exchanged under DAC8 — becomes a question first for the client and then for the quality of the institution's due diligence. That is why supervisors and correspondent banks look above all at whether the forms are consistent with the KYC file and the beneficial ownership registers.

Where This Is Heading

The vector is one — transparency by default, and the coming years are set out by date. 2026 brings the exchange of rulings on individuals and the first public country-by-country report, with the first DAC9 exchange in December. 2027 brings the first reports under CRS 2.0 and the first crypto exchange under DAC8 for 2026, and AMLR starts to apply on 10 July. 2028 brings the second CARF wave and the start of direct AMLA supervision. 2029 brings the U.S. into CARF exchange. Tax authorities increasingly rarely request information manually and increasingly often compare already-received arrays: a discrepancy between a declaration and exchange data itself becomes grounds for an audit.

What remains workable are structures that honestly live under full visibility: real presence, lawful low-tax regimes, carefully closed past. For anyone changing tax residence, the practical minimum is a sober view of exit taxes when changing residence and understanding how exchange overlaps with trusts and holding structures.