🇬🇧UK Tax Information Exchange: CRS, FATCA and HMRC Data

The United Kingdom sits on both sides of automatic tax information exchange. British banks, brokers, investment managers and trusts collect customer self-certifications and report once a year to HMRC on accounts held by non-residents and US persons, while HMRC receives the return flow: millions of records on accounts that UK residents hold abroad. The UK has no standalone foreign-asset return like the US FBAR or Form 8938, so the whole structure comes down to one question: does what HMRC knows about the accounts match what the Self Assessment return says?

Concept

In UK law the exchange rests on the International Tax Compliance Regulations 2015 (SI 2015/878). A single instrument serves both FATCA and the CRS: it requires UK Financial Institutions to identify reportable customers, collect information about them and pass it to HMRC for onward exchange with partner jurisdictions. HMRC describes the mechanics as unified: «the basic process is the same» whichever regime the data is collected for.

The Common Reporting Standard is an OECD standard born of a G20 initiative. In its International Exchange of Information Manual HMRC describes it as built on the FATCA approach without the US-specific features: citizenship-based tax residence and a 30% withholding tax. The CRS creates no tax liability. It supplies facts — balances, income, controlling persons — while the tax charge arises from the rules on residence, source, gains and the regimes for trusts, companies and funds.

That sets the central test for the client. HMRC matches incoming data against Self Assessment, and a mismatch becomes the trigger for a letter or an enquiry. For the licensed institution the central question is different: did it classify itself and its customers correctly, obtain valid self-certifications and file on time? Both sides are tied together by one document — the self-certification the customer signs when opening the account. The general logic of the standard is covered in the article on the CRS, and the regimes are compared in the overview of tax transparency.

Where the regime came from: from FATCA to CRS 2.0

FATCA came first — the provisions of the HIRE Act 2010 under which a foreign financial institution that does not disclose accounts of US citizens and residents risks 30% withholding on US-source income. The UK chose an intergovernmental agreement: the UK–US Agreement to Improve International Tax Compliance and to Implement FATCA was signed on 12 September 2012. The regulation-making power came from section 222 Finance Act 2013 (now section 349 Finance (No. 2) Act 2023). UK institutions report US accounts to HMRC, and HMRC passes the data to the IRS.

The G20 then asked the OECD for a multilateral equivalent. The first jurisdictions signed the Multilateral Competent Authority Agreement in October 2014, exchanges began in 2017, and for UK institutions the first CRS reporting year was 2016. In 2023 the OECD updated the standard to cover electronic money and central bank digital currencies. The UK committed in November 2023 to implement the amendments; they took effect on 1 January 2026, 2026 is the first reporting year under the updated standard (known as CRS 2.0), and the first returns fall due in 2027.

In parallel the Crypto-Asset Reporting Framework (CARF) was launched as a separate regime for crypto platforms. The UK went beyond the minimum standard: its CARF also covers UK residents who are customers of UK platforms. The regime is covered in detail in the article on CARF.

The UK legal framework

The UK financial institution: how the duty works

Registration with HMRC

The 2025 amendments introduced mandatory registration with HMRC's AEOI service: all Reporting Financial Institutions and Trustee-Documented Trusts must register by the later of 31 December 2025 or 31 January following the calendar year in which the entity first becomes a Reporting FI. Institutions brought into scope from 1 January 2026 (above all electronic money issuers) have until 31 January 2027. There is no obligation to file nil returns, but registration is required even where there are no reportable accounts.

Investment managers and trusts felt the practical effect most. A trust managed by a financial institution is often itself an investment entity and therefore a Reporting FI. Where the trustee is itself a Reporting FI and reports on the trust's behalf, the trust is a Trustee-Documented Trust, and under the new rules it too must register. Failure attracts a penalty of up to £1,000 plus up to £300 a day until the registration is made.

Due diligence: new and pre-⁠existing accounts

For new accounts the institution must obtain a self-certification on account opening, and in any case within 90 days of learning that the account exists. An individual's self-certification carries the name, residence address, every jurisdiction of tax residence, a TIN for each reportable jurisdiction and the date of birth (not required for FATCA). It is signed or, for accounts opened online or by telephone, positively affirmed.

The core requirement on the institution is the reasonableness test. The declared residence is checked against everything collected at opening, including AML/KYC documents. A «UAE resident» self-certification alongside a UK address, a UK phone number and salary from a UK employer is not valid until the contradiction is resolved.

Pre-existing accounts follow a lighter procedure. For individual accounts up to $1 million a residence-address test or an electronic search for indicia is allowed. For accounts above $1 million an electronic record search, a paper record search and a relationship manager inquiry apply in sequence, and the residence-address test cannot be used.

For entity accounts the key question is classification. An Active NFE reports only on itself. A Passive NFE discloses its controlling persons; the dividing line is less than 50% of gross income from passive sources for active status. A family holding company living on dividends and interest is almost always passive, so its bank reports its beneficial owners. The forms and the usual client mistakes are covered in the article on FATCA and CRS self-certification.

The reporting cycle

1. The calendar year from 1 January to 31 December is the reporting period for year-end balances, income and gross proceeds.
2. By 31 January following the first year in which an account becomes reportable, the institution notifies the individuals that their details will be reported.
3. By 31 May the institution files its return with HMRC through the online service or the XML schema. From 1 January 2027 CRS and FATCA are filed under separate schemas: HMRC's combined schema is withdrawn after 31 December 2026.
4. HMRC passes the data to the tax authorities of partner jurisdictions and, for FATCA, to the IRS.
5. Due diligence records are kept for five years after the end of the reporting period.

Penalties after 16 July 2025

The 2025 amendments replaced the old scale with a system in which the amount grows with the number of customers. The revised framework applies to failures on or after 16 July 2025.

The penalty for a missing self-certification does not apply to pre-existing individual accounts, where the standard does not require one. It is also not charged on new accounts opened between 1 January 2016 and 15 July 2025 without a self-certification, although inaccurate returns filed after 16 July 2025 are penalised in the ordinary way. For a bank with tens of thousands of customers, «£100 per person» quickly reaches seven figures, so remediating legacy files is a matter of hard money for a large institution.

What CRS 2.0 changed from 1 January 2026

The perimeter has widened. From 2026 the definition of a depository account includes accounts representing Specified Electronic Money Products and accounts holding central bank digital currencies. E-money used to fall outside reporting under certain conditions; EMIs are now Reporting FIs.

Returns have become more detailed. From the 2026 reporting year they carry the account type, account holder status and the roles of controlling persons and equity interest holders. For entities the role follows a hierarchy: ownership, control by other means, senior managing official. For trusts the roles are settlor, beneficiary and others. For accounts opened before 2026, the role is reported in 2026–2027 only if it is already held in the institution's electronically searchable records; from 2028 the requirement becomes mandatory for all controlling persons. Whether a valid self-certification was obtained is also flagged, so HMRC and its partners also see the quality of the file.

CARF and domestic reporting

From 1 January 2026 UK crypto platforms collect user and transaction data. Following the government's decision of October 2024, CARF extends to UK customers of UK platforms; HMRC estimates around 50 businesses are affected. The first return is filed between 1 January and 31 May 2027, with registration and user notification due by 31 January 2027.

What HMRC does with the data

The scale of the flow

According to the government as at October 2024, HMRC receives information on around 9 million accounts from more than 100 jurisdictions, and work on that data has secured more than £820 million in additional yield. At Autumn Budget 2024 HMRC was given additional resources to tackle serious offshore non-compliance by wealthy individuals and the entities they control.

HMRC keeps a list of participating jurisdictions expected to exchange with the UK, with more than a hundred entries. It includes Switzerland, Singapore, Hong Kong and the UAE; the United States is absent because it takes part in exchange only through FATCA.

HMRC published its first official estimate built on this data in October 2024. For the 2018/19 tax year it received more than 7 million foreign account reports, identified 3.9 million distinct individuals and traced 3.2 million of them (82%) to its own records. Based on a random sample of 400 individuals, HMRC estimates that 4% of UK residents covered by the exchange under-declared tax on foreign income, around £0.3 billion in total. Of those who under-declared, 55% had a shortfall below £1,000, 44% between £1,000 and £10,000, and 2% above £10,000.

Connect and matching

Incoming records are matched against tax data in Connect, the analytical system HMRC itself described in 2016 as «our own world-leading database of intelligence». The same data lets HMRC select risk populations and build prompts into the online Self Assessment return so that foreign income is not forgotten before filing.

One-⁠to-⁠many letters and campaigns

The first step on a mismatch is a mass letter (one-to-many, known in practice as a nudge letter). It is not an enquiry: HMRC says it holds information about foreign income or accounts and invites the taxpayer to check the return. The 2018/19 study was built this way: letters first, then compliance checks for unresolved cases. HMRC's list of genuine contacts currently shows ongoing campaigns aimed at investors in offshore funds, at former non-doms on the 2025 changes and at cryptoasset holders.

The letter is not in itself a statutory demand, but the response has consequences. A disclosure made after a letter counts as prompted, and its minimum penalty is higher than for an unprompted one. If the taxpayer keeps filing returns without the foreign income after the letter, arguing reasonable care becomes difficult, and the behaviour may be treated as deliberate, with a longer assessment window.

The Worldwide Disclosure Facility

The standard route to correct an offshore position is the Worldwide Disclosure Facility. It is open to anyone whose liability relates wholly or partly to an offshore issue, including personal representatives and tax advisers. The process has two steps: notification through the Digital Disclosure Service, then 90 days to gather the information, calculate tax, interest and penalties, and submit the disclosure. The number of years covered depends on the self-assessed behaviour and the matching time limit. As at October 2024, more than 41,000 disclosures had been made through the WDF and more than £430 million collected. Amnesty mechanisms across countries are compared in the article on voluntary disclosure, and the UK enquiry process is covered in the article on HMRC enquiries.

Offshore penalties

The penalty for an inaccurate return involving an offshore matter depends on behaviour and on the category of the territory where the income or asset sits. The maximum rates for deliberate behaviour are the same for an inaccurate return, a failure to notify and the deliberate withholding of information; concealment raises the ceiling:

The examples by category come from HMRC's Compliance Handbook. On top there may be an offshore asset moves penalty of 50% of the underlying penalty and an asset-based penalty: the lower of 10% of the asset's value or ten times the offshore tax. Late-payment interest runs separately.

Time limits

The 12-year limit was introduced by the Finance Act 2019 (ss. 80–81, section 36A TMA 1970). For income tax and CGT for 2013/14 and 2014/15 it applies to careless behaviour, and from 2015/16 onwards whether or not reasonable care was taken. The exception ties straight into automatic exchange: the window does not extend if, before the normal 4- or 6-year limit expired, HMRC received overseas information from which the lost tax could reasonably have been identified and it was reasonable to expect an assessment. CRS data that sat idle at HMRC works for the taxpayer; data that arrived later works against. The full scale of time limits is set out in the Compliance Handbook.

Failure to Correct: the historical backdrop

Ahead of the first CRS exchanges the UK introduced the Requirement to Correct (section 67 and Schedule 18 Finance (No. 2) Act 2017). All offshore income tax, CGT and IHT non-compliance for periods before 6 April 2017 had to be corrected by 30 September 2018. Anything left uncorrected falls under Failure to Correct: a standard penalty of 200% of the tax, reducible to no less than 100% for an unprompted disclosure and no less than 150% for a prompted one. Naming, an asset-based penalty of up to 10% of asset value and a 50% uplift for asset moves are also possible. For old periods now surfacing in CRS data, this regime still sets the price of the error.

The link to the end of non-⁠dom status

From 6 April 2025 the remittance basis was abolished and domicile stopped governing the taxation of foreign income. New residents in their first four years after at least ten years of non-residence may claim the FIG regime, but only through the return: HS266 requires each amount of foreign income from each source to be entered on the SA106 and SA108 pages and the claim to be ticked on SA109. Relieved foreign income, unlike the old unremitted income, is visible on the return, which hands HMRC a direct item to match against CRS data. The price of the claim is the loss of the personal allowance and the CGT annual exempt amount.

Former remittance basis users may, up to and including 2027/28, designate on their return foreign income and gains that arose before 6 April 2025 under the Temporary Repatriation Facility and pay the charge at 12% for 2025/26 and 2026/27 and 15% for 2027/28. The designation mechanics are covered in the article on the TRF, and the wider picture in the overview of the 2025 non-dom reform and the article on the remittance basis after 2025. The practical point for the CRS: HMRC has been receiving data on a former non-dom's foreign accounts for years, and the position «nothing brought in, nothing owed» no longer works after 2025.

Three client scenarios

A UK resident with accounts abroad

This is the main target of the inbound flow. Accounts in Switzerland, Singapore, Hong Kong, the UAE or Cyprus reach HMRC through the CRS if the client declared UK residence or if the bank found UK indicia: an address, a phone number, a standing order to a UK account. A founder with brokerage accounts in Switzerland and Singapore will appear in CRS data with income even if nothing is brought to the UK.

Where onboarding usually breaks: the client names one residence to the bank while the Statutory Residence Test points to another. A bank that sees UK indicia will ask for an explanation or a certificate of residence and, without them, may report on the indicia. What will be asked for: a self-certification listing every residence with TINs, documents for both states in a dual-residence case, and evidence of source of funds for larger accounts.

A foreign national with a UK bank account

A UK bank reports on such a customer only if their jurisdiction is on the list of reportable jurisdictions, of which there are more than 90. The list for 2026 returns includes Switzerland, Singapore, Hong Kong, Cyprus and most EU states. The UAE and Russia are not on it, although both appear among participating jurisdictions: a UK bank collects a self-certification from a UAE resident but does not report the account to the UAE. The return flow still runs: UAE banks send HMRC data on UK residents.

US citizens and residents are a separate story. Under FATCA a UK bank passes their data to the IRS through HMRC, so an American in London will always be asked for a TIN, and some banks decline such customers. How this works is covered in the articles on banking for US citizens abroad and on US person status. Account opening for non-residents is covered in the article on a UK bank account for non-residents.

A UK company or trust

There are two roles here, and they are often confused. If the company or trust is itself a financial institution (for example, a trust whose assets are managed by an FCA-authorised manager), it must register with HMRC and report on its equity interest holders: for a trust these are the settlor, the beneficiaries and any other person exercising ultimate effective control. If it is a Passive NFE, the bank holding the account reports, and the structure's controlling persons appear in the return — for a trust, the settlor, trustees, protector and beneficiaries.

A family trust with a corporate trustee can generate CRS reporting on its controlling persons. The result is the same either way: a structure that looks private on an ownership chart still shows a named UK-resident individual in HMRC's data. For the licensed institution the most frequent failure here is misclassification: a trust that believes itself passive turns out to be an investment entity and misses registration, which now carries a penalty of up to £1,000 plus daily amounts.

The consistency test

The analysis of a client's position runs through five questions:

1. Is the institution or structure a financial institution?
2. If not, is it active or passive under the 50% income test?
3. Who are the controlling persons, and what are their roles?
4. Which residence self-certification was given to each bank, and do they agree?
5. Does the data received by HMRC match Self Assessment, including FIG and TRF claims?

A file that passes this test is built before the return is filed. Every account, structure and insurance wrapper is mapped to its holder, beneficial owner and controlling person. Each self-certification is kept on file, and a single residence and ownership map explains every classification. Foreign income and balances are reconciled to the tax return. Related topics are UK family office records and the banks' AML/KYC requirements for private clients.