Get in touch
Sources last verified: 17 October 2026
Official sources cited at the end of this page.
One new paragraph of the OECD’s amended Commentary carries the main change to the TIN rules for CRS 2.0, and it cuts both ways. The standard does not require a financial institution to confirm a TIN’s format and other specifications against the information the OECD publishes. It does say that a self-certification with no TIN, where that information shows the jurisdiction issues TINs to all its tax residents, gives the institution reason to know the self-certification is unreliable or incorrect. TIN validation at scale is how an institution keeps both halves of that rule under control across thousands of accounts.
The gap sits in the space between the two halves. A blank TIN is easy to catch. A TIN that is present, well formed and wrong is not: it passes every format rule and reaches the receiving tax authority with a number that may not lead to the right taxpayer. The amended report now also states, for every reportable account holder and every controlling person who is a reportable person, whether a valid self-certification was provided.
In the United Kingdom the cost has a number: failing to obtain a valid self-certification carries a penalty of up to £300 for each account holder or controlling person. In the EU, Member States must have effective enforcement provisions and set their own penalties.
There are two ways to meet the TIN rules. The first collects the number on the form and tests it later, in a remediation file that grows with the book. The second tests it while the customer is still opening the account, so a blank, malformed or implausible TIN is cured in the same session. One checks the report; the other checks the customer while there is still someone to ask.
The new rules come from the OECD’s 2023 update of the Common Reporting Standard, published in a consolidated text on 8 June 2023, required in the EU by DAC8 from 1 January 2026 and applied in the UK from the same date.
01 · CRS 2.0 TIN rules at a glance
| Point | Position as at 17 October 2026 |
| TIN in the self-certification | For an individual: one TIN for each reportable jurisdiction of residence, with name, residence address, jurisdictions of tax residence and date of birth |
| Blank TIN | Reason to know the self-certification is unreliable or incorrect, where OECD information shows the jurisdiction issues TINs to all residents |
| Exceptions | No TIN is required if the jurisdiction does not issue one, or its domestic law does not require it to be collected |
| Format check | Not required by the standard; institutions may choose to check, including through national TIN check modules |
| Pre-existing accounts | Reasonable efforts to obtain the TIN by the end of the second calendar year after the account is identified as reportable |
| Government Verification Service | Optional, offered by a jurisdiction; its reference is treated as equivalent to a TIN |
| OECD TIN data | The AEOI portal summarises each listed jurisdiction’s rules on issuing, structuring and using TINs |
| EU tooling | The Commission’s TIN on the Web checks syntax only, for natural persons; Member States endeavour to offer electronic confirmation from 1 January 2028 |
| What the report shows | Each TIN, and whether a valid self-certification was provided for the reportable holder and each reportable controlling person |
| Penalties | UK: up to £300 per account holder or controlling person where the institution fails to obtain a valid self-certification; EU: set nationally |
Our regulatory compliance engine clears every new account for CRS 2.0 on Day 1, TIN included. It collects the self-certification, runs the reasonableness test and the other due diligence, checks each TIN against official sources where they exist, resolves indicia automatically instead of by your team, and prepares the validated CRS report, with zero remediation, as section 06 shows.
02 · What Is CRS 2.0? The Updated Global Tax Transparency Framework
The Common Reporting Standard is the OECD’s model for exchanging financial account information between tax authorities; as at 30 September 2026 the OECD lists 131 jurisdictions committed to it. CRS 2.0 is the 2023 update, approved by the OECD Committee on Fiscal Affairs on 26 August 2022. It expands reporting to specified e-money products and central bank digital currencies, excludes e-money accounts whose rolling 90-day average balance did not exceed USD 10,000 at any day during the calendar year, catches crypto derivatives held in custody and funds investing in crypto-assets, and adds data points on roles, self-certification, account status and joint accounts. Transactions in crypto-assets themselves are reported by crypto-asset service providers under the separate Crypto-Asset Reporting Framework; in the EU both arrive through DAC8.
03 · Who Needs CRS 2.0 Compliance? Your Scope of Responsibility
Every Reporting Financial Institution in a participating jurisdiction: depository and custodial institutions, investment entities and specified insurance companies, now including institutions that hold specified e-money products or central bank digital currencies for customers. The TIN rules apply to every reportable account they keep, new or pre-existing, and to every controlling person of a passive entity who is a reportable person. Each jurisdiction sets its own start date: DAC8 requires the EU to apply from 1 January 2026, and the UK applies from the same date.
04 · The Role of Tax ID (TIN) Validation in CRS 2.0 Reporting Accuracy
Three different checks travel under the name TIN validation, and they prove different things. A format check tests length, characters and, where one exists, a checksum: it proves the number could exist. An existence check asks the issuing authority whether the number is live. A match checks that the number belongs to the person or entity named. Only the last two touch the receiving authority’s problem: a record it may not be able to attribute to a taxpayer.
The OECD’s and the Commission’s public tools stop at the first. The OECD’s AEOI portal summarises each listed jurisdiction’s rules on issuing, structuring and using TINs, which is what a format check is built from. In the EU, the Commission’s TIN on the Web confirms only the syntax or structure of a number, for natural persons, and does not confirm the person’s identity or that the TIN exists. A jurisdiction may also offer a Government Verification Service, whose reference the amended Commentary treats as equivalent to a TIN; it is optional.
At scale, the role of TIN validation in ensuring CRS reporting accuracy is triage. Blank TINs, where OECD information shows the jurisdiction issues TINs to all residents, give reason to know the self-certification is unreliable or incorrect, and are caught at once. Malformed TINs are caught by format. Well-formed numbers are checked against the issuing authority wherever that is possible, so the remaining uncertainty is concentrated in jurisdictions with no official check. Our TIN lookup checks numbers in real time against official sources in 130+ countries, with format validation across 210+.
For accounts already on the book, the standard asks for reasonable efforts to obtain a missing TIN by the end of the second calendar year after the account is identified as reportable, and the Commentary reads reasonable efforts as genuine attempts, at least once a year.
05 · Why CRS 2.0 Compliance Matters: Penalties and What the Report Shows
Penalties are national. In the EU, Annex I to the Directive on administrative cooperation requires effective enforcement provisions and leaves the amounts to each state. The United Kingdom’s 2025 amendment regulations, in force since 16 July 2025, set a penalty of up to £300 for each account holder or controlling person where an institution fails to obtain a valid self-certification.
The report itself changed too. Under the amended Section I it carries, for each reportable person, whether a valid self-certification was provided, the role of each controlling person, whether the account is new or pre-existing and whether it is joint. A blank TIN now sits in the file beside the institution’s own statement on whether the self-certification was valid, where the tax authority can see both.
06 · Two Ways to Meet the CRS 2.0 TIN Rules
By hand, after onboarding
An institution can collect the TIN on the self-certification form and test it in a periodic review: a format script over the book, an exceptions list, letters to customers. It works for a small book. It does not scale, because every failure found after onboarding needs the customer to answer again, and under CRS 2.0 the report states, for each reportable person, whether a valid self-certification was provided.
At onboarding, from Day 1
TaxDo runs CRS 2.0 due diligence inside onboarding, in five steps.
Step 1 · Collect the self-certification. Guided and jurisdiction-aware, with a digital signature; a passive entity’s controlling persons and roles in the same flow.
Step 2 · Validate the identity. Every TIN checked in real time against official sources in 130+ countries, and the business against registries in 120+.
Step 3 · Run forensic due diligence with Verify+. Our Verify+ forensic engine runs 20+ checks on an individual and 30+ tax-native checks across eight areas on an entity, including official TIN lookup in 130+ countries.
Step 4 · Cure the gaps, without the compliance team:
4a · New accounts. Reasonableness tested and a blank, malformed or implausible TIN resolved in the same session.
4b · Existing accounts. One click starts a remediation campaign for the cohort, with guided questions through a link in your brand and every answer checked by Verify+. Each case closes with a signed self-certification and an audit-ready certificate.
Step 5 · Report, and keep the evidence. Schema-validated CRS XML, prepared and validated for your institution to submit. On request, our team can also submit it on your behalf as an additional service.
From Day-1 self-certification to CRS XML reporting, with zero remediation.
Our CRS 2.0 compliance software · Solutions for financial institutions
Where this sits, and what it does not touch
It runs beside your KYC provider and core systems, not in place of them. The reporting obligation, and the responsibility for what is reported, stays with your institution, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.
07 · Which Providers Offer CRS 2.0 Tax ID Validation: What to Test
What the Features Must Prove Under CRS 2.0
A buyer evaluating platforms for CRS, crypto included, should ask for evidence on five points, tested on its own data. Coverage, with official-source checks counted separately from format checks, because a vendor quoting one number for both is comparing two different things. Timing: whether the check runs inside onboarding or only over the book afterwards. Scope: individuals, entities and every controlling person, with roles. Evidence: a record per account of what was checked, against what, and when. Output: a schema 3.0 file validated before submission.
Real-World Impact: A Worked Example
Take a fictional private bank in Luxembourg that opens 2,000 accounts a year for clients resident in 30 jurisdictions, and suppose its year-end review finds 40 self-certifications with no TIN from jurisdictions that issue TINs to all residents, 25 TINs that fail the format rules and 60 that pass format in jurisdictions with no official check. The first 40 are self-certifications the bank had reason to know were unreliable from the day they arrived; the next 25 are certain errors; only the last 60 are real uncertainty. Checked at onboarding, the first two groups never reach the book, and the review shrinks to the third.
08 · Recent Changes and What Comes Next
8 June 2023
The OECD publishes the amended CRS and Commentary, including the blank-TIN rule.
2 October 2024
CRS XML Schema version 3.0 and its User Guide released.
1 January 2026
The amended CRS applies in the UK, and DAC8 requires EU Member States to apply it from this date; new accounts must meet the new self-certification and data requirements.
2027
First reports under the amended standard in the EU and the UK, covering 2026.
1 January 2028
EU Member States apply the duty DAC8 adds to the Directive: to endeavour to let reporting entities confirm TINs electronically.
09 · Related Reading
Framework articles: CRS 2.0 compliance for financial institutions · CARF and crypto tax transparency · DAC8 compliance · Self-certification under CRS 2.0, DAC8 and CARF
Product: Regulatory compliance engine · Day 1 onboarding validation · Business registry check · CRS 2.0 compliance software
