CRS 2.0 Compliance for Financial Institutions: Step-by-Step Strategies for Banks, From Day 1

Sources last verified: 13 October 2026

Official sources cited at the end of this page.

Our regulatory compliance engine clears every new bank customer for CRS 2.0 on Day 1. It collects each self-certification with controlling persons and roles, runs the TIN check, the reasonableness test and the other due diligence, resolves indicia automatically instead of by your team, and prepares the validated CRS XML report, with zero remediation, as section 09 shows.

131 jurisdictions are committed to exchanging financial account information under the Common Reporting Standard, and in the European Union and the United Kingdom the standard they apply changed on 1 January 2026. CRS 2.0 is the market’s name for that change: the OECD’s 2023 amendment, which brings e-money and central bank digital currencies into scope, adds new data points to every report and tightens how a self-certification is tested. In the EU and the UK the first reports under it are due in 2027. In the EU it arrives through DAC8, alongside the OECD’s Crypto-Asset Reporting Framework for crypto-assets held directly.

One change in the Commentary moves a familiar problem forward. When a new customer resident in a jurisdiction that issues tax identification numbers to all residents signs a self-certification with the TIN left blank, the institution now has “reason to know” that the self-certification is unreliable. It cannot be relied on. The account was mis-documented on the day it was opened, not on the day someone noticed.

The cost lands later, in the data. Every amended CRS report carries a field saying whether a valid self-certification was obtained, so a gap is no longer buried in a file; it travels to the tax authority with the account. In the United Kingdom, failing to obtain a valid self-certification now carries a penalty of up to £300 for each account holder or controlling person.

There are two ways to meet CRS 2.0. The first is the one most institutions run today: collect forms at onboarding, then test, chase and remediate before the reporting deadline. The second moves that work to the moment the account is opened, so the self-certification is complete, tested against what the institution already knows and cured before the customer leaves the session. Both are set out below, step by step. The difference is whether a gap is closed by the customer’s next answer or found by the tax authority’s first question.

01 · CRS 2.0 at a glance

02 · What Is the Common Reporting Standard (CRS) and Why CRS 2.0 Matters

The Common Reporting Standard is the OECD’s model for the automatic exchange of financial account information between tax authorities. A financial institution identifies which of its account holders are tax resident elsewhere, reports their accounts to its own tax authority once a year, and that authority passes the information to the jurisdictions of residence. As at 30 September 2026 the OECD lists 131 jurisdictions committed to exchange under it. The United States is not among them: it exchanges under FATCA and its intergovernmental agreements instead.

The 2023 update brings certain e-money products and central bank digital currencies into scope, and amends the Financial Asset and Investment Entity definitions to ensure crypto derivatives held in custody and investment entities investing in crypto-assets are covered. It does six things that matter to a bank:

1. Widens scope. E-money and central bank digital currencies held for customers make the holder a Depository Institution; crypto derivatives in custody and investment entities investing in crypto-assets are caught through amended definitions.
2. Adds targeted exclusions. Small e-money accounts, capital contribution accounts for up to 12 months, and, where a jurisdiction opts in, confirmed non-profit entities.
3. Expands the report. New data points on roles, self-certification, account status, joint holders and account type, set out in section 04.
4. Tightens reliance. Where an institution relies on its AML/KYC procedures to identify Controlling Persons, those procedures must be consistent with the 2012 FATF Recommendations.
5. Ends the tiebreaker shortcut. For self-certification purposes, relying on treaty tiebreaker rules to pick a single jurisdiction of residence is no longer permitted on a prospective basis. Dual residents declare every residence.
6. Moves guidance into the Commentary. The 2018 guidance on residence and citizenship by investment schemes is now part of the “reason to know” standard.

Crypto-assets held directly are a separate regime: CARF covers exchanges and transfers of crypto-assets, and CRS 2.0 covers the indirect exposure and the e-money and CBDC accounts. In the EU both arrive through DAC8. Our DAC8 article sets out how the two meet.

03 · Are you in scope? A five-question check

04 · Key CRS 2.0 Requirements for Reporting Financial Institutions

A Reporting Financial Institution still identifies Reportable Accounts through due diligence and reports them once a year. What changed is the content of the report, set out in the amended Section I:

Two practical points follow. First, an account with nothing in it is still an account: HMRC’s manual states that a reportable account “must be reported even where the balance or value of the account is zero or negative”, and that a nil or negative balance, an overdrawn account for example, is reported as nil. Second, a role never captured at onboarding cannot be reported without going back to the customer.

05 · Step-by-Step Compliance Actions for Banks Under CRS 2.0

Due diligence still turns on two questions: is the account held by an individual or an entity, and is it new or pre-existing.

A. Handling New Individual Accounts (Section IV)

1. Obtain the self-certification at account opening. It may be given in any manner and any form, including electronically, provided it is signed or otherwise positively affirmed and can be produced in hard copy on request. The amended Commentary expects that affirmation to be captured so the institution can credibly show it happened, for example a voice recording or a digital footprint.
2. Check that it is complete. Name, residence address, every jurisdiction of tax residence, a TIN for each Reportable Jurisdiction, and date of birth. The form may be pre-populated, except for the jurisdictions of residence, which the customer must declare.
3. Test it for reasonableness. Confirm it against the information obtained when the account was opened, including the AML/KYC documentation. The standard is objective: an institution cannot rely on a self-certification it knows, or has reason to know, is incorrect or unreliable, meaning one that would make a reasonably prudent person in its position question the claim.
4. Screen for residence by investment. Where a customer claims residence under a scheme the OECD identifies as potentially high-risk, the Commentary sets out follow-up questions for the institution, including whether the customer spent more than 90 days in any other jurisdiction in the previous year.
5. Treat a missing self-certification as an exception, not a route. Where one cannot be obtained in time, the institution applies the pre-existing account procedures until it is obtained and validated, within 90 calendar days.

B. Managing Preexisting Individual Accounts (Section III)

Pre-existing accounts are reviewed rather than re-papered, with enhanced review for High Value Accounts above USD 1,000,000 at 31 December. Where a TIN or date of birth is missing from the records of a pre-existing account, the institution must make reasonable efforts to obtain it by the end of the second calendar year following the year in which the account was identified as reportable. The Commentary defines reasonable efforts as genuine attempts at least once a year.

One burden is eased. For accounts already open before the amended rules took effect, the new role information for controlling persons and equity interest holders need only be reported, for reporting periods ending by the second calendar year after that date, if it is available in electronically searchable data. In the EU the reference date is 31 December 2025. The relief is temporary.

C. Entity Accounts: Preexisting and New (Sections V-VI)

Unless the institution elects otherwise, a pre-existing entity account with an aggregate balance or value of USD 250,000 or less at 31 December need not be reviewed until it crosses that threshold. Above it, and for every new entity account, the institution determines whether the entity is itself a Reportable Person and whether it is a Passive NFE whose controlling persons are reportable.

Two CRS 2.0 changes bite here. The report must now state the role of each controlling person, which depends on the legal form: settlor, trustee, protector or beneficiary of a trust, or the person exercising control of a company. And where the institution relies on its AML/KYC procedures to identify those persons, the procedures must be consistent with the 2012 FATF Recommendations. Entity classification, the controlling person look-through and the role assignment are one continuous piece of work, easier done once at onboarding, with the entity checked against its business registry, than reconstructed for a report.

A fund that is a legal arrangement must now report the role by which each reportable person holds an equity interest, and a fund investing in crypto-assets can now fall within the Investment Entity definition. A compliant CRS 2.0 solution for an investment fund applies the same self-certification, reasonableness and TIN rules to investors, and reports the roles.

D. E-money, CBDC and Digital Asset Users

In the EU and the UK, accounts holding e-money products or central bank digital currencies for customers became Depository Accounts from 1 January 2026, unless the USD 10,000 exclusion applies. Other crypto-assets held directly are reported under CARF, not as Depository Accounts. CRS 2.0 expands reporting obligations for digital assets through e-money and CBDC accounts, crypto derivatives in custody and investment entities investing in crypto-assets. The impact on a financial institution managing cross-border crypto accounts is that one customer may need to be documented under both CRS 2.0 and CARF, ideally with one self-certification. Onboarding workflows for digital asset users therefore need the same self-certification and reasonableness steps as a current account. For e-money and payment institutions, see our fintech and neo-bank solutions page; for exchanges, the crypto exchanges and CASPs page; for both tracks in the EU, our DAC8 compliance software.

E. Where the amended CRS applies, and our jurisdiction articles

Start dates are national. Those below were checked at the national authority or in EU law on 12, 13 and 17 October 2026.

06 · The Critical Role of TIN Validation in CRS 2.0 Compliance

TIN validation is not mandatory under the amended Commentary. It says the standard “does not require a Reporting Financial Institution to confirm the format and other specifications of a TIN” against the information the OECD publishes, and that institutions “may nevertheless wish to do so”, including through national websites with a TIN check module. A claim that CRS 2.0 mandates TIN validation against official databases misreads the amended Commentary.

What the Commentary does make firm is narrower, and in practice sharper. A self-certification that contains no TIN, from a customer resident in a jurisdiction that issues TINs to all tax residents, gives the institution reason to know it is unreliable. The exceptions remain where they were: no TIN is required if the jurisdiction does not issue one, or if its domestic law does not require it to be collected. In the EU, from 1 January 2028, DAC8 requires Member States to endeavour to let reporting entities confirm TINs electronically; that is a duty on governments, not on the institution.

Institutions validate anyway because a well-formed number proves nothing: a TIN can pass every format rule and still belong to nobody, or to somebody else.

Checking a number against the issuing authority is the only way to confirm it is live. Our TIN lookup does this in real time against official sources in 130+ countries, with format validation across 210+.

07 · Penalties, Enforcement and What Gets Seen

Penalties are set nationally. In the EU, Annex I to the Directive on administrative cooperation requires “effective enforcement provisions to address non-compliance” with the CRS procedures and leaves the penalties to each state. The UK has put a number on the self-certification duty: The International Tax Compliance (Amendment) Regulations 2025 provide for a penalty not exceeding £300 for each account holder or controlling person where an institution fails to obtain a valid self-certification. The regulations came into force on 16 July 2025, ahead of the 1 January 2026 start of the updated CRS in the UK.

The amended report also changes what gets seen. It now states whether a valid self-certification was obtained, for the account holder and for each controlling person, so a pattern of gaps is visible in the data itself. The OECD Commentary expects records to be kept for not less than five years after the end of the period within which the institution must report, DAC8 writes a five-year minimum into EU law, and national law may require longer.

08 · Common Challenges and Best Practices for CRS 2.0 Readiness

Multi-jurisdiction groups carry a particular problem. The XML schema is common, version 3.0, but start dates, penalties, portals and transitional arrangements are national. The systems required to support multi-jurisdiction tax reporting under CRS 2.0 keep one record of the customer and produce each jurisdiction’s report from it. Firms running one process per country should modernize legacy systems to meet evolving CRS 2.0 compliance requirements once, before the relief on roles ends.

Five practices separate institutions that will file cleanly from those that will remediate:

1. Capture, do not reconstruct. Collect roles, residences and TINs at onboarding, in structured fields.
2. Test reasonableness when the form arrives. Compare the declaration with the KYC record while the customer is still present.
3. Validate TINs against the issuing source where you can. It is optional under the standard. It is also the only check that tells you a number exists.
4. Keep the evidence with the decision. For each account: what was collected, how it was tested, what was cured.
5. Plan the pre-existing book now. The role relief runs out; work the accounts most likely to be reportable first.

09 · Secure CRS 2.0 Compliance Today: The Two Ways to Do It

By hand, at year-end

Most institutions meet CRS today with forms and follow-up. The customer completes a self-certification at onboarding; operations teams check it against the KYC file, log the gaps and write to the customer; the report is assembled at year-end from whatever has been cured.

For a small book, this works. Its weakness is timing: every gap found after onboarding needs the customer to answer again, and under CRS 2.0 every gap not closed appears in the report as a self-certification that was not obtained.

At onboarding, from Day 1

TaxDo runs CRS 2.0 due diligence inside onboarding, from the first self-certification to the CRS XML report, on one platform. It works in five steps, in this order, because each one needs the one before it.

Step 1 · Collect the self-certification. Guided and jurisdiction-aware, one question at a time, for individuals and entities, with a digital signature. Where the entity is passive, its controlling persons are collected in the same flow.

Step 2 · Validate the identity. Every TIN is checked in real time against official sources in 130+ countries, and the business against registries in 120+.

Step 3 · Run the due diligence. Indicia are detected across everything held on the account, and the self-certification is tested for reasonableness against it. For CRS 2.0 that includes the residence-by-investment questions, entity classification, the controlling person roles the new report requires and the new account flags.

Step 4 · Cure the gaps, without the compliance team:

4a · New accounts. Discrepancies are resolved in the same session, while the customer is still onboarding, instead of landing in a queue for your team.

4b · Existing accounts. The book is scanned and prioritised, and missing TINs, expired self-certifications and unresolved indicia are remediated.

Step 5 · Report, and keep the evidence. Schema-validated CRS XML (schema v3.0) for each jurisdiction from one data layer, prepared and validated for your institution to submit. On request, our team can also submit it on your behalf as an additional service. Every account holder keeps an immutable clearance record.

From Day-1 self-certification to CRS XML reporting, with zero remediation. Every account holder is cleared when the account opens, so nothing is left for year-end.

Our CRS 2.0 compliance software · Solutions for financial institutions

Where this sits, and what it does not touch

Your KYC provider keeps verifying identity, and your core banking platform keeps holding the account. KYC answers who the customer is; tax due diligence answers where they are resident for tax, and whether that declaration holds up. This runs beside KYC, not in place of it.

The reporting obligation, and the responsibility for what is reported, stays with your institution, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.

The difference is when the gap is found. At onboarding, it is one question to the customer. At year-end, it is a remediation campaign, a reminder log and a report that says the self-certification was never obtained.

10 · Recent Changes and What Comes Next

17 October 2023

The EU adopts Council Directive (EU) 2023/2226 (DAC8), published in the Official Journal on 24 October 2023, carrying the CRS amendments and CARF into EU law.

2 October 2024

Release of the amended CRS XML Schema (version 3.0) and its User Guide (version 4.0).

16 July 2025

The UK’s International Tax Compliance (Amendment) Regulations 2025 come into force, including the £300 penalty per account holder or controlling person.

1 January 2026

Application in the EU and the UK begins. New accounts must meet the new self-certification and data requirements from this date.

2027

First reports under the amended standard in the EU and the UK, covering 2026; first exchanges between tax authorities are expected from this year.

11 · Related Reading

Framework articles: CARF and crypto tax transparency · DAC8 compliance · Self-certification under CRS 2.0, DAC8 and CARF

Product: Regulatory compliance engine · Day 1 onboarding validation · CRS 2.0 compliance software