CRS 2.0 in South Africa: Strengthening Cross Border Transparency Ahead of 2026–2027 Reporting

Sources last verified: 28 October 2026

Official sources cited at the end of this page.

A customer opens an investment account in Johannesburg and leaves the tax-residence section of the form for later. Under South Africa’s amended Common Reporting Standard, in force since 1 March 2026, that is no longer an option for most institutions: the self-certification must be obtained on day one of account opening, and an institution that cannot obtain a valid one, with no exception available, must not complete the opening. This is the country’s version of CRS 2.0, set out in Government Notice R. 6886 of 28 November 2025.

A narrow exception, the Day Two Process, allows up to 90 days, and where the form still has not arrived or fails the reasonableness test by then, the institution must suspend transactions on the account (Section X(B)(1)). The first return under the amended rules covers 1 March 2026 to 28 February 2027 and is due to the South African Revenue Service (SARS) by 31 May 2027.

The gap shows up twice: as an account frozen while the customer is still active, and as a return that tells SARS, field by field, which accounts carry no valid self-certification.

There are two ways to meet the new rules. One relies on the back office to chase forms inside the 90-day window. The other completes and tests the form while the customer is still in the onboarding session. The first manages suspensions; the second rarely has any to manage.

01 · South Africa CRS 2.0 at a Glance

Our regulatory compliance engine clears South African accounts for CRS 2.0 on day one. It collects and checks each self-certification, runs the TIN, reasonableness and other required due diligence checks, resolves indicia automatically instead of by your compliance team, and prepares the validated return, with zero remediation.

02 · Scope and Applicability

The Regulations apply the OECD’s 2023 update to the CRS, published with the Crypto-Asset Reporting Framework on 8 June 2023, through South African law. They replace the 2020 and 2023 regulations and work through the TAA: returns are filed under a public notice issued under section 26 (Section I(F)) (GN R. 6886).

03 · Customer Due Diligence and Verification

Day one, and the two exceptions

For new individual and entity accounts, the self-certification must be obtained on day one of account opening, form part of the opening documentation, and be checked for reasonableness against what the institution already holds, including its AML/KYC documentation (Sections IV(A) and VI(A)(1)(a)). The Day Two Process allows 90 days in two cases only: where the form is taken at opening but validation is a back-office step, or, exceptionally, where the specificities of the business make collection at opening impossible (Section VIII(E)(11)). SARS’s FAQs add that, under the general rule, institutions should not materially progress the opening without it.

When the form does not arrive

Section X(B) is the enforcement rule. Without a valid self-certification the institution must not complete the opening where Day Two does not apply; must suspend transactions where it does and 90 days pass; and must report the account under the temporary-lack rule in Section VII(A bis) for every period the form stays outstanding. Closure is allowed, not required, where the account presents a risk of being used to evade tax. SARS’s FAQs call suspension “the minimum mandatory response” and closure a risk-based last resort.

Controlling persons and changes

For a new entity account, the institution determines whether the holder is a Passive NFE with reportable controlling persons. Status rests on the holder’s self-certification unless information the institution holds or that is public lets it reasonably determine the holder is an Active NFE or a Financial Institution (Section VI(A)(2)(a)); controlling persons can be identified from AML/KYC records (VI(A)(2)(b)); whether a controlling person is reportable may rest only on a self-certification (IX(B)). An institution may not rely on a self-certification it knows or has reason to know is wrong, and a change in circumstances can give it that reason (Sections VII(A) and IX(A)).

04 · Transaction Capture and Reporting

The amended return carries more about each account than before. Besides name, address, residence, TIN and date of birth, each record states whether the holder provided a valid self-certification, whether the account is joint and with how many holders, whether it is pre-existing or new, its account type, and the role by which each controlling person controls the entity (Section I(A)). Place of birth is reported only where domestic law requires it and the data is electronically searchable (Section I(E)).

One transitional rule softens the start: for accounts held on 28 February 2026, controlling-person and equity-holder roles are needed only where electronically searchable, for reporting periods ending by the second period after that date (Section XII(B)). A permanent rule avoids double reporting: gross proceeds already reported under the CARF need not be reported again under the CRS unless the institution elects otherwise for a clearly identified group of accounts (Section I(G)).

05 · CRS XML Schema Requirements

SARS’s final Business Requirement Specification, version 3.0.0-17 of 16 February 2026, aligns the return to the OECD’s amended CRS XML Schema and adds fields for the self-certification flag, account type, due diligence procedure, joint accounts and controlling-person type. One date has caught out readers of SARS’s notices: the “CRS 2.0” that SARS discontinued on 18 September 2026 is the old file version, not the amended standard. Since that date SARS accepts only CRS 3.0 submissions, after a trade-testing window from 1 to 18 September 2026.

Files go through Connect:Direct (no size limit) or the Secured File Gateway for files under 10 MB; eFiling takes nil returns only, on form FTI-01. A submission is complete only once the FTI-02 declaration is filed on eFiling.

06 · Operational and Compliance Requirements

A Cape Town e-money issuer

Take a fictional e-money issuer in Cape Town holding wallets for 60,000 customers. Under the old rules its wallets sat outside the CRS; from 1 March 2026 each customer’s e-money holdings form one Depository Account, in scope unless the rolling 90-day average balance stays within USD 10,000 (Section VIII(C)(17)(e bis)) and reported where the holder is a Reportable Person, so the issuer reports as a Depository Institution. Existing wallets go through pre-existing account procedures; every wallet opened since 1 March needs a day-one self-certification or a documented Day Two case, and the first return covers activity to 28 February 2027.

A Durban asset manager

An asset manager opening accounts through intermediaries may validate self-certifications in the back office under Day Two, but the 90 days run from the opening date. If 300 accounts are opened in a month, 300 clocks start, and any form still missing or unreasonable at day 90 means suspended transactions on that account (Section X(B)(1)(b)).

Enforcement

The Regulations carry no penalty schedule of their own. They treat an account holder’s or controlling person’s failure to give the institution what it needs as non-compliance under section 26(4) of the TAA (Section X(A)(2)), add a main-purpose anti-avoidance rule (Section X(A)(1)), and leave sanctions to the Act; SARS describes the consequences of non-compliance as administrative and criminal. Its AEOI penalty page applies fixed-amount administrative penalties under Chapter 15 of the TAA to the CRS failures listed in Public Notice 193, using the table in section 211(1): from R250 to R16,000 per incidence, by taxable income or assessed loss, rising by the same amount each month for up to 36 months while the failure continues. Criminal proceedings may be brought under section 234.

07 · International Coordination and Policy Context

South Africa signed the Addendum to the CRS Multilateral Competent Authority Agreement, which gives effect to the revised CRS, on 26 November 2024; the OECD listed 87 Addendum signatories on 30 October 2026. SARS refused requests to defer the start to 1 March 2027, noting that it has committed to exchange information in 2027. The country starts two months after the EU, where DAC8 has applied the corresponding amendments since 1 January 2026; a group with EU entities runs both calendars (our DAC8 compliance software covers the EU side).

The crypto side runs in parallel under separate CARF regulations with the same 1 March 2026 start; our South Africa CARF article covers them.

08 · Two Ways to Meet South Africa’s CRS 2.0

Back office within 90 days

An institution can take a basic form at opening and validate it later under Day Two, tracking each 90-day clock and suspending accounts that run out. It works where volumes are low and the Day Two conditions are met. The cost is the suspensions themselves, and the record of each one SARS expects to see.

Inside onboarding, step by step

TaxDo runs CRS 2.0 due diligence inside onboarding, from the first self-certification to the CRS XML report, in five steps.

Step 1 · Collect the self-certification. Guided, one question at a time, for individuals and entities, with a digital signature; a Passive NFE’s controlling persons are collected in the same flow.

Step 2 · Validate the identity. Every TIN is checked in real time against official sources in 130+ countries, and the business against registries in 120+.

Step 3 · Run forensic due diligence with Verify+. Our Verify+ forensic engine runs 20+ checks on an individual and 30+ tax-native checks across eight areas on an entity, testing each self-certification against what the institution holds, with entity classification and controlling-person roles set for the return.

Step 4 · Cure the gaps, without the compliance team:

4a · New accounts. Discrepancies are resolved in the same session, on day one.

4b · Existing accounts. One click starts remediation for the whole cohort through a link in your own brand, with every answer checked by Verify+ and each case closed by a signed self-certification and an audit-ready certificate.

Step 5 · Report, and keep the evidence. Schema-validated CRS XML from one data layer, prepared and validated for your institution to submit. Our team can also submit it on your behalf on request, as an additional service. Every account holder keeps an immutable clearance record.

From Day-1 self-certification to CRS XML reporting, with zero remediation. Every account holder is cleared when the account opens.

Our CRS compliance software · Financial institutions

Where this sits, and what it does not touch

It runs beside the KYC process anti-money-laundering law already requires, not in place of it. The reporting obligation, and the responsibility for what is reported, stays with your institution, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.

09 · Implementation Timeline

26 November 2024

South Africa signs the Addendum to the CRS MCAA.

28 November 2025

Final Regulations published (GN R. 6886).

16 February 2026

Final BRS 3.0.0-17 for CRS and FATCA.

1 March 2026

The amended CRS applies; day-one self-certification for new accounts.

5 March 2026

SARS publishes its CRS FAQs, refusing a one-year deferral.

18 September 2026

SARS accepts only CRS 3.0 files.

28 February 2027

The first amended reporting period ends.

31 May 2027

First return under the amended rules, followed by exchange with partner jurisdictions in 2027.

10 · Related Reading

Framework articles: CRS 2.0 compliance guide for banks · Self-certification under CRS 2.0, DAC8 and CARF · CARF in South Africa

Product: Regulatory compliance engine · Day 1 onboarding validation