Get in touch
Sources last verified: 21 October 2026
Official sources cited at the end of this page.
Since 1 January 2026 the UK’s International Tax Compliance Regulations 2015 have applied the Common Reporting Standard “as amended by the 2023 update”. The change came through SI 2025/740, made on 24 June 2025, which also requires every reporting financial institution to register with HMRC and replaced the penalty regime. The first return under the amended rules, for 2026, is due by 31 May 2027. Our CRS 2.0 guide for financial institutions sets out the standard itself.
The amendments widen the net: e-money institutions and certain e-money products come into scope and most charities leave it, and the return carries more data on each account. HMRC’s policy paper of 25 June 2025 puts the number of affected institutions and trusts at about 6,000, some 300 of them newly in scope.
The failure point is the self-certification. Regulation 22A now sets a penalty of up to £300 for each account holder or controlling person for whom an institution fails to obtain a valid self-certification the CRS requires, three times the penalty for other due diligence failures.
There are two ways to meet the amended UK rules. The first collects forms at onboarding, then chases and remediates before 31 May. The second completes and tests the self-certification while the customer is still onboarding, so the return is built from data that was clean on Day 1. One finds the gap in May; the other closes it the day the account opens.
01 · UK CRS 2.0 at a Glance
| Point | Position as at 21 October 2026 |
| Penalties | Up to £300 per account holder or controlling person without a valid self-certification; £100 for other due diligence failures (reg 22A); £5,000 for a late return, then up to £600 a day after an assessment (reg 22C) |
| Amended CRS applies from | 1 January 2026; first amended return, for 2026, by 31 May 2027 |
| Legal basis | International Tax Compliance Regulations 2015 (SI 2015/878), as amended by SI 2025/740 (in force 16 July 2025) |
| Registration | With HMRC by the later of 31 December 2025 and 31 January after the year an institution first comes within scope (reg 10A) |
| Return | Electronically, by 31 May after the calendar year (reg 6(4)); no nil return in most cases (HMRC) |
| Records | Five years from the end of the year an account was last reported, or last treated as not reportable (reg 3(2A), (2B)) |
| Account holders | Must give the self-certification requested (reg 12GA); up to £300 if they deliberately or carelessly fail to (reg 22H) |
| Exchange | UK signed the Addendum to the CRS multilateral agreement on 26 November 2024; reportable jurisdictions are set by HMRC notice (reg 1(7)) |
| Authority | HM Revenue & Customs (HMRC) |
Our regulatory compliance engine readies UK banks, platforms and funds for the amended CRS from Day 1. It gathers each self-certification at opening, validates the TIN, runs the reasonableness and indicia checks, resolves indicia automatically instead of by your team, and prepares the validated CRS return, with zero remediation, as section 06 shows.
02 · The UK Framework and Institutional Expectations
The CRS is the OECD’s model for exchanging financial account information, and the OECD lists 131 jurisdictions committed to it as at 30 September 2026. Its 2023 update was published with the Crypto-Asset Reporting Framework in a single OECD publication of 8 June 2023. The UK writes it into regulation 1(3)(aa) of the 2015 Regulations, and SI 2025/740 provides that the amended CRS does not apply to reporting for 2025 or earlier years.
The core duty is unchanged. Under regulation 3, an institution must establish and maintain arrangements designed to identify where each account holder and, for passive non-financial entities, each controlling person is resident for tax, and whether an account is reportable, by applying the CRS due diligence procedures. Those procedures are now the amended ones, and around that duty sit registration, a duty on customers to answer, and new penalties.
Crypto-assets held directly are a separate regime. The UK applies the CARF from the same date through SI 2025/744, with the first report due by 31 May 2027, and an institution that reports gross proceeds under the CARF need not repeat them under the CRS unless it elects, by notice under regulation 7A, to report them under both.
03 · Who Needs CRS 2.0 Compliance?
| If you are | Under the amended Regulations |
| A bank or building society | A depository institution: register, carry out due diligence, return reportable accounts by 31 May. |
| An e-money institution | Newly in scope where it holds specified e-money products for customers (amended CRS, Section VIII(A)(5)). |
| A fund or investment manager | Generally an investment entity: register, carry out investor due diligence and return reportable accounts. |
| A trustee-documented trust | A specified non-reporting financial institution that must still register (reg 10A). |
| A charity | Most leave scope as qualified non-profit entities (reg 1(7)). |
| A crypto exchange | Reports crypto-asset transactions under SI 2025/744; the CRS reaches it if it is a custodial or depository institution. |
More on the crypto side in our UK CARF and CRS 2.0 article.
04 · CRS 2.0 in Action
Registration
Every reporting financial institution, and every trustee-documented trust, gives notice to HMRC by the later of 31 December 2025 and 31 January of the year after it first comes within scope (regulation 10A). Missing it costs up to £1,000, then up to £300 a day if the failure continues after notice of that penalty (reg 22F).
Self-certification and due diligence
Account holders and controlling persons must now provide the self-certification an institution requests under the CRS (reg 12GA), and one who deliberately or carelessly fails to can be charged up to £300 (reg 22H). The institution’s own exposure is wider: up to £300 for each holder or controlling person without the valid self-certification the CRS requires (reg 22A(2)). The OECD’s amended Commentary expects a new account’s self-certification at opening or, where that is not possible, obtained and validated within 90 days.
Returns and records
The return is filed electronically by 31 May (reg 6(4)), through HMRC’s Automatic Exchange of Information service. HMRC’s guidance says a nil return is not normally needed, except where an institution is in a nil position only because it applied the USD 50,000 or USD 250,000 thresholds to pre-existing accounts. Records of the steps taken and the information collected are kept for five years (reg 3(2A), (2B)), and an arrangement whose main purpose, or one of whose main purposes, is to avoid an obligation under the Regulations is ignored (regulation 23).
05 · TIN Validation: The Backbone of CRS 2.0
TINs must be collected under the UK rules, not validated: neither the 2015 Regulations nor the OECD’s amended Commentary (Section VII, paragraph 4bis) mandates a format or authenticity check. The Commentary does say that a self-certification without a TIN, where the jurisdiction issues TINs to all residents, gives reason to know it is unreliable. A UK institution reports customers resident in the reportable jurisdictions on HMRC’s published list, so the TIN it collects is the one each customer holds there; a UK resident’s own TIN, for most individuals the National Insurance number (HMRC, IEIM402040), is what an institution abroad collects to report that customer to HMRC.
Validation is still where accuracy is won: a well-formed number can belong to nobody, and once filed it is exchanged abroad. Our TIN lookup tool checks numbers in real time against official sources in 130+ countries, and format across 210+.
Penalties at a glance
| Regulation | Maximum | For |
| 22A(1), (2) | £100, or £300 without a valid self-certification, per holder or controlling person | Due diligence not applied |
| 22B | £5,000 per reportable period | Records not kept |
| 22C | £5,000, then up to £600 a day after an assessment | Return late |
| 22D | £100 per account holder or controlling person | Inaccurate or incomplete return, if deliberate or careless, or if the error is found later and HMRC is not told |
| 22F | £1,000, then up to £300 a day after notice of assessment | Registration missed |
| 22H | £300 | Customer’s deliberate or careless failure to self-certify |
Insufficient funds and reliance on another person are not reasonable excuses (reg 22I), and penalties are appealed in writing within 30 days (regs 22M, 22N).
For the first two reportable periods under the amended rules, HMRC’s manual (IEIM405101) sets a soft landing: HMRC may contact an institution that has not met the new requirements to understand why, and may not charge a penalty where it shows it took all reasonable steps to comply. That relief is HMRC practice set out in its manual, not an exemption in the regulations: where reasonable steps cannot be shown, the regulations’ penalties remain available, subject to the reasonable-excuse defence in regulation 22I.
The self-certification penalty scales with onboarding volume. A fictional Edinburgh investment platform opens 400 accounts in 2026, each for a different individual, through a flow that lets customers skip the tax-residence step. If none of the 400 holds a valid self-certification once the 90-day window has passed, and there is no reasonable excuse (reg 22I), its exposure under regulation 22A(2) is up to £300 per holder, or £120,000, before any penalty on the customers themselves.
06 · Two Ways to Meet the UK’s Amended CRS
At year-end, by hand
Many institutions collect forms at opening and review before May; each gap found later needs the customer again, and the penalty is counted per person.
At onboarding, from Day 1
TaxDo runs CRS 2.0 due diligence inside onboarding, in five steps.
Step 1 · Collect the self-certification. Guided and jurisdiction-aware, with a digital signature; a passive entity’s controlling persons and roles in the same flow.
Step 2 · Validate the identity. Every TIN checked in real time against official sources in 130+ countries, and the business against registries in 120+.
Step 3 · Run forensic due diligence with Verify+. Our Verify+ forensic engine runs 20+ checks on an individual and 30+ tax-native checks across eight areas on an entity, including official TIN lookup in 130+ countries.
Step 4 · Cure the gaps, without the compliance team:
4a · New accounts. Reasonableness tested and discrepancies resolved in the same session.
4b · Existing accounts. One click starts a remediation campaign for the cohort, with guided questions through a link in your brand and every answer checked by Verify+. Each case closes with a signed self-certification and an audit-ready certificate.
Step 5 · Report, and keep the evidence. Schema-validated CRS data, prepared and validated for your institution to submit to HMRC. Our team can also submit it on your behalf on request, as an additional service.
From Day-1 self-certification to CRS XML reporting, with zero remediation.
Our CRS 2.0 compliance software · Solutions for financial institutions
Where this sits, and what it does not touch
It runs beside your KYC provider and core banking system. The reporting obligation, and the responsibility for what is reported, stays with your institution, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.
07 · Timeline
26 November 2024
Signature of the Addendum to the CRS multilateral agreement by the United Kingdom.
24 and 25 June 2025
SI 2025/740 is made and laid; HMRC publishes its policy paper.
16 July 2025
SI 2025/740 comes into force, with registration and the new penalties.
31 December 2025
The first registration deadline for institutions in scope before 2025; one first in scope during 2025 has until 31 January 2026.
1 January 2026
The amended CRS applies, and the CARF under SI 2025/744.
31 May 2027
The first returns under the amended CRS and the CARF are due.
08 · Related Reading
Framework articles: CRS 2.0 compliance for financial institutions · CARF and crypto tax transparency · Self-certification under CRS 2.0, DAC8 and CARF · CRS 2.0 in Switzerland · CRS 2.0 and DAC8 in Germany · CRS 2.0 in France
Product: Regulatory compliance engine · Day 1 onboarding validation · Business registry check · CARF compliance software
