FATCA and CRS Compliance for Financial Institutions: One Due Diligence Process for Two Regimes

Sources last verified: 23 October 2026

Official sources cited at the end of this page.

Our regulatory compliance engine runs FATCA and CRS due diligence on Day 1. It routes the right W-form and CRS self-certification, checks the TIN against official sources and the GIIN against the IRS FFI List, tests the declaration against US and CRS indicia, resolves them automatically instead of by the compliance team and prepares both validated reports: zero remediation.

What do FATCA and the CRS require of the same financial institution? Two searches of one customer file. FATCA, the US Foreign Account Tax Compliance Act, looks for US persons, meaning citizens wherever they live, residents and non-exempt US entities, and for foreign entities they control. The OECD’s Common Reporting Standard (CRS) looks for account holders resident for tax in another participating jurisdiction. Both rest on a self-certification tested against what the institution already holds, both classify every entity customer, and both end in an annual XML report, on different forms, thresholds and timetables.

The gap usually opens at onboarding. An investment holding company that declares itself active on Form W-8BEN-E while its income is portfolio dividends and interest is a passive non-financial foreign entity (NFFE) for FATCA and a passive non-financial entity (NFE) for the CRS, and the people who control it should have been identified twice over. Found at opening, that costs one more question. Found at year-end, it is a re-contact letter, a reminder log and, if the customer never answers, a gap in two reports.

There are two ways to run the two regimes. One keeps a FATCA process and a CRS process side by side, reconciled each spring when the reports fall due. The other collects one set of answers at account opening and derives both classifications from it. The first reconciles two files at year-end; the second builds one file at opening.

As at 23 October 2026 the US Treasury lists 114 jurisdictions under FATCA intergovernmental agreements (IGAs), 103 of them in force or in effect, and the OECD lists 131 jurisdictions committed to CRS exchanges (30 September 2026). The United States is not among the 131: the OECD notes that it exchanges under FATCA and its IGAs instead.

01 · FATCA and CRS at a Glance

02 · Who Is in Scope, by Institution Type

Under the IGAs and the CRS, both regimes use the same four kinds of financial institution: depository institutions, custodial institutions, investment entities and specified insurance companies. The labels match because the CRS was drafted on the intergovernmental model already used for FATCA. What differs is the person each regime is looking for, and that difference falls unevenly across the business lines.

Banks and custodians

At a bank the two regimes part company at the first question. The CRS asks where the customer is resident for tax; FATCA also asks whether the customer is a US citizen, so a US citizen living in Paris is a FATCA account and, from a London branch, a CRS account reportable to France. Custodians carry the same split, plus the payments: a custodian paying US-source income is often a withholding agent, so the W-8 series and counterparty GIINs join the same onboarding flow.

Funds and investment entities: a worked example

Take a fictional Guernsey private bank opening an account for an investment holding company incorporated outside the United States. Its income is portfolio dividends and interest and no financial institution manages it, so it is passive for both regimes. Two people control it: a US citizen who lives in London and holds 60 percent, and a German resident who holds 40 percent.

Under FATCA the company gives Form W-8BEN-E with the status of a passive NFFE, and the bank identifies its controlling persons under its anti-money-laundering procedures, as the Model 1 IGA requires; the US citizen is reportable because of citizenship, not residence. Under the CRS the same two people are controlling persons of a passive NFE, reportable to the United Kingdom and to Germany respectively. One customer, one onboarding session, three reportable relationships across two reports. Two separate forms collect the same facts twice and invite them to disagree.

Insurers

A life insurer’s in-scope products are cash value insurance and annuity contracts. Under a Model 1 IGA a pre-existing contract with a value of USD 250,000 or less at 30 June 2014 did not have to be reviewed; the CRS has no such floor for individuals. A policy that FATCA never reviewed can therefore be a CRS account, and the gap shows up only when the two files are compared.

Non-financial entities and withholding agents

An entity customer that is not a financial institution still has a classification in each regime, and on Form W-8BEN-E it states its Chapter 4 status. For certain statuses the payer must verify the payee’s GIIN against the published IRS FFI List. Our FATCA compliance software verifies each GIIN against the list in real time at onboarding.

03 · What Differs: Citizenship Against Residence

Citizenship is the root of every other difference. Because FATCA follows US citizens wherever they live, a US place of birth is an indicium under FATCA and not under the CRS, and a non-US address does not settle the matter. The CRS, built on residence, looks instead for addresses, telephone numbers and standing instructions linked to each reportable jurisdiction, and it applies to every individual account without the USD 50,000 floor that Model 1 IGAs allow.

Ownership is measured differently too. Under the US regulations a substantial US owner of a passive NFFE is a specified US person holding more than 10 percent (26 CFR 1.1473-1(b)). Under a Model 1 IGA, and under the CRS, the test is the controlling persons determined under anti-money-laundering procedures, read consistently with the Financial Action Task Force Recommendations. An institution in a Model 1 jurisdiction applies the IGA definition and need not also run the 10 percent test, though its jurisdiction may let it use the US regulations’ definitions instead.

FATCA adds three obligations that the CRS does not have. The first is registration: an institution obtains a GIIN, a 19-character number, and appears on the IRS FFI List, which counterparties check before paying. The second, for participating FFIs, Model 2 reporting institutions and certain other registered entities, is periodic certification by a responsible officer, due on 1 July following the third full calendar year after registration. The third is withholding: a payment to a non-compliant institution, or a US-source payment to a payee without valid documentation, can carry US tax at 30 percent, or backup withholding at 24 percent where a US payee fails to provide a correct TIN.

The CRS is simpler in form. It has no withholding, no global registry and no fixed expiry on self-certifications; and the amended CRS, applied in the EU and the UK since 1 January 2026, adds e-money and central bank digital currency accounts, the role of each controlling person and new data points to the report.

04 · Due Diligence, Step by Step, for Both at Once

New individual accounts

For a new account the institution obtains a self-certification at opening and confirms its reasonableness against the information collected for the account, including anti-money-laundering documentation. Both regimes apply the same test. One form can carry both declarations: under an IGA the self-certification may be an IRS form or a similar agreed form, often the institution’s own where local rules allow, provided it captures US status and, for the CRS, every jurisdiction of residence with the TIN for each. The reasonableness test then runs once, against the same file.

New entity accounts

For an entity the order is classification first. Is the customer a financial institution? If so, under FATCA it needs a GIIN where its status requires one. If not, is it active or passive? Under a Model 1 IGA an NFFE is active where less than half its gross income for the preceding year is passive income and less than half its assets produce or are held to produce passive income. A passive entity triggers the controlling-person questions in both regimes, and each controlling person gets his or her own residence and, for FATCA, citizenship answer.

Pre-existing accounts

Existing customers are reviewed by searching electronic records for indicia. Under a Model 1 IGA there are seven US indicia:

• identification of the account holder as a US citizen or resident;

• an unambiguous US place of birth;

• a current US mailing or residence address, including a US post office box;

• a current US telephone number;

• standing instructions to transfer funds to an account maintained in the United States;

• a currently effective power of attorney or signatory authority granted to a person with a US address;

• an in-care-of or hold-mail address that is the sole address on file (for lower value accounts, only an in-care-of address in the United States counts).

High value accounts, above USD 1,000,000, get more in both regimes: a paper record search, unless electronic records hold all the data needed, and a question to the relationship manager.

An indicium does not end the inquiry: it starts the curing. A US place of birth, for example, is cured under a Model 1 IGA with a self-certification of non-US status, a non-US passport or similar document, and either a certificate of loss of nationality or a reasonable explanation of why the customer has none or did not obtain US citizenship at birth. Pre-existing reviews usually stall at this evidence.

Change in circumstances

Documentation goes stale in two ways. A W-8 generally expires on the last day of the third calendar year after the year it was signed, and the account holder must tell the institution within 30 days if a change makes it incorrect. A CRS self-certification has no fixed expiry, but a change in circumstances, a new address abroad for example, means the institution can no longer rely on it until it has a new one or a reasonable explanation.

05 · Reporting: Forms, Schemas and the Calendar

Where FATCA is reported depends on the IGA. A reporting institution in a Model 1 jurisdiction sends its US accounts to its own tax authority, which passes them to the IRS; it does not file Form 8966 with the IRS. In a Model 2 jurisdiction, and for an institution registered directly with the IRS, the report is Form 8966, filed electronically by 31 March after the calendar year, in the IRS’s FATCA XML schema, now v2.0.1, updated on 6 October 2025.

Many Model 1 jurisdictions run FATCA and the CRS through one domestic return. In the United Kingdom the International Tax Compliance Regulations 2015 cover both the UK-US agreement and the CRS, and the return is due by 31 May after the calendar year (reg. 6(4)). In India rule 239 of the Income-tax Rules, 2026 covers US reportable accounts and other reportable accounts in one statement, Form No. 166, due by 31 May.

Missing US TINs are the long-running problem. The IRS has given Model 1 institutions temporary relief from a finding of significant non-compliance where a US TIN is missing on a pre-existing account, on conditions: the account holder’s date of birth reported, an annual request for the TIN, an electronic search of records and the correct TIN code. Notice 2024-78 extended that relief to calendar years 2025, 2026 and 2027 and added data points, including city and country of residence. It covers pre-existing accounts only: a new account still needs a US TIN at opening.

The 2023 CRS amendments come with a new schema, version 3.0, approved in August 2024, and the first reports under the amended rules are due in 2027 in the EU and the UK. HMRC has said its combined CRS and FATCA schema will not be used after 31 December 2026, so from 1 January 2027 a UK institution files XML on the amended CRS schema or the FATCA schema respectively. Our CRS 2.0 guide covers the amended data points in detail.

06 · Jurisdictions: FATCA Model and CRS Status

Of the 103 IGAs in force or in effect on the Treasury list, 94 are Model 1 and nine are Model 2: Armenia, Austria, Bermuda, Hong Kong, Japan, Macao, Moldova, San Marino and Switzerland. Four more are signed but not in force and seven are agreed in substance. The table covers the jurisdictions our CRS articles address; each row was read on the Treasury list on 23 October 2026.

Switzerland is the change to watch. The Model 1 agreement signed on 27 June 2024 would replace direct reporting to the IRS with automatic exchange between the two tax authorities, in both directions; the State Secretariat for International Finance (SIF) now gives its entry into force as 1 January 2029 at the earliest. Until then Swiss institutions report under Model 2.

07 · Penalties and Enforcement

FATCA’s own sanction is withholding. Section 1471(a) of the Internal Revenue Code requires a withholding agent to deduct 30 percent from a withholdable payment to a foreign financial institution that does not meet its requirements. An institution in a Model 1 jurisdiction is treated as compliant while it meets the IGA; significant non-compliance that is not resolved can end that treatment.

Domestic law adds penalties for both regimes. In the United Kingdom an institution that fails to obtain a valid self-certification faces a penalty of up to GBP 300 for each account holder or controlling person concerned (reg. 22A, inserted by SI 2025/740). In India a late statement costs INR 200 a day, capped at INR 1,00,000, and an inaccurate statement or a due diligence failure can cost INR 50,000. Each return is checked by the authority that receives it, so one onboarding gap can surface in both.

08 · Two Ways to Meet FATCA and the CRS

At year-end, by hand

The manual route works for a small book: W-forms and CRS self-certifications collected as PDFs, a format check on each TIN, a spreadsheet of indicia per regime and a reminder log for customers who have not answered. Its limit is arithmetic. Every passive entity creates at least two classifications and a list of controlling persons; every US indicium needs documentary evidence to cure; most W-8s expire on their own three-year clock. Run as two processes, the customer is contacted twice for overlapping facts and the files are reconciled just before the reports fall due.

At onboarding, from Day 1

TaxDo runs FATCA and CRS due diligence inside onboarding, from the first answer to both XML reports, in five steps.

Step 1 · Collect the self-certification. Plain-language questions route each customer to the right form, W-9, W-8BEN, W-8BEN-E, W-8IMY or W-8EXP, and to the CRS self-certification in the same session; a passive entity triggers the controlling-person questions automatically.

Step 2 · Validate the identity. Every TIN checked in real time against official sources in 130+ countries, the business against registries in 120+, and the GIIN against the IRS FFI List.

Step 3 · Run the due diligence. US and CRS indicia detected across everything held on the account; the declaration tested for reasonableness against it; Chapter 4 and CRS classification resolved, with the controlling-person look-through.

Step 4 · Cure the gaps, without the compliance team:

4a · New accounts. Indicia and discrepancies resolved in the same session, while the customer is still onboarding.

4b · Existing accounts. The book scanned and prioritised; expired W-forms, missing TINs and unresolved indicia remediated.

Step 5 · Report, and keep the evidence. FATCA XML, for Model 1 or Model 2, and CRS XML prepared and validated for your institution to submit. Our team can also submit them on your behalf on request, as an additional service. Every account holder keeps an immutable clearance record.

From Day-1 W-form and self-certification to FATCA and CRS XML reporting, with zero remediation.

Our FATCA compliance software · Solutions for financial institutions

Due diligence alone, or with withholding and reporting

The engine is modular. Due diligence, steps 1 to 4, is the core and can run on its own. A separate Withholding engine sets the rate per payment, 0 percent, treaty rate, 24 percent backup or 30 percent, from each payee’s classification and form; reporting, step 5, is the other optional module.

Due diligence runs on customer and account details alone. Balances and payments are needed only if the institution adds withholding or reporting, and where a rule turns on a balance, such as the USD 50,000 and USD 1,000,000 tests, the institution can apply the threshold in its own systems. The institution chooses what leaves its systems, and the engine runs in the cloud or on-premises.

A validated form is not finished due diligence

Checking that a W-8BEN-E is complete and agrees with itself is necessary, and it is the first step, not the last. FATCA and the CRS ask whether the declaration holds up against everything the institution already knows, whether the TIN exists, whether the GIIN is on the list, whether the entity was classified correctly for both regimes and whether a US place of birth was cured with evidence. A form-checking tool cannot see a wrong form choice: a W-8BEN-E that should have been a W-8IMY passes every field check.

Where this sits, and what it does not touch

It runs beside your KYC provider and core banking system: KYC establishes who the customer is, tax due diligence establishes where the customer is taxable and whether the declaration holds up. The difference is when the gap is found. The same engine covers CRS 2.0 and the TIN lookup behind it. The reporting obligation, and the responsibility for what is reported, stays with your institution, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.

09 · Recent Changes and What’s Next

6 October 2025

The IRS publishes FATCA XML v2.0.1 for Form 8966 reporting.

1 January 2026

The amended CRS applies in the EU and the UK; e-money and central bank digital currency accounts come into scope.

1 January 2027

HMRC’s combined CRS and FATCA schema is no longer accepted; UK returns use the amended CRS schema or the FATCA schema. Singapore applies the amended CRS.

Calendar year 2027

The last year covered by the IRS relief for missing US TINs on pre-existing accounts under Notice 2024-78.

1 January 2029 at the earliest

Switzerland’s Model 1 FATCA agreement, signed on 27 June 2024, would enter into force (SIF, 29 June 2026).

Crypto-assets are moving the same way. The OECD lists the United States among the jurisdictions committed to exchanges under the Crypto-Asset Reporting Framework by 2029. Our CARF compliance software runs the equivalent due diligence for crypto-asset service providers.

10 · Related Reading

Framework articles: CRS 2.0 compliance for financial institutions · CARF and CRS 2.0 for crypto · Self-certification under CRS 2.0, DAC8 and CARF · TIN validation under CRS 2.0

Product: Regulatory compliance engine · FATCA compliance software · Day 1 onboarding validation · Business registry check