AEOI Reporting Requirements: CRS, FATCA, and Crypto-Asset Rules

Automatic Exchange of Information reporting requirements fall almost entirely on financial institutions: banks, brokerages, investment entities, and specified insurance companies in a participating jurisdiction must identify accounts held by tax residents of other participating jurisdictions, run due diligence on those accounts, collect specific identifying and financial data, and file an annual electronic report with their domestic tax authority in the format the Common Reporting Standard prescribes. The domestic authority then transmits the data to the account holder’s home country. More than 120 jurisdictions now operate under this system.¹

Which Institutions Have Reporting Obligations

The CRS captures four categories of financial institution located in a participating jurisdiction:

Depository institutions — banks, credit unions, and similar businesses that take deposits in the ordinary course of business.
Custodial institutions — firms that hold financial assets for clients, where income from holding those assets is at least 20 percent of gross revenue.
Investment entities — firms that trade securities, manage portfolios, or invest money on behalf of others, including hedge funds, private equity vehicles, and certain trusts managed by another financial institution.
Specified insurance companies — insurers issuing cash-value life insurance or annuity contracts.

Government bodies, international organizations, central banks, and certain pension funds are generally exempt.²

Trusts and Passive Entities

A trust whose income comes primarily from investing in financial assets and that is managed by a bank, broker, or investment firm is itself an investment entity with its own reporting obligations. A trust that fails that test, or that sits outside a participating jurisdiction, is treated as a passive non-financial entity.³

Passive-entity status does not remove the account from scope. The financial institution holding the entity’s account must look through it and identify controlling persons. For a trust, the settlor, trustees, protectors, beneficiaries, and anyone else exercising ultimate control all count as controlling persons, regardless of whether any of them individually directs the trust’s operations.⁴ If any of them is a tax resident of a reportable jurisdiction, the account is reportable. The same principle applies to foundations and similar arrangements.

How Reportable Accounts Are Identified

Institutions do not report every account. They run a due diligence process, and that process differs sharply between accounts opened after the CRS took effect and accounts already on the books when a jurisdiction adopted it.

New Accounts

For new accounts, the institution collects a self-certification from the account holder declaring jurisdiction of tax residence and providing a taxpayer identification number. The self-certification can take any form, including a verbal declaration during onboarding, as long as it is signed or positively affirmed.³ The institution must then confirm the certification is reasonable given other information gathered during onboarding. A residency claim that contradicts a passport, for instance, needs follow-up before it can be accepted.

Some jurisdictions impose criminal penalties for false self-certifications. The CRS Commentary uses the phrase “penalty of perjury,” which is satisfied by any domestic criminal-nature penalty for false statements.³

Preexisting Accounts and Indicia

For preexisting accounts, the institution searches its records for indicators of foreign residency. These indicia include a foreign residential or mailing address, a foreign telephone number, standing instructions to transfer funds to an account in another jurisdiction, a power of attorney granted to someone with a foreign address, and a “hold mail” instruction with no other address on file.² If any indicator turns up, the account is treated as reportable unless the holder produces documentation proving otherwise.

High-value accounts, meaning preexisting individual accounts with a balance above $1,000,000, get a deeper review.⁵ Beyond the electronic search, the institution must review paper files including current account-opening documentation, powers of attorney in effect, and standing transfer instructions. If a relationship manager has actual knowledge that the holder is a foreign tax resident, the account is reportable regardless of what the paperwork says.⁶

Excluded Accounts

Not everything is reportable. Jurisdictions may exclude dormant accounts with an annual balance no greater than $1,000 as low-risk excluded accounts. The $1,000 figure is indicative rather than mandatory, but jurisdictions are expected not to set a threshold that substantially exceeds it.³

What Data Must Be Reported

Every reportable account triggers two clusters of information. On the identifying side, for individuals the institution reports full name, residential address, jurisdiction of tax residence, taxpayer identification number, and date and place of birth. For entity account holders with reportable controlling persons, the same personal details are required for each controlling person, plus the entity’s name, address, jurisdiction, and taxpayer identification number.⁵

On the financial side, the report must include the account number or functional equivalent, the total account balance or value as of December 31, and total gross amounts of interest, dividends, and other income earned during the year. For custodial accounts, total gross proceeds from selling or redeeming financial assets must also be included.²

Joint Accounts

Joint accounts are attributed in full to each holder rather than split between them. If two people jointly hold an account worth $500,000, each is reported as holding $500,000.⁷ The same full-balance attribution applies to aggregation for threshold purposes, and an account is reportable if any one joint holder is a reportable person.

Filing Format and Deadlines

Reports are submitted electronically in the CRS XML schema, a standardized structure that lets different national systems read the data in bulk.⁸ Every data element, from currency codes to account-holder status, must be mapped to the correct field. Formatting errors cause automated rejection at the intake stage, so getting the technical build right is a compliance step in its own right.

Tax authorities operate portals for encrypted uploads and publish technical specifications and test environments. Access typically requires digital certificates or authorized credentials. Filing dates vary. Bermuda sets a May 31 deadline for all CRS returns.⁹ The Cayman Islands uses July 31.¹⁰ Other jurisdictions commonly settle on dates in June or September. Missed deadlines usually carry penalties that scale with the volume of unreported data.

Even when due diligence turns up no reportable accounts, many jurisdictions still require a nil return confirming that the review took place and produced nothing to disclose.⁹ After a submission goes in, the authority may send error notifications or clarification requests, and monitoring the portal matters as much as filing on time.

Record Retention

Institutions must keep all due diligence and reporting records for at least five years after the end of the reporting period in which the information was required to be reported.⁵ Many jurisdictions extend that to six years in their domestic legislation, and some institutions hold records longer under internal policies. Records worth keeping include self-certifications, identity documents from onboarding, results of electronic and paper record searches, and the XML files submitted to the tax authority.

Confidentiality Obligations on Receiving Authorities

Before a jurisdiction can receive exchanged data, it must pass a confidentiality and data-safeguard assessment covering personnel screening, physical and system access controls, IT security, incident management, and audit functions, along with sanctions for improper disclosure.¹¹ A jurisdiction that falls short can be suspended from receiving information until it corrects the deficiency.¹² For reporting institutions, this matters because the data leaving the building is protected by binding standards on the receiving side.

The United States: FATCA Instead of CRS

The United States does not participate in the CRS. It runs the Foreign Account Tax Compliance Act, under which foreign financial institutions worldwide report accounts held by U.S. persons — citizens, green card holders, and resident aliens — either directly to the IRS or through intergovernmental agreements. The trigger is U.S. person status based on citizenship, not tax residency as with the CRS. American financial institutions therefore do not perform CRS due diligence, and American account holders at foreign banks are picked up under FATCA rather than the CRS.

FATCA also imposes an individual filing obligation the CRS does not: U.S. taxpayers with foreign financial assets above certain thresholds must file Form 8938 with their annual return. Under the CRS, the reporting burden sits entirely on the institution.

2023 Amendments and the Crypto-Asset Reporting Framework

The OECD updated the CRS in 2023 to pull new categories of digital financial products into scope. Electronic money products — digital representations of a single fiat currency, issued on receipt of funds and redeemable at par — are now covered, and their issuers are treated as depository institutions if not already classified that way. Central bank digital currencies are within the framework. Crypto-asset derivatives held in custodial accounts or by investment entities are included in the CRS definition of financial assets. Due diligence procedures were tightened and reporting requirements expanded across the board.¹³

A separate Crypto-Asset Reporting Framework sits alongside the amended CRS. CARF applies to digital assets that rely on a cryptographically secured distributed ledger, including stablecoins, crypto-denominated derivatives, and certain non-fungible tokens. Central bank digital currencies and electronic money products are excluded from CARF because the amended CRS now covers them.¹⁴ Under CARF, crypto-asset service providers — exchanges and other platforms that facilitate transactions — must collect taxpayer identification numbers and jurisdictions of tax residence from users and report transactions involving users resident in reportable jurisdictions. Around 60 jurisdictions had committed to CARF implementation by the 2024 Global Forum Plenary, with first exchanges expected in 2027 or, for jurisdictions facing particular implementation challenges, 2028.¹⁵

What Individual Account Holders Actually Need to Do

The CRS imposes no personal filing obligation on account holders. The point of contact for most individuals is the self-certification form presented when opening an account in a participating jurisdiction, which asks for tax residency and a taxpayer identification number. Declining to provide it does not make the account invisible; it typically triggers closer scrutiny, restricted account use, or eventual closure.

If you hold a bank account, investment portfolio, or cash-value insurance policy in a country where you are not a tax resident, the account details and annual balance and income figures are almost certainly being transmitted to your home tax authority under the CRS or, if you are a U.S. person, under FATCA. Where accounts have gone unreported to the home authority, the shrinking gap between non-compliance and detection is the operative fact: authorities in participating jurisdictions are receiving data automatically each year, and voluntary correction is generally treated more favorably than discovery.

1
OECD. Standard for Automatic Exchange of Financial Account Information in Tax Matters, Second Edition
2
Canada Revenue Agency. Guidance on the Common Reporting Standard – Part XIX of the Income Tax Act
3
OECD. CRS-related Frequently Asked Questions
4
OECD. Standard for Automatic Exchange of Financial Account Information in Tax Matters, Second Edition
5
OECD. Consolidated Text of the Common Reporting Standard (2025)
6
Revenue Commissioners (Ireland). Standard for Automatic Exchange of Financial Information in Tax Matters – Implementation Handbook – Second Edition
7
Revenue Commissioners (Ireland). Standard for Automatic Exchange of Financial Account Information
8
OECD. Amended Common Reporting Standard XML Schema
9
Government of Bermuda. Common Reporting Standard and Country-by-Country Reporting
10
Department for International Tax Cooperation. CRS Jurisdictions Lists and 2026 Reporting Deadlines
11
OECD. Confidentiality and Information Security Management Toolkit
12
OECD. Terms of Reference for Confidentiality and Data Safeguards Assessments
13
OECD. International Standards for Automatic Exchange of Information in Tax Matters
14
Government of Jersey. Crypto-Asset Reporting Framework (CARF) and Expansion of the Common Reporting Standard (CRS)
15
OECD. Delivering Tax Transparency to Crypto-Assets