CRS Classification: Entity Types, NFEs, and Self-Certification

CRS classification is how a financial institution decides what an account holder is under the Common Reporting Standard, and that decision controls whether the account gets reported to a foreign tax authority. Every entity that opens or holds an account at an institution in a participating jurisdiction falls into one of four categories: Reporting Financial Institution, Non-Reporting Financial Institution, Active Non-Financial Entity, or Passive Non-Financial Entity. The category depends on what the entity does, where its income comes from, and who stands behind it. Get it right and the reporting flows to the correct country. Get it wrong and accounts either get reported when they shouldn’t be or, more dangerously, fail to get reported when they must.¹

Over 100 jurisdictions now exchange account information under the CRS. The United States is not one of them, and that gap matters for anyone with U.S. tax exposure — more on that below.

The Four Categories at a Glance

Every entity classified under the CRS sits in one of these buckets:

Reporting Financial Institutions: banks, custodians, investment firms, and certain insurers that must identify foreign tax residents among their account holders and report those accounts.
Non-Reporting Financial Institutions: government bodies, central banks, qualifying pension funds, and similar low-risk entities that are carved out of the reporting obligation.
Active Non-Financial Entities: operating businesses whose income comes mostly from trade or services rather than investment returns.
Passive Non-Financial Entities: entities whose income comes mostly from passive sources such as dividends, interest, royalties, or rent, which triggers look-through reporting on the individuals who control them.

The classification of the account holder drives what the financial institution has to do. If the account holder is an Active NFE, reporting typically stops at the entity level. If it is a Passive NFE, the institution must look through the entity to identify controlling persons and report them individually.

Is the Entity a Financial Institution?

The first fork is whether the entity is a Financial Institution at all. The CRS recognizes four types.²

Custodial Institutions hold financial assets for others as a substantial part of their business. The threshold is quantitative: gross income from holding assets and related services must equal or exceed 20% of total gross income over the preceding three years, or over the entity’s lifetime if shorter.
Depository Institutions accept deposits in the ordinary course of a banking or similar business. Traditional banks, credit unions, and comparable deposit-takers sit here.³
Investment Entities primarily trade, manage portfolios, or invest on behalf of customers. A second branch captures entities whose gross income comes mainly from investing or trading in financial assets, provided they are managed by another financial institution.
Specified Insurance Companies issue or make payments under cash value insurance contracts or annuity contracts.

What the entity is called and how it registered do not decide the question. What it actually does decides it. A company holding financial assets for clients that earns more than 20% of its income from that activity is a custodial institution regardless of how it markets itself.

Financial institutions that qualify as Non-Reporting are exempt because they present minimal risk of being used to hide offshore wealth. Government entities, international organizations, and central banks acting outside commercial financial activity fall here. So do pension funds with broad or narrow participation, provided they operate under contribution limits, withdrawal restrictions, and regulatory oversight strong enough to make abuse impractical. If an entity is not a Financial Institution at all, it is a Non-Financial Entity, and the next question is whether it is active or passive.

Active NFE or Passive NFE?

The default definition is quantitative. An NFE is Active if less than 50% of its gross income for the preceding year is passive income, and less than 50% of its assets during that period produce or are held to produce passive income.⁴ Both tests must be met. Passive income includes dividends, interest, royalties, annuities, and rents. Trading companies, consultancies, and manufacturers generally clear this test because they earn from selling goods or services.

Several categories qualify as Active NFE regardless of the income mix:

Publicly traded companies whose stock is regularly traded on an established securities market, along with their related entities.
Government entities, international organizations, and central banks when acting in a non-financial capacity.
Non-profit organizations established and operated exclusively for religious, charitable, scientific, artistic, cultural, athletic, or educational purposes. They must be tax-exempt in their jurisdiction, prohibited by their governing documents from distributing income or assets to private persons (except reasonable compensation or through charitable activities), and required on liquidation to transfer all assets to another non-profit or the government.
Start-up entities that are not yet operating a business, have no operating history, and are investing capital into assets with the intent to operate a non-financial business. This status lasts 24 months from initial organization, after which the income and asset tests apply.⁵

An NFE that fails to qualify as Active is Passive. Holding companies, family investment vehicles, and entities that park wealth in financial assets typically land here. A specific rule closes an obvious loophole: an investment entity based in a jurisdiction that does not participate in the CRS is treated as a Passive NFE rather than as a financial institution.³ The institution holding its account then applies passive due diligence and looks through to the individuals behind it.

Controlling Persons When the Entity Is Passive

Passive NFE status triggers the part of the CRS that catches people out. The financial institution must identify every Controlling Person of the entity, determine each person’s tax residency, and report each one’s name, address, tax residency, and taxpayer identification number.²

For a company, controlling persons are the natural persons who ultimately own or control the entity through direct or indirect ownership of more than 25% of the shares or voting rights. Indirect ownership counts through the chain: someone owning 30% of a parent that owns 100% of the account-holding subsidiary is a controlling person of the subsidiary. The 25% threshold aligns with the Financial Action Task Force’s anti-money-laundering framework, so institutions can build on their existing know-your-customer work.

Trusts are treated differently. The following are automatically controlling persons, whether or not they exercise actual control: the settlor, every trustee, any protector, and every beneficiary or class of beneficiaries. Anyone else exercising ultimate effective control over the trust is also included.⁶ When the settlor is itself an entity rather than a person, the institution must identify the controlling persons of that entity too, and must do so every year, not only in the year the trust was established.³

A discretionary beneficiary who may never receive a distribution still gets reported. This surprises people using trusts for ordinary estate planning, and it drives most of the disputes over classification.

Accounts That Are Excluded Even at a Reporting Institution

Classification does not end with the entity. Certain account types are excluded from reporting entirely because their structure limits abuse. These include:

Retirement and pension accounts that are tax-favored, subject to information reporting to local tax authorities, and restricted by withdrawal conditions tied to retirement age, disability, or death, with annual contributions capped at $50,000 or lifetime contributions capped at $1,000,000.
Tax-favored savings accounts for non-retirement purposes such as education or medical expenses, where contributions are capped at $50,000 annually and withdrawals are restricted to the account’s stated purpose.
Certain life insurance contracts where coverage ends before the insured turns 90, premiums are payable at least annually, and the contract has no accessible cash value without termination.
Estate accounts held solely in connection with a court order, judgment, or real estate transaction.

The $50,000 and $1,000,000 thresholds sit in the text of the standard and are not annually adjusted. Institutions apply aggregation rules, combining accounts held at the same institution or a related entity when testing whether the caps are met.

Self-Certification: How Classification Actually Gets Recorded

Financial institutions rely on self-certification forms to classify account holders. When opening a new account, you provide your legal name, current address, every jurisdiction where you are tax-resident, and your taxpayer identification number for each reportable jurisdiction.⁵ Some jurisdictions require a TIN for every jurisdiction of residence, not only reportable ones.

Entity account holders declare their classification on the form: Reporting Financial Institution, Active NFE, or Passive NFE. A Passive NFE also supplies identifying information for each controlling person. The institution may rely on the self-certification unless it knows or has reason to know the information is incorrect.³

A common misconception is that a financial institution cannot open your account without a completed self-certification. The CRS itself does not impose a blanket prohibition. What it does say is that if an institution opens an account without one, it must treat the account holder as resident in every reportable jurisdiction for which it has any identifying indicator, which usually means the account gets reported to multiple countries rather than the right one. Jurisdictions also fine institutions that fail to collect self-certifications, so in practice most institutions refuse to finalize account opening until they receive one.

When Circumstances Change

A self-certification stays valid until the institution knows or has reason to know that something has changed. Moving to a new country, changing tax residency, or restructuring an entity so its classification shifts all invalidate the original form.⁷

Once invalid, a 90-day grace period runs. The institution can continue treating the status as unchanged during that window. If the account holder does not provide a new certification or confirmation within 90 days, the institution must report the account holder as resident in both the jurisdiction on the original form and the jurisdiction indicated by the change. Dual reporting continues until the account holder resolves the mismatch. Ignoring the institution’s request is not a neutral choice.

Where CRS Ends and FATCA Begins

The United States does not participate in the CRS. It obtains information about U.S. persons holding non-U.S. accounts through the Foreign Account Tax Compliance Act instead. Financial institutions in CRS jurisdictions often have to run both regimes side by side: FATCA for U.S. tax residents, CRS for residents of every other participating jurisdiction. The classifications look similar — FATCA has active and passive NFFEs, CRS has Active and Passive NFEs — but the definitions, thresholds, and forms differ. Completing one does not satisfy the other, and the two can reach different conclusions on the same entity.

Crypto-Assets and Digital Currencies Now in Scope

The OECD has amended the CRS to bring electronic money products, central bank digital currencies, and indirect investments in crypto-assets within its scope.⁸ Investments in crypto-assets held through derivatives or investment vehicles are covered, so entities and accounts dealing in these products face the same classification analysis as traditional financial instruments. Effective dates depend on the jurisdiction where the institution is located.

What Getting Classification Wrong Costs

The CRS itself does not prescribe penalties. Each participating jurisdiction sets its own enforcement framework, so the range is wide. Common penalty triggers are late filing, incomplete or inaccurate data (missing TINs, wrong balances), inadequate due diligence, and omitted reportable accounts. Most jurisdictions impose administrative fines structured as fixed amounts per account or per day of delay. Willful non-compliance or fraud can escalate to criminal liability in some jurisdictions.

For account holders, giving false information on a self-certification can lead to fines and, in serious cases, criminal prosecution under the implementing law of the jurisdiction of residence. The more frequent problem is quieter: neglecting to update a self-certification after tax residency changes, which produces dual reporting and puts two tax authorities on notice instead of one.

1
OECD. Consolidated Text of the Common Reporting Standard (2025)
2
Organisation for Economic Co-operation and Development. Standard for Automatic Exchange of Financial Account Information in Tax Matters – Commentary on Section VIII
3
OECD. CRS-Related Frequently Asked Questions
4
Canada Revenue Agency. Guidance on the Common Reporting Standard
5
Organisation for Economic Co-operation and Development. Entity Tax Residency Self-Certification Form
6
Organisation for Economic Co-operation and Development. CRS Controlling Persons Self-Certification Form
7
GOV.UK. Due Diligence: New Individual Accounts: Self Certifications: Change of Circumstances
8
OECD. International Standards for Automatic Exchange of Information in Tax Matters