FATCA and CRS Compliance: An Operational Guide for Boards and Compliance Teams 

FATCA and CRS compliance requires financial institutions to classify entities and accounts, collect and validate tax information, monitor changes, identify reportable relationships, submit accurate returns and retain evidence of each decision. For boards, directors, compliance professionals and finance and operations teams, the central task is to connect technical interpretation with reliable year-round execution. 

Key Takeaways 

• Classification comes first because an incorrect entity or account status affects every later stage. 
• A self-certification must be complete, plausible and consistent with other information held. 
• FATCA and CRS can share one operating framework, but their legal tests and conclusions remain separate. 
• Reporting financial institutions remain accountable when service providers perform work on their behalf. 
• Population reconciliations, documented review and retained evidence matter as much as technical file validation. 

Treat Compliance as a Year-Round Process 

Annual reporting is the visible deadline, but most reporting outcomes depend on decisions made much earlier. Entity classification, account-opening evidence, tax residence, controlling-person records and changes in circumstances all feed the final return. Weakness at any point can leave a technically accepted file incomplete or inaccurate. 

The operating model should identify every responsible entity, applicable regime, registration or identifier, account population, filing route, timetable and accountable owner. It should also connect tax-reporting controls to onboarding, AML records, investor or customer data, finance systems and provider oversight. 

This guide uses Jersey as a practical reference while keeping the operating principles relevant to cross-border organisations. Jersey institutions should apply the current domestic regulations, Revenue Jersey guidance and applicable agreements. Organisations elsewhere must map the process to their own implementing rules, portals and deadlines. Technical classifications and jurisdiction-specific conclusions require appropriately qualified legal or tax review. 

Understand Where FATCA and CRS Differ 

FATCA is a US regime that generally requires foreign financial institutions and certain other foreign entities to report relevant information about US account holders or ownership interests, subject to the applicable status, rules and intergovernmental arrangements. FATCA can also create a 30% withholding consequence on certain withholdable payments where required documentation or status conditions are not met. Registration and a Global Intermediary Identification Number may be relevant depending on the entity’s status. 

CRS is the OECD standard for annual automatic exchange of financial account information. Participating jurisdictions obtain prescribed information from their reporting financial institutions and exchange it with jurisdictions in which account holders or, in some cases, controlling persons are tax resident. CRS is implemented through domestic law, so filing dates, penalties, elections and portal processes remain jurisdiction-specific. 

The two regimes use a similar operational sequence: classify entities and accounts, obtain documentation, apply due diligence, identify reportable relationships, maintain data and file prescribed information. One client record and common timetable can reduce duplication. 

The conclusions cannot be merged. FATCA focuses on defined US connections and uses FFI and NFFE terminology; CRS focuses on tax residence and uses Financial Institution and NFE categories. A GIIN has no direct CRS equivalent, and CRS does not reproduce FATCA’s withholding mechanism. US citizenship may remain relevant under FATCA, while CRS can require several tax residences to be recorded. 

In Jersey, separate FATCA and CRS reports are required. Revenue Jersey states that CRS version 2.0 came into force from 1 January 2026, while reporting for 2025 remained under the original CRS. Institutions should confirm the current technical guidance, reportable jurisdictions, portal requirements and annual deadlines at the start of each cycle. 

Establish Entity and Account Classifications 

Classification is the control point with the greatest downstream effect. Determine whether each entity is a Financial Institution under the relevant regime and, if not, which non-financial category applies. Depository, custodial, investment and specified insurance classifications may be relevant, along with non-reporting, exempt or deemed-compliant categories where their conditions are satisfied. 

Commercial, regulatory, AML and accounting labels do not automatically determine FATCA or CRS status. An investment holding company may require analysis of its activities, income, assets and management arrangements. A trust may require consideration of its trustee, professional management and financial assets. 

The classification record should state the legal entity, jurisdiction, regime and rule version; relevant activities and evidence; ownership and management facts; selected category; registration consequence; preparer; reviewer; effective date; and next review trigger. Escalate uncertain cases and retain any technical advice used. 

Account classification should identify which arrangements meet the applicable definition of a financial account and whether exclusions apply. Depository and custodial accounts are familiar examples, but equity or debt interests in some investment entities and certain insurance or annuity arrangements may also be relevant. Funds and trusts can require careful analysis of the account unit and account holders. 

Revisit classifications after restructuring, new investment activity, changes in professional management, trustee or service-provider changes, or material shifts in income and assets. The control should respond to changed facts rather than treat the original conclusion as permanent. 

Collect and Validate Self-Certifications 

Onboarding creates much of the evidence used for later reporting. The procedure should determine which form is required, who must complete it, which supporting documents are needed and who can approve an exception. 

Individual CRS self-certifications generally capture identity, residential address, date and place of birth, tax residence and tax identification numbers, subject to the implementing rules and permitted exceptions. FATCA documentation should establish US or non-US status using the documentation appropriate to the account and applicable framework. 

Entity onboarding usually requires tax residence and classification, together with controlling-person information where the entity analysis requires look-through. AML records can support identity and ownership checks, but they do not replace the separate FATCA or CRS conclusion. 

Validation should test reasonableness rather than only confirm that fields are populated. Review whether: 

• Tax residence aligns with addresses, incorporation, management and other information held. 
• Required tax identification numbers are present or a permitted absence is supported.
• The entity classification fits its activities, income, assets and management.
• Controlling persons agree with current ownership and AML records.
• The form is signed or positively affirmed by an authorised person and dated.
• Conflicting information has been resolved and documented. 

Missing information should follow the institution’s documented legal, compliance and risk parameters. Any permitted exception should be time-limited, approved and tracked. Relationship teams may own collection, trained tax-reporting or compliance specialists may validate, and operations may complete system records, but responsibility and escalation must be explicit. 

Manage Indicia and Changes in Circumstances 

Due diligence converts documentation into a reportability decision. Depending on the account and procedure, relevant indicia may include addresses, telephone numbers, payment instructions, powers of attorney or hold-mail details associated with another jurisdiction. FATCA has its own US indicia and cure procedures. An indicium should trigger the treatment or further work required by the applicable rules. 

When indicia conflict with the recorded status, open a case that records the issue, evidence requested, due date, applicable cure procedure, provisional treatment, reviewer and final resolution. The system should reflect any required temporary reportable treatment rather than leave the case outside the reporting population while awaiting a response. 

Changes can enter through AML refreshes, returned mail, ownership changes, investor-register updates, new payment instructions, relationship-manager knowledge, correspondence or expiring documentation. The FATCA and CRS process needs defined feeds from those activities and a timetable for reassessment. 

A regular exception report should show invalid or expired forms, missing tax identification numbers, conflicting residence information, unreviewed address changes, undocumented accounts and overdue classification reviews. Each item needs an owner, target date and escalation route. This turns due diligence into a managed process rather than an annual clean-up exercise. 

Build a Controlled Reporting Population 

Start with all in-scope legal entities and accounts before filtering for reportable records. Reusing the previous year’s file as the starting population can omit new entities, opened or closed accounts, migrations and residence changes. 

A controlled annual cycle should: 

• Reconcile the full population to authoritative client, investor, account and finance records.
• Apply approved classifications and reportability rules, retaining reasons for exclusions.
• Enrich records with account-holder, controlling-person, balance, payment, currency and identifier data. 
• Resolve missing, conflicting or implausible information.
• Generate and validate the file under the current local schema and portal rules.
• Obtain documented preparation, review and accountable approval.
• Submit, retain the receipt and monitor technical or record-level feedback.
• Correct errors through the prescribed process while linking original and amended records.

Technical validation does not establish substantive accuracy. Reconcile balances and account totals to authoritative records, investigate unusual movements and confirm that exclusions are supported. A portal receipt proves that a file passed a stage of submission, not that classifications and populations were correct. 

Data protection belongs inside the process. Restrict access, protect transfers, use anonymised test data where required and govern retained extracts. Reporting teams should confirm schema versions, portal validations and local filing requirements each year rather than rely on a prior template. 

Set Governance, Oversight and Evidence Standards 

The reporting financial institution remains accountable when a service provider completes due diligence, data preparation or reporting on its behalf. The service agreement should define data hand-offs, timetables, exception ownership, quality measures, change notification, correction support, incident escalation and access to working papers. 

A proportionate responsibility model may include: 

• The board or governing body approving the risk framework and receiving material reporting. 
• An accountable executive owning resources and remediation.
• A FATCA and CRS lead maintaining policy, classifications and exceptions.
• Client or onboarding teams collecting information and identifying changes.
• Operations and finance maintaining core data, balances and reconciliations. 
• A reporting preparer producing the return and validation pack.
• A reviewer testing completeness, accuracy and approval evidence. 
• Service providers performing agreed tasks and supplying evidence. 

The annual evidence pack should include the entity register, classifications, account population, self-certification exceptions, changes log, reconciliations, validation output, review comments, approval, submission receipt, portal responses and corrections. Apply the retention period required by the relevant rules and consider other AML, data-protection, contractual and limitation requirements. 

Governance reporting should focus on decisions and trends: valid self-certifications, unresolved exceptions by age, classifications due for review, rejected records, post-filing corrections and progress against milestones. Management should understand what remains unresolved, why, and what action is authorised. 

Correct Errors and Address Root Causes 

Common failures include incorrect entity classifications, collected but unvalidated forms, FATCA outcomes copied into CRS, missing controlling persons, unmanaged changes, incomplete reporting populations and third-party activity without sufficient oversight. 

Remediation should first contain the issue and protect relevant deadlines. Identify affected entities, accounts and reporting periods, obtain technical advice where the treatment is uncertain, and use the prescribed correction or notification channel where required. Preserve the decision and evidence. 

The final step is control repair. An inaccurate return may originate in onboarding, ownership data, system mapping, classification governance or provider hand-offs. Correcting the file without addressing the source leaves the same risk in the next cycle. Historic errors, late filings and disclosure decisions should receive qualified advice in the relevant jurisdiction because available mechanisms and consequences vary. 

Practical Compliance Review 

Before each reporting cycle, confirm that the institution has: 

• A complete perimeter of entities, funds, trusts and account-maintaining arrangements.
• Separate, reviewed FATCA and CRS classifications with supporting evidence.
• Named owners for onboarding, data, reporting, review and remediation.
• Tested self-certifications, tax forms and controlling-person records.
• Feeds that capture ownership, address, payment and AML-refresh changes.
• A population reconciled to authoritative account, investor and finance data.
• Aged exceptions with escalation and documented treatment.
• Current schemas, portal rules and technical validations.
• Recorded preparation, independent review and accountable approval.
• Submission receipts, correction records and agreed improvement actions.

External support may help where the institution lacks capacity, classification knowledge, dependable data assembly or independent quality review. The institution still needs an informed owner who can challenge conclusions and evidence delivery. 

Where Project Accountants Can Support Execution 

We can provide compliance support, fund administration support, operational finance outsourcing and specialist project support within a client’s governance, systems and controls. This additional capacity may assist with data preparation, reconciliations, exception tracking, remediation and annual reporting coordination. The client retains approvals and should obtain qualified legal or tax advice for technical interpretation and exposure. 

The Bottom Line 

Effective FATCA and CRS compliance operates throughout the year and extends beyond annual file production. Boards and compliance leaders should know which entities and accounts are in scope, how documentation is validated, how changes reach the reporting population and what evidence supports the final submission. Shared workflows can improve consistency, but each regime still requires its own defensible conclusions. 

Frequently Asked Questions