Managing competing operational risks under CRS and FATCA

The trend toward tax transparency and the exchange of information on financial accounts throughout the world is creating new requirements for taxpayers everywhere.  These efforts began with the U.S. government’s enactment of the Foreign Account Tax Compliance Act (FATCA) and has culminated with governments around the world adopting similar provisions under the Common Reporting Standard (CRS). FATCA requires foreign financial institutions (FFIs) to agree to report information on U.S. persons holding offshore accounts to avoid 30 percent FATCA withholding on certain payments. 

Building on FATCA, CRS requires financial institutions (FIs) to disclose specific information on accounts held by residents of jurisdictions that have adopted CRS and is the new global standard for the automatic exchange of financial information between governments.  CRS is expected to significantly affect the compliance obligations of financial institutions around the world that were just starting to get comfortable with FATCA. Is your organization prepared to handle these increased reporting obligations which start in 2017 and which vary by jurisdiction?  

A recent survey jointly sponsored by RSM and Hedge Fund Management Week indicates that most firms still consider themselves only “somewhat familiar” with CRS and that only 20 percent rated themselves as “fully prepared” for the impact of CRS.   The survey also indicates overwhelmingly that, firms expect to rely on the same systems, resources, and processes used for FATCA to comply with CRS, but expect that differences in the format of reports, extensible markup language (XML) schemas, and other requirements under local laws for CRS will increase their costs going forward.  This article provides an overview of requirements under CRS and highlights key differences between CRS and FATCA.

What is FATCA and CRS?

FATCA requires non-U.S. FIs to agree to report certain information on income and assets of U.S. persons holding offshore accounts and it requires nonfinancial foreign entities to provide information on their substantial (i.e., 10 percent or more) U.S. owners or they will be subject to 30 percent withholding on certain payments that they receive.  Leveraging FATCA Model 1 Intergovernmental Agreements, the Organisation for Economic Co-operation and Development (OECD) introduced CRS as a global standard for the sharing of financial information between over 100 countries that have adopted the regime to date.   CRS requires FIs to report specific information on accounts held by residents of participating jurisdictions to the FI’s local government using a particular format.   This information is then exchanged with other participating jurisdictions as appropriate to assist the customer’s jurisdiction of residence to identify potential tax avoidance.   

Unlike FATCA, which generally has effective dates going back to July 2014 and under which reporting started in March 2015, the effective date of CRS varies by jurisdiction depending on when local laws are passed, but most CRS reports are due starting as early as April 2017.  CRS and FATCA can apply to a wide range of companies engaged in financial services, including banking, brokerage, and investment activities (including private equity). 

Under the CRS, FIs organized in or doing business in a country that has adopted the CRS will need to perform extensive due diligence on existing customer accounts and develop new account opening procedures. The scope of the CRS rules exceeds the scope of the rules existing under FATCA. Consequently, FIs may need to perform additional work to comply with the requirements of CRS. 

To date, over 100 jurisdictions (but not the United States) have committed to exchanging information with each other on an annual basis under the CRS, and of these, over 50 have committed to exchange information beginning in 2017. The due diligence process and the development of new account opening procedures were required to be completed by Dec. 31, 2016, for certain accounts in early adopter jurisdictions and reporting begins as early as May 2017 in some jurisdictions with notifications or registrations required by April 2017.

Who is affected?

While FIs are most greatly affected by these rules, multinational companies in non-financial services industries and U.S. companies are affected as well.  In fact, any company (whether the U.S. or foreign and irrespective of whether they are an FI or not) doing business outside of the United States or making payments outside of the United States is potentially affected by FATCA in that they must collect documentation from payees to determine whether or not they are FATCA compliant and must withhold 30 percent of certain U.S. sourced payments made to anyone who is undocumented or noncompliant unless excepted or otherwise deemed compliant under the rules. Since compliance with CRS is enforced directly by national governments instead of through a withholding tax, a comparable obligation to withhold does not exist under CRS, but FIs are still required to report the information for residents of participating jurisdictions to the taxing authority of the country in which the FI is resident.

Finally, although they may not have any direct requirements under FATCA or CRS, customers of FIs subject to either regime will likely find that there is more paperwork involved in opening or continuing an account than was required previously. In particular, most covered financial institutions will require account holders to self-certify their status for both FATCA and CRS.

What is a foreign financial institution?

Under FATCA, an FFI includes depository institutions (e.g. banks), custodial institutions (e.g. mutual funds), investment entities (e.g. hedge funds or private equity funds), and certain insurance companies.  Some FFIs that the drafters of FATCA believed to have a low risk of facilitating tax evasion (such as financial institutions that only serve local customers and do not accept deposits from U.S. persons) were specifically exempted from having to comply with FATCA’s due diligence and reporting requirements.

CRS largely borrows the FATCA definition of a financial institution, but without some of the exemptions provided by FATCA.  As an example, the above-described exception for local financial institutions from FATCA is not similarly available for CRS.

Which accounts must be reported?

Corresponding to the four classifications of FFIs, FATCA provides for four classifications of accounts that are potentially subject to reporting: depository accounts, custodial accounts, equity or debt interests in investment entities, and certain insurance or annuity contracts. Any of these accounts, if held by a U.S. person, must be reported—either to the IRS or the FFI’s local taxing authority as set forth in any applicable intergovernmental agreement. An exception exists for depository accounts held by individuals where the total balance of all accounts maintained by that individual at the institution totals less than $50,000. Since FATCA is only concerned with ensuring tax compliance by U.S. persons, accounts held by non-U.S. persons are not subject to FATCA reporting.

While using a similar definition of financial account, the scope of those financial accounts subject to reporting under CRS is much wider. For starters, accounts held by a resident of any CRS signatory country must be reported to the financial institution’s national government. Also, there is no CRS equivalent to the $50,000 threshold for individuals under FATCA, meaning that the floodgates are now open to mandatory reporting of tremendous numbers of low-value accounts.

What is the difference between FATCA and CRS?

While the overall goal and general requirements of CRS are similar to FATCA, one key difference between the two regimes is that, unlike FATCA, there is no withholding under CRS. CRS is enforced with penalties for noncompliance which vary by jurisdiction.  Another very important difference between the two regimes is that while FATCA is primarily focused on identifying U.S. persons, CRS is focused on identifying residents of any CRS participating jurisdiction which requires due diligence of nearly all of a FI's account holders or investors and imposes a greatly increased reporting burden. 

CRS will also affect more accounts and applies to more products than FATCA since there are no de minimis thresholds for individual accounts, since it applies to any investor or accountholder that is a tax resident of a participating jurisdiction, and since certain types of entities and accounts that were excepted or deemed-compliant under FATCA (such as certain deemed-compliant investment entities or others considered to be of low risk under FATCA) may not be excepted or deemed compliant for purposes of CRS. Notably, however, the CRS classification of most non-U.S. financial institutions should generally be consistent with its FATCA classification, but, unlike FATCA, most jurisdictions do not have a separate requirement for financial institutions to register for or obtain a CRS identification number or anything similar to the global intermediary identification number required under FATCA.

Another key difference between CRS and FATCA is the documentation requirements.  While withholding agents typically collect U.S. tax withholding certificates (i.e., Forms W-8 and W-9), for FATCA purposes to document the identity and FATCA compliance of account holders and investors, these forms are not sufficient for CRS since they do not capture certain CRS relevant information (such as CRS status or tax residency).  Instead, CRS requires entities to self-certify certain information.  There is no prescribed format for self-certifications under CRS, but many jurisdictions have provided examples of formats and templates that can be used to satisfy local requirements.

In certain situations, CRS also allows FIs to rely on publicly available information or information in their possession to establish that an account is a non-reportable account. Certain publicly available information is allowed instead of a self-certification form for both new and pre-existing entity accounts.  In the case of preexisting accounts over $1,000,000, FIs are allowed to use publicly available information or information in the financial institution's possession for determining the CRS classification of the controlling persons if they are active non-financial entities or financial institutions other than non-participating professionally managed investment entities. Notably, there may be jurisdictional guidance that requires certain other information or that establishes other specific requirements that should be considered.

Complying with new CRS reporting requirements while simultaneously managing FATCA’s existing reporting and withholding requirements will likely be a challenge for most organizations. Private equity funds, mid-sized banks, hedge funds, and other financial institutions in particular with account holders and investors that are residents of any one of the over 100 jurisdictions that have adopted CRS must take action now to ensure that they are prepared to start reporting information to participate jurisdictions in early 2017. 

How does CRS affect U.S. companies?

Although the United States has not adopted CRS to date, U.S. companies should not assume that they are not affected by these rules.  To the extent that U.S. entities do business in non-U.S. jurisdictions, they will be required by non-U.S. banks and other financial institutions to document their tax residency and CRS status by providing documentation such as a CRS self-certification form.  Many jurisdictions treat residents of non-participating jurisdictions as “passive nonfinancial entities” under CRS and, as such, U.S. companies may be required to disclose their controlling persons.  This may be particularly burdensome for certain U.S.-based entities commonly used in cross-border fund structures, such as Delaware limited partnerships and limited liability companies, who may also be classified as passive nonfinancial entities and as such may find themselves the subject of a CRS due to diligence information request regarding their controlling persons.  CRS may also have unwelcome consequences regarding confidentiality and data protection for individual U.S. tax residents with significant interests in offshore accounts or fund structures. 

What should you do now?

While many organizations intend to leverage systems, policies, and resources used for FATCA to comply with CRS, differences in CRS’s data requirements, reporting and due diligence deadlines, and the format of CRS reports may present competing operational challenges going forward.   In order to comply with CRS, FIs will need to assign a CRS classification to all legal entities in the group and revise procedures for onboarding new investors and account holders to include the collection and review of self-certifications.  They will also need to perform due diligence on existing investors and accounts by searching information collected for purposes of complying with anti-money laundering and know-your-customer rules to identify investors and residents of participating jurisdictions.  Thirdly, because CRS is driven by tax residency, companies should ascertain the jurisdictions where investors and account holders are residents and may need to enhance or modify systems, processes, and processes for identifying CRS reportable accounts and for capturing reportable information.  This information includes certain details about the investor or account holder, the balance in the account at the end of each year and income earned during the year (including but not limited to interest, dividends and gross proceeds from the sale of property). Once the information is collected, it must be translated into an appropriate format for reporting it to the local taxing authority.

Please refer to the table below for more details on the top ten tasks that organizations should consider now in order to be compliant.  Although some of these steps apply to non-U.S. entities only, many of them will affect both U.S. and non-U.S. companies alike.

Top 10 action steps for CRS compliance