The Common Reporting Standard (CRS) Explained: What Banks Report

The Common Reporting Standard is the reason a Swiss private bank now asks a new client to declare tax residency in Portugal, then quietly forwards the account balance to Lisbon each September. It is a standing, automatic pipe between tax authorities in more than 120 jurisdictions, and it has been running at scale since 2017. Anyone planning cross-border residency, cross-border investing, or a cross-border business needs a working model of what it does, what it does not do, and where its blind spots sit.

This guide walks through what CRS actually is, what data flows through it, how tax authorities use that data, why residency certificates and self-certification forms carry so much weight, and where the standard does not reach — including why the United States sits outside it entirely and uses FATCA instead. It is informational only; specific reporting positions should be reviewed with a qualified adviser in each jurisdiction involved.

What CRS actually is

The Common Reporting Standard is an OECD framework, published in 2014, that requires participating jurisdictions to collect defined financial account information from their financial institutions and exchange it automatically each year with the tax authorities of every other participating jurisdiction where an account holder is tax resident. It is modelled on the reporting mechanics of the U.S. Foreign Account Tax Compliance Act (FATCA) but is multilateral rather than U.S.-centric.

The legal machinery sits in the Multilateral Competent Authority Agreement (MCAA) on Automatic Exchange of Financial Account Information, layered on top of the older Multilateral Convention on Mutual Administrative Assistance in Tax Matters. Jurisdictions sign the MCAA, activate exchange relationships bilaterally with other signatories, and then their domestic tax code compels banks and other reporting financial institutions to hand over the data.

Early adopters exchanged for the first time in September 2017 (covering 2016 accounts). A second wave began in 2018. The list of participating jurisdictions has grown steadily and, as of 2026, covers essentially every major financial centre — Switzerland, Singapore, the UAE, the Cayman Islands, Luxembourg, Hong Kong, Jersey, Guernsey, the Isle of Man, and the EU 27 among them. The full and current list is maintained by the OECD's Global Forum on Transparency and Exchange of Information for Tax Purposes; verify status there rather than relying on any point-in-time article.

How the annual exchange actually works

CRS is not real-time surveillance and it is not a search tool. It is a defined, once-a-year, jurisdiction-to-jurisdiction bulk transfer.

The typical rhythm looks like this. During the calendar year, a reporting financial institution — a bank, brokerage, custodian, specified insurance company, or investment entity — identifies which of its account holders are tax resident somewhere other than the jurisdiction where the institution sits. It does this through documentary evidence for pre-existing accounts and through a self-certification form for new accounts. In the first quarter or so of the following year, the institution submits the reportable data to its own domestic tax authority in a standardised XML schema. That domestic authority then transmits the data to each relevant partner jurisdiction's tax authority, typically by 30 September. The receiving authority ingests the file and — depending on its analytics maturity — matches, cross-references, and flags anomalies against its own domestic tax filings.

Two important consequences follow. First, there is always a lag: data about a 2026 account arrives at the residence country's tax authority in late 2027. Second, the exchange is push, not pull. A Portuguese tax officer cannot query a Singaporean bank directly under CRS. They receive the annual file, and any deeper enquiry goes through the separate exchange-on-request channel under a tax treaty or the Convention on Mutual Administrative Assistance.

What data actually flows

The data set is broader than many account holders assume, but narrower than the popular image of "total financial surveillance".

For each reportable account, the reporting institution transmits identifying information about the account holder — name, address, jurisdiction(s) of tax residence, taxpayer identification number (TIN), and date of birth for individuals. For accounts held by entities, the institution also looks through passive entities to their controlling persons and reports those individuals as well, again with TIN and residence details.

On the financial side, the institution reports the account number, the account balance or value as of the end of the calendar year (or the closure value if the account was closed mid-year), and — depending on account type — the gross amount of interest, dividends, other income, and gross proceeds from the sale or redemption of financial assets credited to the account during the year.

What CRS does not include is equally worth understanding. It does not report every transaction. It does not include narrative descriptions of what an account is used for. It does not directly cover real estate, physical gold in a private vault, most operational businesses, or debt owed to individuals rather than to financial institutions. Cryptocurrency held on centralised exchanges is being drawn in under the OECD's Crypto-Asset Reporting Framework (CARF), which many jurisdictions are targeting to begin exchanging in 2027 or 2028 — verify the effective date in each jurisdiction, as timelines have slipped in several implementations.

Why residency certificates and self-certification carry weight

Because CRS reporting hinges on the account holder's jurisdiction(s) of tax residence, the self-certification form and the underlying evidence of residency are the pivot point of the whole system.

When an individual opens a new bank account in any CRS jurisdiction, the institution requires a signed self-certification declaring every jurisdiction of tax residence and the corresponding TIN. Signing that form falsely is generally a criminal offence in the reporting jurisdiction; it also invites reassessment and penalties in any residence jurisdiction that discovers the discrepancy. Institutions are required to apply a "reasonableness" test — if the address on file is Frankfurt but the self-certification claims Dubai, the bank must query the mismatch and, in practice, will often ask for a tax residency certificate from the claimed jurisdiction.

A tax residency certificate is a document issued by a national tax authority stating that a specific individual (or entity) is treated as a tax resident there for a defined period. The UAE, for example, will issue a Tax Residency Certificate once an individual has been physically present for 183 days in the relevant twelve-month period — that 183-day threshold is written into the UAE Federal Tax Authority's guidance and is the standard reference point used by UAE banks for CRS classification. Singapore issues equivalent certificates via IRAS, typically on the basis of 183 days of presence in a year, three consecutive years of residence, or continuous residence straddling two calendar years. Switzerland issues cantonal residency confirmations, with actual tax residence often turning on the "centre of vital interests" test rather than a simple day count.

The mechanical implication: a person who has physically moved to a low- or no-tax jurisdiction but has not established genuine, documentable residency there will still be reported by their bank to their prior residence country. And a person who claims residency in a jurisdiction where they cannot obtain a certificate is exposed on multiple fronts simultaneously. Where dual residency is possible under domestic rules, treaty tie-breaker provisions decide which jurisdiction wins for treaty purposes — a topic explored in this guide on tie-breaker tests.

The non-CRS holdouts, and why the US is the biggest one

The most consequential gap in CRS is the United States. The US never signed on to CRS; it uses its own bilateral FATCA regime instead, under which foreign financial institutions report information on U.S. accounts to the IRS (either directly or through their local tax authority under a Model 1 IGA). FATCA is not symmetrical: the US receives far more information from foreign institutions than it sends back to foreign tax authorities on non-U.S. persons holding accounts at U.S. financial institutions.

This asymmetry is why some commentators describe the US as the world's largest onshore secrecy jurisdiction for non-U.S. persons — a Brazilian tax resident holding a brokerage account in Miami will typically not have that account reported to Brazil under CRS (because the US is not in CRS) and only limited reporting flows the other way. It does not, however, help U.S. citizens or green card holders trying to escape U.S. reporting anywhere in the world, because FATCA reaches into every CRS-participating jurisdiction and, separately, U.S. taxpayers must file FBAR and Form 8938 themselves. The interaction of FATCA and personal filing is unpacked in the FBAR and FATCA reporting guide.

A short list of other non-participating jurisdictions exists — largely small or sanctioned economies with limited international banking infrastructure — but every meaningful cross-border banking centre is inside the system. The days when a mainstream Swiss, Liechtensteiner, Panamanian, or BVI account fell outside automatic exchange are over. Bank secrecy in the historical sense — where a foreign tax authority genuinely could not find out that an account existed — is a defunct concept for CRS-covered institutions. Numbered accounts still exist at some Swiss private banks, but the numbering is internal; the account holder's identity is still reported to their home jurisdiction if it is a CRS partner.

Switzerland, Singapore and the UAE under CRS

Each of the three financial centres most associated with wealth and residency planning treats CRS somewhat differently in operational practice.

Switzerland's inclusion is the most historically significant, given the country's earlier reputation for banking secrecy. Swiss institutions apply CRS rigorously and the country now exchanges with more than 100 partner jurisdictions. Swiss residents are themselves fully within scope of CRS reporting from other jurisdictions where they hold accounts, in addition to being taxed on worldwide income by their canton of residence.

Singapore uses CRS to fit its policy stance: it does not need aggressive information exchange to police its own tax base (because its territorial system means foreign-sourced income is largely not taxable for residents), but it must be a credible partner to retain access to the international financial system. IRAS handles the exchange competently and Singaporean banks apply full due diligence — a common surprise for new arrivals whose home country still considers them tax resident during a transitional year.

The UAE became a full CRS reporter from 2018 and is now a significant source of outbound reporting to residence jurisdictions in Europe, Asia and Latin America. A UAE-resident individual with a genuine 183-day presence, a UAE Emirates ID, a tax residency certificate from the Federal Tax Authority, and a bank account that self-certifies UAE residency will not have that account reported anywhere except back to UAE authorities (who do not use it for personal income tax purposes). A UAE-resident on paper only — spending most of the year elsewhere — will typically be reported to whatever jurisdiction the bank has flagged as the true centre of interests.

Common myths, briefly

"If I open the account before I move, my old country will never know." Pre-existing accounts have already been swept into CRS reporting under the pre-existing-account due diligence rules. The self-certification is triggered when residence data on file becomes unreliable — for example, when the customer updates their address.

"A holding company or trust shields me." CRS explicitly requires reporting institutions to look through passive non-financial entities to controlling persons, and through investment entities in non-participating jurisdictions to their equity and debt holders. The look-through is one of the standard's defining features.

"Small accounts are below the reporting threshold." There is no de minimis threshold for individual accounts under CRS. Pre-existing lower-value individual accounts had lighter due diligence, but the reporting itself has no floor. New accounts are reportable from opening.

"The tax authority is too under-resourced to actually use the data." This was somewhat true in the first few exchange cycles and remains partially true in some smaller jurisdictions. Major residence countries — including HMRC in the UK, the CRA in Canada, the ATO in Australia, and most EU tax authorities — now run automated matching against domestic filings and issue nudge letters and formal enquiries directly off CRS data.

"Perpetual traveller status makes me invisible." Every bank account still needs a declared tax residence. Claiming residence in a jurisdiction where the individual cannot actually obtain a residency certificate creates the worst of both worlds — this failure mode is explored in more detail in the perpetual traveller article.

Where to go next

For a foundational read on how tax residency is established in the first place, see the tax residency guide, and for how residence interacts with cross-border income, the treaties guide. To compare the three jurisdictions above on a like-for-like tax basis, use the country comparison tool or read the individual country pages for Switzerland, Singapore, and the UAE. Any position taken on the basis of CRS reporting risk should be reviewed with a qualified tax adviser in each jurisdiction involved before it is implemented.