CRS, FATCA, and the Family Office Reporting Stack

Why the reporting environment changed permanently

For most of the twentieth century, the practical barrier to cross-border tax enforcement was informational. A family with accounts in Zurich, a holding company in the Cayman Islands, and beneficial owners in three countries could reasonably expect that no single tax authority possessed a complete picture of the structure. That asymmetry no longer exists in any meaningful operational sense. The OECD's Common Reporting Standard, activated in 2017 for early adopters and now covering more than 120 jurisdictions, created an automated, annual pipeline of financial account information flowing between tax authorities worldwide. The United States, through FATCA—the Foreign Account Tax Compliance Act enacted in 2010 and operationally live by 2014—built an analogous but distinct architecture that preceded CRS and in several respects exceeds it in reach. Within the European Union, the Directive on Administrative Cooperation, now in its seventh iteration (DAC7, effective 2023), adds mandatory disclosure obligations for digital platform operators and intermediaries that layer directly onto CRS and FATCA. The cumulative effect is that a competent, well-resourced family office operating in 2026 should assume that material financial information about every structure it manages has already been exchanged, will be exchanged, or can be obtained on request within weeks.

The families that lose in this environment are not primarily those engaged in deliberate evasion—enforcement against that group was always the stated objective. The families that lose are those who built governance structures in an earlier era, have not systematically re-classified their entities under modern reporting frameworks, and whose compliance programs lag behind both the law and the data already in circulation. Penalties are real and compounding. Reputational exposure from automatic exchange landing in the wrong jurisdiction is not hypothetical. The operational challenge is not understanding that these regimes exist—most sophisticated families do—but building a reporting stack that is accurate, consistent across all jurisdictions of exposure, and sustainable year over year.

CRS: what it does and how it works

CRS stands for Common Reporting Standard, the OECD framework adopted in 2014 and modelled in part on the intergovernmental agreement structure that FATCA created. Under CRS, financial institutions—defined broadly to include depository institutions, custodial institutions, investment entities, and specified insurance companies—are required to identify the tax residency of their account holders, apply defined due diligence procedures to determine whether those holders are reportable persons, and then report relevant account information to their domestic tax authority. That domestic authority automatically transmits the information annually to the tax authority in each reportable jurisdiction. The data fields exchanged include account balances, gross interest, dividends, and other income, and gross proceeds from the sale of financial assets—a scope wide enough to reconstruct a meaningful portion of a family's financial profile.

The critical operational question for any family office is entity classification under CRS. An entity is either a Financial Institution (FI) or a Non-Financial Entity (NFE). If it is an FI, it has its own reporting and registration obligations. If it is an NFE, it is either Active or Passive. A Passive NFE—which captures most family holding companies and investment vehicles—requires the financial institution where it holds accounts to look through it to its Controlling Persons and report their tax residencies. In practice, this means that a Liechtenstein foundation holding a brokerage account in Luxembourg will trigger reporting on the foundation's Controlling Persons—typically the settlor, protector, and in some cases discretionary beneficiaries—to Luxembourg's tax authority, which will then exchange that data with the relevant jurisdictions. Families that have provided self-certifications to their banks without a formal entity classification analysis risk both over-reporting (unnecessary disclosure) and under-reporting (penalty exposure).

CRS does not simply report accounts. It reports the beneficial economic interest behind accounts. A family that classified its holding structure in 2016 and has not revisited that classification has likely misclassified it under the 2023 and 2024 guidance updates from multiple participating jurisdictions.

The investment entity classification trap

Under the CRS Commentary and the domestic implementing legislation of most participating jurisdictions, an entity whose gross income is primarily attributable to investing, reinvesting, or trading in financial assets is classified as an Investment Entity—a sub-category of Financial Institution. This classification is far more prevalent among family office structures than most advisors acknowledge. A family holding company that earns 95% of its income from a portfolio of listed equities, fixed income, and alternative fund interests is, on a plain reading of the standard, an Investment Entity. As an Investment Entity, it is itself a Reporting Financial Institution with obligations to register with relevant authorities, conduct due diligence on its own account holders, and file reports. Most family holding companies that have not sought specific regulatory guidance in their domicile are not complying with these obligations. The exposure is material: HMRC, for example, has specifically flagged Investment Entity misclassification as an audit priority in its 2024-2025 compliance programme.

FATCA: the US-specific architecture and its global reach

FATCA was enacted as part of the Hiring Incentives to Restore Employment Act of 2010, primarily as a mechanism to fund domestic employment incentives by recovering offshore tax. Its architecture is distinct from CRS in ways that matter operationally. FATCA imposes a 30% withholding tax on US-source payments made to Foreign Financial Institutions (FFIs) that have not entered into an agreement with the IRS to report on their US accountholders. This withholding mechanism—absent from CRS, which relies entirely on information exchange—created a powerful commercial incentive for non-US financial institutions to participate. As of 2025, approximately 500,000 FFIs are registered with the IRS's FATCA registration system, a figure that understates the actual compliance universe because Model 1 Intergovernmental Agreement (IGA) jurisdictions report through their domestic tax authority rather than directly to the IRS.

For a family office advising on FATCA family office structures, the key distinction is between the obligations of the family's financial institutions and the obligations of US persons within the family. FFIs report to the IRS (or their domestic authority under a Model 1 IGA) on accounts held by US persons or US-owned foreign entities. Separately, US persons themselves face their own reporting stack: the Report of Foreign Bank and Financial Accounts (FBAR) under 31 USC 5314 for any US person with signature authority or financial interest in a foreign financial account exceeding USD 10,000 at any point during the year; Form 8938 under IRC Section 6038D for specified foreign financial assets above thresholds that vary by filing status and residency; and entity-level reporting on Forms 5471, 5472, 8865, and 8858 for interests in foreign corporations, partnerships, and branches. Each of these obligations is independent. Non-filing penalties for Form 5471, for example, begin at USD 10,000 per form per year and can reach USD 50,000 per form per year after IRS notice, with potential criminal exposure for willful failure.

PFIC and GILTI: the substantive tax overlay

FATCA's reporting obligations are compounded for US persons in family office structures by two substantive tax regimes that generate their own compliance requirements. The Passive Foreign Investment Company (PFIC) rules under IRC Sections 1291-1298 apply to any foreign corporation in which 75% or more of gross income is passive, or 50% or more of assets produce or are held to produce passive income. Most foreign family investment holding companies meet this definition. A US beneficiary or shareholder in a PFIC is subject to a punitive default tax treatment—the Excess Distribution Regime—unless a timely Qualified Electing Fund (QEF) election or Mark-to-Market election is made. The QEF election requires the PFIC to provide annual PFIC Annual Information Statements, which many foreign holding companies neither prepare nor know they are obligated to provide. The Global Intangible Low-Taxed Income (GILTI) regime, introduced by the Tax Cuts and Jobs Act of 2017, requires US shareholders of Controlled Foreign Corporations (CFCs) to include a portion of the CFC's net income annually, regardless of distribution. For family office structures with US persons holding more than 10% (by vote or value) in foreign corporations, the interaction between GILTI, Subpart F income, and FATCA reporting creates a compliance matrix that requires deliberate, annual management.

DAC6 and DAC7: the EU's disclosure overlay

The European Union's Directive on Administrative Cooperation has undergone successive expansions since its original 2011 form. DAC6, transposed by EU member states with effect from July 2020, requires intermediaries—lawyers, accountants, financial advisors, and banks—to report cross-border arrangements that meet any of five defined hallmarks to the tax authority of the relevant member state. Those hallmarks cover a range of structuring features: arrangements with a main benefit test where one of the principal benefits is a tax advantage; arrangements involving deductible cross-border payments to zero or low-tax recipients; arrangements that circumvent the automatic exchange reporting obligations under CRS; and arrangements involving hard-to-value intangible assets, among others. Where no reportable intermediary exists in the EU (for example, because all advisors are non-EU), the reporting obligation falls on the taxpayer directly.

DAC7, effective from January 2023, extended reporting obligations to digital platform operators required to collect and report information on sellers using their platforms. For family offices, the more immediately relevant development is the context DAC7 creates for the Commission's next phase: DAC8, under discussion through 2024-2025, proposes to extend CRS to cover crypto-assets and e-money, consistent with the OECD's Crypto-Asset Reporting Framework (CARF) published in 2022 and adopted by more than 50 jurisdictions for exchange beginning in 2027. A family office that holds digital assets—directly or through fund interests—should be building the classification and reporting infrastructure now rather than treating CARF as a future problem. The lead time between a framework being adopted and financial institutions demanding self-certifications is typically 12 to 18 months.

DAC6's hallmark D specifically targets arrangements designed to undermine CRS. This means that a restructuring undertaken to reduce CRS reporting exposure is itself potentially reportable under DAC6. The regimes are deliberately self-reinforcing.

Distinguishing US-resident, non-US-resident, and dual-resident families

The most important variable in designing a family's reporting stack is the residency and citizenship profile of its members. Three broad categories require materially different approaches, though in practice most multigenerational families straddle more than one.

US-resident families with no non-US members

A family entirely composed of US citizens and US tax residents faces FATCA primarily as a recipient of information (their foreign financial institutions are reporting on them) and as filers of the domestic reporting forms—FBAR, Form 8938, and entity-level forms. Their primary CRS exposure is indirect: they are the Controlling Persons or beneficial owners that foreign financial institutions are identifying and reporting. The practical implication is that the IRS now receives data from foreign institutions on accounts the family may never have reported, creating a triangulation risk where institution-level data contradicts (or simply supplements) the family's self-reported position. The IRS's use of FATCA data in audit selection has increased measurably since 2019: the agency's 2024 Annual Report to Congress on offshore tax evasion cited FATCA data as contributing to more than 4,200 enforcement actions in the 2023 fiscal year, up from approximately 2,800 in 2020. US-resident families should assume their foreign account data is being systematically compared against their filed returns.

Non-US-resident families with no US persons

A family with no US persons—no US citizens, no US green card holders, no individuals meeting the substantial presence test—has no FATCA filing obligation as taxpayers. Their exposure is as the subjects of CRS reporting by their financial institutions. The operational priorities for this family are: ensuring that self-certifications provided to financial institutions accurately reflect tax residency and entity classification; monitoring changes in CRS participation status in jurisdictions where they hold assets; and managing the interaction between CRS data flows and domestic disclosure requirements in their country of residence. A British-resident family with a Jersey trust, a Luxembourg holding company, and a Cayman fund interest will be reported on by all three structures' financial institutions. Jersey reports to HMRC, Luxembourg reports to HMRC, and the Cayman administrator reports to the Cayman Tax Information Authority, which exchanges with HMRC. HMRC cross-references this against the family's self-assessment returns and trust registration entries. The compliance gap, where it exists, is typically not between the CRS data and what the family knows—it is between the CRS data and what the family has disclosed.

Dual-resident and mixed families: the maximum complexity case

A family with members who are US persons and members who are not—or a family that has relocated across jurisdictions, triggering simultaneous or sequential tax residencies—faces the full reporting stack simultaneously. Consider a family in which the patriarch is a US citizen resident in Switzerland, the matriarch is a Swiss national with no US ties, and their two adult children are UK tax residents who hold green cards. The family holds assets through a Cayman Islands fund, a British Virgin Islands holding company, and a Swiss private bank account. The patriarch is subject to FATCA reporting by all three structures, FBAR and Form 8938 filing obligations, and potentially CFC and PFIC inclusion rules. The matriarch is subject to CRS reporting by the Swiss bank to the Swiss tax authority (and any other jurisdictions of her tax residency). The children, as US persons, are subject to FATCA reporting, and as UK tax residents, their Swiss bank may also report them under CRS to HMRC. The BVI holding company must self-certify its status under both FATCA and CRS—and if it is an Investment Entity managed by a professional manager, it may itself be a Reporting Financial Institution under both regimes. This family requires a consolidated reporting matrix, reviewed at least annually, that maps each family member's obligations, each entity's classification, and each jurisdiction's filing calendar.

BEPS Pillar Two and the data cross-reference risk

The OECD's BEPS Pillar Two framework, establishing a 15% global minimum tax on the profits of large multinational enterprises (broadly, those with consolidated revenues exceeding EUR 750 million), is directly relevant to the largest family office structures. Family-owned operating groups that meet the threshold are subject to the Income Inclusion Rule and the Undertaxed Profits Rule, and must file GloBE Information Returns—a new category of cross-border disclosure—in each jurisdiction where they operate. For family offices below the revenue threshold, the indirect relevance of Pillar Two is the data infrastructure it creates. Tax authorities in EU member states that have enacted Pillar Two domestic legislation (the EU minimum tax directive, Directive 2022/2523, effective from fiscal years beginning after 31 December 2023) are building GloBE data collection capabilities that sit alongside and integrate with CRS exchange data. The practical consequence is that tax authorities are developing increasingly granular, cross-referenced views of corporate structures and their economic substance—capabilities that migrate, in amended form, to the audit of family office structures over time.

The economic substance requirements that Pillar Two reinforces are particularly relevant to family office holding structures in low-tax jurisdictions. A BVI or Cayman holding company that routes income through without demonstrating genuine management and control, decision-making, and economic presence is increasingly exposed not only to CRS-triggered scrutiny but to domestic anti-avoidance provisions in the jurisdictions of the family's residence. The UK's Offshore Anti-Avoidance Legislation, Ireland's Section 806 transfer of assets abroad provisions, and Germany's Außensteuergesetz foreign tax rules all draw on the same information flows that CRS and FATCA generate.

Building the operational reporting stack

The governance response to this environment is not primarily a technology challenge, though technology is a necessary enabler. It is an analytical and organisational challenge. A family office that cannot answer the following questions with documented, current, legal-quality analysis is operating with unacceptable compliance risk: What is the FATCA and CRS classification of each entity in the structure? Which family members are US persons, and has that status been reviewed in the last 12 months? What self-certifications have been provided to financial institutions, and are they accurate as of the current date? What disclosure obligations exist in each jurisdiction of the family's activity? Is there a documented DAC6 analysis for each restructuring completed in the last six years?

The entity classification exercise

Entity classification should be treated as a standing annual obligation, not a one-time exercise. The classification of a family entity can change based on: changes in the entity's income mix (a holding company that begins to operate a business may shift from Passive NFE to Active NFE); changes in the entity's ownership or management (a new US person beneficiary triggers FATCA classification); changes in the jurisdiction's implementing legislation (Luxembourg updated its CRS implementing law in 2024 to align with revised OECD Commentary, altering the treatment of certain collective investment vehicles); and changes in the family's residency profile. The classification exercise should be documented in a legal memorandum, reviewed by tax counsel in the relevant jurisdiction, and retained as evidence of reasonable care in the event of a compliance inquiry. The cost of this documentation is trivially small relative to the penalty exposure it mitigates.

The annual compliance calendar

A family office managing a multi-jurisdictional structure should maintain an annual compliance calendar that maps every filing obligation by jurisdiction, deadline, and responsible party. The filing cadence for a family with US persons and EU-connected structures will include: FBAR due by 15 April with automatic extension to 15 October; Form 8938 with the US tax return; Forms 5471 and 8865 with the US tax return; FATCA reporting by non-US financial institutions (typically September or October in Model 2 IGA jurisdictions, or as specified by the relevant domestic authority); CRS reporting by financial institutions (typically between June and September depending on jurisdiction); DAC6 filings within 30 days of implementation of a reportable arrangement; and UK Trust Registration Service updates within 90 days of any change. Failure to own this calendar—to have named individuals responsible for each filing—is itself a governance failure that any competent family office board should identify and remediate.

Adviser coordination and the information silo problem

The most common operational failure in family office reporting is not ignorance of the rules—it is the fragmentation of information across advisers who do not communicate with each other. A US tax attorney prepares the family's US returns without full visibility into the CRS self-certifications their Swiss bank has filed. A Cayman administrator classifies a structure as a Non-Reporting Financial Institution without coordinating with the Jersey trust company that is relying on a different classification. A London solicitor advises on a restructuring without triggering a DAC6 analysis because the tax consequences are handled by a separate firm. The solution is a designated compliance coordinator—whether an internal chief operating officer, an external multi-family office, or a lead adviser with a defined mandate—whose explicit responsibility is to maintain the entity classification matrix, coordinate adviser communications, and own the compliance calendar. This role is not glamorous. It is, however, the single most effective risk mitigation a family can implement.

The families that manage CRS and FATCA exposure well are not the ones with the most sophisticated structures. They are the ones where someone, with authority and information, owns the compliance function as a year-round operational priority.

Penalty exposure and enforcement trends

The penalty landscape for CRS and FATCA non-compliance has hardened materially since 2020. In the United States, the IRS's Large Business and International Division has allocated specific audit resources to FATCA compliance, and the Department of Justice's Tax Division maintained an active offshore enforcement docket through 2024 with prosecutions in multiple jurisdictions. FBAR civil penalties for non-willful violations were previously capped at USD 10,000 per violation, but the Supreme Court's 2023 decision in Bittner v. United States (598 U.S. 85) clarified that the per-violation penalty applies per account per year rather than per form per year—providing modest relief while confirming that multi-account non-filers face compounding exposure. Willful FBAR penalties remain at the greater of USD 100,000 or 50% of the account balance per violation.

In the EU, enforcement of CRS obligations is primarily a domestic matter, but several member states have moved from passive administration to active cross-referencing. France's Direction Générale des Finances Publiques (DGFiP) has used CRS data to generate more than EUR 1.2 billion in additional assessments since 2018, according to figures published in the DGFiP's 2023 annual report. Germany's Bundeszentralamt für Steuern has issued formal requests to dozens of major financial centres for supplemental information when CRS data appeared inconsistent with domestic filings. Switzerland, despite not being an EU member state, exchanges under both CRS and a bilateral arrangement with the EU, and has progressively tightened its domestic implementing ordinance to reduce the ability of account holders to use classification arguments to avoid exchange. The direction of travel across all jurisdictions is toward more automated cross-referencing, faster identification of discrepancies, and shorter windows between data receipt and enforcement action.

Looking forward: CARF, DAC8, and the closing of remaining gaps

The OECD's Crypto-Asset Reporting Framework, published in 2022 and scheduled for first exchanges in 2027 among the 50+ adopting jurisdictions, extends CRS-equivalent reporting to crypto-asset service providers. This addresses what has been, since approximately 2017, the most significant remaining informational gap in the automatic exchange architecture. A family holding digital assets through a non-custodial wallet faces no current reporting obligation from the wallet infrastructure—but the exchanges and custodians through which those assets were acquired or through which they generate yield are already within the CARF reporting perimeter in adopting jurisdictions. DAC8, the EU's domestic implementation of CARF currently in legislative process, adds an EU-specific layer that will require crypto-asset service providers operating in the EU to register and report from 2026.

The broader trajectory is unambiguous: the informational advantage that offshore and cross-border structures historically provided is being systematically eliminated through a combination of automatic exchange, mandatory disclosure, and increasingly sophisticated data analytics at the authority level. The families that position themselves well are not those that resist this trend—the cost of resistance, in penalties, remediation, and reputational exposure, substantially exceeds any remaining opacity benefit. They are the families that treat reporting compliance as a core governance function, invest in the analytical infrastructure to maintain accurate classifications and complete filings, and engage competent, coordinated advisers who communicate across jurisdictions. The reporting stack is complex, but its logic is consistent: authorities want to know where income arises, who benefits, and whether the appropriate tax has been paid. A family office that can answer those questions with documentary confidence, across every jurisdiction of activity, has transformed a compliance burden into a governance asset.