Compliance
Is CRS reporting mandatory?
Yes — in every jurisdiction that has signed the Multilateral Competent Authority Agreement (MCAA), CRS is binding law on financial institutions, with significant penalties for failure.
Updated May 2026 · CRS.brief editorial
The legal basis
CRS itself is a model standard. It becomes binding when a jurisdiction implements it through domestic legislation — for example the EU's DAC2 directive, the UK's International Tax Compliance Regulations 2015, or Switzerland's AEOI Act. Once law, it applies without opt-out.
Who is obligated
| Party | Obligation |
|---|---|
| Banks & custodians | Identify, document, and report relevant accounts annually. |
| Investment entities | Same, plus look-through rules for passive NFEs. |
| Certain insurers | Report cash-value insurance and annuity contracts. |
| Account holders | Provide truthful self-certification; update on change of circumstances. |
| Tax authorities | Exchange received data with peer jurisdictions on time. |
Penalties for non-compliance
- Institutions: fines often per-account or per-day, plus reputational and licensing risk.
- Account holders: deliberately false self-certification is a criminal offence in many CRS jurisdictions, with fines up to USD $10,000 per declaration in some places.
Can an individual "opt out"?
No. If you are tax resident in a CRS jurisdiction and you hold a reportable account, the data will be reported. Refusing to self-certify typically forces the institution to treat you as undocumented and report you anyway — often with worst-case assumptions.