Key Takeaways

  • Financial institutions in over 100 participating jurisdictions must report account data annually to their local tax authority for automatic exchange.
  • CRS 2.0 takes effect 1 January 2026 in most jurisdictions, adding new data fields and expanding scope to cover electronic money products and central bank digital currencies.
  • EU member state penalties for CRS non-compliance range from EUR 10,000 to EUR 250,000 per failure depending on the jurisdiction.
  • Auditors assess whether the entity has correctly classified itself as a reporting or non-reporting financial institution and whether due diligence procedures match the CRS categories.

What is CRS (Common Reporting Standard)?

CRS obliges every reporting financial institution (banks, custodians, certain investment entities, and specified insurance companies) to apply due diligence procedures that identify whether an account holder is tax-resident in another participating jurisdiction. Section II of the CRS distinguishes between pre-existing accounts and new accounts, with different identification rules for each. For new individual accounts, the institution must obtain a self-certification at account opening that includes the holder's jurisdiction(s) of tax residence and taxpayer identification number(s). For pre-existing accounts, the institution reviews its records and applies residence-address tests or electronic-record searches.

Reportable accounts trigger annual reporting under Section I. The institution reports the account holder's name, TIN, jurisdiction of residence, account balance at year-end, and total gross amounts of interest, dividends, other income, and gross proceeds from sales. The local tax authority exchanges this data with the holder's residence jurisdiction under the competent authority agreement. Within the EU, DAC2 implements CRS as a binding directive, and DAC8 (effective 1 January 2026) extends scope to crypto-assets while aligning reporting fields with CRS 2.0. For auditors of financial institutions, the CRS classification of the entity determines whether it must report; errors in that classification trigger penalties and reputational damage with the tax authority.

Worked example: Rossi Alimentari S.p.A.

Client: Italian food production company, FY2025, revenue EUR 67M, IFRS reporter. Rossi holds a 100% subsidiary, Rossi Treasury S.r.l., which manages the group's cash pooling and intercompany lending. The question is whether Rossi Treasury qualifies as a reporting financial institution under CRS.

Step 1 — Classify the entity under CRS Section VIII: Rossi Treasury earns interest from intercompany loans and deposits excess cash with external banks. Under CRS Section VIII.A.6(b), an entity qualifies as an investment entity if its gross income is primarily attributable to financial assets and it is managed by another financial institution. Banca Intesa manages the cash pool. Rossi Treasury meets the investment entity definition.

Documentation note: record the CRS entity classification analysis, the percentage of gross income derived from financial assets (here: 94% of Rossi Treasury's EUR 3.2M gross income comes from intercompany interest and bank deposit interest), and the basis for concluding the entity is managed by a financial institution. Reference CRS Section VIII.A.6(b).

Step 2 — Identify reportable accounts: Rossi Treasury's only "account holders" are the parent (Rossi Alimentari S.p.A.) and two sister subsidiaries, all Italian tax-resident. Because every holder resides in the same jurisdiction as the reporting entity, no reportable accounts exist for FY2025. Adding a German subsidiary to the cash pool would change that: the German entity's account would become reportable for exchange with Germany.

Documentation note: record the account-holder identification, the tax residence of each cash pool participant, the conclusion that no reportable accounts exist, and the self-certifications obtained from each group entity. Reference CRS Section II.D.

Step 3 — Assess CRS 2.0 impact for FY2026 onward: Under the amended CRS (effective 1 January 2026), Rossi Treasury must report additional data elements including the type of account (equity or debt interest) and whether each self-certification is valid. The Italian transposition of DAC8 will require updated reporting XML using CRS Schema v4.0.

Documentation note: flag CRS 2.0 transition requirements in the FY2025 management letter. Record the gap analysis between current data capture and expanded reporting fields required from 1 January 2026.

Step 4 — Evaluate the financial statement impact: Rossi Treasury's CRS compliance costs (systems upgrade for CRS 2.0 and external adviser fees) total EUR 85,000 in FY2025, recognised as administrative expenses. No provision is required under IAS 37 because no penalty proceedings exist. The auditor confirms the classification is defensible by reviewing income composition and management arrangements.

Documentation note: record the CRS entity classification assessment and the absence of penalty exposure. Note the CRS 2.0 transition plan status. Cross-reference to the uncertain tax positions analysis under IFRIC 23.

Conclusion: Rossi Treasury qualifies as a reporting financial institution under CRS but has no reportable accounts in FY2025 because all cash pool participants are Italian-resident, and the classification is defensible because the income composition and management structure are documented against the CRS Section VIII definitions.

What reviewers and practitioners get wrong

  • Groups frequently fail to assess whether treasury vehicles, cash pooling entities, or holding companies qualify as financial institutions under CRS Section VIII. The CRS definition of "investment entity" captures entities whose gross income is primarily from financial assets if they are managed by another financial institution. When the entity is misclassified as a non-financial entity, the reporting obligation is missed entirely, and the local tax authority may impose penalties retrospectively once the error surfaces during an exchange-of-information review.
  • Practitioners often treat CRS compliance as a banking-sector obligation with no relevance to the statutory audit of a non-financial group. IAS 37.14 requires recognition of a provision when a present obligation from a past event makes an outflow probable and the amount can be reliably estimated. If the entity has failed to register or report under CRS and the tax authority has a track record of enforcement, the auditor must assess whether a penalty provision is needed. Ignoring this assessment leaves the contingent liability disclosure incomplete.

Related terms

Frequently asked questions

Does CRS apply to my audit client if it is not a bank?

Yes. CRS applies to any entity meeting the definition of a reporting financial institution under Section VIII, which covers investment entities, custodial institutions, depository institutions, and specified insurance companies. A corporate treasury subsidiary earning primarily financial income and managed by a bank qualifies as an investment entity. Review the entity's income composition against CRS Section VIII.A.6(b) during acceptance.

What changes under CRS 2.0 from 1 January 2026?

CRS 2.0 expands scope to electronic money products and central bank digital currencies, adds new reporting fields (account type, self-certification validity, controlling person roles), and introduces XML Schema v4.0. DAC8 transposes these changes within the EU. Financial institutions must update due diligence procedures before the first CRS 2.0 reporting deadline in 2027 (for 2026 data). Transitional relief defers controlling person role data for pre-existing accounts until 2028.

How do I document CRS entity classification in the audit file?

Record the entity's gross income split between financial and non-financial sources and identify whether the entity is managed by another financial institution. Map the conclusion to the CRS Section VIII definition. Include self-certifications obtained from account holders. Cross-reference the analysis to the tax risk assessment and to any transfer pricing documentation covering intercompany financial arrangements.