FATCA & CRS | Obligations for Reporting Financial Institutions for year 2025
FATCA and CRS are two important tax compliance regulations that certain financial institutions (including investment funds and securitisation vehicles) must comply with. This is particularly relevant as the Luxembourg tax authorities may impose penalties in case of breach of certain obligations.
Purpose
FATCA aims to prevent offshore tax evasion by certain U.S. Persons, including U.S. citizens and tax residents. It requires Foreign Financial Institutions to report information about their U.S. account holders. The goal is to increase transparency and prevent U.S. taxpayers from hiding assets and income abroad.
CRS is a global standard for the automatic exchange of financial account information between "participating jurisdictions". It is designed to allow tax authorities to identify and combat tax evasion and ensure that taxpayers are paying the right amount of tax in the right place.
Exemptions
Both FATCA and CRS have exemptions available, but their scope differs. FATCA exemptions are available for certain entities and financial accounts. These exemptions reduce the compliance burden on Financial Institutions and avoid unnecessary reporting.
In contrast, CRS exemptions are more limited and include certain types of financial accounts.
Mandatory reporting to Luxembourg tax administration
Reporting to Luxembourg tax authorities is mandatory for both FATCA and CRS regulations. The reporting in relation to fiscal year 2025 must be filed by 30 June 2026.
In certain cases, Financial Institutions can submit a report indicating that it has no reportable accounts (e.g., “Zero” or “nil” report).
Registration process for FATCA
Foreign Financial Institutions should generally register and obtain a Global Intermediary Identification Number ("GIIN") for FATCA purposes.
No registration is required for CRS.
Penalties for non-compliance
Significant sanctions apply for non-compliance with both FATCA and CRS.
- No (zero) reporting: EUR 10,000 (lump sum amount)
- Breach of obligations (mainly, due diligence and compliance set up): Up to EUR 250,000 (“Main Penalty”)
- No or incomplete/late/inaccurate reporting: Main Penalty + 0.5% of the amounts that should have been reported.
FATCA and CRS controls – guidance issued by the Luxembourg tax authorities in 2025
The Luxembourg tax authorities updated their CRS FAQ on 29 October 2025, where they have detailed three types of controls that may now be conducted:
- Classification control: to verify an entity’s status;
- Thematic controls: targeting specific due diligence or reporting aspects; and
- In-depth controls: assessing overall compliance with due diligence, reporting and record-keeping obligations – the latter involving on-site inspections and interviews, spanning several weeks.
Financial Institutions are also expected to maintain a detailed register of actions taken, written policies and procedures, and copies of annual reports filed.
The fact that the Luxembourg tax authorities have formalised and published such a detailed and structured audit framework indicates that scrutiny is expected to intensify. Non-compliance with due diligence, reporting and record-keeping obligations may lead to the Main Penalty.
If you need assistance with your FATCA and CRS reporting obligations, or with your due diligence policies and procedures, do not hesitate to reach out to us. We can help you to understand these regulations requirements, as well as to provide guidance on how to stay compliant and reduce the risk of penalties.
