CRS / DAC2 reporting requirements
The framework page: obligations, filing population and penalty powers.
Read the requirements →The Common Reporting Standard is a due diligence exercise that ends in an XML file. This walks the whole path — classification, account review, message construction, submission and correction — in the order a reporting team meets it.
CRS classification comes before anything else, and it is where most scope errors start. An entity is a reporting financial institution if it is resident in a participating jurisdiction and falls into one of four categories: a custodial institution, a depository institution, an investment entity, or a specified insurance company. Council Directive 2014/107/EU imports these definitions into Union law, so an EU institution is testing itself against the same categories a non-EU participating jurisdiction applies.
Two classifications cause most of the trouble. Investment entity catches managed funds, certain holding vehicles and trusts whose gross income comes predominantly from investing in financial assets and which are managed by another financial institution. Specified insurance company is narrower than an insurance licence: it turns on whether the entity issues, or is obliged to make payments under, cash value insurance contracts or annuity contracts. Getting either wrong does not surface as a validation error — it surfaces as a jurisdiction asking why nothing was filed.
A group with entities in several jurisdictions classifies each entity separately. The same product, sold from two entities, can be reportable in one place and out of scope in the other.
An account is reportable when the holder — or a controlling person of a passive non-financial entity holder — is tax resident in a reportable jurisdiction. Reaching that answer is a due diligence procedure, not a database query.
What ends up in the file is narrow: identity and residence data, the tax identification number, date of birth for individuals, the account number, the account balance or value as at the end of the reporting period or at closure, and payment amounts by type — interest, dividends, other income and gross proceeds — according to the account category.
The reporting period is the calendar year. Financial institutions file to their own tax authority; the authority then exchanges with partner jurisdictions. Under the Directive, EU Member States exchange within nine months of the end of the calendar year to which the information relates, which sets the outer boundary — domestic filing dates sit inside it and are set jurisdiction by jurisdiction.
Two practical consequences follow. First, a group filing in several jurisdictions runs several different domestic dates against a single dataset, so the data has to be frozen once and released repeatedly rather than rebuilt per filing. Second, the residence data used to determine reportability is the position during the reporting period, not the position when the file is prepared — a holder who moved after period end is still reported against the earlier residence.
Always confirm the current domestic date with the tax authority you file to; national dates move, and extensions are granted locally.
The submission is an XML message built on the OECD CRS XML Schema. Jurisdictions publish national variants, but the backbone is constant.
| Element | What it carries |
|---|---|
| MessageSpec | Sending and receiving jurisdiction, a unique message reference, the message type, the reporting period end date and the message contents indicator. |
| ReportingFI | The identity of the filing institution, including its identification number and address, plus its own document specification block. |
| AccountReport | One block per reportable account: account number and type, holder or controlling-person identity, residence, tax identification number, balance and payment amounts. |
| DocSpec | Per-record provenance: the document type indicator, a unique document reference and, for amendments, the references of the record being corrected. |
Two identifiers do the heavy lifting. MessageRefId must be unique across every message a jurisdiction has ever received from the filer. DocRefId must be unique across every record, permanently — not per file and not per period — because it is the anchor a later correction points at. Reusing either is the single most common cause of a file being rejected on receipt.
Schema validity and acceptance are different tests. A file can be well-formed, valid against the schema, and still be rejected by the receiving system.
MessageRefId or DocRefId, usually caused by regenerating a file after a partial submission.The schema handles amendments through the document type indicator rather than by resending the whole population. A record is marked as new data, as a correction of an earlier record, or as a deletion of one; corrections and deletions carry the message and document references of the original so the receiving authority can trace the chain. Sending a full replacement file with new identifiers does not correct anything — it creates a duplicate population.
Where a jurisdiction requires it, a nil return is filed using the message type that signals there is no data to report. Nil-return practice is not uniform: some authorities require one, some accept one, and some reject it. Confirm the treatment for each jurisdiction you file into.
Primary instruments only. Each is named in full so the reference remains traceable even if a link moves.
REGREP is an independent software provider. This record explains a reporting framework in plain language and is not legal, tax or regulatory advice. Confirm scope, thresholds and submission dates with your competent authority before you file.
More on this framework, and the module that produces the filing.
The framework page: obligations, filing population and penalty powers.
Read the requirements →One dataset, several authorities and several schema variants.
Read use case →Map, validate and export the submission file from your own account data.
See the module →Run a period of real data through the mapping and validation, and read the full validation report before you commit to anything.