Before the Standard: Thirty Years of Polite Failure
The idea that tax authorities should share information with one another is as old as tax treaties themselves. But for decades, cooperation rested on a single mechanism, exchange “on request”: one country’s tax agency, suspecting a taxpayer, sends a reasoned inquiry to its foreign counterpart. The flaw is obvious. To ask, you already have to know: the taxpayer’s name, the bank, ideally the account. Tax evasion consists precisely of making sure the government knows nothing. And many financial centers answered such requests by invoking banking secrecy, in some cases backed by criminal penalties.
The OECD took up the issue in 1998 with its report on “harmful tax competition,” followed in 2000 by a list of tax havens. The offensive bogged down, particularly after the Bush administration withdrew U.S. support in 2001. What came out of it was a model information exchange agreement in 2002 and, in 2005, a rewrite of Article 26 of the OECD’s model tax treaty establishing that a country cannot cite banking secrecy as grounds for refusing a request. On paper, that was progress. In practice, Switzerland, Luxembourg, Austria, and Belgium entered reservations, and nothing changed.
The European Union, for its part, tried something more ambitious. The Savings Directive of 2003, in force from July 2005, created automatic exchange for the first time: banks would report interest paid to residents of other member states. But the political compromise that made it possible gutted much of its substance. Austria, Belgium, and Luxembourg won the right to substitute an anonymous withholding tax, as did Switzerland under a parallel agreement. Worse, the directive covered only interest and only individuals. Shift a bond portfolio into stocks, or drop a Panamanian company or a Liechtenstein foundation between yourself and the account, and you were out of scope. Private bankers did it for their clients in a matter of weeks. The Savings Directive endures as a textbook case: a good idea ruined by its exceptions.
2008-2009: The Crisis Shifts the Balance of Power
It took two scandals and a financial crisis to break the logjam. The UBS and LGT affairs in 2008 exposed the industrial scale of evasion run out of Switzerland and Liechtenstein. At the same time, governments that had just bailed out their banks at enormous cost were looking for revenue and for someone to blame. On April 2, 2009, the G20 leaders meeting in London declared in their communiqué that the era of banking secrecy was over. The same day, the OECD published a gray list of uncooperative jurisdictions. The way off the list: sign 12 information exchange agreements.
The result looked spectacular. Within months, every holdout dropped its reservations on Article 26, and hundreds of agreements were signed. The Global Forum on Transparency and Exchange of Information for Tax Purposes, restructured in Mexico City in September 2009 and opened to all countries, launched peer reviews. But the standard was still exchange on request, and some havens signed their 12 agreements with one another, or with Greenland and the Faroe Islands. Economists Niels Johannesen and Gabriel Zucman would show in 2014 that this wave of treaties mostly shifted deposits from havens that signed to havens that hadn’t, with no meaningful repatriation.
Switzerland, sensing the wind changing, floated a counter-model: the “Rubik” agreements, under which its banks would levy a final withholding tax on foreign clients’ assets and remit it to their home countries without ever revealing who they were. The United Kingdom and Austria signed on. But Germany’s upper house, the Bundesrat, rejected its agreement in late 2012, and Rubik died with it. Anonymity in exchange for cash: the offer came too late.
The American Detonator
Because in the meantime, Washington had changed everything. By enacting FATCA in March 2010, the United States unilaterally required banks around the world to report their American clients or face a punitive 30% withholding tax on their U.S.-source income. For European governments, the position became politically untenable: how do you explain to voters that your banks automatically hand the IRS what they refuse to give their own tax authority, or the one next door?
On February 8, 2012, France, Germany, Italy, Spain, and the United Kingdom issued a joint statement with the United States on implementing FATCA through intergovernmental agreements. This “G5” immediately announced its intention to use those agreements as the template for a multilateral standard. A most-favored-nation clause in the EU’s directive on administrative cooperation finished the job: having agreed to give to the Americans, Luxembourg and Austria could no longer legally refuse their fellow Europeans. In April 2013, Luxembourg, then led by Jean-Claude Juncker, announced it would give up banking secrecy for nonresidents. The European lock had been picked.
From there, things moved fast, at least by diplomatic standards. In April 2013, G20 finance ministers endorsed automatic exchange as the future global standard. The G8 summit at Lough Erne in June, then the G20 in St. Petersburg in September, confirmed the goal and handed the OECD the mandate. At the organization’s tax policy center, run by Frenchman Pascal Saint-Amans, the staff built deliberately on FATCA’s Model 1 agreement: banks had already spent billions complying with it, and a standard that reused the same plumbing would be that much easier to accept. The Common Reporting Standard was unveiled in February 2014 and endorsed by G20 finance ministers in Sydney. The full text, with commentary, was approved by the OECD Council on July 15, 2014.
On October 29, 2014, in Berlin, 51 jurisdictions signed the multilateral agreement that brought it to life. Among them: Liechtenstein, Luxembourg, the Cayman Islands, Jersey. Switzerland signed a few weeks later. Five years had passed since the London G20 declaration. Four since FATCA.
The Legal Architecture: Three Layers
The CRS is not a treaty. It is a standard, meaning a set of model rules that each jurisdiction must write into its own law to bind its financial institutions. Its international legal force comes from elsewhere, from a layered structure worth describing precisely.
The foundation is the Convention on Mutual Administrative Assistance in Tax Matters, drafted by the OECD and the Council of Europe in 1988, amended in 2010, and opened to all countries the following year. Its Article 6 permits automatic exchange between parties that agree to it. The second layer is the Multilateral Competent Authority Agreement (MCAA), the document signed in Berlin, which spells out what is exchanged, when, and how. The third layer holds an important subtlety: the agreement is multilateral in form but bilateral in effect. Each jurisdiction files with the OECD a list of the partners it intends to exchange with, and a relationship goes live only if both sides have named each other. That lets a country decline to send data to a partner whose confidentiality safeguards it considers inadequate. Several thousand bilateral relationships are active today.
The European Union went its own way. Directive 2014/107/EU of December 9, 2014, known as DAC2, writes the CRS into EU law and makes exchange mandatory among member states. The Savings Directive, now redundant, was repealed in 2015. Mirror agreements were struck with Switzerland, Liechtenstein, Andorra, Monaco, and San Marino.
National implementation varies in its details. France, for example, codified the regime in its tax code, has its institutions report to the national tax authority for onward transmission, and tightened the rules in a 2018 anti-fraud law requiring banks to report account holders who refuse to provide a self-certification of tax residence.
Who Reports, and What
The mechanics borrow FATCA’s grammar. The obligation falls on “reporting financial institutions,” which come in four families: depository institutions, custodial institutions, investment entities, and insurance companies that issue cash-value or annuity contracts. The investment entity category is the broadest and the trickiest. It takes in funds and asset managers, but also many private wealth structures, trusts, and family holding companies, as long as their financial assets are professionally managed. A trust managed by a private bank is thus itself a financial institution, required to report on its own beneficiaries. Central banks, government entities, international organizations, and certain pension funds are excluded.
Covered accounts include deposit accounts, custodial accounts, equity and debt interests in investment entities, and cash-value insurance and annuity contracts. Each country may carve out products with a low risk of evasion, typically regulated retirement and employee savings plans, provided it lists them publicly.
For each reportable account, the institution transmits the holder’s name, address, jurisdiction or jurisdictions of tax residence, taxpayer identification number, date and place of birth, the account number, the year-end balance or value, and the year’s flows: interest, dividends, other income, and gross proceeds from the sale or redemption of financial assets. That last item is often underestimated. The receiving tax authority sees not just a snapshot but movement.
Due Diligence: Finding the Residence
The operational heart of the CRS is the identification procedure, which differs depending on whether the account predates the regime or was opened afterward.
For new accounts, the rule is simple: no self-certification, no account. The client states in writing where they are tax resident and provides their tax ID numbers, and the bank must check that statement for reasonableness against what it otherwise knows, including through its anti-money-laundering files. A client who claims to be a resident of Dubai but whose mail all goes to an address in Lyon presents a problem the bank is not allowed to ignore.
For preexisting individual accounts, the standard sets two tiers. Up to $1 million, the bank may rely on the residence address on file if it is supported by documentation, or otherwise run an electronic search for indicia: a mailing address or phone number in a foreign country, standing instructions to transfer funds there, a power of attorney granted to someone who lives there, or a hold-mail or “in care of” address as the only address on file. Above $1 million, enhanced review applies: a search of paper files and an inquiry with the relationship manager, whose personal knowledge of the client binds the institution. Accounts for which no residence can be established are reported as “undocumented,” which tends to draw the local tax authority’s attention.
Two major differences from FATCA stand out. First, the test is tax residence, not citizenship: the CRS has no equivalent of the “accidental American.” Second, there is no de minimis threshold for individual accounts, whereas FATCA let banks skip accounts under $50,000. A savings account with a few hundred euros left behind in a former country of residence is reportable. Only preexisting entity accounts get an optional $250,000 threshold.
Many countries have also adopted the “wider approach,” under which banks collect tax residence information from all foreign clients, not just those living in current partner countries, so they don’t have to redo the exercise every time a new jurisdiction joins.
Piercing the Structure: Looking Through Entities
The Savings Directive’s fatal flaw was the shell company. The CRS answers with a look-through rule. Entity account holders fall into two categories. “Active” non-financial entities, which essentially means businesses with genuine commercial operations, publicly traded companies, and nonprofits, are reported only in their own name. “Passive” entities, those with more than half their income or assets of an investment nature, get pierced: the bank identifies the “controlling persons” and reports them to their own country of residence.
The concept is borrowed from the beneficial ownership recommendations of the Financial Action Task Force, with a 25% ownership threshold in practice for companies. For trusts, the standard casts a deliberately wide net: the settlor, the trustees, the protector if there is one, and the beneficiaries are all deemed controlling persons, whether or not they exercise any actual control.
An anti-avoidance clause takes direct aim at countries outside the system: an investment entity located in a non-participating jurisdiction is treated as a passive entity. One notable consequence is that a U.S. fund or trust holding an account in Geneva or Singapore gets looked through, and its French or German beneficiaries are reported. The American shelter, as we’ll see, works only for assets held in the United States itself.
The Calendar and the Plumbing
The cycle is annual. Institutions report to their tax authority in the first half of the year following the reporting year, and tax authorities exchange the data by the end of September. Files follow a standardized XML schema and travel over an encrypted platform run by the OECD, the Common Transmission System, in service since 2017. The organization never sees the contents. It just provides the pipe.
Forty-nine “early adopter” jurisdictions, including nearly all of the EU, made their first exchanges in September 2017, covering 2016 data. Some 50 more, including Switzerland, Singapore, Hong Kong, and the Bahamas, followed in September 2018. Panama, initially a holdout, came around in 2016, a few weeks after the Panama Papers broke. More than 120 jurisdictions have now committed.
The volumes are staggering. According to the Global Forum, exchanges in 2019 covered 84 million accounts holding about €10 trillion in assets. By 2022, the figures were 123 million accounts and nearly €12 trillion.
What the Standard Changed
The most tangible effect came before the first exchange ever took place. Knowing transparency was inevitable, hundreds of thousands of taxpayers came clean through voluntary disclosure programs around the world. In France alone, a dedicated disclosure unit open from mid-2013 through the end of 2017 handled on the order of 50,000 cases and recovered roughly €8 billion. Worldwide, the Global Forum puts at more than €120 billion the additional revenue identified since 2009 through voluntary disclosures and offshore investigations, an aggregate figure to be handled with care, since it lumps together very different programs and counting methods.
Independent research points the same way. An OECD analysis published in 2019 found that bank deposits held by foreigners in international financial centers fell by roughly a quarter between 2008 and 2019, with automatic exchange accounting for a substantial share of the drop. Researchers Elisa Casi, Christoph Spengel, and Barbara Stage, in a 2020 paper, measured a decline of around 11% in cross-border deposits in tax havens attributable to the CRS. The EU Tax Observatory went further in its 2023 global report: offshore tax evasion by individuals has fallen by a factor of about three in ten years. Before 2013, the bulk of offshore financial wealth, the equivalent of 10% of world GDP, went untaxed; today that is true of only about a quarter. Gabriel Zucman, no one’s idea of an OECD cheerleader, calls it one of the few undeniable successes of international tax cooperation.
The Blind Spots
The picture has its dark areas, though, and the first is the size of a continent. The United States never joined the CRS. Washington maintains that its reciprocal FATCA agreements serve the same purpose, which is inaccurate: the information the IRS sends abroad is far more limited, with no account balances and no identification of the beneficial owners behind entities. The Casi, Spengel, and Stage study found that the United States was the only major financial center where cross-border deposits rose after the standard took effect. South Dakota, Nevada, and Delaware have built a trust industry on that asymmetry. The OECD, which owes its standard to American pressure, has never put the United States on a list of uncooperative jurisdictions.
The second gap is scope. The CRS covers only financial assets held through intermediaries. Directly owned real estate, physical gold, art, and the contents of safe deposit boxes and freeports fall outside it. The available research suggests that some of the wealth that left offshore accounts went into property, in London, Dubai, and elsewhere. Crypto assets and e-money, nonexistent or marginal when the standard was designed, weren’t covered either.
The third gap is residence itself. Since everything hinges on declared tax residence, all you have to do is buy one. A number of jurisdictions sell residence permits or passports in exchange for investment, with no requirement of actual physical presence. A European taxpayer holding a residence certificate from a Caribbean island can present it to the bank, which will then report the data to a government that will do nothing with it. In October 2018, the OECD published a list of high-risk programs and asked banks to apply extra scrutiny. It also drew up, that same year, mandatory disclosure rules for CRS avoidance arrangements, which the EU folded into its DAC6 directive requiring intermediaries to report the schemes they design.
The fourth limit is less visible: the North-South divide. To receive data, a country must show it can protect it and must have the systems to process it. Many developing countries, particularly in Africa, remain outside the system or are joining late, even though they are proportionally the hardest hit by capital flight. Conversely, several tax havens with no income tax participate on a “non-reciprocal” basis: they send, and ask for nothing back.
Finally, receiving data is not the same as using it. Matching millions of records to taxpayers, with transliterated names and missing or wrong tax ID numbers, takes resources not every tax agency has. The Global Forum has supplemented its reviews of legal frameworks with reviews of effectiveness in practice, and the first findings, in 2022, showed very uneven results. Concentrating data this sensitive also creates a risk of its own: after Bulgaria’s tax agency was hacked in 2019, several partners suspended their transmissions to Sofia. Lawyers, particularly in the United Kingdom, have also challenged the regime’s proportionality under the General Data Protection Regulation, so far without obtaining a landmark ruling from the EU’s Court of Justice.
CRS 2.0 and the Move Into Crypto
The OECD has undertaken the standard’s first major overhaul. In 2022, it adopted the Crypto-Asset Reporting Framework (CARF), which requires exchanges and other service providers to report their customers’ transactions along lines modeled on the CRS. In parallel, the CRS itself was amended: e-money and central bank digital currencies were brought in, indirect crypto investments through funds or derivatives were covered, and the data transmitted was enriched, particularly regarding the exact role of controlling persons, joint accounts, and the validity of self-certifications. The package was published in consolidated form in 2023.
Some 50 jurisdictions, this time including the United States, pledged in November 2023 to implement the CARF in time for first exchanges in 2027. The EU wrote both pieces into its DAC8 directive of October 2023, applicable from January 1, 2026. At the G20’s request, the OECD is also working on transparency for cross-border real estate ownership, the biggest of the remaining blind spots.
A Success, and Its Limit
The CRS accomplished what 30 years of tax diplomacy had not: it made bank opacity the exception rather than the rule. Fifteen years ago, keeping an undeclared account in Geneva or Luxembourg was routine practice among well-off Europeans. Today it is a criminal exposure that almost no established bank will take on. The standard got there without a binding treaty, without a world tax organization, through nothing more than peer pressure, blacklists, and the pull of an American statute.
That is also its limit. A system that owes its existence to one country’s power is powerless against that country. As long as the United States stays outside, the CRS will be a fine-mesh net stretched around a hole. And as long as residence can be bought and fortunes converted into apartments, banking transparency will mostly capture the people who can’t afford to get around it. The wider history of international tax cooperation picks up from here — BEPS, the global minimum tax, and the power struggle now testing all of it.