CRS and Automatic Exchange of Information in 2026: Classifying the Entity and the Account, Getting the Self-Certification Right, and the Mistakes That Cost Most

CRS classification begins with the entity, not the account: you first decide whether a person is a Financial Institution or a Non-Financial Entity, and only then which of its accounts are reportable. The Common Reporting Standard is the OECD’s standard for the automatic exchange of financial account information, brought into UAE law by Cabinet Resolution No. 93 of 2021 and Ministerial Resolution No. 134 of 2021. An error at the first step invalidates everything that follows: a wrong entity status produces either unfiled reports or reports on accounts that never had to be reported at all.

Important. In the UAE the costliest single mistake falls on the customer, not on the bank. Article 5(1)(a) of Cabinet Resolution No. 93 of 2021 imposes a penalty of AED 20,000 on an Account Holder or Controlling Person who supplies information in a self-certification knowing, or in circumstances where they should have known, that it was inaccurate. It is one of the few CRS penalties anywhere aimed squarely at the client rather than the institution. The second-largest risk runs the other way: the UAE has no domestic Excluded Accounts and no domestic Non-Reporting Financial Institutions at all. Annexes 1 and 2 to the Ministry of Finance Guidance Notes each say “None” — only the OECD’s own categories are available, and any claim of a “local exemption” rests on nothing.

The Legal Framework: Three Layers That Must Not Be Conflated

CRS obligations in the UAE arise from three independent layers: the OECD Standard, the international exchange agreements, and UAE domestic law. Each does something distinct: the OECD sets the substance of the rules, the agreements determine which jurisdictions are exchange partners, and UAE law supplies the binding force, the deadlines and the penalties.

The OECD layer:

•          Standard for Automatic Exchange of Financial Account Information in Tax Matters — first edition 2014, second edition 2017 (Standard plus Commentaries).

•          International Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023 update to the Common Reporting Standard — OECD publication of 8 June 2023, DOI 10.1787/896d79d1-en. It contains the Crypto-Asset Reporting Framework (CARF) and the CRS amendments the market calls CRS 2.0. Both were approved by the OECD Committee on Fiscal Affairs on 26 August 2022.

•          Consolidated text of the Common Reporting Standard (2025) — the OECD’s unofficial consolidation of the amended CRS, published April 2025, DOI 10.1787/055664b1-en. The amended-text quotations in this article come from it.

•          CRS-related Frequently Asked Questions — OECD interpretive guidance, last updated December 2025.

•          Model Mandatory Disclosure Rules for Addressing CRS Avoidance Arrangements and Opaque Offshore Structures — a separate model regime published 8 March 2018.

The UAE’s treaty layer:

•          Multilateral Convention on Mutual Administrative Assistance in Tax Matters (MAC), ratified by Federal Law No. 54 of 2018.

•          Multilateral Competent Authority Agreement (CRS MCAA), ratified by Federal Law No. 48 of 2018. Section 2 of the Ministry of Finance Guidance Notes: “The MAC was ratified according to Federal Law No. 54 of 2018 and the MCAA according to Federal Law No. 48 of 2018”. A caveat: the Ministry’s own CRS 2.0 announcement calls the same instrument “Federal Decree No. (48) of 2018” — an inconsistency within the Ministry’s own publications; the Guidance Notes wording is the one to follow. Author’s assessment: the Ministry of Finance dates both the signing of the MCAA declaration and the signing of the Convention itself to April 2017 without giving days; no exact dates appear in accessible primary sources.

•          The CRS regime went live in the UAE on 1 January 2017, the first reporting deadline fell on 30 June 2018, and the first exchanges took place, in the Guidance Notes’ words, “on or after 30 September 2018” — domestic regulation therefore lagged the international commitment, which is exactly why there are two Cabinet Resolutions, one from 2020 and one from 2021.

UAE domestic law — the operative chain:

•          Insurance Authority Board of Directors Decision No. 32 of 2017 on the CRS Regulations, effective 29 September 2017 and shown as In-Force in the Central Bank of the UAE Rulebook. Author’s assessment: SCA Chairman Decision No. (21/Chairman) of 2020 does not appear on the Capital Market Authority’s live automatic-exchange page; its current status could not be confirmed against primary sources and it should not be relied on.

•          Federal Decree-Law No. 32 of 2025 Regarding the Capital Market Authority, issued 1 October 2025, in force 1 January 2026. Article 2(3) replaces the designation “Securities and Commodities Authority” with “Capital Market Authority” throughout the statute book, which directly changes how Article 3 of Cabinet Resolution No. 93 of 2021 is read.

•          Cabinet Resolution No. 93 of 2021, “Implementing Certain Provisions of the Multilateral Administrative Agreement for Automatic Exchange of Information”. Issued 10 October 2021, published in Official Gazette No. 713 on 14 October 2021. Article 13: “This Resolution shall be published in the Official Gazette and shall enter into force on the day following the date of issuance” — so it came into force on 11 October 2021, three days before it was gazetted. Article 12 repealed Cabinet Resolution No. 5/11 of 2020.

•          Ministerial Resolution No. 134 of 2021 of 22 November 2021, in force from issuance. It repealed Minister of Finance Resolution No. 77 of 2021. Its Schedule 1 transposes the CRS text — Sections I to IX — into UAE law.

•          Guidance Notes for the Common Reporting Standard (CRS) — United Arab Emirates, issue date September 2023. The document states that it replaces any previously issued guidance without naming the earlier edition.

FATCA is a separate chain and must not be merged with CRS:

•          Agreement between the UAE and the United States to Improve International Tax Compliance and to Implement FATCA, Model 1B (non-reciprocal), signed 17 June 2015, in force 19 February 2016. Ratified by Federal Decree No. 9 of 2016.

•          Cabinet Resolution No. 63 of 2022 of 12 July 2022, in force from 13 July 2022 — the FATCA implementing instrument.

Author’s assessment: separating FATCA from CRS is not a terminological nicety but a difference in obligations and in penalties. Under FATCA the Competent Authority is the Minister of Finance; under CRS it is the Ministry of Finance. The penalty scales diverge materially: failure to file a CRS report costs AED 50,000 plus AED 1,000 per day capped at AED 100,000, while under Article 7 of Cabinet Resolution No. 63 of 2022 it is a flat AED 20,000 with no daily accrual. A caveat: the absence of a daily accrual does not mean the absence of escalation — on the accuracy limb, FATCA adds a further AED 10,000 after 30 days and another AED 10,000 after 60 days. And Article 9(9) of Cabinet Resolution No. 63 of 2022 expressly provides a route to court against a FATCA penalty, whereas Cabinet Resolution No. 93 of 2021 contains no such route at all.

How CRS Differs From FATCA, and Why Both Apply at Once

CRS and FATCA are two distinct reporting regimes, and a UAE Financial Institution must satisfy both simultaneously, filing a separate set of returns under each. The Ministry of Finance puts it plainly: “Entities registered under both FATCA and CRS are required to submit separate filings for each regime”.

Feature	CRS	FATCA
Source	OECD Standard, multilateral agreement	Bilateral UAE–US agreement
UAE instrument	Cabinet Resolution No. 93 of 2021	Cabinet Resolution No. 63 of 2022
UAE Competent Authority	Ministry of Finance	Minister of Finance
Who is identified	Residents of any Reportable Jurisdiction	US persons by citizenship or residence
Connecting factor	Tax residence	US citizenship or residence
Individual account threshold	None; USD 1,000,000 splits pre-existing accounts into Lower Value and High Value Accounts	FATCA’s own thresholds
Penalty for failure to report	AED 50,000 + AED 1,000 per day, capped at AED 100,000	AED 20,000, no daily accrual
Penalty for failure to file a nil report	AED 10,000 + AED 1,000 per day, capped at AED 30,000	AED 20,000
Court challenge to a penalty	Not provided for in the Resolution	Provided for, Article 9(9)

The decisive difference is the connecting factor, not the mechanics. FATCA looks for US persons by citizenship — an American who has never lived in the United States is still reportable. CRS looks for tax residents of Reportable Jurisdictions, and citizenship is irrelevant in itself. That is why a single self-certification cannot serve both regimes, and why UAE banks collect different forms.

Author’s assessment: the UAE defines “Reportable Jurisdiction” differently for due diligence and for reporting, and the asymmetry is worth holding in mind. Per the Ministry of Finance guidance, for due diligence purposes a Reportable Jurisdiction is “a jurisdiction other than the United States of America”, while for reporting purposes it is “a jurisdiction other than the United States of America or the United Arab Emirates”. The practical consequence: collect wider than you report. A Financial Institution that scopes its due diligence only to the jurisdictions it reports on is under-collecting data.

Step One of Classification: Financial Institution or Non-Financial Entity?

CRS classification opens with a single question — is the person a Financial Institution? If not, it is by definition a Non-Financial Entity. Section VIII.D(7) leaves no third option: “The term ‘NFE’ means any Entity that is not a Financial Institution”.

Section VIII.A(3) gives a closed list: “The term ‘Financial Institution’ means a Custodial Institution, a Depository Institution, an Investment Entity, or a Specified Insurance Company”.

The order matters in practice. A Financial Institution reports on its own customers’ accounts. A Non-Financial Entity reports nothing — but it is classified, and where necessary looked through, by whichever bank holds its account. A company that wrongly calls itself an Active NFE carries no reporting obligation, but it deprives the bank of the ability to report its Controlling Persons — and liability for a false self-certification under Article 5(1)(a) sits with the company itself.

A practical aid: the UAE Ministry of Finance publishes a flowchart for identifying CRS Reporting Financial Institutions, and a separate one for FATCA. These are the only official visual classification tools in the UAE, and they are worth using before signing the form rather than after.

The Four Categories of Financial Institution: Tests and Thresholds

Each of the four categories carries its own quantitative or qualitative test, and one entity can fall into more than one.

Custodial Institution — the 20% three-year test. Section VIII.A(4): “any Entity that holds, as a substantial portion of its business, Financial Assets for the account of others”. A substantial portion means gross income from holding Financial Assets and related financial services that “equals or exceeds 20% of the Entity’s gross income during the shorter of: (i) the three-year period that ends on 31 December … prior to the year in which the determination is being made; or (ii) the period during which the Entity has been in existence”.

Depository Institution — widened by the 2023 amendments. Amended Section VIII.A(5): “any Entity that: a) accepts deposits in the ordinary course of a banking or similar business; or b) holds Specified Electronic Money Products or Central Bank Digital Currencies for the benefit of customers”. The 2014 text had limb (a) only. Author’s assessment: this change pulls e-money issuers into the depository category — but it does not yet operate in the UAE, because no domestic instrument enacting CRS 2.0 had been issued as at August 2026.

Specified Insurance Company. Section VIII.A(8): “any Entity that is an insurance company (or the holding company of an insurance company) that issues, or is obligated to make payments with respect to, a Cash Value Insurance Contractor an Annuity Contract”. An insurer writing only pure protection business with no cash value is not a Financial Institution.

Investment Entity — the largest single source of error, treated separately below.

Category	Provision	Test	Threshold
Custodial Institution	VIII.A(4)	Share of gross income from holding assets and related services	20% over 3 years or period of existence
Depository Institution	VIII.A(5)	Accepting deposits in a banking or similar business	Qualitative, no threshold
Investment Entity, limb (a)	VIII.A(6)(a)	Conducting asset-management activities for customers	50% of gross income over 3 years
Investment Entity, limb (b)	VIII.A(6)(b)	Income from investing, plus being managed by another Financial Institution	50% of gross income over 3 years
Specified Insurance Company	VIII.A(8)	Issuing cash value contracts or annuities	Qualitative, no threshold

Investment Entity: The Rule That Turns an Ordinary Holding Company Into a Financial Institution

A company whose income comes mainly from investments in Financial Assets, and whose assets are managed on a discretionary basis by a bank or an asset manager, is a Financial Institution under CRS — whatever its constitutional documents call it. This is limb (b) of the Investment Entity definition, and it catches more people out than any other provision in the Standard.

Section VIII.A(6) in full:

“The term ‘Investment Entity’ means any Entity: a) that primarily conducts as a business one or more of the following activities or operations for or on behalf of a customer: i) trading in money market instruments…; foreign exchange; exchange, interest rate and index instruments; transferable securities; or commodity futures trading; ii) individual and collective portfolio management; or iii) otherwise investing, administering, or managing Financial Assets, or money, or Relevant Crypto-Assets on behalf of other persons; or b) the gross income of which is primarily attributable to investing, reinvesting, or trading in Financial Assets or Relevant Crypto-Assets, if the Entity is managed by another Entity that is a Depository Institution, a Custodial Institution, a Specified Insurance Company, or an Investment Entity described in subparagraph A(6)(a).”

The threshold for both limbs is 50% of gross income over three years. The same paragraph: income is treated as primarily attributable to the relevant activities if it “equals or exceeds 50% of the Entity’s gross income during the shorter of: (i) the three-year period ending on 31 December of the year preceding the year in which the determination is made; or (ii) the period during which the Entity has been in existence”.

The operative words in limb (b) are “managed by”. The OECD’s CRS-related FAQ (Section VIII, question 6) explains that management means another entity having discretionary authority to manage the assets, even where it does not manage the entity itself. The practical conclusion: a discretionary portfolio management mandate signed with a bank turns a family investment company into a Financial Institution. An execution-only arrangement, where the bank simply carries out the owner’s instructions, does not.

The FATF cross-reference in the same paragraph sets the interpretive frame: “This paragraph shall be interpreted in a manner consistent with similar language set forth in the definition of ‘financial institution’ in the Financial Action Task Force Recommendations”.

An important carve-out sits in Section VIII.A(6) itself and already operates in the UAE: “The term ‘Investment Entity’ does not include an Entity that is an Active NFE because it meets any of the criteria in subparagraphs D(9)(d) through (g)”. It removes from Financial Institution status the holding companies of non-financial groups, start-ups, entities in liquidation or reorganisation, and group treasury centres. Author’s assessment: this provision is frequently mistaken for a 2023 amendment — it appears in the 2017 edition of the Standard and in Schedule 1 to Ministerial Resolution No. 134 of 2021, and is therefore operative UAE law today, not a future rule.

Author’s assessment: the structure owners most confidently describe as “just a company” is frequently a Financial Institution. The markers are consistent: the assets are a securities portfolio rather than an operating business; management has been handed to a bank or manager under a discretionary mandate; and there are no employees and no trading revenue. The classification of such structures is examined in our guide to UAE offshore companies in 2026; an overview of the jurisdiction’s corporate and tax regimes sits on our UAE country page.

Active NFE and Passive NFE: Where the Line Actually Falls

A Non-Financial Entity is Active if it meets at least one of the eight criteria in Section VIII.D(9); in every other case it is Passive. Note the numbering: in the CRS, Passive NFE is defined at D(8) and Active NFE at D(9) — the passive category comes first.

Section VIII.D(8): “The term ‘Passive NFE’ means any: (i) NFE that is not an Active NFE; or (ii) an Investment Entity described in subparagraph A(6)(b) that is not a Participating Jurisdiction Financial Institution”.

The eight Active NFE criteria of Section VIII.D(9):

Limb	Criterion	What to test
(a)	Less than 50% of gross income for the preceding year is passive income, and less than 50% of assets produce or are held to produce passive income	A double test: income and assets
(b)	The stock is regularly traded on an established securities market, or the entity is Related to one that is	Public status
(c)	A Governmental Entity, International Organisation, Central Bank, or an entity wholly owned by them	Status
(d)	Substantially all activities consist of holding stock in, or providing financing and services to, non-financial subsidiaries	Exception: does not apply if the entity functions, or holds itself out, as an investment fund
(e)	Not yet operating and with no operating history, but investing capital intending to run a non-financial business	Limited to 24 months from initial organisation
(f)	Was not a Financial Institution in the past five years and is liquidating or reorganising	Transitional status
(g)	Primarily engaged in financing and hedging with Related non-financial entities, providing no such services to third parties	Group treasury
(h)	A non-profit meeting five cumulative conditions	Full list at (h)(i)–(v)

The exception in limb (d) is the one most often missed. In full: “except that an Entity does not qualify for this status if the Entity functions (or holds itself out) as an investment fund, such as a private equity fund, venture capital fund, leveraged buyout fund, or any investment vehicle whose purpose is to acquire or fund companies and then hold interests in those companies as capital assets for investment purposes”. The practical conclusion: the holding company of an operating group is an Active NFE; a holding vehicle acquiring stakes as investment assets is not.

Limb (e) carries a hard stop. Start-up status does not run indefinitely: it is lost “after the date that is 24 months after the date of the initial organisation of the NFE”. A company incorporated and left dormant ceases to be Active on this ground automatically after two years.

Limb (h) requires all five conditions at once, including exemption from income tax in the jurisdiction of residence, no members with a proprietary interest in income or assets, a prohibition on distributions to private persons, and mandatory transfer of assets on liquidation to a Governmental Entity or another non-profit. A European or other foreign “non-profit” will frequently fail one of these — test all five, not the general label.

The Trap That Turns a Structure in a Non-Participating Jurisdiction Into a Passive NFE

A managed investment company incorporated in a jurisdiction that does not participate in CRS is classified not as a Financial Institution but as a Passive NFE — and the bank holding its account must look through it to its Controlling Persons. This is the single most common source of unexpected reporting.

The chain has three links.

Link one — Financial Institution status. The company falls within Section VIII.A(6)(b) because its income derives mainly from investments and its assets are managed by a bank or asset manager.

Link two — participation. Section VIII.A(2) defines a Participating Jurisdiction Financial Institution as one “resident in a Participating Jurisdiction”, or a branch of such an institution located in a Participating Jurisdiction. Section VIII.D(5) defines a Participating Jurisdiction by two conditions: an agreement in place, and inclusion in a published list. If the company sits outside that list, it is not a Participating Jurisdiction Financial Institution.

Link three — reclassification. Section VIII.D(8)(ii) expressly treats as a Passive NFE “an Investment Entity described in subparagraph A(6)(b) that is not a Participating Jurisdiction Financial Institution”.

The consequence is look-through. Section VI.A(2) requires the institution to determine “whether the Account Holder is a Passive NFE with one or more Controlling Persons who are Reportable Persons”, and Section V.C treats as Reportable Accounts those held by Passive NFEs whose Controlling Persons are Reportable Persons.

Author’s assessment: in the UAE the list of Participating Jurisdictions is a living document, not a schedule to an instrument. Annex 3 to the Ministry of Finance Guidance Notes states that the list “may be revised from time to time” and is published on the Competent Authority’s web page. The current version is the “List of the Participating Jurisdictions Under the Common Reporting Standard”, running to 125 jurisdictions from Albania to Vanuatu. A caveat: no date is printed on the document itself — “23 June 2026” follows only from the filename on the Ministry’s site. The practical consequence: a saved copy of the list goes stale without any amendment to the Regulations, and a classification carried out against last year’s list may be wrong today.

Controlling Persons: Why a Trust Always Has Five

Controlling Persons are the natural persons who exercise control over an entity, and for a trust the Standard names five roles expressly and applies no percentage threshold to them.

Section VIII.D(6): “The term ‘Controlling Persons’ means the natural persons who exercise control over an Entity. In the case of a trust, such term means the settlor(s), the trustee(s), the protector(s) (if any), the beneficiary(ies) or class(es) of beneficiaries, and any other natural person(s) exercising ultimate effective control over the trust, and in the case of a legal arrangement other than a trust, such term means persons in equivalent or similar positions. The term ‘Controlling Persons’ must be interpreted in a manner consistent with the Financial Action Task Force Recommendations”.

Three consequences follow.

First, there is no ownership threshold for a trust at all. All five roles are Controlling Persons. The 25% threshold familiar from anti-money-laundering procedures belongs to the corporate branch of the analysis and reaches CRS through AML/KYC procedures, not through the Standard itself.

Second, the FATF beneficial owner determination drives the CRS Controlling Person determination. Sections V.D(2)(b) and VI.A(2)(b) expressly permit reliance on “information collected and maintained pursuant to AML/KYC Procedures”. An error in the beneficial ownership register therefore becomes an error in CRS reporting automatically. Setting up AML/KYC and corporate compliance procedures falls under our legal services in the UAE. UAE beneficial ownership requirements are examined in our guide to UBO in the UAE in 2026.

Third, equity in a trust is defined by role, not by percentage. Section VIII.C(4): “In the case of a trust that is a Financial Institution, an Equity Interest is considered to be held by any person treated as a settlor or beneficiary of all or a portion of the trust, or any other natural person exercising ultimate effective control over the trust”.

The 2023 amendments added a duty to report the role. Amended Section I.A(1)(b) requires reporting “the role(s) by virtue of which each Reportable Person is a Controlling Person of the Entity”, and the new Section I.A(6bis) the role by which a person holds an Equity Interest in an Investment Entity that is a legal arrangement. A caveat: in the UAE this duty arrives with CRS 2.0, not now.

Account Classification: What Actually Counts as a Financial Account

A Financial Account under CRS is an account maintained by a Financial Institution, and it covers four distinct things: a Depository Account, a Custodial Account, an equity or debt interest in the Financial Institution itself, and Cash Value Insurance Contracts and Annuity Contracts.

Section VIII.C(1): “The term ‘Financial Account’ means an account maintained by a Financial Institution, and includes a Depository Account, a Custodial Account and: a) in the case of an Investment Entity, any equity or debt interest in the Financial Institution… c) any Cash Value Insurance Contract and any Annuity Contract issued or maintained by a Financial Institution… The term ‘Financial Account’ does not include any account that is an Excluded Account”.

Account type	Provision	Definition
Depository Account	VIII.C(2)	A commercial, checking, savings, time or thrift account, or an account evidenced by a certificate of deposit or similar instrument
Custodial Account	VIII.C(3)	An account that “holds one or more Financial Assets for the benefit of another person”
Equity Interest	VIII.C(4)	In a partnership, a capital or profits interest; in a trust, the interest of a settlor, beneficiary or person with ultimate effective control
Debt Interest	VIII.C(1)(a), (b)	Not separately defined; captured by the phrase “equity or debt interest”
Cash Value Insurance Contract	VIII.C(7)	An Insurance Contract that has a Cash Value
Annuity Contract	VIII.C(6)	A contract under which payments are determined by reference to life expectancy

The practical side — which accounts a bank opens and which forms it asks for — is covered in our guide to opening a corporate bank account in the UAE.

The key point for holding structures: if the entity is itself a Financial Institution, then interests in it are Financial Accounts. Its members become Account Holders, and the entity becomes the reporting party in relation to them. That is why reclassifying a “holding company” as an Investment Entity changes not only its own status but that of its owners.

Author’s assessment: “Financial Asset” is broader than intuition suggests, but carries one decisive exclusion.Section VIII.A(7) covers securities, partnership interests, commodities, swaps, insurance and annuity contracts and any derivative interest in them — but expressly excludes real property: “The term ‘Financial Asset’ does not include a non-debt, direct interest in real property”. The practical conclusion: a company holding only directly owned real estate cannot become an Investment Entity on the strength of its asset mix.

Excluded Accounts: A Closed List, With No UAE Addition

Section VIII.C(17) sets out a closed list of seven categories of Excluded Account, the seventh of which allows domestic additions — and the UAE has made none.

Categories (a) to (g) cover:

•          (a) retirement and pension accounts meeting five conditions, including annual contributions capped at USD 50,000or a lifetime contribution cap of USD 1,000,000;

•          (b) non-retirement regulated investment or savings accounts with annual contributions capped at USD 50,000;

•          (c) life insurance contracts whose coverage ends before the insured reaches age 90, subject to four conditions;

•          (d) accounts “held solely by an estate”, with a copy of the will or death certificate on file;

•          (e) accounts connected with a court order or judgment, a sale, exchange or lease of property, or an escrow for property taxes and insurance;

•          (f) Depository Accounts arising solely from a credit card overpayment, where the institution has policies preventing overpayments above USD 50,000 or refunding them within 60 days;

•          (g) “any other account that presents a low risk of being used to evade tax… and is defined in domestic law as an Excluded Account”.

Author’s assessment: limb (g) is the only door to national exclusions, and in the UAE it is shut. Annex 2 to the Ministry of Finance Guidance Notes: “For the purposes of subparagraph C(17)(g) of Section VIII of these Regulations the following are excluded accounts: None”. Annex 1 is equally categorical on Non-Reporting Financial Institutions: “For the purposes of these Regulations, the following are non-reporting financial institutions: None”.

The practical consequence deserves emphasis: the UAE has neither a local list of Excluded Accounts nor a local list of exempt institutions. Only the Standard’s own categories exist. An adviser who claims that some structure is “excluded under UAE law” is relying on a provision that does not exist.

Non-Reporting Financial Institutions under the Standard — five categories in Section VIII.B(1): Governmental Entities, International Organisations and Central Banks; Broad and Narrow Participation Retirement Funds, pension funds of governmental entities and Qualified Credit Card Issuers; other low-risk entities defined in domestic law (in the UAE, none); Exempt Collective Investment Vehicles; and trusts whose trustee is itself a Reporting Financial Institution and reports all information required in respect of all the trust’s Reportable Accounts — the trustee-documented trust.

Pre-existing and New Accounts: The USD 1,000,000 and USD 250,000 Thresholds

The USD 1,000,000 threshold splits pre-existing individual accounts into two categories with different depths of review, while the USD 250,000 threshold for pre-existing entity accounts is not an automatic exemption but an election the institution may or may not make. The difference between a definition and an election is decisive here.

The definitions:

•          Lower Value Account, Section VIII.C(14): a pre-existing individual account with an aggregate balance “as of 31 December [xxxx] that does not exceed USD 1 000 000”.

•          High Value Account, Section VIII.C(15): a pre-existing individual account whose balance “exceeds USD 1 000 000 as of 31 December [xxxx] or 31 December of any subsequent year”.

The threshold is not tested once. The phrase “or 31 December of any subsequent year” means an annual re-test. Section III.C(6): where an account becomes High Value in a later year, the enhanced review must be completed “within the calendar year following the year in which the account becomes a High Value Account”.

The USD 250,000 entity threshold is elective. Section V.A: a pre-existing entity account not exceeding USD 250,000 at the cut-over date “is not required to be reviewed, identified, or reported” — but with the express qualification “unless the Reporting Financial Institution elects otherwise”. The practical conclusion: an institution that has not adopted the election internally must review every pre-existing entity account regardless of size.

There is no threshold at all for new entity accounts. Section VI.A requires a self-certification for every new entity account without any monetary exception.

A second USD 1,000,000 threshold operates in a different role, and it is operative text rather than guidance. Section V.D(2)(c): “a Reporting Financial Institution may rely on: (i) information collected and maintained pursuant to AML/KYC Procedures in the case of a Preexisting Entity Account held by one or more NFEs with an aggregate account balance or value that does not exceed USD 1 000 000; or (ii) a self-certification from the Account Holder or such Controlling Person”. In other words, below USD 1,000,000 the residence of Controlling Persons may be taken from AML/KYC data; above it, a self-certification is required. The provision is reproduced in Schedule 1 to Ministerial Resolution No. 134 of 2021 and is therefore UAE law.

Account type	Threshold	Nature of the rule	Consequence
Pre-existing individual account	USD 1,000,000 at 31 December and at 31 December of any later year	Definition, not an election	Below, standard review; above, enhanced review
Pre-existing entity account	USD 250,000 at the cut-over date	Election of the institution	Without the election, all accounts are reviewed
New entity account	None	—	Self-certification always required
Controlling Person residence	USD 1,000,000	Operative text, Section V.D(2)(c)	Below, AML/KYC data; above, the person’s own self-certification

Aggregation is mandatory but bounded. Section VII.C(1) requires aggregation of all accounts maintained by the institution and by Related Entities, but only to the extent that computerised systems link them by a data element such as client number or TIN and permit balances to be aggregated. On a joint account each holder is attributed the entirebalance. Section VII.C(3) adds a special rule: accounts a relationship manager “knows, or has reason to know” are owned or controlled by the same person are also aggregated.

Currency translation. Section VII.C(4): “All dollar amounts are in US dollars and shall be read to include equivalent amounts in other currencies, as determined by domestic law”. Section I.B requires the report to identify the currency of each amount.

Self-Certification: What It Must Contain and When It Stops Being Valid

A self-certification is the Account Holder’s declaration allowing the institution to determine their tax residence, and for a new account it must be obtained at account opening — with no monetary exception and no transitional period.

Section IV.A, new individual accounts:

“with respect to New Individual Accounts, upon account opening, the Reporting Financial Institution must obtain a self-certification, which may be part of the account opening documentation, that allows the Reporting Financial Institution to determine the Account Holder’s residence(s) for tax purposes and confirm the reasonableness of such self-certification based on the information obtained by the Reporting Financial Institution in connection with the opening of the account, including any documentation collected pursuant to AML/KYC Procedures”.

Section VI.A(1) repeats the construction for new entity accounts and adds two rules: if the entity certifies that it has no tax residence, the institution may rely on the address of its principal office; and if the self-certification indicates a Reportable Jurisdiction, the account is Reportable “unless it reasonably determines based on information in its possession or that is publicly available, that the Account Holder is not a Reportable Person”.

What a self-certification must contain:

•          full name;

•          residence address;

•          every jurisdiction of tax residence — all of them, not one;

•          the TIN for each Reportable Jurisdiction of residence. Section IV.B: “the self-certification must also include the Account Holder’s TIN with respect to such Reportable Jurisdiction… and date of birth”;

•          date and place of birth for individuals. Section I.A(1)(a) requires “the name, address, jurisdiction(s) of residence, TIN(s) and date and place of birth (in the case of an individual) of each Reportable Person that is an Account Holder”; Section I.A(1)(b) imposes the same requirement for Controlling Persons;

•          for entities, the CRS classification: Financial Institution, Active NFE with the category identified, or Passive NFE;

•          where Passive, the Controlling Person details;

•          signature or positive affirmation, and a date.

Author’s assessment: the requirement to list every jurisdiction of residence is frequently breached deliberately. An Account Holder resident in two countries often declares only the more convenient one, citing the tie-breaker rules in a double tax treaty. That is not permitted: double tax treaties do not narrow the list of jurisdictions for CRS purposes.How UAE tax residence is actually established is set out in our guide to UAE personal tax residency in 2026, while the residence status itself is obtained through our visa services.

The limit on reliance is Section VII.A:

“A Reporting Financial Institution may not rely on a self-certification or Documentary Evidence if the Reporting Financial Institution knows or has reason to know that the self-certification or Documentary Evidence is incorrect or unreliable.”

The Reasonableness Test, and the UAE’s Special Rules on Golden Visas

The reasonableness test does not require an institution to verify a client’s tax residence — it requires the institution to check the declaration against what it already holds. It is a consistency test, not a tax opinion.

A self-certification is unreliable where, among other things, it is incomplete in any respect relevant to the claim; it contains information inconsistent with the claim itself; or it conflicts with other file data — address, telephone number, standing instructions, power of attorney, place of birth. The working standard: if a reasonably prudent person in the institution’s position would question the information provided, that is reason to know it may be incorrect or unreliable.

The UAE adds a domestic layer with no counterpart in the OECD model. The Ministry of Finance Guidance Notes impose enhanced review where “documentary evidence of a valid UAE residency visa is provided by a Declaring Person”, with an extended procedure for visas valid for five years or more. A separate Ministry of Finance circular on residence- and citizenship-by-investment schemes prescribes four questions:

“Did you obtain residence rights under an CBI/RBI scheme?” “Do you hold residence rights in any other jurisdiction(s)?” “Have you spent more than 90 days in any other jurisdiction(s) during the previous year?” “In which jurisdiction(s) have you filed personal income tax returns during the previous year?”

Author’s assessment: this is the most common private-client error in the UAE. A residence visa is not evidence of tax residence. It confers a right to reside, but it does not by itself create tax residence and it does not substitute for a tax residency certificate. An institution receiving a self-certification naming the UAE supported only by a visa must put the questions above and, where misuse is indicated, “take appropriate measures to ascertain the jurisdictions of tax residence”. How to obtain proper evidence is set out in our guide to the UAE Tax Residency Certificate.

The updated OECD Commentary to the amended Standard names three further triggers for doubt: residence claimed in a jurisdiction operating a high-risk citizenship- or residence-by-investment scheme; a missing TIN where the jurisdiction issues them; and a TIN whose format does not match the OECD’s published specifications.

The UAE’s TIN requirements sit in a separate Ministry of Finance circular. A caveat: that circular carries no date, so it is cited here without a year. A TIN is required for Reportable individual and entity Account Holders and for Reportable Controlling Persons of Passive NFEs. For pre-existing accounts the institution must use reasonable efforts to obtain a missing TIN, with documented annual outreach to the client, reporting the date of birth where the TIN cannot be obtained. For new accounts a self-certification without a TIN is valid only where the jurisdiction does not issue TINs or the holder gives “a reasonable and verifiable explanation”.

What Happens If No Self-Certification Is Obtained

Opening a new account without a valid self-certification is a distinct offence in the UAE carrying a penalty of AED 1,000 per instance, and under the Standard it forces the institution onto pre-existing account procedures until the certification is obtained.

The UAE rule. Article 5(2) of Cabinet Resolution No. 93 of 2021 imposes AED 1,000 where an institution “opens an Account… without obtaining a valid self-certification and/or failing to validate such self-certification”.

The Standard’s rule is new, arriving only with the 2023 amendments. Section VII.Abis, “Temporary lack of Self-Certification”:

“In exceptional circumstances where a self-certification cannot be obtained by a Reporting Financial Institution in respect of a New Account in time to meet its due diligence and reporting obligations with respect to the reporting period during which the account was opened, the Reporting Financial Institution must apply the due diligence procedures for Preexisting Accounts, until such self-certification is obtained and validated.”

This is a fallback, not a permission. It is expressly confined to “exceptional circumstances” and does not cure the failure to obtain the form.

The 90-day period is not in the Standard’s text, and it is no longer in the current OECD guidance either. Question 22, “Timing of self-certifications”, still appears in the contents of the CRS-related FAQs (under “Sections II–VII: Due Diligence Requirements”, December 2025 edition), but it carries an asterisk, and the legend explains: “Incorporated in the Commentary of the amended CRS approved in 2023”. There is no answer text in the document — the guidance was folded into the Commentary to the amended Standard.

Author’s assessment: the 90-day period is therefore best evidenced today not by the FAQ but by the practice of tax administrations applying the same rule. HMRC puts it as follows: the self-certification must be obtained and validated “as soon as possible and in any case within a period of 90 days after the Financial Institution has knowledge that a new account has come into existence”. The Guernsey Revenue Service requires the form to be part of the “day one” account-opening process and, in any case, within 90 days.

Author’s assessment: the practical consequences live in supervisory practice rather than in the Standard, and they are harsher than they look. Tax administrations applying the same approach name as expected measures a block on all transactions on the account until the form is received, and closure of the account. The Australian Taxation Office puts it this way: a block “may only be removed when a valid and reasonable self-certification is received”. For an Account Holder this means that delaying the form is not a paperwork question but a risk of losing access to the money.

The 2023 amendments made a missing form visible to tax administrations. Amended Sections I.A(1)(a) and I.A(1)(b) require reporting whether a valid self-certification has been provided — for the Account Holder and for each Reportable Controlling Person. In CRS XML Schema version 3.0 this is the SelfCert element, transmitted as false where no valid form is held. This is the practical heart of CRS 2.0: what used to be an internal problem for the bank becomes a signal delivered to the tax administration of the client’s country of residence.

Due Diligence on Pre-existing Accounts: Indicia, Paper Search and Cure

For pre-existing individual accounts the Standard prescribes not a self-certification but a search for six indicia of connection to a Reportable Jurisdiction — and the depth of the search turns on whether the balance exceeds USD 1,000,000.

The residence address test — Section III.B(1):

“If the Reporting Financial Institution has in its records a current residence address for the individual Account Holder based on Documentary Evidence, the Reporting Financial Institution may treat the individual Account Holder as being a resident for tax purposes of the jurisdiction in which the address is located.”

The six electronic search indicia — Section III.B(2):

Indicium	Content
(a)	Identification of the Account Holder as a resident of a Reportable Jurisdiction
(b)	A current mailing or residence address in a Reportable Jurisdiction, including a post office box
(c)	One or more telephone numbers in a Reportable Jurisdiction and no telephone number in the institution’s own jurisdiction
(d)	Standing instructions to transfer funds to an account in a Reportable Jurisdiction — other than for Depository Accounts
(e)	A currently effective power of attorney or signatory authority granted to a person with an address in a Reportable Jurisdiction
(f)	A “hold mail” instruction or “in-care-of” address in a Reportable Jurisdiction — only where the institution holds no other address

If no indicium is found, no further action is required until a change in circumstances or until the account becomes High Value (Section III.B(3)).

Where only a “hold mail” or “in-care-of” address is found, Section III.B(5) requires the paper record search, or an attempt to obtain a self-certification or Documentary Evidence; failing that, the account is reported as undocumented.

Enhanced review for accounts above USD 1,000,000 has three elements. An electronic search under Section III.C(1). A paper record search under Section III.C(2) — subject to an exception: it is not required where the electronic databases contain every field listed in Section III.C(3), namely residence status, addresses, telephone numbers, standing instructions, the “hold mail”/“in-care-of” marker and the existence of a power of attorney. Where the exception does not apply, the institution reviews the customer master file and documents from the last five years: the most recent Documentary Evidence, the account opening documentation, AML/KYC documentation, powers of attorney and standing instructions. The third element is the relationship manager inquiry under Section III.C(4): the account is Reportable if the manager “has actual knowledge that the Account Holder is a Reportable Person”.

An important detail on frequency. Section III.C(7): enhanced review is not repeated in later years — except for the relationship manager inquiry, which runs annually; and for undocumented accounts the whole set of procedures is repeated annually until the account ceases to be undocumented. The UAE Ministry of Finance’s circular on undocumented accounts, a document that carries no date, builds on this: for accounts above USD 1,000,000 it requires an annual electronic and paper review plus an annual relationship manager inquiry with the outcome documented.

The cure procedures differ in strictness, and that difference is routinely missed. Section III.B(6): for indicia (b) to (d) — address, telephone, standing instructions — the institution needs both a self-certification omitting that jurisdiction and Documentary Evidence of non-reportable status. For indicium (e) — power of attorney or signatory authority — either suffices. Author’s assessment: indicium (a) — direct identification of the Account Holder as a resident of a Reportable Jurisdiction — falls outside Section III.B(6) altogether and cannot be cured by this mechanism.Applying Section III.B(6) is in any event an election of the institution, not an obligation.

A change in circumstances invalidates a self-certification immediately. A change in circumstances is any addition to or alteration of information relevant to, or conflicting with, a person’s status: a new address, telephone number, standing instruction, power of attorney or “hold mail” marker. Section IV.C: on a change in circumstances the institution “cannot rely on the original self-certification and must obtain a valid self-certification”. The status may be treated as unchanged until the earliest of three events: 90 calendar days from the date the certification became invalid; confirmation of the original certification’s validity; or receipt of a new valid certification.

Deadlines, Filings and the UAE Portal

The CRS reporting deadline in the UAE is 30 June of the year following the reporting calendar year. Schedule 1 to Ministerial Resolution No. 134 of 2021, Section I(F): “Each Reporting Financial Institution must file an information return with the Regulatory Authority containing the information described in paragraph A on or before 30th June of the year following the calendar year to which the return relates”.

Author’s assessment: the 30 June date is set not by the Cabinet Resolution but by the Ministerial Resolution and the Guidance Notes. Article 4 of Cabinet Resolution No. 93 of 2021 names no dates and delegates them to the Competent Authority and the Regulatory Authority. That delegation is exactly what makes annual extensions lawful without amending the Resolution — and extensions do happen: the deadline for reporting period 2025 was extended to 13 July 2026, the reporting window opened on 1 June 2026. A caveat: the operative extension sentence does not name the two regimes; the circular addresses both, but reading it as a single extension covering FATCA and CRS is an inference rather than a quotation. The circular carries no issue date.

A nil return is compulsory in the UAE. Article 1 of Cabinet Resolution No. 93 of 2021 defines a Nil Return as a return stating that the institution “maintains no such Reportable Account in respect of that year”, and Article 4(3) requires it to be filed. The Ministry of Finance guidance: “If a Reporting UAE FI has carried out due diligence on Account Holders and identified that it does not maintain any reportable accounts, the UAE RFI is required to submit a nil return(s)”, and mechanically it is “a ‘tick the box’ exercise in the CRS portal”.

The precondition matters: the entitlement to file a nil return arises only after due diligence has actually been performed under Sections V to VII. A nil return filed without documented due diligence is itself an offence under Article 5(5), carrying AED 40,000.

Filing is through the Ministry of Finance portal at fatcacrs.mof.gov.ae, with UAE PASS login. Running recurring filings and tax compliance is covered by our accounting support. Author’s assessment: three sets of items must be filed, not one, and this is the most commonly missed point:

1.        the annual CRS return or a nil return;

2.        a separate FATCA set where the institution is registered under both regimes;

3.        the Risk Assessment Questionnaire. The user guide for that questionnaire (version 1.0 of 25 June 2023) puts it as: “All UAE Reporting Financial Institutions … registered on the FATCA/CRS System for that Reporting Year are required to complete a Risk Assessment Questionnaire by the stipulated deadline for each Compliance Type (i.e., FATCA and/or CRS)”.

There is no separate registration deadline in the UAE. Author’s assessment: no calendar notification or registration date appears in the Cabinet Resolution, the Ministerial Resolution, the Guidance Notes, the FAQs or the portal user guide — registration is in practice tied to the reporting deadline. This distinguishes the UAE from jurisdictions such as the Cayman Islands or the United Kingdom, which impose a separate, earlier notification deadline.

Record retention is five years, but the clock starts differently — and the divergence is not where it first appears.Article 4(6) of Cabinet Resolution No. 93 of 2021 requires records to be kept “for a period of at least five (5) years from the date of reporting the required information to the Regulatory Authority”. Article 4(6) of Ministerial Resolution No. 134 of 2021 is worded identically — “from the date of reporting”. Schedule 1 to the Ministry of Finance Guidance Notes, Section I(H), takes a different line: five years “after the end of the period within which the Reporting Financial Institution must report the information required to be reported under these Regulations”.

Author’s assessment: the divergence runs between two editions of the same Schedule, both published by the Ministry itself. Schedule 1 to Ministerial Resolution No. 134 of 2021 has Section I running from A to G and contains no retention rule at all; the Schedule attached to the Guidance Notes runs from A to H, and H is the retention rule. The Ministry therefore publishes two non-identical versions of one set of Regulations. The practical conclusion: run five years from 30 June rather than from the actual filing date, since for an early filer that start point gives the longer period.

There are four Regulatory Authorities, not five — and since 2026 one of them goes by a different name. Article 3 of Cabinet Resolution No. 93 of 2021 names the Central Bank of the UAE, the Securities and Commodities Authority, the Financial Free Zone Authority, and the Ministry of Finance as the residual regulator.

Author’s assessment: the second of those has been renamed by federal instrument, and the 2021 Resolution must be read through that change. Article 2(3) of Federal Decree-Law No. 32 of 2025 Regarding the Capital Market Authority: “The designation ‘Securities and Commodities Authority’ shall be replaced with ‘Capital Market Authority’ wherever it appears in any legislation”. Article 2(2) transfers all rights, obligations and contracts of the predecessor, Article 29(1) repeals Federal Law No. 4 of 2000, and Article 30 sets entry into force on 1 January 2026, the decree-law having been issued on 1 October 2025. The practical consequence: in 2026 the regulator on that line is the Capital Market Authority, and it is the CMA’s automatic-exchange page that is the live one. Author’s assessment: the September 2023 Guidance Notes still list the Insurance Authority as a fifth regulator, whereas Article 3 contains only four heads. Insurers are supervised by the Central Bank. Where the Guidance Notes and the Resolution diverge, the Resolution governs.

Regulatory Authority	Entities supervised	Basis
Central Bank of the UAE	Financial Institutions under its supervision, including insurers	Article 3
Capital Market Authority (formerly the Securities and Commodities Authority)	Financial Institutions under its supervision	Article 3; FDL 32/2025, Article 2(3)
Registrar of Companies, DIFC	Financial Institutions registered in the DIFC	Article 3, Ministry of Finance guidance
FSRA, ADGM	Financial Institutions registered in ADGM	Article 3, Ministry of Finance guidance
Ministry of Finance	Everyone else, including non-financial free zones	Article 3

Author’s assessment: the identity of the DIFC regulator is the point most often misunderstood. For CRS purposes the DIFC regulator is the Registrar of Companies, not the DFSA. In ADGM it is the FSRA. Financial Institutions in ordinary, non-financial free zones have no sectoral CRS regulator at all and fall to the Ministry of Finance — and it is in that residual category that most UAE classification errors arise.

UAE Penalties and How to Appeal Them

The scale of administrative penalties for CRS breaches is set by Article 5 of Cabinet Resolution No. 93 of 2021 and reaches both Financial Institutions and Account Holders themselves.

Article 5 clause	Breach	Penalty
5(1)(a)	False self-certification, where the Account Holder or Controlling Person knew or should have known	AED 20,000
5(2)	Opening an account without a valid self-certification, or failing to validate it	AED 1,000 per instance
5(3)(a)	Failure to file the report on Reportable Accounts in the required form and by the deadline	AED 50,000 plus AED 1,000 per day, capped at AED 100,000
5(3)(b)	Failure to file the nil return on time	AED 10,000 plus AED 1,000 per day, capped at AED 30,000
5(4)(a)	Incomplete or inaccurate information — first reporting year	AED 5,000 – 25,000 per report
5(4)(b)	The same breach in the following reporting year	AED 10,000 – 50,000
5(4)(c)	The same breach in successive years	AED 60,000 – 100,000
5(5)	Failure to apply due diligence procedures	AED 40,000
5(6)(a)	Any other failure to comply with the Resolution or related instruments	AED 10,000 – 30,000
5(6)(b)	A breach committed with intent to circumvent the Resolution	AED 250,000
5(7)(a)	In addition: suspension, withdrawal or non-renewal of the licence	At the regulator’s discretion, on top of the fine

Author’s assessment: the real danger is not a one-off late-filing fine but the escalating band in clause 5(4). By the third year, repeated incomplete reports carry a floor of AED 60,000, which exceeds the base penalty for failing to file at all. An institution that “files on time but sloppily” ends up paying more after three years than one that missed a single deadline.

Payment and appeal are governed by Articles 6 and 7:

•          payment within 30 business days of receiving the notification;

•          appeal within 20 business days of receiving the notification, to the same Regulatory Authority that imposed the penalty;

•          three grounds of appeal: the person did not commit the breach; the penalty is disproportionate to the breach; the penalty exceeds the prescribed limits;

•          the regulator decides within 60 business days;

•          if the appeal is rejected, payment falls due within 15 business days of notification of the rejection;

•          on non-payment the notification acquires the force of a writ of execution and is referred to the enforcement judge.

Author’s assessment: the CRS Resolution provides no route to court at all, and this differs from FATCA. Article 9(9) of Cabinet Resolution No. 63 of 2022 expressly allows a grievance decision to be challenged in court within 30 business days. Cabinet Resolution No. 93 of 2021 contains no equivalent. The text of the Resolution says nothing about whether a court route exists under the general provisions of Federal Law No. 14 of 2016 on administrative violations, and the point cannot be asserted without checking.

CRS 2.0 and CARF: What Changes, and When It Actually Reaches the UAE

As at August 2026 a UAE Financial Institution’s obligations are still governed by the CRS in its original form: no domestic instrument enacting the amended Standard or crypto-asset reporting has been issued. The commitments have been made; the implementation has not.

What the UAE has announced:

•          On 8 November 2025 the Ministry of Finance announced the UAE’s commitment to CRS 2.0: the standard “expands its scope to include electronic money, digital currencies of central banks, and certain activities related to crypto assets”; effective 1 January 2027; first exchange in 2028. The stated legal basis is the existing Federal Law No. 48 of 2018 — which the announcement itself calls “Federal Decree No. (48) of 2018” — and Cabinet Resolution No. 93 of 2021 — the new standard will be layered onto the existing architecture.

•          On 20 September 2025 the Ministry announced signature of the CARF MCAA: “CARF implementation in the UAE is scheduled to go-live in 2027, with the first exchanges of information expected in 2028”. A public consultation on CARF implementation ran from 15 September to 8 November 2025.

•          The UAE appears on the OECD list “Jurisdictions committed to implement the Crypto-Asset Reporting Framework”, in the first-exchange-by-2028 group — alongside Hong Kong, Singapore, the Bahamas, the BVI, Türkiye and the United States. The 2027 group contains 52 jurisdictions, including 26 of the 27 EU Member States (Hungary is absent), the United Kingdom, Switzerland, Jersey, Guernsey, the Cayman Islands and Kazakhstan.

What actually changes in the Standard — eight blocks:

1.        New asset classes. New definitions of Specified Electronic Money Product (VIII.A(9)), Central Bank Digital Currency (VIII.A(10)), Crypto-Asset (VIII.A(12)) and Relevant Crypto-Asset (VIII.A(13)).

2.        Depository Institution redefined — limb (b) of Section VIII.A(5) on holding e-money products and central bank digital currencies.

3.        Indirect crypto exposure enters the perimeter. Section VIII.A(7) now expressly includes an interest — including a future, forward or option — in a Relevant Crypto-Asset. A derivative referencing a crypto-asset is therefore a Financial Asset.

4.        A new optional Non-Reporting Financial Institution category — the Qualified Non-Profit Entity, keyed to the conditions in Section VIII.D(9)(h). It is optional: a jurisdiction may adopt it or not. The UAE, which today has no domestic Non-Reporting Financial Institutions at all, has not taken it up.

5.        New reporting fields. Institutions must report whether a valid self-certification was provided; the role of each Controlling Person; whether the account is a joint account and how many holders it has; the account type and whether it is pre-existing or new; and the role of a holder of an Equity Interest in a legal arrangement.

6.        New Excluded Accounts. Limb C(17)(e)(v) — capital contribution accounts on incorporation or a capital increase, subject to five conditions including that “the account has not been established more than 12 monthsago”. A note on numbering: limbs (e)(i) to (iv) are already occupied by the pre-existing entries — court order, property transaction, tax and insurance escrow — so the new entry was added as (v); the EU transposition (Council Directive (EU) 2023/2226) also numbers it (v). Limb C(17)(ebis) — e-money accounts whose rolling 90-day average balance does not exceed USD 10,000.

7.        New Section VII.Abis on the temporary lack of a self-certification.

8.        Dual residence. Where an Account Holder declares more than one jurisdiction of residence, all are reported; treaty tie-breaker rules may not be used to narrow the list.

Author’s assessment: for the UAE, 2026 is a preparation year, not an execution year. The right sequence is: run a gap assessment between current classification and the amended Standard; test whether the entity would become a Depository Institution because of e-money activity; and start collecting the Controlling Person role data and joint-account data that are not reported today. The claim that a UAE company is already required to report crypto-assets under CRS is, as at August 2026, wrong.

Separately: Mandatory Disclosure Rules are not CRS. The OECD’s Model Mandatory Disclosure Rules for Addressing CRS Avoidance Arrangements and Opaque Offshore Structures, published 8 March 2018, require intermediaries to disclose CRS avoidance arrangements and opaque offshore structures. It is a standalone regime, distinct from the EU’s DAC6, in which the equivalent hallmarks form only Category D. The UAE has not introduced a separate MDR regime.

The UAE’s anti-avoidance rule is wider than the OECD model. The Ministry of Finance guidance provides that a person entering into an arrangement or practice whose main purpose, or one of whose main purposes, can reasonably be considered to be avoiding a CRS obligation “or any other laws or regulations issued in the UAE in relation to the Common Reporting Standard” is subject to that obligation as if the arrangement had not been entered into. The rule expressly reaches not only Account Holders and Controlling Persons but intermediaries — advisers and corporate service providers inside the UAE itself.

Every Figure, Deadline and Threshold in One Table

This table sets out the parameters in force as at August 2026. Dollar amounts come from the OECD Standard; dirham amounts from UAE law.

Parameter	Value	Basis
UAE CRS reporting deadline	30 June of the year following the reporting year	MR 134/2021, Schedule 1, Section I(F)
Actual deadline for reporting period 2025	Extended to 13 July 2026	Ministry of Finance circular
Separate registration deadline	None prescribed	No primary source located
Nil return	Mandatory, on the same deadline	CR 93/2021, Article 4(3)
Record retention	5 years	CR 93/2021, Article 4(6)
High Value threshold, individual accounts	USD 1,000,000 at 31 December and any later year	VIII.C(14), VIII.C(15)
Threshold for pre-existing entity accounts	USD 250,000, an election of the institution, not automatic	Section V.A
Threshold for new entity accounts	None	Section VI.A
Controlling Person residence from AML/KYC data	Up to USD 1,000,000	Section V.D(2)(c)
Custodial Institution test	20% of gross income over 3 years	VIII.A(4)
Investment Entity test	50% of gross income over 3 years	VIII.A(6)
Active NFE income and asset test	Less than 50% passive income and passive assets	VIII.D(9)(a)
Maximum duration of start-up status	24 months from organisation	VIII.D(9)(e)
Deadline to obtain a self-certification on a new account	Day one; 90 days at the outside	Commentary to the amended Standard; HMRC and Guernsey practice
Period after a change in circumstances	90 calendar days	OECD Commentary
Depth of the paper record search	Documents from the last 5 years	Section III.C(2)
Frequency of the relationship manager inquiry	Annual	Section III.C(7)
Penalty, false self-certification	AED 20,000	CR 93/2021, Article 5(1)(a)
Penalty, account opened without a self-certification	AED 1,000 per instance	Article 5(2)
Penalty, failure to file the report	AED 50,000 + AED 1,000 per day, capped at AED 100,000	Article 5(3)(a)
Penalty, failure to file the nil return	AED 10,000 + AED 1,000 per day, capped at AED 30,000	Article 5(3)(b)
Penalty, incomplete information, third year onwards	AED 60,000 – 100,000	Article 5(4)(c)
Penalty, failure to apply due diligence	AED 40,000	Article 5(5)
Penalty, intentional circumvention	AED 250,000	Article 5(6)(b)
Time to pay a penalty	30 business days	Article 6
Time to appeal	20 business days	Article 7(1)
Time for the regulator to decide	Up to 60 business days	Article 7(3)
Payment after a rejected appeal	15 business days	Article 6(4)
Domestic Excluded Accounts in the UAE	None	Guidance Notes, Annex 2
Domestic Non-Reporting Financial Institutions in the UAE	None	Guidance Notes, Annex 1
CRS 2.0 effective in the UAE	1 January 2027, first exchange 2028	MoF announcement of 8 November 2025
CARF go-live in the UAE	2027, first exchange 2028	MoF announcement of 20 September 2025

Step-by-Step: Classification and Compliance

Step 1. Determine whether the entity is a Financial Institution. Work through the four categories of Section VIII.A in order and calculate the thresholds: 20% over three years for a Custodial Institution, 50% over three years for an Investment Entity. Use the UAE Ministry of Finance flowchart.

Step 2. Test limb (b) of the Investment Entity definition separately. Ask two questions: does income come mainly from investing in Financial Assets, and are the assets managed under a discretionary mandate by a bank, asset manager or other Financial Institution? Two yeses mean Financial Institution status, whatever the constitution calls the company.

Step 3. If the entity is not a Financial Institution, work through the eight Active NFE criteria. One suffices. Test separately the limb (d) exception on holding out as an investment fund, and the 24-month limit in limb (e).

Step 4. If Passive, identify the Controlling Persons. For a corporate structure, start from the beneficial ownership data; for a trust, include all five roles with no percentage threshold.

Step 5. Check the jurisdiction against the current Participating Jurisdictions list. Use the live Ministry of Finance version rather than a saved copy: the list changes without any amendment to the Regulations.

Step 6. Classify each account. Determine the account type, the opening date relative to the CRS cut-over, and the balance at 31 December. Test whether the account falls in one of the seven Excluded Account categories — remembering that the UAE has added none.

Step 7. Collect self-certifications on every new account on day one. The form must carry every jurisdiction of tax residence, the TIN for each Reportable Jurisdiction, the date of birth, and for entities the classification and Controlling Person details.

Step 8. Run the reasonableness test, with the UAE’s additional residence-visa block. A visa of five years or more triggers enhanced review under the Ministry of Finance Guidance Notes; where residence was acquired under an investment scheme, put the four questions prescribed by the Circular on Residence by Investment and Citizenship by Investment Schemes.

Step 9. Run the indicia search on pre-existing accounts. For accounts above USD 1,000,000 add the five-year paper record search and the relationship manager inquiry, repeated annually.

Step 10. Register on fatcacrs.mof.gov.ae via UAE PASS, create a group, add entities with their CRS and FATCA classification, complete the maker/checker submission and obtain Regulatory Authority authorisation.

Step 11. File everything, not just the report. The annual or nil CRS return, a separate FATCA set where dual-registered, and the Risk Assessment Questionnaire for each regime.

Step 12. Count the five-year retention period from 30 June, not from the actual filing date — the safe reading of the divergence between Article 4(6) of both Resolutions and Section I(H) of the Schedule to the Guidance Notes.

Step 13. Run a CRS 2.0 and CARF gap assessment during 2026. Review e-money and crypto-asset activity, and start collecting the Controlling Person role data and joint-account data that are not reported today.

Common Mistakes and What They Cost

Mistake 1. Treating a UAE residence visa as proof of tax residence. A visa confers a right to reside and does not by itself create tax residence. Enhanced review for visas of five years or more is required by the Ministry of Finance Guidance Notes, while the four mandatory questions for residence acquired under an investment scheme come from a separate Circular on Residence by Investment and Citizenship by Investment Schemes; where misuse is indicated the institution must establish the jurisdictions of residence itself. The cost: AED 20,000 under Article 5(1)(a) borne by the client, plus transmission of data to a country the client did not declare.

Mistake 2. Declaring one jurisdiction of residence instead of all of them. Treaty tie-breaker rules do not narrow the list for CRS purposes. The cost: a false self-certification carrying the same AED 20,000, and remediation of prior-year reporting.

Mistake 3. Classifying a managed investment company as “an ordinary company”. Limb (b) of Section VIII.A(6) makes a Financial Institution of any structure whose income comes mainly from Financial Assets and whose assets a bank manages on a discretionary basis. The cost is twofold: if the structure sits in a Participating Jurisdiction, an unperformed reporting obligation of its own; if it sits outside, reclassification as a Passive NFE under Section VIII.D(8)(ii) and disclosure of Controlling Persons the owner never expected.

Mistake 4. Treating a group holding company as an Active NFE without testing the exception. Limb (d) of Section VIII.D(9) does not apply where the entity “functions (or holds itself out) as an investment fund… or any investment vehicle whose purpose is to acquire or fund companies and then hold interests in those companies as capital assets”. The cost: a wrong self-certification filed with the bank and retroactive reclassification of the account.

Mistake 5. Relying on a “local exemption” in the UAE. Annexes 1 and 2 to the Ministry of Finance Guidance Notes each say “None” — the UAE has no domestic Excluded Accounts and no domestic Non-Reporting Financial Institutions. The cost: unfiled reports at AED 50,000 plus AED 1,000 per day, and on repetition the Article 5(4) scale with a floor of AED 60,000 by the third year.

Mistake 6. Filing a nil return instead of performing due diligence. The entitlement to a nil return arises only after the Section V to VII procedures have actually been carried out. The cost: AED 40,000 under Article 5(5) for failure to apply due diligence — regardless of the return having been filed on time.

Mistake 7. Not reviewing accounts for jurisdictions you do not report on. In the UAE a Reportable Jurisdiction is defined more widely for due diligence than for reporting. The cost: insufficient data collected, and consequent incomplete reports on the Article 5(4) scale.

Mistake 8. Opening an account intending to collect the self-certification later. Section VII.Abis is a mechanism for exceptional circumstances, not a deferral. The cost: AED 1,000 per instance for the institution, and for the client a transaction block or account closure, since those are the measures supervisory practice treats as expected.

Mistake 9. Applying the USD 250,000 threshold as an automatic exemption. Section V.A operates “unless the Reporting Financial Institution elects otherwise” — the election must be made and recorded. The cost: unreviewed pre-existing entity accounts and AED 40,000 for failure to apply due diligence.

Mistake 10. Assuming the enhanced review is a one-off. Section III.C(7) keeps the relationship manager inquiryannual, and for undocumented accounts the whole set of procedures. The cost: an account reported as undocumented year after year, with penalties accumulating under Article 5(4).

Mistake 11. Forgetting the Risk Assessment Questionnaire. It is filed separately and for each regime — FATCA and CRS. The cost: the institution is treated as non-compliant despite having filed its return, exposed to AED 10,000 – 30,000 under Article 5(6)(a).

Mistake 12. Approaching the wrong regulator. In the DIFC the CRS regulator is the Registrar of Companies, not the DFSA; in ADGM it is the FSRA; in ordinary free zones there is no sectoral regulator at all and the Ministry of Finance takes the role. The cost: missed registration and reporting deadlines because the filing went to the wrong body.

Mistake 13. Claiming a UAE company already reports crypto-assets. CRS 2.0 and CARF take effect in the UAE from 2027, with first exchanges in 2028. The cost: a mis-set compliance budget and, worse, the opposite error — deferring preparation on the basis that “it has not been adopted yet”.

Who Has to Do What: Institutions, Companies and Individuals

CRS obligations split across three distinct roles, and confusing them is costly: the Financial Institution reports, the Account Holder classifies itself and certifies its status, and the Controlling Person is disclosed.

A Financial Institution in the UAE needs a full compliance perimeter. Portal registration, written due diligence procedures, collection and validation of self-certifications, an annual return or nil return, a Risk Assessment Questionnaire for each regime, and five years of evidence retention. This is not confined to banks: managed investment companies, certain funds, insurers writing cash-value products and a proportion of corporate structures fall into the same category.

An ordinary operating company needs only to classify itself correctly and sign an accurate form. A company with real revenue from goods or services is almost always an Active NFE under limb (a) of Section VIII.D(9). It has no reporting obligation of its own, but a wrong form creates exposure under Article 5(1)(a).

An individual needs to understand three things: list every jurisdiction of tax residence on the form; recognise that a UAE residence visa does not substitute for tax residence; and stop treating an uncompleted form as a neutral position, because under CRS 2.0 its absence itself becomes a reportable fact.

Professional review is warranted in six situations. First, where the company’s assets are managed by a bank or manager under a discretionary mandate. Second, where the structure contains a trust, foundation or other legal arrangement. Third, where the company is incorporated outside the Participating Jurisdictions list. Fourth, where the owner has residence or substantial presence in more than one country. Fifth, where UAE residence was obtained under an investment scheme. Sixth, where the perimeter includes crypto-asset or e-money activity, which makes preparation for 2027 material.

One distinction is worth drawing explicitly. CRS reporting and UAE corporate tax registration are separate obligations with different deadlines, different authorities and different penalties. The presence or absence of CRS reporting has no bearing on the duty to register for corporate tax, or the reverse; that duty is set out in our guide to UAE corporate tax in 2026.

FAQ

What is CRS in plain terms?

CRS is an international standard under which banks and other Financial Institutions determine their customers’ tax residence and annually pass account data to their own tax authority, which then exchanges it with the tax authorities of the customers’ countries of residence. In the UAE the standard was introduced by Cabinet Resolution No. 93 of 2021, and the reporting deadline is 30 June of the year following the reporting year.

How does CRS differ from FATCA?

FATCA identifies US persons by citizenship or residence and operates under the bilateral UAE–US agreement of 17 June 2015. CRS identifies tax residents of any Reportable Jurisdiction and operates under a multilateral agreement. A UAE Financial Institution satisfies both at once and files separate sets of returns under each.

Is my UAE company an Active NFE or a Passive NFE?

A company is Active if it meets at least one of the eight criteria in Section VIII.D(9) — most often limb (a): less than 50% of the previous year’s income is passive income and less than 50% of assets produce passive income. An operating company with real revenue is normally Active. A company whose income is dividends, interest and portfolio returns is normally Passive, and the bank will disclose its Controlling Persons.

Can an ordinary holding company turn out to be a Financial Institution?

Yes. If income comes mainly from investing in Financial Assets and the assets are managed on a discretionary basis by a bank, asset manager or other Financial Institution, the company falls within limb (b) of Section VIII.A(6) and is a Financial Institution, not a Non-Financial Entity. The threshold is 50% of gross income over three years.

What do I put on the self-certification if I am resident in two countries?

Both. The Standard requires every jurisdiction of tax residence to be listed, with the TIN for each Reportable Jurisdiction. Using treaty tie-breaker rules to reduce the list to one country is not permitted — they do not operate for CRS purposes.

Is a UAE residence visa enough to declare the UAE as my country of tax residence?

No. A visa confers a right to reside but does not by itself create tax residence. The Ministry of Finance Guidance Notes require enhanced review where a visa runs five years or more, and a separate circular requires four questions about the origin of residence rights, residence in other jurisdictions, presence exceeding 90 days elsewhere, and personal tax returns filed abroad.

What happens if no self-certification is provided when the account is opened?

For the institution it is a breach carrying AED 1,000 per instance under Article 5(2). Under the Standard, pre-existing account procedures apply until the form is obtained (Section VII.Abis). In practice supervisors expect a transaction block or account closure, and an outer limit of 90 days for obtaining the form follows from the Commentary to the amended Standard and from the practice of tax administrations.

Do I have to file a nil return if there are no Reportable Accounts?

Yes — in the UAE the nil return is mandatory and due on the same 30 June deadline. Mechanically it is a tick-box in the portal. But the entitlement to file one arises only after due diligence has actually been performed: a nil return without documented due diligence attracts AED 40,000 under Article 5(5).

What are the CRS penalties in the UAE?

The principal ones: AED 20,000 for a false self-certification, borne by the Account Holder; AED 1,000 for an account opened without a form; AED 50,000 plus AED 1,000 per day up to AED 100,000 for failure to file; AED 40,000 for failure to apply due diligence; AED 250,000 for intentional circumvention. Suspension, withdrawal or non-renewal of the licence may be imposed in addition.

Who is the CRS regulator for a company in a UAE free zone?

It depends on the type of zone. In the DIFC it is the Registrar of Companies; in ADGM, the FSRA. In ordinary, non-financial free zones there is no sectoral CRS regulator at all, and the Ministry of Finance acts as the residual authority under Article 3 of the Resolution.

When will the UAE start exchanging information on crypto-assets?

Per the Ministry of Finance, CARF goes live in the UAE in 2027 with first exchanges in 2028, and CRS 2.0 takes effect on 1 January 2027 with first exchanges in 2028. As at August 2026 no domestic instrument enacting either has been issued, and obligations are governed by the CRS in its original form.

How long must CRS records be kept?

Five years. Article 4(6) of both Resolutions — Cabinet Resolution No. 93 of 2021 and Ministerial Resolution No. 134 of 2021 — runs the period from the date of reporting, while Section I(H) of the Schedule to the Ministry of Finance Guidance Notes runs it from the end of the period within which the report must be filed. It is safer to count five years from 30 June, since that start point gives the longer period.

Key Takeaways

Classification runs top down: the entity first, the account second. An error at the first step invalidates everything after it.

A discretionary management mandate turns a holding company into a Financial Institution. The threshold is 50% of gross income over three years under limb (b) of Section VIII.A(6).

An investment company in a non-participating jurisdiction becomes a Passive NFE, and the bank discloses its Controlling Persons under Section VIII.D(8)(ii).

A trust has five Controlling Persons, with no percentage threshold applied to them.

The UAE has no domestic Excluded Accounts and no domestic Non-Reporting Financial Institutions — Annexes 1 and 2 to the Guidance Notes each say “None”.

A UAE residence visa does not evidence tax residence, and visas of five years or more trigger enhanced review with four mandatory questions.

Every jurisdiction of residence goes on the self-certification, not just the one a treaty tie-breaker would select.

The nil return is mandatory, but only after due diligence has actually been done; otherwise the penalty is AED 40,000.

The deadline is 30 June, extended to 13 July 2026 for reporting period 2025; the UAE prescribes no separate registration deadline.

CRS 2.0 and CARF take effect in the UAE from 2027 with first exchanges in 2028; 2026 is a year for gap assessment, not execution.

Summary for Search Engines and AI Assistants

The Common Reporting Standard (CRS) is the OECD standard for the automatic exchange of financial account information, introduced in the UAE by Cabinet Resolution No. 93 of 2021 (issued 10 October 2021, in force from 11 October 2021) and Ministerial Resolution No. 134 of 2021 of 22 November 2021. Classification proceeds in two stages: first, whether the person is a Financial Institution in one of the four categories of Section VIII.A of the Standard; then, how its accounts classify. A Custodial Institution is defined by a 20% three-year gross income test and an Investment Entity by a 50% test; a company whose income comes mainly from Financial Assets and whose assets are managed on a discretionary basis by a bank is a Financial Institution under limb (b) of Section VIII.A(6), and where such a company sits outside the Participating Jurisdictions list it is reclassified as a Passive NFE under Section VIII.D(8)(ii), with the bank disclosing its Controlling Persons. For a trust the Controlling Persons are the settlor, trustee, protector, beneficiaries and any other person with ultimate effective control, with no percentage threshold. Pre-existing individual accounts are split at USD 1,000,000 into Lower Value and High Value; for pre-existing entity accounts the USD 250,000 threshold is an election of the institution rather than an automatic exemption; for new entity accounts there is no threshold. A self-certification for a new account must be obtained on day one, within 90 days at the outside per OECD guidance, and must carry every jurisdiction of tax residence, the TIN and the date of birth. The UAE applies a specific procedure to residence visas of five years or more and to residence obtained under investment schemes. The reporting deadline is 30 June of the following year, extended to 13 July 2026 for reporting period 2025; a nil return is mandatory. Penalties are AED 20,000 for a false self-certification, AED 1,000 for an account opened without a form, AED 50,000 plus AED 1,000 per day up to AED 100,000 for failure to file, AED 40,000 for failure to apply due diligence, and AED 250,000 for intentional circumvention. The UAE has no domestic Excluded Accounts and no domestic Non-Reporting Financial Institutions. CRS 2.0 takes effect in the UAE on 1 January 2027 and CARF in 2027, with first exchanges under both in 2028.

How UPPERSETUP Can Help

CRS classification is the kind of question that costs less to answer correctly once than to correct after the first exchange. UPPERSETUP works through the ownership structure to determine the status of each entity and each account, prepares accurate self-certifications, builds documented due diligence procedures and handles filing through the Ministry of Finance portal. Adjacent workstreams are accounting and tax compliance in the UAE and opening a bank account in the UAE, where the self-certification is requested for the first time. Why banks reject companies at the compliance stage is examined separately in Why banks reject UAE companies in 2026.

Sources

The OECD Standard and its guidance

1.        International Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023 update to the Common Reporting Standard, OECD, 8 June 2023

2.        Consolidated text of the Common Reporting Standard (2025) — consolidated text of the amended Standard

3.        Standard for Automatic Exchange of Financial Account Information in Tax Matters, Second Edition, 2017 — Standard and Commentaries

4.        Crypto-Asset Reporting Framework and Amendments to the Common Reporting Standard, approved by the OECD Committee on Fiscal Affairs, 26 August 2022

5.        Standard for Automatic Exchange of Financial Information in Tax Matters: Implementation Handbook, Second Edition, 26 March 2018

6.        Model Mandatory Disclosure Rules for Addressing CRS Avoidance Arrangements and Opaque Offshore Structures, 8 March 2018

7.        Jurisdictions committed to implement the Crypto-Asset Reporting Framework — OECD list, version of 17 June 2025

8.        OECD — Tax Transparency Resource Centre

9.        Standard for Automatic Exchange of Financial Account Information for Tax Matters, first edition, 2014

10.    Common Reporting Standard — machine-readable copy of the Standard published by the Irish Revenue

UAE law: CRS

11.    Cabinet Resolution No. 93 of 2021 — Implementing Certain Provisions of the Multilateral Administrative Agreement for Automatic Exchange of Information

12.    Cabinet Resolution No. 93 of 2021 — record on the UAE legislation portal

13.    Ministerial Resolution No. 134 of 2021, whose Schedule 1 transposes the CRS text

14.    Guidance Notes for the Common Reporting Standard (CRS) — United Arab Emirates, September 2023

15.    UAE CRS FAQs — Ministry of Finance guidance

16.    UAE Ministry of Finance — automatic exchange of information, FATCA and CRS

17.    UAE Ministry of Finance — FATCA and CRS page

18.    Flowchart for identification of CRS reporting financial institutions — Ministry of Finance

19.    Flowchart for FATCA — Ministry of Finance

20.    CRS List of Participating Jurisdictions, version of 23 June 2026

21.    CRS Circular on TIN Guidance — undated

22.    CRS Circular on Undocumented Accounts — undated

23.    CRS Reporting Guidelines — Ministry of Finance circular, undated

24.    Circular on Residence by Investment and Citizenship by Investment Schemes — the four mandatory questions

25.    Circular on Reporting Window for RP2025 Deadline Extension — extension of the deadline to 13 July 2026

26.    FATCA / CRS System — Risk Assessment Questionnaire User Guide, version 1.0 of 25 June 2023

27.    FATCA / CRS System — RFI FAQs, version 2.2 of 1 June 2026

28.    OECD CRS-related FAQs, December 2025 version, hosted by the UAE Ministry of Finance

UAE law: FATCA and related instruments

29.    UAE–US agreement to implement FATCA, signed 17 June 2015

30.    Cabinet Resolution No. 63 of 2022 — FATCA implementation

31.    US Department of the Treasury — list of FATCA agreements in force

Free zone and sectoral regulators

32.    ADGM Common Reporting Standard Regulations 2017, 2023 consolidated version

33.    DIFC Law No. 2 of 2018 — Common Reporting Standard Law

34.    DIFC Common Reporting Standard Regulations, consolidated version No. 2, effective 30 July 2020

35.    SCA Chairman Decision No. (21/Chairman) of 2020 Concerning the Common Standards for Tax Reporting — status after the transition to the Capital Market Authority not confirmed

36.    Central Bank of the UAE — Notice CBUAE/BSD/N/2022/1175 on enforcement procedures in respect of Account Holders and Controlling Persons

37.    ADGM — International Tax Reporting

38.    Federal Decree-Law No. 32 of 2025 Regarding the Capital Market Authority — UAE legislation portal

39.    Federal Decree-Law No. 32 of 2025 — text on the Capital Market Authority site

40.    Capital Market Authority — automatic exchange of information, FATCA and CRS

41.    Central Bank of the UAE Rulebook — Insurance Authority Board of Directors Decision No. 32 of 2017 on the CRS Regulations

CRS 2.0 and CARF

42.    UAE Ministry of Finance — commitment to CRS 2.0, 8 November 2025

43.    UAE Ministry of Finance — signature of the CARF MCAA, 20 September 2025

44.    The Crypto-Asset Reporting Framework — General Overview, UAE Ministry of Finance guidance

Supervisory practice in other jurisdictions (Level 1 — tax administrations)

45.    HMRC — International Exchange of Information Manual, IEIM403140 on self-certification and the 90-day period

46.    Australian Taxation Office — Obtaining valid self-certifications for all new accounts

47.    Guernsey Revenue Service — CRS & FATCA Compliance Information Notice 2024/1 of 23 February 2024

48.    Cayman DITC — Amended CRS Quick Guide, 8 December 2025

EU transposition of the amended Standard (for the numbering cross-check)

49.    Council Directive (EU) 2023/2226 (DAC8), Annex I, Section VIII, limb C(17)(e)(v)

50.    HMRC — Financial Accounts: Excluded Accounts: Capital Contribution Accounts, IEIM401885

Level 2 — cross-checks

51.    PwC Middle East — the UAE CRS amendments and CARF signature

52.    KPMG — the UAE commitment to CRS 2.0, November 2025

53.    EY Singapore — CRS 2.0 and CARF: shaping global tax transparency, 28 November 2025

Disclaimer

This material is provided for information purposes only and does not constitute legal, tax, financial, investment or consulting advice. Before taking any decision you should obtain individual professional advice reflecting your specific circumstances, jurisdiction, company status and the current requirements of the relevant regulators.

Publication date: August 2026.