FATCA and CRS Implementation in the Gulf: A Compliance Guide

FATCA The US Framework

The Foreign Account Tax Compliance Act was enacted by the United States Congress in 2010 as part of the Hiring Incentives to Restore Employment Act. FATCA requires foreign financial institutions (FFIs) to report to the Internal Revenue Service (IRS) information about financial accounts held by US taxpayers or by foreign entities in which US taxpayers hold a substantial ownership interest. Financial institutions that fail to comply with FATCA requirements are subject to a 30% withholding tax on certain US-source payments made to them.

FATCA operates through a network of Intergovernmental Agreements (IGAs) that US Treasury has negotiated with other jurisdictions. These agreements modify the FATCA requirements to align with local law and reduce the administrative burden on financial institutions by allowing reporting through local authorities rather than directly to the IRS.

The FATCA IGA framework includes two principal models. Under Model 1, the FFI reports account information to its local tax authority, which in turn exchanges that information with the IRS under a bilateral tax information exchange agreement or tax treaty. Under Model 2, the FFI reports directly to the IRS, with the local authority providing certain administrative support. The choice of model affects the reporting process, the legal basis for information exchange and the specific obligations of the financial institution.

FATCA IGAs in the GCC States

All six GCC states have concluded FATCA IGAs with the United States, providing the legal framework for FATCA implementation in the Gulf.

The UAE’s FATCA IGA was signed in June 2015 and entered into force in February 2016, making it one of the earlier GCC FATCA agreements. The UAE operates under a Model 1 IGA, which means that UAE financial institutions report account information to the UAE Ministry of Finance (now the Ministry of Economy) or the Central Bank of the UAE, and the UAE government exchanges this information with the IRS under the bilateral agreement. An associated Understanding between the UAE and US Treasury addresses certain procedural and interpretative matters.

Saudi Arabia’s FATCA IGA was signed in November 2016 and entered into force in February 2017. Saudi Arabia also operates under a Model 1 IGA, with the Saudi Arabian Monetary Authority (now the Central Bank of Saudi Arabia) overseeing implementation by Saudi financial institutions.

Qatar’s FATCA IGA was signed in January 2015 and entered into force in June 2015, making it among the earliest FATCA agreements in the GCC. Qatar operates under a Model 1 IGA.

Kuwait’s FATCA IGA was signed in April 2015 and entered into force in January 2016, also under a Model 1 framework.

Kuwait and Bahrain have also concluded FATCA IGAs with Model 1 status confirmed (Kuwait: In Force January 2016; Bahrain: In Force March 2018). Oman does not appear in the U.S. Treasury FATCA IGA table and therefore does not have a FATCA IGA in force.

Financial institutions in GCC states should verify the specific Model 1 implementation details for their jurisdiction, including the designated local reporting authority, the reporting deadline and the format and content of the reporting package. The US Treasury maintains a comprehensive table of FATCA IGAs by jurisdiction on its website, which financial institutions can use to confirm the current status of their jurisdiction’s agreement.

GCC financial institutions are classified under FATCA as either reporting FFIs, limited FFIs or non-reporting FFIs, depending on their activities and whether they are subject to full FATCA reporting. The classification determines the specific due diligence and reporting obligations that apply to each institution.

CRS The OECD Multilateral Framework

The Common Reporting Standard is the OECD’s multilateral framework for the automatic exchange of financial account information between tax authorities. CRS was developed by the OECD in response to the G20 mandate and draws heavily on the FATCA model, but it operates as a global standard rather than a bilateral arrangement.

Under CRS, financial institutions in participating jurisdictions are required to identify the tax residency of their account holders and report account information to their local tax authority, which in turn exchanges that information with the tax authorities of the jurisdictions in which the account holders are tax resident. CRS uses a standardized due diligence procedure and reporting format to ensure consistency across jurisdictions.

The OECD maintains the CRS framework and publishes the list of jurisdictions that have committed to implementing CRS, together with the dates on which they commenced or will commence exchanges. The OECD’s CRS portal provides authoritative information on the implementation status of each jurisdiction.

CRS implementation is mandatory for OECD member states and has been adopted by a large number of non-OECD jurisdictions. The scope of CRS generally covers financial accounts held by individuals and entities, including certain passive entities where the controlling persons may be tax resident in a reportable jurisdiction.

GCC states have progressively implemented CRS, with the UAE, Saudi Arabia, Qatar, Kuwait, Oman and Bahrain each having committed to the CRS framework and established domestic implementation requirements. The specific implementation dates, reporting formats and competent authority responsibilities vary by jurisdiction, and financial institutions should confirm the current requirements with their local regulator.

Key Differences Between FATCA and CRS for GCC Financial Institutions

While FATCA and CRS share common conceptual foundations, the practical differences between the two frameworks are significant for GCC financial institutions operating both simultaneously.

The first difference is the reporting recipient. FATCA requires reporting to the IRS, either directly under a Model 2 IGA or through the local tax authority under a Model 1 IGA. CRS requires reporting to the local tax authority, which then exchanges information with foreign tax authorities under the OECD multilateral framework. For GCC financial institutions, FATCA reporting flows to the US Treasury and IRS, while CRS reporting flows to the local tax authority such as the UAE Ministry of Finance.

The second difference is scope. FATCA focuses specifically on US taxpayers, including US citizens and green card holders, and on entities in which US taxpayers hold substantial ownership. CRS covers tax residency in any participating CRS jurisdiction, which includes the GCC states, most major economies and many lower-income countries that have committed to the CRS framework. For a GCC bank with a diverse international customer base, CRS reporting obligations may be considerably broader in geographic scope than FATCA obligations.

The third difference is the definition of a reportable account. FATCA uses the concept of a US account, defined by reference to indicia such as US citizenship, US residency, US mailing address, US telephone number or standing instructions to transfer funds to a US account. CRS uses tax residency as the primary criterion, determined by reference to the account holder’s address, tax identification number or other tax residency indicators.

The fourth difference is the treatment of certain entity types and account categories. Both FATCA and CRS include provisions for classifying entities as either reporting or non-reporting, and for applying simplified or enhanced due diligence depending on the account type. However, the specific entity classifications and the threshold values that trigger reporting differ between the two frameworks.

Practical Compliance Implications for GCC Financial Institutions

Managing FATCA and CRS compliance simultaneously requires a programme that addresses both frameworks without unnecessary duplication, while ensuring that the specific requirements of each are met.

The first practical step is to establish a unified account due diligence process that captures the information required for both FATCA and CRS simultaneously, where possible. Many FATCA due diligence procedures, such as the search for US indicia and the classification of entity account holders, generate information that is directly relevant to CRS due diligence. Financial institutions that build their FATCA and CRS due diligence processes as separate silos will face higher operational costs and a greater risk of inconsistency.

The second step is to maintain a GIIN (Global Intermediary Identification Number) registration for FATCA purposes. FFIs that are not registered with the IRS may be treated as non-participating FFIs, triggering the 30% withholding tax on certain US-source payments. GIIN registration should be kept current and renewed as required.

The third step is to ensure that CRS registration with the local competent authority is completed and maintained. GCC financial institutions should confirm their registration status with the relevant local authority and maintain current contact details and responsible officer information.

The fourth step is to establish robust due diligence for high-value individual accounts and entity accounts that are subject to enhanced procedures under both FATCA and CRS. The due diligence for these accounts should include verification of the account holder’s tax residency, collection of tax identification numbers where required and identification of the ultimate beneficial owner for entity accounts.

The fifth step is to manage the reporting calendar for both frameworks. FATCA and CRS reporting deadlines may differ by jurisdiction, and financial institutions should maintain a compliance calendar that tracks all applicable deadlines and ensures that reports are filed on time.

Wealth Management and CRS in the GCC

The GCC wealth management sector presents specific CRS compliance challenges. GCC financial institutions managing accounts for high-net-worth individuals from CRS-reporting jurisdictions, including clients from Europe, South Asia and other regions, face CRS reporting obligations that may require them to report on the accounts of clients who are tax resident in foreign jurisdictions.

The Cayman Islands, which is widely used as a structuring jurisdiction for GCC wealth management products, is a CRS-participating jurisdiction. Financial institutions with Cayman Islands-incorporated fund vehicles or structured products in their clients’ portfolios may face additional CRS due diligence and reporting obligations. The Cayman Islands Monetary Authority (CIMA) oversees CRS implementation in the Cayman Islands and publishes guidance on the due diligence and reporting requirements applicable to Cayman-registered financial institutions.

GCC private banks and wealth managers should ensure that their CRS due diligence processes extend to the full range of investment structures used by their clients, including entities, trusts and fund interests that may be incorporated or registered in CRS-reporting jurisdictions.

Penalties for Non-Compliance

The penalties for FATCA and CRS non-compliance differ by framework and by jurisdiction.

For FATCA, non-compliance by a participating FFI can result in the imposition of the 30% withholding tax on withholdable payments received from US sources. For registered FFIs that fail to meet their reporting obligations, the IRS may take enforcement action under the FFI agreement, potentially resulting in the FFI’s removal from the IRS FFI list and the consequent application of withholding tax to its US-source income. The specific penalty regime depends on the FATCA IGA model and the jurisdiction.

For CRS, the penalties for non-compliance are set by the domestic legislation of each participating jurisdiction. GCC states have enacted or are developing domestic legislation that specifies penalties for failure to comply with CRS due diligence and reporting requirements. These penalties may include financial penalties, administrative sanctions and, in serious cases, criminal liability for wilful non-compliance.

Financial institutions should confirm the specific penalty provisions applicable in each of their GCC jurisdictions from the relevant domestic legislation and regulatory guidance.

Conclusion

FATCA and CRS represent two parallel but distinct automatic exchange of information frameworks that GCC financial institutions must implement simultaneously. All six GCC states have concluded FATCA Model 1 IGAs with the United States and are implementing CRS as OECD-participating jurisdictions. The operational implications of dual-reporting obligations are significant, but they can be managed through a unified due diligence framework, disciplined reporting calendar management and clear allocation of FATCA and CRS responsibilities within the compliance function.

For compliance leaders, the priority is to ensure that the institution’s FATCA and CRS programmes are integrated rather than duplicative, that the GIIN registration and local CRS registration are maintained, that due diligence for entity accounts and high-value individual accounts meets the enhanced requirements of both frameworks, and that the reporting calendar is managed to meet all applicable deadlines.

This article was accurate at the time of publication in August 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.