A lot of offshore marketing still trades on an idea that stopped being true around 2017. Your bank works out where you are tax resident and reports your account to that country every year, with nobody asking and nobody suspecting anything. Reading the sales page instead of the standard is how people end up holding a structure that cannot survive its first exchange cycle. Here is what is actually reported.
What the Common Reporting Standard actually is
The Common Reporting Standard is an OECD framework, adopted in February 2014, under which participating jurisdictions require their financial institutions to establish where each account holder is tax resident and pass that information to their own tax authority, which then exchanges it with the other participating jurisdictions. The OECD describes the standard in its consolidated text of the CRS as calling on jurisdictions to obtain information from their financial institutions and automatically exchange it on an annual basis.
Two words in that description carry the whole thing: automatically, and annual.
It is not a request system. No tax authority has to suspect you of anything, ask another government for help, or show cause. The reporting happens as routine administration, once a year, for every reportable account, in the same way a payroll department files returns whether or not anyone is under investigation.
That is the part the marketing tends to skip. Older offshore planning was built around a world of information exchange on request, where your details moved only if someone specifically came looking and cleared a legal threshold to do it. Automatic exchange inverted that. The default is now disclosure.
The scale of what is already running
At its 2025 plenary meeting the Global Forum on Transparency and Exchange of Information for Tax Purposes recorded the exchange of data on 171 million accounts worth EUR 13 trillion in 2024, and put the number of jurisdictions committed to automatic exchange at 129 after Zambia joined. Those figures come from the Global Forum's own statement of outcomes from that meeting.
This is not a pilot programme or a policy direction. It is a running system moving more accounts in a year than most countries have citizens, and it has been doing so for years.
What actually gets reported
More than most people assume, and specific enough to be useful to the receiving tax authority without further work:
- Your name, address, jurisdiction of tax residence and taxpayer identification number
- Your date and place of birth
- The account number and the identity of the reporting institution
- The account balance or value at the end of the year
- Interest, dividends, other income, and gross proceeds from sales or redemptions
That last line is the one people underestimate. Gross proceeds means the tax authority sees the money that moved, not just what sat still. An account that ends the year empty because everything was sold and moved on still generates a report describing the sales.
Note also that the balance figure is taken at year end. Moving money out in December does not remove the account from the report. It produces a report showing a low balance, a full year of gross proceeds, and a pattern that reads exactly like what it is.
Passive companies do not block the view
For an account held by a company rather than a person, the reporting can look through the entity to the individuals behind it.
The test is whether the entity is classified as passive, which broadly means it earns most of its income from passive sources such as dividends, interest, rents or royalties rather than from an active trade. A holding company usually is. An operating business with staff and customers usually is not.
Where the entity is passive, the financial institution identifies the controlling persons and reports them by name, address, tax residence and taxpayer identification number, alongside the account details. The company sits in the report as the account holder, and the people behind it sit in the report too.
That look-through exists precisely because the alternative was obvious. Putting a company between yourself and an account was the standard technique, so the standard was drafted to see through it.
Where your company sits does not decide this
This is the most common misunderstanding, so it is worth being exact about the mechanics.
CRS reporting follows the account holder's tax residence. It does not follow the company's jurisdiction of incorporation. If you live in Germany and hold a Seychelles company whose bank account is in Singapore, Singapore reports to Germany, because Germany is where you are resident. Seychelles is not consulted and has nothing to withhold.
Choosing a jurisdiction with strong corporate privacy laws does not change this, because the obligation sits on the financial institution holding the account, not on the company registry. What a registry publishes about your company and what a bank reports about your account are two different systems with different rules, and only one of them is sending an annual file to your home tax authority.
The same logic disposes of the non-participant argument. Banking somewhere outside the network changes what gets reported. It does not change what you owe, or what you are required to declare, in the country where you actually live. Those obligations arise under your own domestic law and exist whether or not anyone reports anything.
What the amended standard added
The standard has not stood still. Following a comprehensive review, the OECD adopted a set of amendments in August 2022 which expanded the scope of the CRS to include specific electronic money products and central bank digital currencies, and made further revisions to bring indirect investments in crypto-assets, through derivatives and investment vehicles, within the standard. The same amendments strengthened the due diligence and reporting requirements and added a carve out for genuine non-profit organisations. All of that is set out in the OECD's consolidated text of the standard, published in June 2025.
The Global Forum's 2025 statement of outcomes records members working to implement the amended CRS in time to commence exchanges under it by 2027, with transitional arrangements where jurisdictions need them.
The direction has been consistent for a decade: more products, more jurisdictions, fewer gaps. Any structure whose value depends on sitting in one of those gaps should be assumed to have a short life, because closing them is the entire programme of work.
Crypto-assets have a framework of their own
Crypto is worth separating out, because the amended CRS and the crypto framework get run together constantly.
The CRS amendments described above reach electronic money, central bank digital currencies and indirect crypto exposure held through derivatives and investment vehicles. Direct holdings of crypto-assets are dealt with by a separate instrument, the Crypto-Asset Reporting Framework. The OECD's tax transparency resource centre records jurisdictions committing to implement that framework in time to commence exchanges in 2027 or 2028.
The Global Forum put the number of jurisdictions that have made that political commitment at 76, with most aiming for 2027. Anyone choosing a jurisdiction on the basis that their exchange reports nowhere is working to a deadline whether they know it or not.
Arrangements built to defeat CRS are themselves reportable
This is the part almost nobody writing about offshore structures mentions, and it deserves more attention than it gets.
Alongside the standard itself, the OECD maintains an international exchange framework for mandatory disclosure rules covering CRS avoidance arrangements and opaque offshore structures, with its own multilateral competent authority agreement sitting behind it. The framework and the agreement are both listed on the OECD's tax transparency resource centre.
Read that back slowly. There is a reporting channel whose subject is the schemes designed to escape the first reporting channel. An arrangement marketed to you on the basis that it sidesteps automatic exchange is not simply a plan that might fail. It falls into a category that has been named, defined and made the subject of its own exchange framework.
The implication is about the adviser as much as the structure. Anyone selling a CRS workaround is selling something regulators anticipated and built machinery around, which tells you most of what you need to know about the advice.
Beneficial ownership is a separate system
People conflate these two constantly, and the conflation causes real errors in planning.
CRS is about financial accounts and the reporting is done by banks and other financial institutions. Beneficial ownership registers are about who owns companies, and the record is held by company registries or regulators. Different custodians, different triggers, different law.
Both BVI companies and Seychelles IBCs are registered in jurisdictions that collect beneficial ownership information, and access to that kind of record has broadened across most offshore centres over the last decade, though how public it is still varies and has been litigated in several places.
So there are two independent channels through which your ownership becomes known: the bank reporting the account, and the registry holding the ownership record. A structure designed around defeating one of them does nothing at all about the other. That is a design flaw people discover late.
The United States is the real exception
Every offshore centre worth banking in participates in CRS. The significant non-participant is the United States, which runs FATCA instead.
FATCA is a different shape. The IRS describes it as requiring foreign financial institutions and certain non-financial foreign entities to report on the foreign assets held by their US account holders, or face withholding. That is a regime built to find Americans with money abroad. It does not create the same reciprocal outflow of information about foreign owners of US accounts, which is why a Delaware LLC or a Wyoming one gets described as private.
The asymmetry is real. It is also narrower than the marketing suggests, in three ways that matter. US banks still run full onboarding and know exactly who their customers and beneficial owners are. The LLC's income still belongs to you where you are tax resident, and your own country's rules on foreign entities apply regardless of what the United States tells anyone. And an asymmetry that exists because of a policy choice can stop existing because of a different policy choice.
Building a structure on the second of those points while ignoring the first two is how people end up with a US entity, an undeclared income stream at home, and no defence.
The jurisdictions people ask about
Every offshore centre we rank participates, so the honest answer to "which one does not report" is none of them.
Seychelles and the BVI both exchange information and both maintain beneficial ownership records. A Cyprus company reports through an EU member state, as does an Estonian company, and EU membership layers further directives on top of the OECD framework. Banking a Hong Kong company or a Singapore company means banking inside a participating jurisdiction, and both centres take financial crime compliance seriously precisely because their banking sectors depend on the reputation. Georgia participates as well, which surprises people who file the Georgian option mentally alongside the older offshore centres.
Dubai and the wider UAE participate too, which surprises rather more people, because the emirate is regularly sold as an opaque jurisdiction. What it actually offers is a genuine 0% personal income tax rate for residents. That is a tax outcome, not a privacy one, and the two get marketed as though they were the same thing.
Sorting the genuinely low-tax jurisdictions from the ones that simply market themselves that way is a separate exercise from sorting on reporting, and the answers do not line up neatly.
What this changes about offshore
It changes what offshore is for. It does not make it pointless, and treating the whole field as dead is as lazy as pretending nothing happened.
The legitimate reasons survive intact. Limited liability. A neutral jurisdiction for shareholders sitting in several different countries. Flexible share structures that your home company law will not give you. Clean asset holding without commingling. Access to a particular banking or regulatory environment. Predictable, boring corporate law that courts elsewhere respect. A BVI or Cyprus holding structure is a perfectly sound arrangement and always was.
What does not survive is the idea that a company somewhere quiet keeps income invisible from your own tax authority. With 171 million accounts moving through the system annually, that is not a risky plan. It is a plan with a scheduled failure date.
If your reason for choosing a jurisdiction is that nobody will know, you do not have a reason. You have a countdown.
Self-certification is where people get caught
Expect your bank to hand you a self-certification of tax residence when you open any account, including for a Cyprus or Estonian company. It is a short form. It asks where you are tax resident and for your taxpayer identification number, and the answer determines where your account gets reported.
Answer it accurately. A false self-certification is a distinct offence in many jurisdictions, separate from and additional to any question about the underlying tax. It converts a civil argument about what you owe into a document you signed that says something untrue, and that is a much worse position to defend from.
The same applies to the controlling person declarations behind a corporate account. Naming a nominee as the controlling person when the real control sits elsewhere is not a technicality.
The practical checklist
Declare what you are required to declare where you are tax resident. That is the whole game, and it is enormously cheaper than the alternative.
Keep the company's records properly. Economic substance obligations and accounting record requirements now apply across most offshore jurisdictions, and they are ongoing rather than one-off. The BVI Financial Services Commission publishes the registered agent fee schedule and the obligations that sit behind it, which is a reasonable illustration of the standing cost of holding a company properly rather than nominally.
Budget for the annual work rather than the formation fee. The cheap agents whose service ends when the certificate arrives leave the filings, the records and the substance questions to you, and those are the parts that recur. Knowing how to tell an agent from a reseller matters more for compliance than it does for setup.
Treat the tax outcome and the reporting outcome as separate questions. A jurisdiction can be excellent on tax and fully participating on reporting, and most of the good ones are. Choosing on the reporting half alone is how people end up with a structure they cannot open a bank account for.
If you already have an undeclared structure, take advice in your own country promptly rather than reading more about jurisdictions. Most countries operate disclosure routes, and every one of them is cheaper than being found.
Key takeaways
- CRS reporting is automatic and annual. Nobody has to suspect anything or make a request for your account details to be exchanged.
- Reporting follows your tax residence, not your company's jurisdiction. Incorporating somewhere private changes nothing about what your bank sends.
- Reported data covers identity, tax residence, year-end balance, income and gross proceeds, and looks through passive entities to the controlling persons.
- The standard was amended in August 2022 to reach specific electronic money products and central bank digital currencies, with exchanges under the amended standard commencing by 2027. Direct crypto holdings fall under CARF.
- The OECD runs a separate exchange framework aimed at CRS avoidance arrangements and opaque offshore structures. The workarounds are a reporting category.
- Beneficial ownership registers are a separate channel from CRS. Defeating one does nothing about the other.
- The United States is the significant non-participant, running FATCA instead. The asymmetry is real, narrower than advertised, and does not affect what you owe at home.
Frequently asked questions
What is the Common Reporting Standard?
The Common Reporting Standard is an OECD framework, adopted in 2014, under which participating jurisdictions require financial institutions to establish where their account holders are tax resident and exchange that information automatically with other participating jurisdictions every year.
Which countries participate in CRS?
129 jurisdictions have committed to automatic exchange of financial account information, including every major offshore financial centre. The United States is the significant exception and operates FATCA instead, which reports in one direction rather than reciprocally.
What information is reported under CRS?
Your name, address, date and place of birth, tax residence and taxpayer identification number, the account number and the reporting institution, the year-end balance, and income including interest, dividends and gross proceeds from sales.
Does CRS apply to company bank accounts?
Yes. Where the entity is classified as passive, meaning it earns most of its income from passive sources rather than an active trade, the reporting looks through to the controlling persons behind it and reports them individually alongside the account.
Can I avoid CRS by incorporating offshore?
No. Reporting follows your own tax residence and the obligation sits on the financial institution holding the account, not on the company registry or the jurisdiction of incorporation. The company's location is not an input to the question.
Does CRS cover crypto?
Partly, and a second framework covers the rest. The CRS amendments reach electronic money products, central bank digital currencies and indirect crypto exposure held through derivatives and investment vehicles. Direct crypto holdings fall under the separate Crypto-Asset Reporting Framework, with exchanges commencing in 2027 or 2028.
What happens if I bank in a country outside CRS?
Your account is not exchanged through that channel, but nothing about your own obligations changes. You still declare the income and the account where you are tax resident, under your own country's law, and that duty exists independently of whether anyone reports it.
Is having an offshore company illegal?
No. Owning a foreign company is legal in almost every country. Failing to declare the company, or the income from it, where you are tax resident is the illegal part, and that is a domestic law question rather than an offshore one.
What is a self-certification?
A form your bank asks you to complete confirming where you are tax resident, used to decide where your account gets reported. Providing false information on one is a distinct offence in many jurisdictions, separate from any tax owed on the underlying income.
Are beneficial ownership registers public?
It varies by jurisdiction and has been contested in litigation in several places. Assume the information is collected everywhere and that access is broader than it was, even where the register is not open to the general public.
What should I do if I have an undeclared structure?
Take professional advice in your own country promptly. Most jurisdictions operate voluntary disclosure routes that are substantially cheaper than being found, and with 171 million accounts exchanged in a single year, being found is now the ordinary outcome rather than the unlucky one.
