FATCA & CRS Filing: Do You Actually Have to File?

Every summer, the same thing happens inside German compliance teams. The 31 July FATCA and CRS filing deadline comes into view, and a question that has been quietly parked all year suddenly turns urgent: do we actually have to file this — and if so, for what?

It is a fair question, and a harder one to answer from the outside than it should be. FATCA and CRS filing is the task nobody wants to own. Advisors would rather not touch it, and the institutions that carry the obligation — smaller banks, payment institutions, licensed FinTechs and, very often, funds — would rather it belonged to someone else. So it drifts, unowned, until the deadline forces the issue.

This guide answers the upstream question: are you even obligated to file, and what does that obligation actually cover? It is written for German-supervised institutions, so where the mechanics matter we describe the German channel — filing to the Bundeszentralamt für Steuern (BZSt). The classification logic itself is the same in every CRS jurisdiction.

Start here: are you a Reporting Financial Institution?

The instinct is to begin with “do we have any reportable accounts?” That is the wrong starting point. Under both FATCA and CRS, the obligation to file does not come from having reportable accounts. It comes from what you are.

The regimes apply to entities that meet the definition of a Reporting Financial Institution (RFI). If you are one, you carry due-diligence and reporting obligations — determined by your status, not by what a given year’s review turns up (more on what that does, and does not, require below). If you are not one, you generally do not. So the first question is not about your accounts; it is about your classification.

There are four categories of Financial Institution. Most institutions that are caught are caught by one of them:

If you run a fund, that third line usually applies to you. An entity whose business is investing, reinvesting or trading in financial assets — or that is managed by such an entity — is typically an Investment Entity, and therefore an RFI. “We’re a small fund” is not an exemption. If anything, small, newly launched vehicles are exactly the ones that overlook the classification until someone asks.

”All our clients are in Europe — why does the US even care?”

This is, almost word for word, the objection we hear most. It bundles two separate misunderstandings, so it is worth pulling them apart.

FATCA is a United States law. It asks German institutions to identify and report accounts held by US persons. If you genuinely have no US-person account holders, your FATCA reportable population may well be nil — but, as we will see, that is not the same as having nothing to file.

CRS is the part people miss. CRS is not American. It is the OECD’s Common Reporting Standard, implemented in Germany through the Finanzkonten-Informationsaustauschgesetz (FKAustG), and it covers tax residents of more than one hundred participating jurisdictions — the entire EU included. “All our clients are in Europe” is not a reason CRS does not apply; it is precisely the situation CRS was built for. An account held by a French, Italian or Spanish tax resident at a German institution is a CRS matter.

The real trap: deciding you’re exempt

Here is the most expensive misunderstanding in the regime, and the one that catches newly licensed institutions most often. It is not about how you file — it is about wrongly concluding you have no obligation at all.

Two assumptions do the damage. The first is “we’re not really a financial institution” — a classification error. The second is “we have no US clients, so this doesn’t apply” — which forgets CRS entirely. Both let an institution quietly write itself out of scope.

The obligations to classify yourself and perform the due diligence attach to your status as a Reporting Financial Institution, not to what the review turns up. You have to run the checks even to be entitled to say you have nothing to report — and for an all-European book, “nothing to report” is usually wrong in the first place, because CRS-reportable accounts held by EU tax residents are exactly what you will find.

A word on the nil return, because it is widely misstated. Some jurisdictions do require a nil return even when you have nothing to report — Luxembourg, for instance, has mandated one since 2021. Germany currently does not: the BZSt states that no nil or empty report is legally required for either CRS or FATCA when there is no reportable data. That is not a licence to skip the work — you should still complete and retain evidence of your due diligence — but in Germany the obligation is the classification and the review, not a mandatory empty filing.

What’s actually in scope — and who counts as an account holder

Once you know you must file, the next fog is scope. Two questions come up constantly.

Who is the account holder — and who is behind it? For accounts held by entities, CRS does not stop at the entity. Where an account is held by a Passive Non-Financial Entity, you are required to look through to its controlling persons — broadly, the beneficial owners — and report those who are reportable. This is why “we only have corporate clients” does not close the question: the controlling persons behind those entities can be reportable even when the entity itself is not.

What gets reported, and how much? For each reportable account you report identifying details, the account number, the year-end balance or value, and the relevant income or gross proceeds — together with the tax identification number (TIN) of the holder’s jurisdiction of residence, and, under CRS, partitioned by jurisdiction. Working out which balance to report, validating TIN formats, and identifying controlling persons is where most of the real effort sits.

If you want the full technical treatment — the XML schemas, the DIP API, the build-versus-buy economics — that is the subject of our FATCA, CRS and DAC8 whitepaper. This guide stays on the prior question: whether, and for what, you must file.

What happens if you miss 31 July?

The German filing to the BZSt for the preceding calendar year is generally due by 31 July. Missing it is not consequence-free.

Under CRS, Section 28 of the FKAustG treats reporting violations — late, missing or inaccurate filings — as administrative offences (Ordnungswidrigkeiten). The ceiling depends on the violation: up to €50,000 for the categories the statute singles out, and up to €10,000 in the other cases. For an institution with accounts across several jurisdictions, a deficient cycle can still compound quickly.

Under FATCA, the mechanism is different and, commercially, often heavier. An institution that fails to file, or files materially inaccurate data, risks being treated as a non-participating foreign financial institution — which exposes US-source payments routed through it to 30% withholding. For anyone who touches US-dollar flows, that is a far more serious outcome than an administrative fine.

The practical point: neither “we’re small” nor “we had nothing to report” changes the deadline, or the exposure.

You do not have to do this yourself

A point that is rarely obvious to the institutions carrying the obligation: you are allowed to have someone file on your behalf. The German system explicitly supports a third-party submitter — a Datensender — that handles the technical submission to the BZSt while the legal responsibility for the accuracy of the data stays with you. You keep the accountability; you hand off the machinery.

This matters more than it used to, for two reasons.

First, the BZSt is moving filing off the old browser-upload route (ELMA) and onto the BZSt online.portal and DIP mass-data interface — FATCA switched over in late 2025, and CRS is moving through the same transition. Filing has become an engineering task — precisely the part a small compliance team should not be building from scratch for two or three submissions a year.

Second — and we are watching this happen in real time — teams under deadline pressure have started pasting client account data into general-purpose AI tools to “just get the filing done.” That means the personal data of your clients is being transferred to third-party services, frequently outside the EU, with little regard for where it ends up. For a regulated institution handling account-holder PII, that is a data-protection exposure in its own right. A purpose-built, access-controlled filing path is not a nicety here; it is the difference between a defensible process and an undocumented data transfer.

The short version

• The obligation follows from being a Reporting Financial Institution, not from having reportable accounts. Most funds are Investment Entities, and are in scope.
• CRS is not FATCA. An all-European client base is squarely within CRS.
• Germany does not require a nil return when you have nothing to report — but the duty to classify and run due diligence stands, and an all-EU book usually does have CRS-reportable accounts.
• Scope reaches the controlling persons behind entity accounts.
• The BZSt deadline is 31 July; missing it carries real penalties under the FKAustG and, for FATCA, withholding exposure.
• You can appoint a Datensender to file for you — and you should not be routing client PII through consumer AI tools to make the deadline.

Karthik Iyengar builds Regfiler, a filing platform for FATCA, CRS and DAC8 submissions to the BZSt.