CRS 2.0 explained for holding companies, trusts and family offices

CRS 2.0 is the OECD's amended Common Reporting Standard, published together with the Crypto-Asset Reporting Framework (CARF) in 2022. It starts on 1 January 2026 in the first group of jurisdictions, including the UK, the EU and the Cayman Islands, and later elsewhere. Under it, your bank collects more information about your entity and the people behind it. The bank then reports that information to its local tax authority, which exchanges it with the tax authorities where you and your controlling persons are resident.

For owners of holding companies, trusts and family office vehicles, the practical result is simple. More forms are arriving, they ask sharper questions, and the answers now carry more weight. If you hold assets through layered structures, the way you classify each entity decides who gets reported and where.

This guide covers what changed, when it applies, and how to fill in the form your bank has probably just sent you.

What is CRS 2.0?

The original Common Reporting Standard has been in use since the first exchanges in 2017. It requires financial institutions to identify account holders who are tax resident elsewhere and to report their balances, income and identity details. More than 100 jurisdictions take part.

CRS 2.0 is not a new system. It is a set of amendments to the existing standard, agreed by the OECD in 2022 after a review of how the first version worked in practice. The review found two problems. New products, such as e-money and crypto-assets, sat outside the rules. The data being exchanged was also often too thin for tax authorities to use well.

The amendments fix both. They widen what counts as a reportable account, and they make banks report more context about each account and each person connected to it. They were released alongside CARF, a separate framework aimed at crypto-asset service providers, so that the two systems fit together without double reporting.

For you, the mechanics stay the same. You complete a self-certification that declares your classification, your bank checks it against what it already knows, and the bank reports where required.

What changed under CRS 2.0 and the Crypto-Asset Reporting Framework

E-money and central bank digital currencies come into scope. Specified Electronic Money Products and Central Bank Digital Currencies are now treated as depository accounts. There is an exclusion for small balances: if the rolling 90-day average balance does not exceed USD 10,000, the product is not reportable. A treasury entity holding larger balances in e-money wallets should expect those wallets to be reported.

Crypto-assets are split between the two frameworks. Indirect holdings fall under CRS. The Investment Entity definition now covers entities investing in crypto-assets, and derivatives referencing crypto-assets count as Financial Assets. Direct holdings fall under CARF, which covers exchanges between crypto and fiat, exchanges from one crypto-asset to another, and transfers. If your family office runs a digital asset portfolio, both regimes may touch it. Our UAE crypto regulation map for 2026 sets out the local licensing side.

Your bank will also collect and report new data:

• Self-certification status: whether a valid self-certification was provided for each reportable person

• Controlling person roles: the role or roles by which each controlling person controls the entity, with every role reported for a trust

• Joint accounts: whether the account is joint and how many joint holders it has

• Account type and age: the type of account, and whether it is pre-existing or new

When CRS 2.0 applies: the 2026, 2027 and 2028 starts by country

The rollout is staggered. The UK starts CRS 2.0 and CARF from 1 January 2026, with first reports to HMRC due by 31 May 2027. In the EU, DAC8 (Council Directive (EU) 2023/2226 of 17 October 2023) applies from 1 January 2026, with the first exchange by 30 September 2027. The Cayman Islands also starts both from 1 January 2026, with first amended CRS reports due 30 June 2027.

The UAE Ministry of Finance announced on 8 November 2025 that CRS 2.0 applies from 1 January 2027, with first exchange in 2028. Singapore also starts on 1 January 2027, with first exchange in September 2028. Hong Kong has proposed amended CRS from 1 January 2028, but its bill has not yet passed, so that date is conditional.

How your entity is classified: Financial Institution, Active NFE or Passive NFE

Classification decides who is reported. A Financial Institution reports on its own account holders. An Active NFE is reported on in its own right. For a Passive NFE, the bank looks through to the people who control it.

A holding company counts as a Financial Institution when its gross income is mainly from investing in financial assets (50% or more over three years) and it is managed by a Financial Institution. It then becomes an Investment Entity. This catches many professionally managed family vehicles, for example a company whose portfolio is run on a discretionary basis by a licensed manager. If you are weighing jurisdictions for that kind of vehicle, see Cayman or BVI for an offshore holding company.

The main route to Active NFE status has two tests, and both must be met. Less than 50% of its gross income in the previous year must be passive income, such as dividends, interest or rents. Less than 50% of its assets must produce, or be held to produce, passive income. A trading company with genuine operations usually passes both tests.

A Passive NFE is any NFE that is not Active. This is the usual answer for a family holding company that owns a portfolio of shares and investments and receives dividends but is not managed by a Financial Institution. Group holding companies are different. A company is an Active NFE if substantially all of its activities consist of holding shares in, or providing finance and services to, subsidiaries that run businesses other than financial businesses. This does not apply if it acts, or presents itself, as an investment fund, such as a private equity or venture capital fund, or as a vehicle that buys or funds companies in order to hold them as investments.

Trusts and foundations follow the same logic. A professionally managed trust with a trust company as trustee is often itself a Financial Institution. A trust with individual trustees holding investments is typically a Passive NFE. The corporate building blocks of family office structures affect which side of that line each entity lands on.

Controlling persons and the entity self-certification form

A CRS controlling person is a natural person who exercises control over an entity, interpreted in line with the FATF Recommendations. For companies there is no single universal ownership threshold. Your bank applies its local anti-money-laundering rules to decide who qualifies, which is why two banks may list different people for the same company.

Trusts work differently. The settlor or settlors, the trustees, any protector, the beneficiaries or classes of beneficiaries, and anyone else with ultimate effective control are all controlling persons. Their percentage interest is irrelevant. A discretionary trust with a protector and three named beneficiaries can easily produce six or more controlling persons, each with their role recorded.

Your bank is sending the form again now because CRS 2.0 requires data that many older forms did not capture in full, such as every role each controlling person holds. Dual-resident entities that are re-documented can no longer rely on treaty tie-breakers and must declare every jurisdiction of residence.

Before you return the entity self-certification form:

• Confirm classification: check it against the income and asset tests, not last year's form

• List every residence: include every jurisdiction where the entity is tax resident

• Map controlling persons: identify each person and every role they hold

• Keep it consistent: make sure the same answers go to every bank

What happens if you do not return the form

The CRS general rule is that a self-certification is obtained on the day the account is opened. The OECD suggests countries make account opening conditional on it, so a missing form can stall a new account entirely. Missing CRS paperwork can hold up UAE business bank account applications, and the same applies when opening a Hong Kong business bank account.

For pre-existing accounts, the bank must presume Passive NFE status if it cannot establish otherwise. That means it will look through your entity and may report controlling persons who should never have appeared, or report them to the wrong jurisdiction. From 2026, UK banks also flag accounts that lack a valid self-certification, so the tax authority can see which accounts were never documented.

In the UK, an account holder or controlling person who deliberately or carelessly fails to give a valid self-certification faces a penalty. The bigger cost is usually operational: frozen onboarding, repeated document requests and awkward questions from tax authorities that receive inaccurate data.

CRS 2.0 FAQs

Does CRS 2.0 apply to my UAE holding company yet? Not in the UAE itself. The UAE applies CRS 2.0 from 1 January 2027, with first exchange in 2028. If your UAE company banks in the UK, the EU or Cayman, those banks already apply the new rules from 2026.

Is my family holding company a Passive NFE? Often, yes. A company that holds a portfolio of investments and earns mainly dividends or interest fails the Active NFE income and asset tests. There are two main exceptions. If it is managed by a Financial Institution and earns 50% or more of its income from financial assets, it is an Investment Entity. If it is the holding company of a group whose subsidiaries run non-financial trading businesses, it can be an Active NFE.

What is the difference between CRS 2.0 and CARF? CRS 2.0 is reported by financial institutions such as banks and custodians, and covers accounts, e-money and indirect crypto holdings. CARF is reported by crypto-asset service providers and covers direct crypto exchanges and transfers. The two were designed together to avoid double reporting.

My company is tax resident in two countries. What do I put on the form? You list both jurisdictions. Under the amended rules, a dual-resident entity being re-documented cannot use a treaty tie-breaker to pick one, so every jurisdiction of residence goes on the form.

Can my bank close my account if I do not send a self-certification? Banks can restrict or close accounts under their own terms, and many treat missing CRS forms as a compliance failure. At a minimum, the bank will presume Passive NFE status and report on that basis. Returning an accurate form is the only way to control what gets reported.

The new rules reward owners who know their structure before the bank asks. Classify each entity properly, map every controlling person and role, and give every bank the same answers. If you hold companies, trusts or family vehicles across several countries, book a conversation with Cosmos about how your structure fits together and what your banks will see. Cosmos is an AI-native platform that coordinates corporate, tax and compliance work across countries, with named specialists and local partners.