FATCA and CRS penalties: what one bad self-certification costs

FATCA and CRS penalties come in three kinds: per-account penalties on the institution for failing to obtain or validate a self-certification, penalties for reports that are late, incomplete or inaccurate, and, under FATCA, a 30% withholding tax on payments to entities that are not properly documented. In the UK an institution faces up to £300 for each account holder or controlling person for whom it failed to obtain a valid self-certification; in Abu Dhabi the regulator charged AED 1,000 per invalid form and AED 5,000 per incompletely reported account in its 2025 decisions. None of these is large alone. They become large because they are counted per person, across every account opened with the same defect, and because a form that fails once can fail again in every report that relies on it. Botminds' FATCA/CRS Self-Certification exists to keep that count near zero by checking every form against the other forms and the KYC file before it is relied on.

Product examples come from the solution's sample data on a fictional fund manager, Quillfield Capital. The penalty figures are from regulators' published decisions and manuals, linked where they appear.

What are the penalties for FATCA and CRS?

They are set by each jurisdiction's implementing law, so the amounts differ; the structure is similar. An institution is penalised for due diligence failures, including failing to obtain a valid self-certification, per account holder or controlling person; for reports that are late; and for reports that are incomplete or inaccurate, again per person. Some jurisdictions, the UK among them, now also penalise the account holder who fails to provide a valid form. FATCA adds a withholding regime on top: a withholding agent must withhold 30% of a withholdable payment to a foreign financial institution that does not meet the FATCA requirements (26 U.S.C. 1471(a)), and the IRS describes the same 30% for a passive NFFE that does not certify or identify its substantial US owners (IRS, Instructions for Form 8966).

The ADGM regulator's May 2025 announcement lists the failures behind its penalties on 23 entities: failing to "submit risk assessment(s)", to "submit the required annual information return(s)", to "follow due diligence procedures", to "report information in a complete and accurate manner" and to "collect valid self-certification forms" (ADGM FSRA, 26 May 2025). For a fund, the last three are the ones that grow with the number of investors.

What is the UK penalty for a missing self-certification?

Up to £300 for each account holder or controlling person, on the institution, for failures on or after 16 July 2025. HMRC's manual sets it out: where the failure is "a failure to obtain a valid self-certification required by the CRS or the FATCA agreement, the penalty is up to £300 for each Account Holder or Controlling Person for which a valid self-certification has not been obtained" (HMRC IEIM405116). The investor is exposed too: a self-certification provider who fails to provide a valid one is "liable to a penalty of up to £300 if the failure is deliberate or due to a failure to take reasonable care" (HMRC IEIM405118).

The schedule has a transitional edge. HMRC says the self-certification penalty does not apply to new accounts opened between 1 January 2016 and 15 July 2025 without a valid form, but that the inaccurate-reporting penalty may apply to returns submitted after 16 July 2025, for example "where account holders are reported without a TIN or correct tax residence" (HMRC IEIM405116). An old defect is not a closed one; it reappears in every return that relies on it.

Have regulators fined funds for contradictory forms?

Yes. The clearest published cases are the Abu Dhabi Global Market regulator's 2025 decisions, which name the defects client by client. ADS Investment Solutions was penalised for a client that was a passive NFE on its CRS form and a sponsored FFI on its W-8BEN-E with nothing on file reconciling them; on appeal, the regulator cut the penalty from AED 20,000 to AED 8,000 after accepting earlier forms for other clients, and kept it for that contradiction (ADGM FSRA, ADS decision). Ousoul Assets Custodian's notice found the reverse pairing, an investment entity on the CRS form and a passive NFE for FATCA (ADGM FSRA, OAC notice). The full ADS reasoning, and what would have closed the contradiction, is in the entity form against its W-8BEN-E.

Funds are not exempt. Investcorp Saudi Pre-IPO Growth Fund LP, a fund, paid AED 69,000 for four invalid self-certifications and a long list of reporting errors, including TINs the fund had generated itself for residents of the British Virgin Islands and the Cayman Islands, which issue none (ADGM FSRA, ISPG decision). Freedom Advantage Funds OEIC PCC was penalised AED 25,000 for incomplete and inaccurate reporting (ADGM FSRA, FAF decision). Two others, PraxisIFM Trust and ACM, had their penalties reduced on appeal, to AED 24,000 and AED 13,000 (PTL; ACM).

How penalties add up across many accounts

By multiplication, and the multiplier is the number of people on the bad forms. The ADGM decisions make it explicit: they end with a table of contraventions, an amount per contravention and a count.

Two things stand out. The reporting count drives the total: Ousoul's four invalid forms cost AED 4,000, while seventeen reportable accounts it left out of its return cost AED 85,000. And one contradictory pair of forms can be counted twice, as ADS's was: once as an invalid CRS self-certification and once as an invalid FATCA one.

Applied to the UK maximums, the same arithmetic scales quickly. Take an illustrative 100 entity investors whose CRS forms are unreconciled, each a passive NFE with two controlling persons, and no valid self-certification held for any of them: up to £300 for each of the 300 people is £90,000 before any inaccurate-reporting penalty at up to £100 each. That is our arithmetic on maximums, not a prediction; HMRC sets each penalty below the maximum under its published reduction guidance, and charges none where there is a reasonable excuse.

Can withholding apply if a form is invalid?

Yes, under US rules, and it can cost more than any penalty. A withholding agent that cannot rely on a W-8 must apply the presumption rules, and for chapter 4 purposes that can mean withholding 30% of a withholdable payment to an entity treated as an undocumented foreign financial institution or a passive NFFE that has not identified its owners. The person who should have withheld carries the risk: "Every person required to deduct and withhold any tax under this chapter is hereby made liable for such tax" (26 U.S.C. 1474(a)).

W-9s have their own regime. A payor must withhold 24% of reportable payments when a payee has not provided a correct TIN or certification, and the IRS warns: "If you don't collect backup withholding from affected payees as required, you may become liable for any uncollected amount" (IRS, Instructions for the Requester of Form W-9). Withholding is not a fine on the fund, but a fund that withholds from the wrong investor, or fails to withhold from the right one, has a problem with that investor or with the IRS.

Who pays: the institution or the account holder?

Both can, for different things. The institution pays for its own failures to obtain, validate and report, and the ADGM decisions are clear that mitigation does not move that responsibility: ADS argued that its contradictory client never invested and never caused a wrong report, and the penalty for that client stood. The account holder can be penalised for not providing a valid form in the UK, and under US rules a W-9 payee faces "a penalty of $50 for each such failure" to furnish a correct TIN and "a $500 penalty" for a false statement with no reasonable basis that avoids backup withholding (IRS, Form W-9).

Some jurisdictions close the door earlier. Ireland's Revenue says "an account cannot be opened in Ireland if a valid self-certification has not been obtained", and that an account opened without one breaches the Irish CRS legislation (Irish Revenue, Tax and Duty Manual Part 38-03-23). There, the cost of a bad form is also the cost of an investor who cannot subscribe until it is fixed.

The cost nobody fines: re-reporting, letters and data that cannot be matched

Most of the cost of a bad self-certification never appears in a penalty notice. It is the analyst time to find the defect, the letters to the investor, the amended returns once it is fixed, and the questions from the receiving authority in between. No regulator or independent study publishes a cost per form for this work; the way to know it is to count, on your own files, the forms that needed a second letter and the returns that needed amending.

What has been measured is where the data ends up. The US Treasury Inspector General for Tax Administration examined the FATCA reports the IRS received for tax years 2016 through 2019:

"Only 44 percent of the Forms 8966 the IRS received contained a valid TIN, while the remaining 56 percent contained an invalid TIN or had no TIN."

Treasury Inspector General for Tax Administration, report 2022-30-019, 7 April 2022

A TIN missing from a report is a TIN missing from a self-certification first. The same report put the IRS's FATCA implementation costs at nearly $574 million between 2010 and 2020. Tax authorities are now asking for the missing pieces directly: from 2026, CRS reports must say whether a valid self-certification is held for each account holder, which turns every unresolved form into a visible flag. The reporting calendar that flag lands in is covered in the CRS reporting season.

Bringing the count of bad forms to zero

Because penalties are counted per person, the lever is the count, and the count is set at intake. FATCA/CRS Self-Certification checks every W-9, W-8 and CRS form against its own rules, then against the other forms and the KYC file, before anyone relies on it; it drafts one cure letter per investor covering every defect, in English and the investor's language, and runs a 90-day clock with reminders, escalation and a proposed fallback for the head of fund tax to decide. Its design targets are no conflicting classification left on file and one letter per investor instead of one request per defective form. They are targets, not results.

Botminds' own estimate of the time from a defective entity investor's forms arriving to the cure request going out is about eight business days by hand, spent logging, reading a local-language template, checking each form, setting the forms side by side and getting the letter approved, against under one business day with the solution. Every one of those days is a day of the 90-day window the investor does not get.

The checker approves the letter, with a reason code, before it goes

Whether a tool actually lowers the count is testable before you buy it, by planting known errors in forms you have already accepted, as tax form validation, tested describes. The cure workflow itself is part of FATCA/CRS Self-Certification.

Questions people ask

Are FATCA and CRS penalties automatic?

Not in the UK. HMRC says penalties are not applied automatically: it first looks for a reasonable excuse, charges nothing if there is one, and otherwise considers how far to reduce the penalty from the statutory maximum.

Can a penalty be reduced on appeal?

In ADGM it often was in 2025. ADS's penalty fell from AED 20,000 to AED 8,000, PraxisIFM Trust's from AED 44,000 to AED 24,000 and ACM's from AED 18,000 to AED 13,000, in ADS's case largely because the firm showed valid earlier forms for other clients. Investcorp Saudi Pre-IPO Growth Fund's and Wahed Invest's were confirmed unchanged.

Does closing the account end the exposure?

No. ADS's contradictory client account had been closed for inactivity, and the regulator still penalised the failure to validate the self-certification while the account was open.

Can an investor be penalised for a false self-certification?

Yes, in some places. In the UK an account holder or controlling person faces up to £300 for failing to provide a valid self-certification deliberately or carelessly. On a US Form W-9, a false statement that avoids backup withholding carries a $500 civil penalty, and wilful falsification can bring criminal penalties.

What is the UK penalty for a late return?

HMRC can charge an initial penalty of up to £5,000 if a return is not made by 31 May, and daily penalties of up to £600 per day if the failure continues after the penalty notice.