CRS: How the Automatic Exchange of Tax Information Works

The CRS (Common Reporting Standard) is the OECD standard under which banks identify the account holder's tax residence and report balances and income to the local tax authority, which then passes the data every year to the authority of the country of residence.

For Brazil, this means that the Federal Revenue Service (Receita Federal) can receive data on accounts held abroad.

How does the CRS automatic exchange of information work?

The exchange follows five steps, and none of them depends on a request from the Receita. The Multilateral Competent Authority Agreement (MCAA) says that each authority exchanges information "automatically", once a year, with the authorities of the countries where the agreement is in force.

1. •Self-certification when the account is opened. The bank requires the holder to state where they are tax resident and checks that the answer is reasonable against the account-opening documents (IN RFB 1,680/2016, Sole Annex, Sections III and V).
2. •Identification of the reportable account. If the holder is resident in a reportable jurisdiction, the account is treated as reportable.
3. •Report to the local authority. The institution reports the data to the tax authority of the country where the account is held.
4. •Transmission between authorities. The local authority passes the data to the authority of the country of residence, in the CRS XML format.
5. •Deadline. The exchange takes place within nine months after the end of the calendar year to which the information refers, that is, by the end of September of the following year (MCAA, Section 3).

There are two conditions. Information for a given year is exchanged only if both countries have the agreement in force and a domestic law requiring the report for that year. And the exchanged data remain subject to the confidentiality and use-limitation rules of the Convention on Mutual Administrative Assistance in Tax Matters (MCAA, Section 5).

What data from my account reaches the Receita Federal?

Registration data, balance and gross income arrive, not the detailed statement. Section 2 of the MCAA lists what is exchanged for each reportable account:

Amounts are reported in the currency in which they were determined (MCAA, Section 3).

Brazil receives this data as the holder's country of residence. What the Receita does with it afterwards is not covered in the CRS texts. The enforcement routine is described in how the Federal Revenue Service audits offshore accounts.

Which countries exchange data with Brazil under the CRS?

The OECD list, as of March 13, 2025, shows 126 signatory jurisdictions to the MCAA. Brazil signed on October 6, 2016, with the first exchange scheduled for September 2018. The list is a snapshot: the "first exchange" date is an intention, not proof that the data was sent.

Signing the MCAA is not enough for an exchange with Brazil to take place. The Sole Annex to IN RFB 1,680/2016 defines "reportable jurisdiction" as one with which an agreement is in force and that appears on a list published by the Receita. Before concluding that an account is inside or outside the CRS, check the current list.

The United States does not appear on the list of MCAA signatories. The American regime is FATCA, under which foreign institutions may report to the IRS the accounts of US taxpayers, according to the IRS itself. That does not, on its own, answer whether another exchange instrument exists with Brazil.

How does Brazil apply the CRS in practice?

Brazil applies the CRS through IN RFB 1,680/2016 (a Receita Federal normative instruction), which rests on Legislative Decree 105/2016, Decree 8,842/2016 and the MCAA. The central points are these:

• •Who identifies. Legal entities required to file the e-Financeira identify accounts under the CRS, for events occurring from January 1, 2017 (art. 2).
• •How it is reported. The information goes through the e-Financeira, within the deadlines of IN RFB 1,571/2015 (art. 2, § 1).
• •What a reportable account is. It is an account held by a reportable person, or by a passive non-financial entity with a reportable controlling person (art. 3, § 1). Excluded from the concept of reportable person, among others, are publicly traded companies, governmental entities, central banks and financial institutions (art. 3, § 2).
• •What data. Art. 4 provides a list equivalent to the MCAA's: holder, TIN, account, balance and gross income.
• •Penalty. Information that is not filed, is incorrect or is incomplete triggers the fines of art. 13 of IN RFB 1,571/2015 (art. 5). The duty to report falls on the legal entity required to file the e-Financeira.

The same IN applies to banks in Brazil that hold accounts of residents of other reportable jurisdictions. The exchange works in both directions.

What changed with CRS 2.0 and IN RFB 2,298/2025?

The OECD updated the CRS in 2023 to broaden its scope and strengthen reporting and due diligence, and the Addendum to the MCAA added items of information to the exchange. Brazil signed the Addendum on November 21, 2024. The list of signatories, as of October 1, 2026, has 83 jurisdictions, among them the Cayman Islands and Switzerland (November 26, 2024), Panama and Uruguay (December 2, 2025).

The Addendum adds these items to the exchanged data:

• •whether there is a valid self-certification for each holder;
• •the role by virtue of which each reportable person is a controlling person of an entity holder;
• •the type of account, whether it is pre-existing or new, and whether it is joint (with the number of joint holders);
• •the role of the holder of an interest in an investment entity that is a legal arrangement, such as a trust.

In Brazil, IN RFB 2,298/2025, published in the Federal Official Gazette (DOU) on December 26, 2025, updates IN 1,680 to the most recent version of the CRS and has produced effects since January 1, 2026. The consolidated text of IN 1,680 now treats as a depository institution anyone holding specific electronic money products or central bank digital currencies. It also included the "reportable crypto-assets" defined in IN RFB 2,291/2025 in the activity of investment entities.

The texts consulted do not set the date of the first exchange under the Addendum. Check with the Receita for that deadline.

Does the CRS reach company and trust accounts?

It does, through controlling persons. If the holder is a passive non-financial entity, the financial institution looks at who controls it. If any controlling person is reportable, the account is reportable (IN RFB 1,680/2016, art. 3, § 1).

A passive non-financial entity is one that is not "active". One of the criteria for an active entity is having less than 50% of gross income as passive income and less than 50% of assets that generate passive income. The full definition has other criteria, so the classification depends on the case.

For trusts, the Sole Annex defines controlling persons as the settlor, the trustees, the protectors, if any, the beneficiaries or classes of beneficiaries and any other natural person exercising ultimate control. Anyone managing the structure should check how corporate structures are treated before opening or maintaining accounts.

The amounts of US$250,000 and US$1,000,000 in the Sole Annex concern the review of pre-existing accounts. For new accounts of individuals and entities, the rule is to obtain the self-certification at opening.

What is the difference between the CRS, the CBE and FATCA?

They are different obligations, with who reports and to whom on opposite sides.

For the CBE (Brazilian Capital Abroad report), the annual declaration is mandatory for those whose assets abroad total US$1,000,000.00 on December 31, according to the Central Bank. It exists alongside the CRS and is not replaced by it. For how to fill in the income tax return, see how to declare an offshore company on your income tax return. Anyone who has already failed to declare will find the path described in regularization of undeclared offshore assets.

What should you check to avoid data mismatches?

The bank reports the registration data and the account amounts, and you declare your own assets and income. Three points help keep the two aligned:

1. •Tax residence. The self-certification must reflect where you are tax resident. The account remains reportable until the holder ceases to be a reportable person (IN RFB 1,680/2016, art. 3, § 3). See international tax residence.
2. •TIN. Provide the correct taxpayer identification number, which is one of the data points exchanged.
3. •Account structure. Know whether the holder is you, a company or a trust, because that defines who the controlling person is. International tax planning should come before the account is opened.