UAE CRS 2.0 and Tax Transparency: Reporting Readiness for Foundations and SPVs

UAE CRS reporting for foundations and holding companies starts with facts, not the label. Establish whether the entity is a Financial Institution (FI), a Non-Reporting FI, an Active Non-Financial Entity (Active NFE) or a Passive Non-Financial Entity (Passive NFE), then map the individuals who control it, their tax residences and the evidence the bank holds. The UAE Ministry of Finance has announced that CRS 2.0 takes effect on 1 January 2027, with first exchanges expected in 2028.

The Common Reporting Standard (CRS) is the international standard for automatic exchange of financial-account information. Under the UAE framework, Reporting Financial Institutions report relevant information through the Ministry of Finance — not a universal report of every UAE client: the institution considers the account holder, entity classification, tax residence and, where relevant, the natural persons who control a Passive NFE.

CRS 2.0 is an updated standard, not a new secrecy test or automatic classification of every foundation and SPV. It may expand the data, due-diligence and reporting perimeter, and introduce related audit expectations, for institutions and activities within the updated scope; the effect on a particular entity depends on its classification, accounts, activities and the applicable implementation materials.

CRS, FATCA (the United States Foreign Account Tax Compliance Act), anti-money-laundering and know-your-customer (AML/KYC) rules, beneficial-ownership rules and UAE Corporate Tax answer different questions even when they use overlapping records. The Crypto-Asset Reporting Framework (CARF) is complementary to CRS, not a replacement; the UAE has signed the CARF multilateral agreement, with implementation and first exchanges expected in 2027 and 2028.

For the separate Corporate Tax treatment of qualifying family foundations, see the UAE Corporate Tax Article 17 transparency guide.

For a foundation, holding company or special-purpose vehicle (SPV), classification is the first decision gate: work through this sequence using current UAE rules and the entity's records.

1. Financial Institution. First ask whether the entity is an FI; if it is, whether it is a Reporting FI or falls within a Non-Reporting FI exclusion. An entity may be an Investment Entity where it primarily conducts relevant investment, trading or portfolio-management activities for or on behalf of customers, or where its gross income is primarily attributable to investing, reinvesting or trading in Financial Assets and it is managed by another entity within the specified Financial Institution categories. "Managed by" requires more than a service-provider label: the managing entity must itself be a Depository Institution, Custodial Institution, Specified Insurance Company or an Investment Entity conducting the relevant activities, measured over the shorter of the three-year period ending on 31 December before the determination year or the entity's existence. Custody, administration or accounting alone does not necessarily satisfy the test; whether management is substantive is fact-dependent under the current OECD Commentary.
2. Non-Reporting Financial Institution. A specific exclusion, not a synonym for a small, private, family-owned or inactive entity. Test it against current UAE rules, activity and evidence, and retain the rationale.
3. Active NFE. For the income-and-assets route, both limbs must be met: less than 50% of the preceding calendar year's gross income is passive income, and less than 50% of the assets held during that year produce or are held to produce passive income. This is one route, not the complete definition; separate routes may apply, including certain operating-company holding, financing or service activities, subject to their own conditions.
4. Passive NFE. A Passive NFE generally includes an NFE that does not qualify as an Active NFE, and also an Investment Entity within the managed-by limb that is not a Participating Jurisdiction Financial Institution. The Reporting Financial Institution may then need to look through the entity to identify relevant Controlling Persons and tax residences.
5. Needs review. Mark an entity "needs review" when its documents, activity, income, assets, management agreement or connected jurisdictions do not support a defensible conclusion. This is not a CRS legal category but a control status: resolve the missing evidence before a self-certification is signed.

The classification is determined by the entity's activities, income, assets, management and documents, not by the label on its registration certificate. The September 2023 Guidance Notes remain the UAE's principal CRS interpretive note, read with the current UAE CRS Regulations, Ministerial Resolution No. 134 of 2021, the Ministry of Finance's CRS FAQs and later circulars; these update reporting, TIN, data-quality, undocumented-account and deadline procedures without altering the core 50% tests.

"Foundation", "holding company" and "SPV" describe legal form, function or use case. A professionally and discretionarily managed investment foundation may need Investment Entity analysis; a family holding company with genuine non-financial group activity may fit an Active NFE category if its conditions are met; a vehicle receiving mainly dividends, interest and rent may require Passive NFE analysis instead.

A free-zone or registry label does not settle tax residence, CRS status, bank acceptance or foreign reporting. DIFC, ADGM and RAK ICC provide legal and governance frameworks that help explain documents and roles; they do not replace the CRS analysis, and for ADGM and DIFC tax-transparency compliance the financial centres' CRS regulations sit alongside the federal framework without replacing entity-level classification.

If the decision is which vehicle to use rather than how to prepare an existing structure, start with UAE foundation, trust and holding-company comparison. For regime-specific context, see the DIFC and RAK ICC foundation comparison.

The CRS Controlling Person analysis is separate from the UAE beneficial-owner framework, but neither displaces AML/UBO transparency obligations. For a company, current UAE CRS materials generally start with natural persons controlling more than 25% directly or indirectly, then consider control through other means and, if no such person can be identified, the senior managing official. For a trust, the CRS definition expressly includes the settlor, trustee, protector, beneficiaries or beneficiary classes and other persons exercising ultimate effective control. For a foundation or other legal arrangement, map equivalent roles from the governing documents and actual powers. ADGM's beneficial-ownership rules, for example, name the Founder, Council Members, Guardian, named beneficiaries and persons exercising control — an ADGM regime, not a universal CRS interpretation for every UAE foundation.

Founder
A Founder may be relevant where they retain appointment, amendment, veto, distribution, investment or reserved powers. Founder status, legal title and tax residence are not the same thing; review the Charter, By-Laws, reserved-powers schedule and actual decision-making.

Council Members
A Council Member exercising governance or decision-making authority may be relevant to the control map, though a professional Council Member is not automatically an economic beneficiary. Record the appointment, authority, service scope and any consent rights.

Protector or Guardian
Map the actual consent, oversight, appointment or removal, veto and other substantive powers. "Guardian" and "Protector" are not automatically identical under every regime; a role title in a registry extract is not enough.

Named beneficiaries
Identify natural persons and tax residences where they have present, vested, mandatory or otherwise relevant rights. A named beneficiary is not automatically reportable in every structure: consider the terms of the benefit, whether rights have crystallised and what the applicable CRS and KYC process requires.

Beneficiary classes
A beneficiary class is not "no beneficiaries". Preserve the class definition and identify individuals when the class crystallises, rights are exercised or the relevant process requires it; do not treat a class as outside reporting merely because individual beneficiaries are not yet listed.

Senior managing official or other effective controller
Where ownership or other means of control cannot identify the relevant natural persons, senior management may be considered under the applicable control analysis. Record the basis for the conclusion and obtain specialist approval where the structure is complex.

Once the relevant roles are mapped, the next question for Controlling Persons under CRS in the UAE is whether the bank can verify them against its file.

Banks apply their own forms and risk standards; use the following as a working structure, then confirm the institution's requirements. ADCB's published FAQ illustrates the information a bank may request; other institutions may differ.

A defensible file commonly aligns:

• legal name, registered address, licence or registry extract and constitutional documents;
• Foundation Charter and By-Laws or equivalent, with Council, Guardian, Protector and beneficiary information where relevant;
• ownership and control map, directors or Council Members, signatories and authority evidence;
• entity purpose, intended activity, account type and expected transaction flows;
• entity CRS classification rationale and date of review;
• tax-residence self-certifications, TINs or the reason a TIN is absent, and connected-country facts;
• source-of-wealth and source-of-funds evidence where requested under the wider bank KYC/AML process;
• investment-management agreement and evidence of discretionary authority if Investment Entity analysis may apply; and
• changes since the last submission, including new jurisdictions, officeholders, beneficiaries, signatories or activities.

A bank may also request identity and address evidence for directors, signatories and persons identified under UBO/AML or CRS analyses, plus supporting evidence for ownership, control, expected activity and relationship purpose. No item is required in every case; the institution's checklist governs.

Use the pack to answer one question: do the bank's records, the entity's documents and the self-certification describe the same structure? The objective is a consistent, explainable and current record, not a guarantee of acceptance. For a broader diagnostic, use the banking readiness checklist for family offices or review private banking readiness in the UAE. Where the issue is inconsistent evidence rather than initial classification, see source-of-wealth documentation and file continuity.

A UAE Tax Residency Certificate is a document issued through the Federal Tax Authority process; it does not classify an entity, identify Controlling Persons or establish that a person is not tax-resident elsewhere.

A UAE TRC may support a residence position for a stated purpose, but it does not replace CRS self-certification or settle residence in another country. A bank may accept it as supporting material in AEOI requirements for UAE private banking, yet must still apply its CRS reasonableness analysis and investigate contradictory information. Foreign tax residence, CFC rules and foreign reporting remain separate questions requiring relevant-country advice.

An old form needs review when the underlying facts change or the bank finds information it cannot reconcile. A typical sequence:

1. The bank identifies an indicium, inconsistency or change in circumstances.
2. It requests clarification, an updated self-certification or documentary evidence.
3. Using information obtained under applicable AML/KYC procedures and its account records, the Reporting Financial Institution assesses whether the self-certification is reasonable and reliable for CRS purposes.
4. If required information cannot be obtained or validated, the institution applies the relevant CRS due-diligence and reporting treatment. Any restriction, non-opening, transaction hold or closure is a separate bank-specific risk or contractual decision.

Typical triggers include relocation or a new tax residence; a new Founder, Council Member, Guardian, beneficiary, director or signatory; a changed account purpose; a mismatched name, address or TIN; or stale forms held by different banks. The Guidance Notes require an institution to respond where it knows a self-certification is incorrect or unreliable.

A CRS mismatch alone does not automatically freeze an account. Any hold, restriction, delay, refusal or closure is a bank-specific and fact-dependent decision, potentially arising from wider KYC/AML, sanctions, fraud or contractual processes. The technical CRS category "undocumented account" is limited by current UAE guidance to certain pre-existing individual accounts opened before 1 January 2017; it is not a standard treatment for an unresolved foundation, holding-company or SPV discrepancy, which calls for due diligence, remediation or escalation.

For the relevant Cabinet Resolution No. 93 of 2021 scenario, an AED 20,000 fine may apply where a required self-certification or supporting document contains inaccurate or incorrect information and the Account Holder or Controlling Person knew, or should have known, that it was inaccurate or incorrect. The Central Bank of the UAE states that licensed banks, finance companies and insurance companies collect applicable fines, and may separately sanction Reporting Financial Institutions for CRS/FATCA failures. These are stated-scenario enforcement contexts, not a general penalty for discrepancies.

If a bank is querying stale or inconsistent CRS records, Request a CRS/AEOI Reporting Readiness Review before submitting another disconnected response.

The preparation window is a records and ownership exercise. Use this sequence before 1 January 2027, then recheck official materials:

1. Inventory bank, custody, investment, e-money, digital-asset and other relevant financial relationships.
2. Confirm the legal account holder or service user for each relationship.
3. Re-test each entity's classification against current activity, income, assets and management arrangements.
4. Refresh the Controlling Person, role and tax-residence/TIN map, including changes since the last self-certification.
5. Reconcile CRS, FATCA, AML/KYC, beneficial-owner, registry and CARF data owners. Keep the regimes distinct even when the same records are used.
6. Document change triggers: relocation, new tax residence, new officeholder or signatory, new beneficiary, new account, new investment mandate, restructuring or new digital-asset exposure.
7. Set a dated review and escalation process, and recheck current Ministry of Finance guidance, forms and circulars before the effective date.

Relevant e-money, CBDC and crypto-asset exposure may alter the reporting perimeter; CARF is complementary to CRS, not interchangeable with it.

A founder has a UAE foundation, a holding company that owns an operating subsidiary, an SPV holding investments and a UAE private-bank account. The founder moved countries after the last self-certification. A new Guardian and beneficiary class were added, and the bank is asking again for TINs, constitutional documents and expected activity.

The review should ask which entity is the account holder; whether the holding company holds or finances non-financial operating subsidiaries or is instead a passive investment vehicle; and whether any investment-management arrangement requires Investment Entity analysis. It should map whichever foundation roles have relevant powers under the documents, and answer the bank's request from that role map rather than a generic list of titles.

The TRC may support only a stated UAE residence purpose while other indicators remain unresolved; the bank mandate, Charter, registry record and self-certification must be compared rather than filed as unexplained documents. The result may be a corrected form, evidence remediation, coordinated tax and legal advice, a Banking File Continuity review or a broader governance mandate — not automatically a new vehicle or a promise of non-reporting.

Octagon is a capital protection and execution partner. It connects structure, banking, governance, compliance records and operating reality rather than treating a CRS form as an isolated filing task. The wider issue may call for cross-border capital-protection framework, asset protection versus tax planning in the UAE or holding-company ownership and control. For families with wider ownership, succession and governance needs, see wealth structuring for international families in the UAE.

Octagon manages the coordination of this work and brings in appropriately qualified tax, legal and banking specialists where formal advice is required. The review can improve the consistency and completeness of the file, but Octagon cannot compel a bank to open, maintain, release, restore or continue an account, and cannot prevent an independent bank risk decision. Compliant privacy means controlled, accurate and explainable disclosure.

What is CRS 2.0 in the UAE and when does it apply?
CRS 2.0 is the updated Common Reporting Standard for automatic exchange of financial-account information. The UAE has announced an effective date of 1 January 2027, with first exchanges beginning in 2028. Check the latest Ministry of Finance notices before reliance, because implementation materials may change.

Does a UAE foundation have to report under CRS?
Not automatically. UAE CRS rules classify entities by legal form, activities, assets, income and management. A foundation may be a Financial Institution, Active NFE or Passive NFE, depending on the facts. If it is a Passive NFE, relevant Controlling Persons may need to be identified and reported.

What is a Passive NFE in the UAE?
A Passive NFE generally includes an entity that does not qualify as an Active NFE, and a professionally managed Investment Entity that is not a Participating Jurisdiction Financial Institution. It is not a shortcut label for a holding company or foundation. The institution applies the facts and a valid self-certification, then the look-through rules.

Who are the Controlling Persons of a UAE foundation or holding company?
For a company, the analysis generally starts with natural persons controlling more than 25% directly or indirectly, then control through other means, then the senior managing official. For a foundation, map equivalent roles from the governing documents and actual powers. The result is fact-specific and should be documented.

Will CRS report a UAE holding-company bank account?
Possibly. A UAE Reporting Financial Institution assesses the holding company's tax residence and CRS classification. If it is a Passive NFE with a Controlling Person resident in a reportable jurisdiction, the account may be reportable. Information may include the entity, relevant persons, account value and specified income or proceeds.

Does AEOI mean a UAE private bank reports every client account?
No. UAE Reporting Financial Institutions report information on Reportable Accounts through the Ministry of Finance. Reportability depends on the account holder, entity classification, tax residences, Controlling Persons and other rules. A private bank still conducts its own due diligence, and CRS reporting does not replace AML or tax advice.

How should an ADGM or DIFC foundation prepare for CRS 2.0?
Build a dated classification file: identify legal form and activities, document why the foundation is an FI, Active NFE or Passive NFE, map relevant Controlling Persons, retain valid self-certifications and align bank, registrar and governance records. Add change triggers for new beneficiaries, controllers, accounts, jurisdictions or activities.

Can a UAE foundation or SPV avoid CRS reporting?
A structure must not be designed to conceal ownership or evade lawful reporting. Lawful reportability is fact-specific: an entity may fall within a permitted Non-Reporting FI category, or an account may not be reportable under applicable rules. Those conclusions require current, evidence-based review, not the entity's label. Lawful privacy means controlled information handling, not secrecy.

The review maps the classification, control and tax-residence records behind the bank file. It produces a prioritised gap map, identifies the correct banking or governance route and defines the next evidence and specialist actions; it is a readiness diagnostic, not a promise of non-reporting, tax treatment or bank approval.

The routing follows the decision that needs to be made:

• Prepare for a new bank relationship: classification, expected activity and evidence before onboarding.
• Repair continuity in an existing bank file: changed residence, stale records, repeated KYC requests or an account query.
• Extend the review to ownership and governance: wider control mapping, succession, new beneficiaries or multi-entity records.

Where the review identifies wider ownership, succession, jurisdictional or governance exposure, Octagon can route the matter into a broader capital-protection or wealth-structuring mandate; a bank-file-only issue remains in the appropriate banking path. This readiness route is not a substitute for advice or representation in a live tax investigation, sanctions matter, insolvency, divorce, creditor-enforcement dispute, litigation or active account restriction; those matters should be referred to appropriately qualified specialists first.

The first conversation covers the trigger, entities, legal account holder, potential controlling persons, connected countries, the date of the last review, any bank delay and the objective: compliant reporting readiness. Enquiries seeking hidden controllers, false TINs, omitted tax residences or non-reporting guarantees are not suitable for this route. Do not send passports, TINs, bank statements, account numbers or self-certifications through an ordinary public form; any later document exchange is handled through a secure process.

Request a CRS/AEOI Reporting Readiness Review →