FATCA & CRS 2025-01

On November 3rd, 2025, the Luxembourg tax authorities (ACD) has updated the Frequently Asked Questions (CRS-FAQ) related to the amended law of 18 December 2015 concerning the Common Reporting Standard (CRS). The new FAQ may have an impact on Financial institutions’ compliance obligations and procedures.

The updated FAQ introduces new and revised guidance for Luxembourg financial institutions under the CRS. Key changes include:

- the obligation to notify the Luxembourg Tax Authorities of any change in CRS entity status by June 30 of the following year;

- expanded record-keeping duties requiring institutions to retain all client files, CRS reports, procedures, and supporting evidence even when using service providers; and clear expectations for maintaining a “Register of Actions” documenting compliance activities

The FAQ also details three types of CRS audits conducted by the Luxembourg Tax Authorities (i.e. classification, thematic, and in-depth) and outlines the audit process from notification to final recommendations. Overall, the updated FAQ reinforces stronger traceability, accountability, and regulatory oversight in CRS compliance.

The FAQ is available under the below link and the changes have been summarized below:

1.     Change of entity status under the CRS Law

Financial institutions must notify any change in status (that affects their reporting obligations) to the Bureau de la retenue d’impôts sur les intérêts (“SRI”) no later than June 30 of the year following the relevant reporting period.

Notification should be done by email to: aeoi-compliance@co.etat.lu, specifying:

• the new CRS entity status,
• the facts and circumstances justifying the reclassification,
• the fiscal year of entry into effect

It is also deemed appropriate to provide evidence that the new entity status was communicated to the relevant financial intermediaries in a timely manner, in order to ensure that the change in entity status does not result in a failure to report persons subject to declaration for the relevant fiscal year.

2.     Scope of record-keeping obligations (Article 2(1) of the CRS Law)

Financial institutions must retain:

• client files (including valuation of positions),
• the Register of Actions undertaken,
• written procedures and policies,
• a copy of submitted CRS reports and ACD feedback, and
• any other supporting evidence related to due diligence or reporting

It has been highlighted that even if a service provider performs these tasks, the institution remains responsible and must document the controls and review the evidence.

3.     Retention of validated CRS reporting

Financial institutions must keep a copy of all submitted CRS reports, along with the validation feedback from the ACD, for all versions of the report (initial, corrections, additions, cancellations).
These copies are required to comply with Article 2(1) on data retention.

4.     Content of the Register of Actions

The requirement to have a Register of Actions was introduced by the updated CRS Law of 16 June 2020. In this respect, while the FAQ confirms that no specific format is imposed, it must describe the concrete actions taken each year, such as:

• updates to procedures and policies,
• strategic decisions affecting CRS,
• incidents or deficiencies detected (and corrections made),
• training sessions organized, and
• monitoring of service providers

This register must complement written procedures by documenting the actual implementation of compliance measures.

5.     Types of compliance audits conducted by the SRI

The SRI performs three types of audits:

• Classification reviews — verification of the entity status applied
• Thematic reviews — focused examination of specific aspects (e.g., due diligence)
• In-depth reviews — overall assessment of obligations related to due diligence, reporting, and record-keeping

6.     Process of audit conducted by the SRI

These reviews aim to verify the full implementation of CRS/FATCA:

• written notification to the entity (with a 6-week deadline to provide documents and account lists),
• preliminary on‑site meeting with the entity,
• on-site interviews (1–2 days) to review procedures, systems, and governance,
• on-site review (2–4 weeks) of client files and IT systems, and
• conclusion report followed by a recommendation letter

In short, this update strengthens:

- the traceability (the Register of Actions and comprehensive archiving),

- proactive communication with the SRI (notification of status changes),

- the responsibility of Luxembourg financial institutions, and

- regulatory oversight carried out by the SRI