Custodial Account Identification Under CRS: Reporting Responsibilities for Private Bank and Brokerage Accounts

The quiet expansion of the Common Reporting Standard (“CRS”) automatic exchange framework has, over the past decade, transformed how private banks and brokerages classify and report client accounts. What was once a binary distinction between “individual” and “entity” has become a multi-layered analysis of controlling persons, passive versus active status, and—most critically—the precise identification of custodial accounts. A 2024 peer review by the OECD’s Global Forum on Transparency and Exchange of Information for Tax Purposes flagged that Hong Kong, while broadly compliant, faces ongoing pressure to tighten enforcement around custodial account due diligence, particularly for accounts held through intermediary structures. With the Inland Revenue Department (“IRD”) issuing its latest CRS return filing guidance in Q1 2025, and the next filing deadline for Hong Kong financial institutions falling on 31 May 2025 (for the 2024 reporting year), the stakes for misclassification have never been higher. For private banks and brokerages managing cross-border portfolios, the identification of a custodial account is not a compliance checkbox—it is the foundational step that determines whether an account is reportable, to which jurisdiction, and under which entity classification rules. This article examines the operative rules under Hong Kong’s Inland Revenue Ordinance (Cap. 112) and the CRS Implementation Guidelines, dissecting the reporting responsibilities that arise once a custodial account is identified.

The CRS Definition of a Custodial Account: Scope and Boundary

The CRS, as implemented in Hong Kong through the Inland Revenue (Amendment) (No. 3) Ordinance 2016 and the Inland Revenue (Disclosure of Information) (Common Reporting Standard) Regulation (Cap. 112L), defines a “Custodial Account” as an account that holds financial assets for the benefit of another person. This definition, found in Section 8 of the CRS Standard, is deliberately broad. It captures any account maintained by a financial institution where the institution acts as a custodian—holding securities, derivatives, units in collective investment vehicles, insurance or annuity contracts, or any other financial asset. The Hong Kong CRS Implementation Guidelines (2024 Edition), issued by the IRD, clarify that this includes accounts held with private banks, licensed securities brokers (under the Securities and Futures Ordinance, Cap. 571), and trust companies acting as custodians.

Distinguishing Custodial Accounts from Deposit Accounts

The boundary between a custodial account and a deposit account is a frequent source of classification error. A deposit account—such as a standard savings or current account—holds cash balances and is reportable under the CRS as a “Depository Account.” The critical distinction lies in the nature of the assets held. Under the CRS Standard, an account that primarily holds cash but also provides incidental custody of a small number of securities (e.g., a single listed share held for voting rights) may still be classified as a custodial account if the financial institution’s role as custodian is substantive. The Hong Kong Monetary Authority (“HKMA”) Circular on CRS Implementation (dated 15 March 2017) advised that the classification should follow the “primary purpose” test: if the account’s primary function is to hold and administer financial assets, it is a custodial account. Private banks and brokerages must document this classification decision in their due diligence procedures.

The Role of the Account Holder and Controlling Persons

Once a custodial account is identified, the reporting obligation attaches to the account holder. For individual account holders, the CRS requires the financial institution to identify the tax residence(s) of the account holder through self-certification (Form IRC 2016/1 for individuals) and to report the account balance and gross proceeds from the sale or redemption of financial assets. For entity account holders, the analysis deepens. The financial institution must determine whether the entity is a “Passive Non-Financial Entity” (“Passive NFE”). If it is, the institution must “look through” the entity to identify its controlling persons—individuals who exercise control through ownership or other means. This look-through requirement applies irrespective of whether the entity is incorporated in a CRS-participating jurisdiction. The Hong Kong IRD’s 2024 Guidance on Entity Classification (paragraphs 4.12–4.18) explicitly states that a passive NFE is any entity that is not a Financial Institution and where the passive income (dividends, interest, rents, royalties) exceeds 50% of gross income or the assets producing such passive income exceed 50% of total assets.

Due Diligence Procedures for Custodial Accounts: The Pre-Existing vs. New Account Divide

The CRS imposes different due diligence procedures depending on whether a custodial account is classified as “pre-existing” (opened before 1 January 2017) or “new” (opened on or after 1 January 2017). This distinction is not merely administrative; it determines the depth of review required and the documentation that must be obtained.

Pre-Existing Custodial Accounts: The Electronic Record Search

For pre-existing custodial accounts, the CRS permits a two-step due diligence process. First, the financial institution must conduct an electronic record search of its electronically searchable data to identify any “indicia” of foreign tax residence. The indicia list, set out in the CRS Standard, includes: a residence address in a reportable jurisdiction, a mailing address in a reportable jurisdiction, one or more telephone numbers in a reportable jurisdiction, standing instructions to transfer funds to an account in a reportable jurisdiction, a current power of attorney or signatory authority granted to a person with an address in a reportable jurisdiction, and a “hold mail” or “in-care-of” address if no other address is on file. If any indicium is found, the institution must treat the account as reportable unless it obtains a valid self-certification or reasonable explanation to the contrary. For accounts with an aggregate balance or value exceeding USD 1,000,000 (or HKD equivalent) as of the CRS determination date (31 December of the preceding year), the institution must also conduct a paper record search for any relationship manager’s actual knowledge of the account holder’s foreign residence.

New Custodial Accounts: Self-Certification as the Primary Evidence

For new custodial accounts, the due diligence requirements are more stringent. The financial institution must obtain a self-certification (Form IRC 2016/1 for individuals, Form IRC 2016/2 for entities) as part of the account opening process. This self-certification must be signed by the account holder and must confirm the account holder’s tax residence(s). The financial institution is required to verify the reasonableness of the self-certification against other information obtained in the account opening process, including any documentation collected for anti-money laundering (“AML”) or know-your-customer (“KYC”) purposes. The HKMA and the Securities and Futures Commission (“SFC”) jointly issued a circular on 15 December 2016 emphasising that the CRS self-certification must be obtained before the account is opened, not after. Failure to obtain a valid self-certification within 90 days of account opening triggers a requirement to close the account or treat it as reportable to all CRS-participating jurisdictions.

The Custodial Account Balance: What Must Be Reported

The CRS requires the financial institution to report the aggregate balance or value of the custodial account as of the end of the relevant calendar year (31 December for Hong Kong). For custodial accounts, this balance is the market value of the financial assets held, including cash balances within the account. The Hong Kong IRD’s CRS XML Schema User Guide (Version 2.0, 2023) specifies that the balance must be reported in the account’s original currency, converted to HKD at the year-end exchange rate published by the Hong Kong Association of Banks. In addition, the institution must report the gross proceeds from the sale or redemption of financial assets credited to the account during the calendar year. This includes proceeds from the sale of securities, redemption of units in collective investment vehicles, and maturity of structured products. For accounts held by Passive NFEs, the institution must also report the name, address, jurisdiction of tax residence, and date of birth of each controlling person.

Entity Classification: The Passive NFE Trap

The most common reporting failure in the private banking and brokerage sector arises from the misclassification of entity account holders. The CRS divides entities into two broad categories: Financial Institutions and NFEs. Financial Institutions include custodial institutions, depository institutions, investment entities, and specified insurance companies. NFEs are entities that are not Financial Institutions. Within NFEs, there is a further subdivision into Active NFEs and Passive NFEs.

Active vs. Passive: The Income and Asset Tests

An Active NFE is an entity that meets any one of several criteria, including: less than 50% of its gross income for the preceding calendar year is passive income, and less than 50% of its assets are assets that produce or are held for the production of passive income; the entity is a corporation whose stock is regularly traded on an established securities market; the entity is a governmental entity, international organisation, central bank, or a non-profit organisation; or the entity is a holding company that is part of a non-financial group. All other NFEs are Passive NFEs. For a family office structured as a private investment holding company—a common structure for HNW clients—the entity will almost invariably be a Passive NFE. The passive income test is particularly unforgiving: even a single year where the entity receives a large dividend or capital gain can tip it into passive status, triggering the look-through requirement for that year and for subsequent years unless the entity can demonstrate a change in circumstances.

The Look-Through Requirement and Controlling Persons

Once an entity is classified as a Passive NFE, the financial institution must identify its controlling persons. The definition of “controlling persons” follows the Financial Action Task Force (“FATF”) recommendations on beneficial ownership. For a trust, the controlling persons are the settlor, the trustee(s), the protector (if any), the beneficiary(ies) (or class of beneficiaries), and any other individual exercising ultimate effective control over the trust. For a foundation, the controlling persons are the founder(s), the council members, and the beneficiary(ies). For a corporation, the controlling persons are the individuals who, directly or indirectly, own or control more than 25% of the shares or voting rights, and any individual who otherwise exercises control. The Hong Kong IRD’s 2024 Guidance (paragraphs 5.8–5.14) explicitly states that where no individual owns or controls more than 25%, the financial institution must identify the individual who exercises control through other means—typically the senior managing official or the ultimate decision-maker.

The Reporting Obligation for Controlling Persons

For each controlling person of a Passive NFE that is a reportable person (i.e., tax resident in a CRS-participating jurisdiction), the financial institution must report the controlling person’s name, address, jurisdiction(s) of tax residence, date and place of birth, and the account balance of the custodial account held by the Passive NFE. This reporting obligation applies even if the controlling person is not an account holder and has no direct relationship with the financial institution. The institution must also report the gross proceeds from the sale or redemption of financial assets credited to the account. This creates a significant compliance burden for private banks managing accounts held by BVI or Cayman Islands holding companies, where the controlling persons may be US, UK, or Australian tax residents. The 2024 OECD peer review noted that Hong Kong financial institutions still face challenges in obtaining accurate controlling person information for such structures, particularly where the entity is managed by a professional trustee or corporate services provider.

Practical Compliance Steps for Private Banks and Brokerages

The IRD’s enforcement focus for the 2025 filing cycle is on data quality and completeness. The IRD has indicated that it will conduct targeted audits of financial institutions that show a high volume of “nil” reports or a low volume of controlling person reports relative to their client base. For private banks and brokerages, the following steps are critical.

Updating Self-Certifications for Pre-Existing Accounts

The CRS permits financial institutions to rely on a self-certification obtained at account opening, but only if the self-certification remains valid. A change in circumstances—such as a change in the account holder’s address, the acquisition of a second passport, or a change in the entity’s ownership structure—requires the institution to obtain a new self-certification within 90 days of becoming aware of the change. The 2024 IRD Guidance (paragraph 7.3) recommends that institutions implement a periodic review process, at least every three years, to confirm the continued validity of self-certifications for high-value accounts (balance exceeding USD 1,000,000). For accounts held by Passive NFEs, the institution should also review the controlling person information at the same interval.

Implementing a Robust Entity Classification Framework

The classification of entity accounts as Active or Passive NFEs should not be a one-time exercise. The CRS requires the financial institution to re-determine the classification annually, based on the entity’s income and assets for the preceding calendar year. For private banks, this means establishing a process to collect financial statements or other evidence of the entity’s income composition. Where the entity fails to provide this information, the institution must treat it as a Passive NFE. The HKMA and SFC joint circular of 2016 emphasised that the burden of proof lies with the financial institution, not the account holder. A well-documented classification framework, with clear escalation procedures for borderline cases, is the best defence against an IRD audit.

Preparing for the 31 May 2025 Filing Deadline

The CRS return for the 2024 reporting year must be submitted to the IRD by 31 May 2025. The return is filed electronically through the IRD’s eTax system, using the CRS XML schema. Financial institutions must ensure that their data extraction and validation processes are tested before the filing window opens. Common errors flagged by the IRD in previous filing cycles include: missing or invalid TINs for reportable persons, incorrect jurisdiction codes, and failure to report gross proceeds for custodial accounts. The IRD’s CRS Validation Rules (Version 3.0, 2024) provide a detailed list of data quality checks that the system applies to each submission. Institutions should run these checks internally before submission and retain the validation report as evidence of compliance.

Actionable Takeaways

1. Re-classify all entity accounts annually: The Passive NFE determination is a yearly obligation; institutions must collect financial evidence or default to passive status for non-responsive account holders.
2. Obtain updated self-certifications for any account where a change in circumstances has been identified: A new address, passport, or entity ownership structure triggers a 90-day deadline to re-document tax residence.
3. Document the “primary purpose” test for accounts holding both cash and securities: A written classification memo, signed by the compliance officer, is the minimum evidence required to defend a deposit account classification.
4. Validate controlling person information for all Passive NFE accounts before the 31 May 2025 filing deadline: Incomplete or inaccurate controlling person data is the most common trigger for an IRD targeted audit.
5. Retain all due diligence records for at least six years: The CRS statute of limitations in Hong Kong runs from the filing date, and the IRD may request supporting documentation for any account reported in the prior six filing cycles.

本文不構成稅務建議。涉及個人稅務情況請諮詢持牌會計師或稅務師。 This does not constitute tax advice. Consult a licensed CPA or tax advisor for your specific situation.