FATCA is often filed under AML, or taken for the FBAR. It is neither. FATCA is a US tax law in the Internal Revenue Code, while the FBAR is a report to FinCEN under the Bank Secrecy Act. AML and onboarding teams still meet it every day, because FATCA runs on the same customer data as KYC requirements: citizenship, place of birth, address and owners.
What is FATCA?
FATCA is chapter 4 of the Internal Revenue Code (26 U.S.C. 1471 to 1474) plus section 6038D, both added by a law of 18 March 2010. It works on two sides of the same account.
A foreign bank, fund or other financial institution identifies its US account holders and reports them, or a withholding agent deducts 30 percent from US source payments made to it. A US taxpayer declares foreign financial assets on Form 8938 with the tax return.
The aim is to stop US taxpayers evading taxes through money held abroad, often in an offshore account the IRS could not see before. Treasury's list of intergovernmental agreements (IGAs), read on 29 October 2026, counts 114 jurisdictions, 102 of them in force.
Who must comply with FATCA?
Four groups carry duties, each for a different reason:
- US persons. Citizens and residents with foreign financial assets above the Form 8938 thresholds file the form, wherever they live.
- Foreign financial institutions (FFIs). Banks, custodians, investment entities and certain insurers report their US accounts, because otherwise their US source payments are cut by 30 percent.
- Passive non financial foreign entities (NFFEs). A company with mainly passive income must name its substantial US owners, those owning more than 10 percent (26 CFR 1.1473-1), so a bank can see the beneficial owner behind the account.
- Withholding agents. Whoever pays a withholdable payment to an FFI outside the system deducts the 30 percent.
In searches, "FATCA sanctions" means these penalties and the withholding, not sanctions lists.
How do foreign banks report under FATCA?
Table 1. Three routes for a foreign bank (Treasury's IGA list and 26 CFR 1.1471-1, as of October 2026).
| Route | The FFI reports to | How the data reaches the IRS | Example from Treasury's list |
|---|---|---|---|
| Model 1 IGA | Its own government's tax authority | Automatic exchange between governments (26 CFR 1.1471-1, (b)(78)) | Germany, in force since 11 December 2013 |
| Model 2 IGA | The IRS directly | The FFI files itself, under an FFI agreement | Austria, in force since 9 December 2014 |
| No IGA | The IRS directly | The FFI signs an FFI agreement or faces 30 percent withholding | A jurisdiction not on Treasury's list |
Every route starts with registration. An FFI that registers with the IRS gets a global intermediary identification number (GIIN), and the IRS publishes the list of registered FFIs and their GIINs every month.
The report itself is narrow. For each US account it carries the holder's name, address and taxpayer identification number (TIN), the account number, the balance or value and certain payments (26 CFR 1.1471-4(d)(3)(ii)), not a transaction history.
When does a person file Form 8938, and what are the penalties?
Picture a US citizen who lives in Germany and files as a single taxpayer (illustrative). The foreign accounts hold $180,000 on 31 December and peaked at $310,000 in June, at the Treasury rate for the last day of the year. Under the Form 8938 instructions, a single taxpayer abroad files above $200,000 at year end or $300,000 at any time, so the $310,000 peak triggers Form 8938. The year end figure alone would not. The aggregate also passed $10,000, so an FBAR is due as well, a separate report under the Bank Secrecy Act.
At home the floors are lower: $50,000 at year end or $75,000 at any time for a single filer, $100,000 or $150,000 for a joint return. For a couple at home filing separately, the IRS's own Example 8 splits a jointly owned $60,000 asset: each spouse counts half of its value, so neither files.
Penalties come from different laws:
- Form 8938 not filed. $10,000 under section 6038D, plus $10,000 for each 30 days after 90 days from an IRS notice, the extra capped at $50,000.
- Tax understated on hidden assets. The accuracy penalty rises from 20 to 40 percent (26 U.S.C. 6662(j)).
- FBAR not filed. A non willful penalty counts per report, not per account, since Bittner v. United States (28 February 2023).
- An FFI outside the system. 30 percent withholding on withholdable payments. A 2018 proposed rule removed withholding on gross proceeds, and taxpayers may rely on it until final rules issue.
Three US rules with a $10,000 shadow get merged: the FBAR, a BSA report once foreign accounts pass $10,000 in aggregate; Form 8938, a FATCA form with far higher floors; and the foreign bank's own report. Their penalties differ in kind: per FBAR report, per Form 8938 return, and withholding on the bank. This entry explains the rules; it is not tax advice.
What does FATCA mean for an AML and onboarding team?
Back to Germany, this time at a bank (illustrative). A new customer's passport shows a US place of birth. That is one of seven US indicia in Treasury regulation 1.1471-4(c)(5)(iv)(B), beside US citizenship, a US address, a US phone number, standing instructions to pay a US account, a power of attorney for someone with a US address, and an in care of or hold mail address.
Each indicium is a field the onboarding desk already captures. Under the regulation, a US place of birth is cured only with proof of another citizenship plus a Certificate of Loss of Nationality, or with a withholding certificate, that proof and a reasonable written explanation. A withholding certificate alone is not enough.
The tax self certification therefore sits beside customer due diligence as a separate record. FATCA stays a tax law. Even so, FATF lists tax crimes among the designated categories of predicate offenses, so hidden accounts can matter to both teams.
In customer risk assessment and KYC, complead, formerly Sanction Scanner, puts the answers from the firm's own KYC forms on the customer record and rates them against a risk model the firm builds; the FATCA classification itself remains the bank's tax decision.
What is new around FATCA in 2026?
- 1 January. The EU's DAC8, Council Directive (EU) 2023/2226, began to apply: crypto asset operators report, and the latest amendments to the OECD's Common Reporting Standard (CRS), the standard for automatic exchange of account data between tax authorities, took effect in EU law.
- 19 September. The IRS reviewed its comparison of Form 8938 and the FBAR, which still gives the FBAR as due April 15 with an automatic extension to October 15.
- 29 October. Treasury's IGA list stood at 114 jurisdictions; the 2018 gross proceeds proposal was still not final.
Three things to do this week:
- Confirm the bank's GIIN on the latest monthly FFI list.
- Pull onboarding files that show a US indicium and no cure documents.
- Put the local FATCA and CRS reporting deadlines in the compliance calendar.
Related terms
- Tax fraud. Evading tax by deceit, including through undeclared foreign accounts.
- Ultimate beneficial owner. The person who ultimately owns or controls a customer.
- Customer due diligence. The checks on identity, owners, purpose and activity.
- Know your customer. Knowing who a customer is and the risk they bring.
- Bank Secrecy Act. The US law behind the FBAR, SARs and CTRs.
- Offshore. Accounts or companies held outside the owner's home country.
How this entry was checked. Checked on 29 October 2026 against chapter 4 and section 6038D of the Internal Revenue Code, section 6662, Treasury regulations 1.1471-1, 1.1471-4 and 1.1473-1, Treasury's list of intergovernmental agreements, the IRS pages for foreign financial institutions, the Form 8938 instructions and the Form 8938 and FBAR comparison, Bittner v. United States, the proposed rule of 18 December 2018 and Council Directive (EU) 2023/2226. The definition rests on the code sections themselves; the taxpayer and the bank are illustrative. After the author, Emirhan Akgün (Software Engineer at complead), wrote it, the reviewer, Ufuk Gürdaş, Compliance Specialist, checked each threshold, penalty and date against the code, the regulations and the IRS text. Last reviewed: 30 October 2026.
