CRS Compliance and Enforcement in the Cayman Islands – What Are the Enforcement Trends?

Overview of the CRS Regulatory Framework in the Cayman Islands

The Common Reporting Standard (CRS) is the OECD’s Standard for the automatic exchange of financial account information between participating jurisdictions.  The Cayman Islands have implemented the CRS through the Tax Information Authority (International Tax Compliance) (Common Reporting Standard) Regulations (2021 Revision) (Cayman CRS Regulations) pursuant to the Tax Information Authority Act (2021 Revision).

The Cayman Islands Tax Information Authority (the Authority), operating through the Department for International Tax Cooperation (DITC) is the competent authority responsible for monitoring compliance and taking enforcement action in respect of the CRS within the Cayman Islands.

Reporting Obligations of Cayman Financial Institutions

The CRS requires entities registered on the DITC’s portal as Cayman reporting financial institutions (Cayman FIs) to notify the Authority of their CRS classification, appoint a Principal Point of Contact (PPoC) and Authorised Person (AP) and comply with annual CRS reporting requirements of their account holders. In practice, this means:

• identifying the tax residency of account holders and controlling persons;
• reporting the required information to the DITC; and
• maintaining written policies and procedures on how they are complying with their CRS registration and reporting obligations.

Compliance Trends and Enforcement Activity

Since the Authority published its CRS Enforcement Guidelines in March 2022, there has been a heightened level of enforcement activity initiated by the Authority in the form of:

• formal enquiries and warning letters;
• breach notices for alleged non-compliance with the Cayman CRS Regulations (Breach Notices); and
• penalty notices imposing financial penalties (Penalty Notices).

In our experience, the majority of the contraventions identified relate to missed reporting (including the failure to file a nil return), failure to file a CRS compliance form by the September due-date, failure to update the DITC when an entity is liquidated, struck-off or has been de-registered as a Cayman entity and continued into another jurisdiction.  These contraventions have frequently arisen due to administrative oversight, CRS misclassification of entities, or a failure to formally apply to the DITC to deactivate an entity from the portal when they are no longer a Cayman FI.

In October 2024, the Authority issued approximately 1,350 CRS Breach Notices. In our experience, the majority of the Breach Notices related to missed filings for the 2023 reporting year due to CRS misclassifications and administrative oversights.  The high number of Breach Notices issued by the Authority within one month caused certain challenges amongst clients to ensure that the relevant remediation timelines were met and the proposed financial penalty contemplated under the Breach Notice was avoided.  In certain instances, in-scope entities did not receive the Breach Notices issued to them because their PPoC had changed without notifying the DITC, and the client contact information held by their registered office was outdated.  For certain entities, this resulted in missing the deadline for completing the remediation, and a financial penalty being imposed.  The heightened level of enforcement activity has led to more industry engagement with the DITC’s Enforcement Team which we expect to continue into the future.

DITC Compliance Reviews

As part of the Authority’s enhanced oversight strategy, the Authority undertakes a programme of CRS reviews and audits of Cayman FIs.  These audits will focus on assessing whether in-scope entities have implemented the following under the Cayman CRS Regulations:

• Governance Framework: – ensuring appropriate policies and procedures for compliance and reporting purposes;
• Classification – ensuring reportable and non-reportable account holders are appropriately classified;
• Data – review of policies, self-certifications and financial statements to ensure the reporting of complete and accurate data.

If selected for review, the PPoC of the Cayman FIs will receive a letter with a request for high level information and documents.  The DITC will arrange a meeting (in-person or remotely) with entities and their service providers appointed for CRS reporting.  These audits reflect the Authority’s ongoing commitment to ensure the integrity and commitment of the Cayman Islands to implementing the OECD’s CRS compliance regime and the importance of maintaining a strong CRS compliance culture for the jurisdiction.

Next steps to ensure compliance with the Cayman CRS Regulations

To mitigate the risk of receiving a Breach Notice or Penalty Notice from the Authority, Cayman FIs should take proactive steps to ensure ongoing compliance with the Cayman CRS Regulations.  In practice, this means:

• ensuring the entity is correctly classified under the Cayman CRS Regulations;
• ensuring timely registration on the DITC’s portal if subject to a registration requirement;
• appointing a suitable service provider to ensure accurate and timely reporting of investor information within the Authority’s prescribed deadlines;
• ensuring that the PPoC and AP information are all current on the DITC’s portal;
• ensuring that any entity that has been liquidated, become dormant, struck-off or is no longer in the Cayman Islands is formally deregistered from the DITC portal; and
• ensuring that CRS written policies and procedures are all update to date to reflect the current reporting requirements and are reviewed by the governing body (and, updated as required) on an annual basis.

How Appleby can help

Appleby, together with our affiliated corporate services provider, Appleby Global Services (Cayman) Limited provides comprehensive compliance support to clients across the full lifecycle of an entity.  Our services range from CRS classification and registration, to maintaining compliance through ongoing reporting obligations, and ultimately assisting with deactivation applications via the DITC portal where appropriate.  We have successfully guided clients through the Authority’s enforcement regime, by preparing formal responses to Breach Notices, and have helped clients avoid financial penalties by promptly identifying and remediating compliance issues in line with the Authority’s expectations.