Gibraltar CRS Reporting: Accounts, Deadlines, Penalties

CRS in Gibraltar: How the Common Reporting Standard AppliesCopy link to section

The Common Reporting Standard operates fully in Gibraltar, where financial institutions collect tax-residence data on account holders and report it to the Income Tax Office for onward exchange with partner countries. CRS in Gibraltar rests on the OECD framework adopted by 116 jurisdictions, with Gibraltar among the early adopters that began exchanging information in 2017.

If you own or hold an account through a Gibraltar entity and reside in another CRS country, your financial details flow back to your home tax authority each year. This article explains the timeline, the legal basis, who must report, what gets reported, and what the rules mean for a foreign owner.

It will be most useful to non-resident company owners, investors, and their advisers weighing whether to incorporate in or stay compliant with the territory.

Gibraltar's CRS Commitment and First-Exchange TimelineCopy link to section

Gibraltar signed up early. Domestic CRS legislation was enacted on 22 December 2016, and the first exchange by the Competent Authorities took place on 30 September 2017, covering the period ended 31 December 2016.

The territory sits on the OECD White List of jurisdictions that have substantially implemented the agreed standard on tax information exchange. It also appears in the Global Forum's record of jurisdictions that completed first exchanges by 2017.

An earlier Intergovernmental Agreement with the United Kingdom for automatic exchange was folded into CRS reporting. Where due diligence had already been performed under that agreement, it was treated as done for CRS purposes, and from tax year 2017 onward the Common Reporting Standard became the sole reporting channel.

Company Incorporation in Gibraltar

Set up your company in Gibraltar with Expanship handling registration end to end.

Learn more

The Legal Basis for CRS in GibraltarCopy link to section

The operative domestic instrument is the International Co-operation Regulations 2016, which implement the OECD's CRS system locally. These regulations sit beneath an enabling statute, the Taxation (Mutual Administrative Assistance) Act 2014.

The wider international foundation is the Convention on Mutual Administrative Assistance in Tax Matters and the associated Multilateral Competent Authority Agreement on AEOI.

A significant update arrived through Legal Notice No. 32/2026, published in the Official Gazette on 29 January 2026. That amendment aligns the local rules with the updated MCAA and the addendum Gibraltar signed on 26 November 2024, removes residual EU law references following Brexit, strengthens data protection requirements, expands the reporting rules, and mandates the current OECD XML schemas.

A narrow disclosure overlay also applies. From 21 January 2021, Gibraltar limited its mandatory disclosure rules under DAC6, following the UK approach, to Category D hallmarks only, which cover CRS avoidance arrangements and opaque offshore structures.

Which Gibraltar Financial Institutions Must ReportCopy link to section

A firm is a Reporting Financial Institution if it falls into one of four categories: depositary institutions, custodial institutions, investment entities, or specified insurance companies. These institutions must collect, review, and report information on reportable account holders and their controlling persons to the Income Tax Office through the AEOI portal.

Early 2026 changes extended the local rules to capture entities that invest in or manage crypto-assets, including crypto-asset derivatives. A 2025 mapping exercise set out to find entities that meet the reporting test but never registered, paired with onsite reviews of due diligence and reporting practices.

Ongoing Compliance in Gibraltar

Keep your Gibraltar entity compliant with filings, returns, and statutory obligations.

Learn more

Reportable Accounts and Reportable PersonsCopy link to section

Financial accounts come into scope where they represent the assets of an individual or entity. Bank accounts, holdings in bonds or equities, and investments into collective vehicles are typical examples.

For entities, an account held by a Reportable Person is reportable, and it must be reported both as the account of a Reportable Person and as the account of an entity that is a Reportable Person. The Active NFE test turns on two conditions: less than 50% of gross income being passive, and less than 50% of assets producing passive income.

Where a Passive NFE is a trust, the Gibraltar Competent Authority lets institutions limit reporting of discretionary beneficiaries to those who actually receive a distribution in a given year, consistent with paragraph 268 of the CRS Implementation Handbook.

Traditional financial assets and currencies sit inside the present framework; most crypto-assets do not, though that boundary is shifting. Worth knowing in reverse: Gibraltar is itself a reportable jurisdiction, appearing on the UK's Reportable Jurisdictions list for the 2024, 2025, and 2026 reporting years, so UK institutions report on Gibraltar-resident account holders.

Due Diligence and Self-Certification ObligationsCopy link to section

Self-certification of tax residence is the central compliance tool. Every individual and most entities opening an in-scope account must complete one, and the Competent Authority applies its own definition of what counts as valid.

Where an account holder does not respond within 90 days, the institution should suspend the account until a valid self-certification is obtained. Systems must keep monitoring tax-residence status, balances, and gross proceeds throughout the relationship.

The territory has adopted the "wider approach" on an optional basis, gathering residence data on all foreign accounts rather than only those tied to reportable jurisdictions, so the information is on hand if new partners come online.

From 1 September 2022, the Competent Authority narrowed its stance on trust discretionary beneficiaries, requiring them to be reported only in the year they receive a distribution. That relaxation does not cut the underlying duty: institutions must still obtain enough information to establish each beneficiary's identity.

Gibraltar Incorporation Pricing

See transparent pricing to incorporate and maintain a company in Gibraltar.

View pricing

Gibraltar's CRS Partner Jurisdictions and Information FlowsCopy link to section

Gibraltar exchanges as both a sending and receiving jurisdiction under the CRS MCAA, and it is named in HMRC's list of 2025 Participating Jurisdictions with activated agreements to exchange with the UK. Bilateral exchange does not switch on automatically among Crown Dependencies and Overseas Territories; each pairing requires a specific agreement to be negotiated, signed, and brought into force.

Partner relationships can be paused when data security fails. The recent record shows how this works in practice:

No single official source gives a definitive count of activated bilateral partners. The OECD's exchange-relationships portal is the authoritative live reference.

Reporting Deadlines, Penalties and Compliance RisksCopy link to section

The annual reporting deadline for reportable accounts is 31 July. Institutions file to the Income Tax Office through the AEOI portal, using the OECD's CRS XML schema.

Penalty exposure rose with the 2026 reforms. The Competent Authority gained power to conduct on-site inspections, and non-compliance can draw fines of up to £10,000, compared with the £3,000 fine under the original 2016 regulations.

On 11 June 2025, the Income Tax Office launched a compliance programme to test how well CRS is applied across the financial sector. A voluntary disclosure window ran until 31 July 2025 for entities that had not registered or complied because of incorrect classification, with good-faith disclosures stated to count in their favour in later compliance actions.

No public rule was found requiring nil CRS returns; the nil-return provision in the guidance applies to FATCA, not CRS.

What CRS Means for Non-Resident Account Holders and OwnersCopy link to section

If you are a non-resident holding an account at a Gibraltar institution, your financial information will be reported to your country of tax residence where that country also participates in CRS. The data set follows the OECD standard: identity details including name, address, date of birth and taxpayer identification number, the account number, the year-end balance or value, and gross income such as interest, dividends, and sale proceeds credited during the year.

Ownership through a company offers no concealment. Institutions must look through Passive NFEs to identify and report controlling persons, so the ultimate beneficial owner of a Gibraltar structure held via a bank or investment account is visible in the CRS flow.

A separate transparency layer runs in parallel: Gibraltar maintains a register of beneficial ownership administered by the Finance Centre, which is distinct from CRS reporting. Crypto-asset holders should expect rising visibility as the proposed CRS amendments and the CARF take hold.

Outlook for CRS Reporting in GibraltarCopy link to section

Crypto reporting is the clear direction of travel. Early 2026 legislation already pulled entities investing in or managing crypto-assets into scope, and Gibraltar has signalled it will adopt the Crypto-Asset Reporting Framework in good time.

CARF borrows heavily from the CRS model but targets transactions rather than assets held, covering exchanges between crypto and fiat, exchanges between crypto-assets, and transfers including retail payments. Operators in the distributed-ledger and financial-services space should plan for it.

Enforcement is also intensifying. The June 2025 compliance programme, with its on-site inspections, mapping exercise, and disclosure window, marks a shift from a registration phase into active supervision, and as an early adopter the territory remains subject to the Global Forum's ongoing effectiveness reviews.

ConclusionCopy link to section

CRS is settled and enforced in Gibraltar, and a foreign owner should treat full self-certification and accurate reporting as routine cost of doing business there. The look-through to controlling persons means a corporate structure will not shield a beneficial owner from exchange, and rising penalties plus active inspections raise the price of getting classification wrong. Crypto activity sits next in line, so anyone in that sector should prepare for CARF and the expanded reporting rules already taking shape.

How Expanship Can Help Your Business in GibraltarCopy link to section

Expanship supports foreign-owned entities in meeting CRS obligations, from confirming whether your structure is a reporting institution or an in-scope account holder to managing self-certification and annual AEOI filings, and we handle the wider compliance picture that surrounds incorporation in the territory.

• Company formation and structuring for non-resident owners
• Registered agent and registered office services
• Tax registration and annual filing with the Income Tax Office
• Ongoing CRS and regulatory compliance management
• Accounting and bookkeeping
• Introductions to banking and financial institutions

To discuss your situation, contact Expanship Gibraltar.

Frequently Asked QuestionsCopy link to section