Old Tricks for New Dogs, Part III

Identifying Crypto Beneficial Owners

By Paul Foster Millen & Peter A. Cotorceanu, 30 Sept, 2024

This article was originally published in Tax Notes International, September 30, 2024, p. 2153

In our last article, you met the “new dogs”; now must be the time for the “old tricks.” As we mentioned in our first article in this series, “old tricks”¹ refers to the fact that the OECD’s cryptoasset reporting framework (CARF²) is based heavily on its own common reporting  standard (CRS³), which was published over a decade ago. “New dogs” refers to the fact that CARF’s due diligence and reporting obligations fall on a whole new set of players, the reporting cryptoasset service providers (RCASPs), almost none of whom have any prior experience with CRS or any similar type of automatic exchange of information regime.

In Part I of this series⁴, we introduced CARF by describing CRS’s basic structure and the challenges faced by the OECD in adapting CRS rules — designed for conventional financial activities — to the world of digital assets. In Part II5, we introduced CARF’s “new dogs” — specifically, the individuals and entities with due diligence and reporting obligations under CARF. In this article, we turn our attention to the “old tricks” — namely, the method of customer documentation used to identify the proper beneficial owner of digital assets in a reportable crypto transaction.

Step Right Up, Step Right Up ...

A robust and effective due diligence process is an absolute prerequisite for proper reporting under CARF, as it is under CRS. Even the greatest magician in the world cannot pull a rabbit out of a hat when there are no rabbits in it. The best assurance of proper reporting and CARF compliance rests on the quality of the information collected, verified, analyzed, and retained. The overall process for due diligence documentation under CARF is well trod and not especially tricky. The steps are⁶:

1.      recognize a relevant (cryptoasset) transaction;

2.      identify the cryptoasset user (CAU);

3.      categorize the CAU by type;

4.      apply the appropriate due diligence steps;

5.      verify and validate the information collected;

6.      store the information for reporting purposes; and

7.      set up monitoring for changes in circumstances (CiCs).

While the overall procedure may be straightforward, its application is fraught with pitfalls, such as how to obtain correct and comprehensive information on relevant (cryptoasset) transactions made through structures.

Recognize aRelevant (Cryptoasset) Transaction

As set out in Part I of this series, CARF starkly differs from CRS in a few areas, including the type of financial activity that prompts due diligence. Under CRS, the due diligence requirement kicks in upon the opening of a financial account as defined under CRS.⁷ For reasons examined in Part I, that approach would not function well for digital assets. Accordingly, the OECD determined that an actual exchange, barter, or purchase transaction involving digital assets, referred to as a relevant (cryptoasset) transaction, is the precursor to documentation and potential reporting.⁸ Thus, as a preliminary step to successful reporting and CARF compliance, every RCASP must develop an internal system for recognizing these transactions and responding accordingly.

Identify the CAU

You would think that identifying the counterparty on any relevant (cryptoasset) transaction would be simple — and mostly it will be. It’s the party sitting across the proverbial table, signing the document and entering into the transaction with you. In short, it’s your customer.⁹ But the efforts to conceal the true beneficial owners of the digital assets exchanged in any reportable transaction may well begin with a disguised counterparty. These disguises are not new and were exploited under CRS occasionally, but two factors will bolster their effectiveness for cryptoassets. First, the reliance on anti-money-laundering/know your client (AML/KYC) standards for determining when a party is operating on their own behalf, rather than on behalf of another party. Generally, a party operating on behalf of another party will not qualify as the CAU (unless it’s an RCASP or financial institution (FI)).¹⁰ Before the advent of CRS, these situations had been examined by banks and other FIs as part of their AML/KYC and “source of funds” duties. The contexts and methods for operating on behalf of another party (as agent, nominee, lawyer, etc.) were known.

Thus, there was scant leeway left for game-playing with the banks under CRS. As noted in Part I, AML/KYC standards in the crypto industry, however, are not so advanced (though there are ongoing signs of material improvement). The hard truth is that the less experience an RCASP has with efforts to disguise the true party to a transaction, the greater the risk of effective trickery.

The second factor facilitating hidden control over cryptoassets is the possession theory of ownership over cryptoassets. The possession or bearer theory, coupled with the pseudoanonymity of crypto transactions, makes ownership of a particular cryptoasset challenging to monitor at any given moment.¹¹ This ownership uncertainty will hamper the identification of the beneficial owner of the cryptoassets, thus sowing confusion over when a CAU is operating on behalf of another party rather than on behalf of itself. Is the CAU acting as the principal or the agent, and how could you even tell if the CAU didn’t want you to know? There’s no crystal ball for gazing into the hearts of counterparties, but hard-earned familiarity with the nooks and crannies (as well as the crooks and nannies) of the financial system helps.

Categorize the CAU by Type

CARF, like CRS, applies different due diligence requirements depending on the type of CAU. These categories are not the familiar multistep classifications from FATCA or CRS. Those will come later. These types are simple: entity or individual, and new account versus preexisting account.¹² Combinations of these four variables yield four rule sets, each of which has its own timing and documentation steps to follow. The core differences distil to whether the RCASP must obtain a self-certification form to document the CAU (see below), or instead may rely on information on file (for example, collected through AML/KYC procedures) or publicly available to do so. For situations in which the same binary option applied under CRS, many FIs decided to rely almost entirely on self-certification forms to avert a needless liability risk.

Apply the Appropriate Due Diligence Steps

As noted above, the CAU category determines the due diligence requirements and/or options for an RCASP documenting a CAU. However, there is one major situation in which the CAU does not need to be documented: if it has already been documented. Each relevant (cryptoasset) transaction featuring a repeat CAU does not necessitate a new round of information gathering and classification. Further, if the RCASP is also an FI for a CRS or a foreign financial institution (FFI) for FATCA and has already documented the CAU as an account holder under the CRS or FATCA documentation rules, or the RCASP has otherwise collected and validated forms with the information required under CARF for different purposes, it may rely on those forms for CARF.¹³ Once a CAU is documented, it does not need to be redocumented.¹⁴

Regrettably, that initial documentation may feel like being shoved into a box and sawed in two. You must use a valid self-certification form to document all individual and many entity counterparties. As a preliminary step to that end, RCASPs should develop or otherwise obtain a valid template form. For FATCA, template forms are ubiquitous because the IRS publishes them. The W8 and W9 series of forms were already in use for other U.S. tax matters, and thus the IRS could refurbish them for purposes of FATCA. Because U.S. tax forms tend to be as bewilderingly complex as the tax regimes they support, the IRS permitted the use of substitute forms and set out the conditions necessary for a valid substitute form.¹⁵ Under these conditions, many large banks and FIs developed their own versions to facilitate the onboarding process and embedded the FATCA forms within it. Thus, when CRS demanded a like-minded use of self-certification forms, the banks and other large FIs expanded their existing substitute forms. But what of the parties that had used — however grudgingly — the regular IRS forms for FATCA and had no substitute version of the IRS forms to adapt?

Multiple solutions were floated. The OECD tasked an industry and business working group, Business and Industry Advisory Committee to the OECD (BIAC), with producing CRS self-certification form templates.¹⁶ Lacking the central authority of the IRS over the regime, however, the OECD could not mandate use of a single form across the implementing jurisdictions. Thus, the BIAC self-certification template was optional, and despite the collective advantages of using a single form, most FIs did not do so.¹⁷ Some jurisdictions prepared and released CRS self-certification forms and several financial industry associations produced their own forms for use by their members, but these had limited purchase. FIs in other, non-form jurisdictions or that were not members of those industry associations had to purchase their forms or develop them in house. The outcome has been a diverse array of this key component of CRS compliance, thereby encumbering customers to adapt to each FI’s approach. Can we expect the same under CARF? No, likely it will be even less standardized.

The cryptoasset trade associations do not yet seem to have the sway or inclination to undertake standardized operations, which require significant buy-in from the membership. The final alternatives are the jurisdictions themselves, but so far, no jurisdiction has shown the appetite. If not, RCASPs will need to adopt the “DIY” default, investing time and resources into preparing a template form (or maybe multiple ones) that is valid,¹⁸ user-friendly, embeddable in their existing compliance framework,¹⁹ and accessible for reporting.²⁰

Alternatives to CARF self-certification forms exist. For some CAU entities, the RCASP may assume the burden of CARF classification without imposing a full self-certification demand on their customers. This method, however, can be risky and demanding. First, the RCASP must obtain a form declaring the jurisdiction(s) of tax residence of the CAU entity and then vet the declared tax residence against other information obtained by the RCASP (for example, AML/KYC purposes).²¹ To the extent that the CAU entity is resident in a reportable jurisdiction, the RCASP must treat the CAU as a reportable person, unless it can classify it as an excluded person.²²

It can classify the CAU entity as an excluded person, or not, either:

•  by itself, based on information on file or publicly available; or

•  by demanding that the CAU assert its claim for the status via a valid self-certification form.

For any CAU entities not classified as an excluded person, the RCASP must either obtain a valid self-certification form on which the CAU entity declares its status as an active entity or look through the entity to its controlling persons²³ and report them accordingly.²⁴ If the CAU entity is subject to the look-through procedure, the RCASP may rely on information collected under local AML/KYC rules (as long as they are up to date) to identify the population of controlling persons of the CAU entity, but it nonetheless must obtain self-certification forms on each.

CRS offered a similar streamlining of the classification of entity account holders. Many FIs were reluctant, however, to depend fully on this process, mainly because of the combination of enhanced liability risk and a restricted application (like with CARF, not all CRS entities could be classified without self-certifications forms). Thus, smaller FIs turned down the option to classify their entity customers themselves, preferring instead to insist that each one complete and submit a valid self-certification form. The larger FIs that did rely in part on information on file or that was publicly available tended to limit it to obvious candidates, such as financial counterparties²⁵ and local “mom and pop” businesses. Based on this experience and the rather zig-zag consequences under CARF of not using forms, CARF’s RCASPs seem even likelier than the CRS FIs to document solely via self-certification forms.

For new CAUs, the form is due, or a valid due diligence process must be completed, upon the initiation of the new business relationship between the CAU and the RCASP.²⁶ For preexisting individual CAUs, the form is due, or a valid due diligence process must be completed, within 12 months of the activation of the CARF regime in the RCASP’s jurisdiction.²⁷ If the RCASP fails to obtain a form or otherwise properly classify the CAU by the applicable deadline, it may not conduct or otherwise facilitate any relevant (cryptoasset) transactions on behalf of that CAU.

Verify and Validate

Once the form is completed and returned by the CAU (and any controlling persons, as warranted), the RCASP will need a process in place to verify and validate the form. The verification procedure is a box-ticking exercise to confirm that all the necessary questions are answered, that none of the information on the form contradicts itself, and that the signature and date are appropriate.²⁸

The validation process is less clerical. For validation, the RCASP must review the information available to confirm that the claimed status and jurisdiction of residence of the CAU and of any controlling persons of the CAU are reasonable. Notably, the RCASP is not responsible for freshly analyzing this information to produce its own independent determination of a customer’s CARF status and jurisdiction. Rather, the RCASP must ensure that the claims are not contradicted by available information.

This validation discrepancy opens up a thoroughfare to plough through. Parties reluctant to be reported may set up layers of intermediary entities between the controlling persons (beneficial owners) of the assets and the assets themselves. For CRS, the easy parlor trick was for a personal investment company to avoid the CRS status of a passive nonfinancial entity (NFE) because that necessitated that the FI maintaining the relevant account look through the entity to identify and potentially report its controlling persons. Thus, false (or at least dubious) claims of FI status, which does not need to be looked through or reported, and active NFE status, which does not need to be looked through and (in some cases) does not need to be reported, were popular.²⁹ Many banks pushed back against these avoidance attempts from the outset, and many more started doing so once the OECD and their local regulators started targeting these setups.

Spotting and rejecting a false CRS status is, however, only the first step to finding the beneficial owners of an account held by an entity.³⁰

The reason for this is that the use of multiple layers of entities between the individual beneficial owners and their assets long predates CRS or FATCA. Structuring to conceal the taxpayer or to improve the tax treatment of an item of income or to remove an asset from a taxable estate or to avoid transfer pricing revaluations or to do virtually anything to pay less or no money to the tax collector is nearly as old as taxation itself. As such, even once the FI navigated past the dubious entity status claimed by an account holder, a second entity held the account holder, and a third entity held the second entity, and so on, and so on. In some cases, a seemingly infinite number of scarves can be pulled from a sleeve before the actual beneficial owner of the assets is revealed.

Under CARF this process gets harder. CARF adds a new entity classification to the list that RCASPs must look through, and this particular entity classification is popular. Under FATCA, only passive NFEs had to be looked through (and not even all of them³¹). Under CRS, passive NFEs, plus any professionally managed investment entity-type (PMIE-type) FIs that were resident in a non-CRS jurisdiction, had to be looked through.³² CARF goes a step further by declaring that all PMIE-type FIs must be looked through, irrespective of where they are set up or managed.³³ While that certainly eliminates the appeal of falsely claiming that a passive NFE investment company is really a PMIE-type FI for CARF purposes, it sharply increases the number of CAU entities that need to be looked through.

While false PMIE claims were a popular method for avoiding look-through treatment under CRS, false PMIEs are far less common than actual PMIEs. Actual PMIEs include investment funds, fiduciary vehicles, and private wealth structures. Under CRS, the compliance teams in the firms that manage PMIEs handled the documentation of their clients.³⁴ Under CARF, it is the RCASPs that will need to look through all those PMIE counterparties; pierce the multilayered, intricate structures behind them; determine who the individual beneficial owners are; and document them.³⁵

Store the Information

If you dazzle the audience all show, but then flub the closing trick, they will not shower you with praise for the bits you did well, but rather condemn you for the show-stopping item you missed. Running an award-winning due diligence process for CARF is irrelevant if you do not store the collected information in a manner that is accessible for annual reporting purposes, meaning you must identify and segregate the reportable wheat from the nonreportable chaff. There are storage mandates under CARF that require the archiving of all information relied on for classification and reporting for five years.³⁶ Obviously such rules must be followed, but the grand finale is the annual reporting. Designing and implementing data storage that facilitates the extraction of reportable information in an efficient, comprehensive, and trustworthy fashion is “the prestige.”³⁷ Failure to do so is an easy — and easily avoidable — way to ruin an otherwise well-conceived and well-executed CARF compliance program.

Set Up Monitoring for Changes in Circumstances

The final dimension of CARF due diligence is the need to set up and maintain a process for monitoring for and communicating changes in circumstances. Like Houdini in a straitjacket inside a metal safe dropped into Lake Michigan, parties that have not disclosed their crypto earnings before being reported have a strong incentive to get loose — and like Houdini in that straitjacket in the safe in the lake, no one can see what is being done at the time. If no one is paying attention, the client can easily shift jurisdictions or controlling persons/beneficial owners or undertake any number of actions to render the original CARF classification and documentation inaccurate. Thus, CARF insists that RCASPs continuously pay attention to their customers in case any indication of a new jurisdiction of residence, entity classification, or controlling person emerges. In those cases, the monitoring system must communicate the emergence of the new information to the party responsible for documenting and reporting transactions.

Conclusion

Mastering the “old tricks” imported into CARF from CRS and other regimes will largely determine the robustness of any RCASP’s compliance program. As set forth in this article, due diligence rules as written will collide with the simple reality that many reportable CAUs will not wish to be known, much less reported, and even some that are ambivalent about disclosure may own their assets behind intricate structures for non-CARF reasons. Thus, an RCASP’s team will need craft, expertise, and the right instruments and tools to ensure that the customer documentation process identifies the correct beneficial owner of the digital assets in a reportable crypto transaction. When tricked, the RCASP — not the tricksters — will be subject to liability under CARF.

In the next articles in this series, we turn to reporting. Part IV will examine CARF’s reportable transactions, the information that must be disclosed, and the valuation challenges for crypto. Finally, the fifth and concluding article in this series will discuss enforcement and the best practices and tools available for demonstrating an effective compliance program.

¹ Paul Foster Millen and Peter A. Cotorceanu, “Old Tricks for New Dogs: The OECD’s Cryptoasset Reporting Framework,” Tax Notes Int’l, Oct. 16, 2023, p. 345.

² As used in this article, “CARF” refers to OECD, “Crypto-Asset Reporting Framework and Amendments to the Common Reporting Standard” (Oct. 10, 2022). This article focuses primarily on Part I of that document, which is titled “Crypto-Asset Reporting Framework.”

³ As used in this article, “CRS” refers to OECD, “Standard for Automatic Exchange of Financial Account Information in Tax Matters” (July 21, 2014; 2d ed. Mar. 27, 2017). Being a mere publication of the OECD, CRS has no legal effect. However, well over 100 countries have implemented CRS by incorporating it — or a version of it — into local law.

⁴ Millen and Cotorceanu, supra note 1.

⁵ Cotorceanu and Millen, “Old Tricks for New Dogs, Part II: The OECD’s Cryptoasset Reporting Framework,” Tax Notes Int’l, Apr. 8, 2024, p. 203.

⁶ Many CRS jurisdictions require written policies and procedures to further ensure compliance with the due diligence process. First-moving Switzerland has already indicated a benefit to those materials for CARF (proposed Swiss CARF law, art. 28). Even in the absence of a requirement, written protocols are obvious needs for any larger RCASPs with a diffuse CARF compliance team that needs to communicate its approach across multiple settings. Moreover, written documents are critical for institutionalizing the protocols and bolstering continuity during periods of staff turnover. These needs are even more prominent under the CARF regime because of the various ambiguities and interpretive uncertainties bedeviling it. Commonly, a noncompliant approach from a faulty interpretation will not result in sanctions if the interpretation is (a) reasonable, (b) made in good faith, and (c) applied consistently across all similar scenarios. A particular approach or interpretation that benefits a particular client and was cherry-picked for that client is likelier to lead to trouble.

⁷ As defined for purposes of CRS, the term “financial accounts” encompasses conventional bank accounts, as well as debt and equity interests in investment vehicles, certain insurance contracts, trust settlors and beneficiaries, and more (OECD CRS Standard, Section VIII, C1).

⁸ OECD CARF Standard, Section IV, C1.

⁹ OECD CARF Standard, Section IV, D1.

¹⁰ OECD CARF Standard, Section IV, D2.

¹¹ For this and many other points fundamental to these articles, see Omri Marian, “A Conceptual Framework for the Regulation of Cryptocurrencies,” 82(1) U. Chicago L. Rev. Online 56 (2015).

¹² OECD CARF Standard, Section IV, D3-6 (with a preexisting CAU defined as one that had already established a relationship with the RCASP in question).

¹³ OECD CARF Standard, Section III, D1.

¹⁴ The process for change in circumstances monitoring (see below) is designed to capture material changes to the initial classification of any CAU.

¹⁵ IRS, “FATCA — FAQs General,” General Compliance, questions 8-9.

¹⁶ These template forms are available on the OECD website (last checked September 11, 2024).

¹⁷ Perhaps that is one reason why — based on our present understanding — there is no OECD group charged with the development of a CARF self-certification form (or any plans to establish one).

¹⁸ OECD CARF Standard, Section III, C1-2 (setting forth the requisite criteria for individual and entity CARF self-certification forms, respectively).

¹⁹ RCASPs will expect to integrate the CARF self-certification forms into their digital onboarding process, which is permissible under CARF but subject to conditions on electronic forms (OECD CARF commentary to Section III, para. 41).

²⁰ There are advantages to preparing your own self-certification forms beyond branding and user-friendliness. For self-certifications prepared for Swiss and U.K. FIs under CRS, for example, self-executing validation cures and “client notification” requirements could be embedded within the template form, thereby saving the FIs significant compliance costs, time, and liability risks.

²¹ OECD CARF Standard, Section III, B1 (the mandatory language seems overdone because the CAU tax residence in a CARF reportable jurisdiction is rendered irrelevant by certain entity classification statuses).

²² CARF defines an excluded person as: a. an Entity the stock of which is regularly traded on one or more established securities markets;

b.  any Entity that is a Related Entity of an Entity described in clause (a);

c.  a Governmental Entity;

d. an International Organisation;

e.  a Central Bank; or

f.  a Financial Institution other than a professionally managed investment entity. (OECD CARF commentary to Section IV, para. 61).

²³ “Controlling Persons” is the term from FATCA/CRS/CARF for the individuals who control the entities being documented, akin to the term “beneficial owner” in AML/KYC parlance. (OECD CARF Standard, Section IV, D10).

²⁴ OECD CARF Standard, section III, B2

²⁵ Moreover, the OECD complicated the process of relying on publicly available information for CRS classifications of other FIs by issuing a FAQ in May that invalidates reliance on the FATCA FFI List (a register of entities that registered as FATCA FFIs with the IRS) to classify a customer as a CRS FI (OECD CRS FAQS, Section II-VII: Due Diligence Requirements, at Q27).

²⁶ Jurisdictions implementing CARF are already recognizing the impracticality of the “day one” rule for documentation validation and accordingly are mapping out the sorts of unusual circumstances in which an RCASP will have more time to obtain and review customer information (see, e.g., proposed Swiss CARF law, art. 12f(2)(b)).

²⁷ Unlike CRS, CARF does not provided a so-called staggered approach option. The participation of the jurisdiction of residence of the CAU is immaterial to the timing of the due diligence process.

²⁸ A major source of irritation in this process is verification of the taxpayer identification number. The TIN format tends to vary by jurisdiction (see OECD CRS webpage dedicated to worldwide TIN formats (last checked September 11, 2024). While the RCASP is not responsible for verifying that the TIN is correct, false or incomplete TINs remain a source of drama for tax authorities trying to sift through information obtained from partner jurisdictions. To that end, the commentary to CARF references a TIN verification database available in certain jurisdictions where RCASPs could, if they wished, confirm TINs (OECD CARF commentary to Section IV, para. 80).

²⁹ See rule 1.1, “CRS Avoidance Arrangements,” of the OECD’s Mandatory Disclosure Rules.

³⁰ Moreover, in light of the marks generally given RCASPs for the implementation of AML/KYC rules, CARF’s due diligence allowance to identify the population of controlling persons based on information collected under AML/KYC rules risks inadequacy through incorporation.

³¹ The only passive nonfinancial foreign entities that don’t need to be looked through under FATCA are so-called “direct reporting” and “sponsored direct reporting” nonfinancial foreign entities. See reg. sections 1.1472-1(c)(1)(vi) and (vii). A direct reporting nonfinancial entity is a nonfinancial foreign entity that has elected to report its own substantial U.S. owners to the IRS. See reg. section 1.1472-1(c)(3). A direct reporting nonfinancial foreign entity is a sponsored direct reporting nonfinancial foreign entity if another entity (the “sponsoring entity”) has agreed to (among other things) perform, on behalf of the direct reporting nonfinancial foreign entity, all the latter’s due diligence, reporting, and other requirements. See reg. section 1.1472-1(c)(5)(i).

³² The addition of PMIE-type FIs in nonparticipating jurisdictions to the list of look-through entities was necessitated by the ease of avoiding CRS reporting otherwise.

³³ OECD CARF Standard, Section IV, E1.

³⁴ In Millen and Cotorceanu, supra note 1, we mused whether the OECD’s definitional scope of RCASPs would be enlarged by local authorities to include asset management firms within the definition, as in the EU’s Directive on Administrative Cooperation 8.

³⁵ RCASPs may delegate their due diligence duties to third parties if they wish. However, the liability for any defective documentation remains with the RCASP (OECD CARF Standard, Section IV, D2; OECD CARF commentary to Section IV, para. 50 et seq.).

³⁶ OECD CARF commentary to Section III, para. 58.

³⁷ According to the late, incomparable Ricky Jay: “The Prestige is the payoff, the third act of any magic trick. First comes The Pledge: The magician shows you something relatively ordinary, like a dove. Second is The Turn: The magician takes the dove and makes it do something extraordinary, like disappear. Finally, there’s The Prestige: The magician tops that disappearance and makes the dove reappear.” Tom Zito, “The Pledge. The Turn. The Prestige,” Alta Online, Dec. 18, 2018.

Disclaimer: This article is intended for general informational purposes only and does not constitute legal or regulatory advice. Parties should seek qualified legal counsel regarding their specific obligations under the applicable CARF/DAC8 regulations.