UAE Risk Assessment Questionnaire for FATCA and CRS Compliance

The risk self-assessment questionnaire is a tool the UAE Ministry of Finance uses to assess how well UAE Reporting Financial Institutions (RFIs) are complying with the Foreign Account Tax Compliance Act (FATCA) and the Common Reporting Standard (CRS). It’s mandatory for every UAE RFI registered on the FATCA/CRS system with reporting obligations for the relevant year, and it’s designed to identify compliance gaps early rather than let them surface during a later review.

This guide covers what FATCA and CRS actually require, which entities count as RFIs, how to complete and submit the questionnaire, what happens after submission, and the most common mistakes RFIs make.

What Are FATCA and CRS?

FATCA and CRS are both regimes for the automatic exchange of information (AEOI) between jurisdictions for tax purposes. FATCA applies specifically to the exchange of information between the UAE and the United States. CRS applies more broadly, to the exchange of information between the UAE and other participating countries.

Under both regimes, UAE RFIs must identify and report certain information about their account holders and controlling persons to the UAE Ministry of Finance annually. The Ministry then exchanges that information with the relevant foreign tax authorities. The UAE has issued laws, regulations, and policy manuals to implement both regimes, and RFIs must register on the CRS/FATCA system and submit their data and risk assessments by the applicable deadlines.

Also check: Tax Consultancy

What Counts as a UAE Reporting Financial Institution

An RFI generally falls into one of four categories under FATCA and CRS: a custodial institution (holding financial assets for others as a substantial part of its business), a depository institution (such as a bank accepting deposits in the ordinary course of business), an investment entity (managing or investing funds on behalf of clients), or a specified insurance company offering products with a cash value or annuity component. This covers a broader range of entities than banks alone, investment funds, certain holding companies within a financial group, and specified insurers can all fall within scope even where they wouldn’t typically think of themselves as a “financial institution” in the everyday sense. Confirming RFI status correctly at the outset is the first step, since an entity that incorrectly assumes it’s out of scope can miss registration and reporting obligations entirely.

Who Should Complete the Questionnaire

• Every UAE RFI registered on the Ministry of Finance FATCA/CRS system for the relevant reporting year must complete a risk assessment questionnaire by the stipulated deadline, separately for FATCA and CRS where applicable.
• An RFI subject to more than one UAE Regulatory Authority must submit a separate Risk Assessment Questionnaire within each relevant Group for FATCA and/or CRS, depending on its obligations.
• The questionnaire can be completed by an Administrator, Maker, or Maker+Checker user in each Group, known as the Maker action. A different Administrator, Checker, or Maker+Checker user must then review it and either Accept or Reject it, known as the Checker action.

The same user cannot perform both the Maker and Checker actions, different individuals must carry out each step.

Must check: Tax Agent Services

How to Fill Out the Questionnaire

The questionnaire is accessed through the FATCA/CRS system, the online portal the UAE Ministry of Finance provides for RFIs to register, submit, and manage their reports.

1. Log in to the FATCA/CRS system and select the Group you’re submitting the questionnaire for.
2. Select “Risk Assessments” then “Submit a risk assessment” from the menu.
3. Select the relevant report type, FATCA or CRS, and the reporting period.
4. Answer all questions and provide any additional information or comments required.
5. Click “Save” to save progress, or “Check” to validate answers.
6. Once checked, click “Complete Checking” to submit the questionnaire to the regulatory authority for review. The questionnaire cannot be edited after this step.
7. To make changes after submission, click “Send Back to Maker,” edit the questionnaire, then repeat the checking and submission process.

What Happens After the Risk Assessment Is Submitted

Once “Complete Checking” is clicked, the questionnaire moves to the relevant Regulatory Authority for review. The responses feed into how the RFI’s compliance risk is assessed, entities whose answers indicate weaker controls, incomplete due diligence processes, or gaps in reporting history are more likely to attract closer regulatory attention or a follow-up request for supporting documentation. The FATCA/CRS system doesn’t accept late submissions, and missing the deadline can itself result in penalties and sanctions from the Regulatory Authority, independent of how the underlying compliance answers would have been assessed. RFIs can track the questionnaire’s status on the system and should expect to receive feedback where the Regulatory Authority has follow-up questions or concerns.

Common Mistakes When Completing the Questionnaire

• Assigning the same person to both Maker and Checker roles. The system and the underlying rules require these to be different individuals, attempting to use one person for both undermines the review step entirely.
• Underestimating how long data validation takes. Answering the questionnaire accurately depends on having reliable, validated account holder and controlling person data on hand, this should be reviewed well before the deadline, not gathered at the last minute.
• Missing that multiple Regulatory Authorities require separate submissions. An RFI subject to more than one Regulatory Authority needs a distinct questionnaire per Group, submitting only one when multiple are required leaves gaps in the compliance record.
• Treating the deadline as flexible. The system doesn’t accept late submissions, and there’s no informal grace period to rely on.
• Assuming FATCA and CRS obligations are identical. The two regimes have separate reporting scopes and separate questionnaire submissions, treating them as a single combined exercise risks missing one entirely.

Frequently Asked Questions (FAQs)

How Farahat & Co. Can Help

Farahat & Co. supports UAE RFIs with FATCA and CRS gap analysis, risk assessment questionnaire preparation and submission, and ongoing compliance and due diligence review.

Contact Farahat & Co. today to discuss your FATCA and CRS compliance requirements.