A client who holds a securities account with a European bank while living elsewhere usually asks one question about it: what does the bank tell my tax authority. The honest answer is that there are two separate streams of information running on different rules and different calendars, that one of them is largely invisible to the client, and that both of them are changing.
The distinction that organizes the whole subject is between information about the account and tax withheld at source on what the account receives. The first is a disclosure obligation owed by the bank to its own authority, which passes it on. The second is a collection mechanism owed by the payer of the income. They involve different documents, they are triggered by different events, and a client who is compliant on one can be exposed on the other.
What the account information contains
The content is set out in article 8(3a) of the directive on administrative cooperation in the field of taxation, inserted by the directive that brought the common reporting standard into European law. For each reportable account, the financial institution provides the name, address and tax identification numbers of each reportable person who is an account holder, adding the date and place of birth in the case of an individual. Where the account holder is an entity that the due diligence rules identify as having one or more controlling persons who are reportable, the file carries the name, address and tax identification numbers of the entity, and separately the name, address, tax identification numbers and date and place of birth of each of those controlling persons. Date and place of birth are reported for the individuals; the entity is described by name, address and tax identification numbers alone.
To that is added the account number or its functional equivalent, the name and identifying number of the institution, and the account balance or value at the end of the relevant calendar year or other appropriate reporting period, or the fact of closure where the account was closed during that year or period. For a custodial account, the information also carries the total gross amount of interest, the total gross amount of dividends and the total gross amount of other income generated by the assets held, in each case paid or credited during the period, and the total gross proceeds from the sale or redemption of financial assets credited to the account.
The word that clients react to is gross. Proceeds of sale travel without deduction of cost, so a portfolio that turns over produces a figure that bears no relation to any gain. That number will not match the client’s return, and it is not supposed to, but it is a routine source of enquiries.
The calendar, and why it is nine months
The deadlines are in article 8(6) of the same directive. For the general categories of income exchanged under article 8(1), such as employment income, directors’ fees, pensions and income from immovable property, the exchange takes place at least once a year within six months following the end of the tax year of the communicating member state during which the information became available. For the financial account information under article 8(3a), the exchange is annual, within nine months following the end of the calendar year or other appropriate reporting period to which the information relates.
Nine months is the number to hold in mind. Information about a calendar year reaches the residence authority around the end of September in the following year, and the text fixes the starting point at taxable periods from 1 January 2016. That is typically after the client has filed, which is why the mismatch is discovered by an authority rather than by a taxpayer.
The consequence for practice is that the account data has to be reconciled against the return before the return is filed, not after the enquiry arrives. The bank will produce the underlying figures on request. Very few clients ask.
Residence is whatever the file says
For an account opened as a new account under these rules, the mechanism that decides where the information goes is the self-certification taken at account opening, which Annex I to the directive requires the bank to obtain and to test for reasonableness against the documentation it already holds, under section IV where the holder is an individual and under section VI where the holder is an entity. Section IV requires a valid replacement where a change of circumstances gives the bank reason to know that an individual holder’s original certification is incorrect or unreliable, and section VII bars any reporting financial institution from relying on a self-certification it knows or has reason to know is incorrect or unreliable. For an account that already existed when the rules arrived, residence comes instead from the indicia in the bank’s own records under section III for an individual holder and from the review procedures of section V for an entity. In the first instance it is the bank’s file, not the client’s actual position, that determines the destination.
Two failures follow from it. A client who has moved and has not told the bank continues to be treated as resident in the wrong state, and the correct one receives nothing, which does not cure the obligation to declare there. A client whose certification is out of date in the other direction is treated as resident in a state they left years ago, which produces correspondence they have to answer.
Neither is a technical problem. Both are answered by treating a change of residence as an event that has to reach every financial institution in the file, alongside the tax authorities themselves. A change of address notified to the bank’s correspondence system is not a change of tax residence for these purposes, and the two are often handled by different teams inside the same institution.
Holding through a company does not remove the individual
The single most persistent misunderstanding is that placing the account in the name of a company, a foundation or a trust removes the individual from the exchange. It does not, and the text says so directly.
Article 8(3a) requires that where an entity is the account holder and the due diligence rules identify it as having one or more controlling persons who are reportable, the information covers both the entity and each of those controlling persons: the entity by name, address and tax identification numbers, and each controlling person by name, address, tax identification numbers and date and place of birth. The entity is added to the file; the individual is not removed from it.
What the structure does change is which state receives the information and on what basis, because the entity has a residence of its own and the controlling persons may have others. A vehicle in one state, a founder in a second and beneficiaries in a third produce a set of exchanges that reach several authorities, each seeing a partial view of the arrangement.
That partial visibility is itself a risk. An authority that receives a controlling person notification without any context tends to ask for the context, and the answer is usually the whole structure. Where the structure exists for succession or governance reasons it will withstand that. Where it exists to interpose distance, the interposition is the first thing the exchange removes.
Withholding is a separate machine
The second stream operates before any of this. Income arising in a European state is taxed at source under that state’s domestic law, and the treaty rate is obtained either by relief at the moment of payment or by reclaim afterwards.
The Dutch example shows the shape of it. Article 5 of the Wet op de dividendbelasting 1965 sets the dividend withholding tax at 15 per cent of the proceeds, article 7 of the same act requires the withholding agent to withhold at the moment the proceeds are made available and to pay the withheld tax over on a return, and article 19 of the Algemene wet inzake rijksbelastingen sets that payment deadline, for a tax not levied over a period, at one month from the moment the tax debt arises. A non-resident entitled to a lower treaty rate either has the reduction applied at source, where the custodian can evidence entitlement in the form the source state requires, or files a claim and waits.
Reclaims are where value is lost quietly. They are documentary, they are slow, they are specific to each source state, and they depend on a certificate of residence issued by the client’s own authority within a validity period that does not always align with the source state’s requirements. A portfolio spread across six European markets can carry six separate reclaim processes, and the amounts individually are small enough that nobody chases them.
What changed on 1 January 2026
The perimeter widened this year. Council Directive (EU) 2023/2226 required member states to adopt and publish the necessary measures by 31 December 2025 and to apply them from 1 January 2026, and it defers two narrower sets of provisions on its own terms, one to be adopted by 31 December 2027 and applied from 1 January 2028, the other to be adopted by 31 December 2029 and applied from 1 January 2030.
Two extensions matter for a private portfolio. A depository account now expressly includes an account or notional account representing all electronic money held for the benefit of a customer and an account holding one or more central bank digital currencies, and a new obligation under article 8ad of the amended directive falls on reporting crypto-asset service providers, which brings a category of holding that was outside the automatic exchange into it. The reported file was widened at the same time: for taxable periods from 1 January 2026 it states whether a valid self-certification has been provided for each account holder, the role by virtue of which each reportable controlling person is a controlling person of an entity account holder, and the type of account, including whether it is joint and how many joint holders it has. In practice that means banks reopening self-certifications that clients regarded as settled.
Clients should expect requests for renewed documentation from institutions they have banked with for years, and should not read them as suspicion. They should also expect that holdings previously outside the exchange are now inside it, and that the first exchanges on the new categories describe periods that have already begun.
What changes at the end of the decade
The withholding side has its own reform, already adopted and not yet applicable. Council Directive (EU) 2025/50 of 10 December 2024 establishes a common framework for relief of excess withholding tax on dividends from publicly traded shares and, where applicable, on interest from publicly traded bonds.
Its central instrument is a digital tax residence certificate. Every member state must provide an automated process to issue one to persons resident for tax purposes in its jurisdiction and must issue it within 14 calendar days of a request, telling the applicant the additional time needed and the reason where verifying that residence takes longer. Alongside it the directive builds relief procedures operated by certified financial intermediaries, which apply in the member states covered by its chapter on the withholding tax relief procedure. Where such a member state operates the quick refund system, it must process a request within 60 calendar days after the end of the period for requesting the quick refund, and interest runs on the refund for each day of delay after the sixtieth. Member states must adopt the implementing measures by 31 December 2028 and apply them from 1 January 2030.
That is a long horizon, and it is relevant now for one reason. A reclaim process built today on paper certificates and bilateral correspondence will be replaced within the decade by one built on a certified intermediary chain. For a custody relationship expected to run that long, whether the institution intends to register as a certified financial intermediary is the question that decides whether relief will be automatic or manual.
Where the client’s own obligation sits
None of the above discharges the client. Automatic exchange informs an authority; it does not file a return, and it does not by itself put the taxpayer in compliance. Several European states also impose a separate obligation to declare foreign assets, distinct from declaring the income they produce, with its own return and its own reporting thresholds. Spain is the clearest example: the eighteenth additional provision of the Ley General Tributaria requires residents to report foreign bank accounts, foreign securities, insurance and annuities, foreign immovable property and foreign virtual currencies, on the terms the implementing regulation lays down, and article 42 bis of the regulation approved by Real Decreto 1065/2007 then provides that no foreign account has to be reported where the balances at 31 December, taken together, do not exceed 50,000 euros and the same is true of the average balances, while every account has to be reported once either of those joint limits is exceeded.
The working assumption should therefore be that the residence authority already has the account, the balance, the gross income and the gross proceeds before it looks at the return. Under that assumption the defensible file is one where the return and the bank data have been reconciled deliberately, with the differences between them identified and explicable.
That reconciliation is a modest annual exercise for most portfolios. It is the cheapest item in this entire subject, and it is the one most consistently skipped, usually because the client assumes that a bank in a well-regulated European state is handling something on their behalf. The bank is handling its own obligation. It is not handling theirs.
This article is informational and does not constitute tax or legal advice. Rules of this kind evolve and their application depends on the facts of each structure. Each engagement is subject to scope and applicable regulation.