ndependent audit compliance eview of a … · independent audit/ compliance review of a fatca...

INDEPENDENT AUDIT/ COMPLIANCE REVIEW OF

A FATCA PROGRAM

Jennifer Dors, LL.M., CAMS-Audit June 2014

INDEPENDENT AUDIT/ COMPLIANCE REVIEW OF A FATCA PROGRAM JULY 2014

2

Table of Contents I INTRODUCTION ................................................................................................................. 3

a. Background ........................................................................................................................ 3 b. About this White Paper...................................................................................................... 3

II FATCA – What does this law entail? .................................................................................. 4 a. Definition of a FFI ............................................................................................................... 4 b. Main Obligations ............................................................................................................... 4 c. FATCA Indicators for Pre-Existing Customers ...................................................................... 5 d. New Customer Onboarding ............................................................................................... 5 e. Key FATCA Milestones ....................................................................................................... 6 f. Record Keeping .................................................................................................................. 6 g. FFI Agreement ................................................................................................................... 7 h. Intergovernmental Agreements ......................................................................................... 7 i. FATCA Responsible Officer .................................................................................................. 7

III INDEPENDT AUDIT AND COMPLIANCE REVIEW ................................................................ 8 a. Purpose and Goal ............................................................................................................... 8 b. What and how to Audit/Review ......................................................................................... 8

1. Pre-existing accounts ..................................................................................................... 8 3. New Customer Onboarding ............................................................................................ 9 4. Non-Participating FFI .................................................................................................... 10 5. Reporting ..................................................................................................................... 10 6. Withholding ................................................................................................................. 10

c. Other Items to be Audited/Reviewed ............................................................................... 10 IV CONCLUSION ................................................................................................................... 11 Glossery .................................................................................................................................. 12 Resources ............................................................................................................................... 12


3

I INTRODUCTION

a. Background

In 2010 the U.S. government passed a new legislation known as FATCA. FATCA stands for Foreign Account Tax Compliance Act and is intended to prevent U.S. taxpayers from avoiding the payment of U.S. income taxes by hiding money offshore. Starting in 2013 foreign (non-U.S) financial institutions (FFIs) are required to enter into agreements with the U.S. Internal Revenue Service (IRS) to report relevant information to the IRS regarding financial accounts held by identified U.S. persons. Failing to comply with this regulation, the IRS will impose a 30 percent withholding tax on U.S. source payments (and potentially certain non-U.S. source payments at a later date) paid to the FFI or their clients. FFIs around the world must take the necessary steps to meet these obligations if they do not want to be subject to a 30 percent withholding. The purpose of FATCA is to detect, deter and discourage offshore tax evasion by U.S. citizens or residents.

b. About this White Paper

An FFI that agrees to be compliant with FATCA will have to register through the IRS web portal and become a Participating FFI (PFFI). By becoming a PFFI, the institution enters into an FFI Agreement with the IRS. Logically, the FFI must comply with the agreement, which is basically a replica of the obligations placed on the PFFI in the law itself. FATCA, however, places an additional burden on the PFFI by obligating the PFFI to certify once every three years, through its responsible officer (RO), that it is complying with the FFI agreement. As you will see further in this paper, the implementation of FATCA has an impact on several areas/departments in a financial institution. The RO will not necessarily be the person heading these departments and thus will need assurance that the institution is complying with its obligations prior to providing the certification to the IRS. The RO will have to rely on the proper implementation of FATCA by the business operations and regular intel audits and compliance reviews to test the institution’s compliance with FATCA. The audit and review plans must be diligently designed to cover each and all aspects necessary to comply with FATCA. The program and complexity may differ in certain aspects depending on the size of the institution, but the basic items will remain the same. The institution where I am employed is a large institution in this jurisdiction, but relatively small compared too many international FFIs. One of my responsibilities for the past two years has been to make our FFI and affiliates fully compliant with FATCA. This entailed, analyzing the law, identifying the stakeholders for a successful implementation, installing a FATCA committee to design an implementation plan, execute that plan. Now that the mayor part of the (pre-July 1, 2014) implementation has been finalized, one of the next big FATCA-related projects is to design an audit program for testing our compliance. The responsibility will change from a proper implementation to proper testing with the objective to identify any gaps and provide for (sometimes assist in finding) solutions to close the gaps.


4

II FATCA – What does this law entail?

a. Definition of a FFI An FFI means any non-U.S. financial institution. A financial institution is defined as any entity that:

1. Accepts deposits in the ordinary course of a banking or similar business; 2. Holds, as a substantial portion of its business, financial assets for the account of others; 3. Is engaged primarily in the business of investing, reinvesting, or trading securities,

partnership interests, commodities, notional principal contracts, insurance or annuity contracts or any interest in these items; or

4. Is an insurance company (or holding company of an insurance company) that issues or is obligated to make payments with respect to a financial account.

Although the law seems to be clear on this point, in practice, we sometimes encounter difficulties in placing a certain type of entity in a specific box because of the way it is incorporated/structured based on the domestic law. After testing the institution’s objective to the definition of a FFI, NFFE, and other types of institutions specified in the law, we continue to test against the exemptions that are provided by the law. The third possibility would be to review the Annex II in IGA Model 1 countries and see whether a specific type of entity is placed on the Annex II as an exempt entity. b. Main Obligations FATCA imposes three main obligations on FFIs:

1) Documentation An FFI is required to document customers as U.S. persons, non-U.S. persons or eligible for an exemption under FATCA by obtaining sufficient documentation to support the determination of status. This requirement sounds easy to execute but the challenges that we see in the global world that we live in, is that—especially with existing customers—they are willing to provide the information and documentation requested but are reluctant to send the information by any type of mail. Especially the tax identification numbers are not provided easily from abroad in connection with the risk of identity theft. 2) Withholding An FFI will be required to withhold on payments made to (a) “recalcitrant” accounts (for example, account holders that do not provide adequate documentation or a waiver when requested) and (b) FFIs that do not enter into FFI Agreements. The challenge with “withholding” is that it has to be 30 percent on U.S. source income. Unfortunately, you cannot automate the assessment of which payment is U.S. source and which is not. Each and every payment of a recalcitrant account holder or NPFFI must be manually investigated before a definitive withholding can take place. Even in a “small” institution of the one where I work, it is an almost impossible task. For this reason many FFIs are aiming not to have recalcitrant accounts and accounts pertaining to NPFFI, by the time that they have to start withholding.


5

3) Reporting An FFI will be required to satisfy annual reporting requirements on certain U.S. persons, recalcitrant accounts, non-participating FFIs and other persons as required under FATCA. The information that needs to be reported on U.S. persons is as follows: For each U.S. person (year 2014):

Name, address and taxpayer identifying number (TIN);

Account number; and

Account balance or value (or if the account was closed after the effective date of the FFI agreement, the amount or value withdrawn or transferred from the account in connection with closure).

From year 2016, also: Gross receipts and gross withdrawals or payments from the account. For each substantial U.S. owner of a U.S. owned foreign entity (year 2014):

Name of the entity;

Name, address and TIN of each substantial U.S. owner;

Account number of the entity; and

Account balance or value of the account held by the entity. From year 2016, also: Gross receipts and gross withdrawals or payments from the account.

Furthermore, the PFFI must report aggregate number and value of financial accounts held by recalcitrant account holders, NPFFIs and dormant accounts. c. FATCA Indicators for Pre-Existing Customers FATCA makes a difference between pre-existing (customer of the FFI before July 1, 2014) and new customers (customer who become a customer of the FFI as of July 1, 2014). The pre-existing customers can be identified by electronic search based on the following criteria:

o Designation as U.S. citizen or resident o U.S. place of birth (for individuals) o U.S. residence or U.S. mailing address o Current U.S. telephone number o Standing orders to U.S. account o Current PoA or signing authority to person with U.S. address o “In-care-of” or a “hold mail” address o Entities with an ultimate beneficial owner who owns more than 10 percent of the

entity by stock or vote The fact that FATCA is satisfied with an “electronic search” (except for high value accounts, which are accounts belonging to individuals and NFFE with a balance above $1 million has been a great relief to FFIs. The difficulty could have been in how well information that is available in the physical file, is also entered into the institutions database or if the information has been entered correctly. d. New Customer Onboarding For customers that become a customer after July 1, 2014, FATCA requires the FFI to have amended its Customer Onboarding Procedures in such way that U.S. citizens and residents are


6

identified at onboarding and that the information required from the customer for reporting by the FFI is immediately requested. With the implementation of the “New Customer Onboarding Procedures,” the institution should emphasize on the importance to really know the customer and to ask further questions and get information that we need to know who we are dealing with. For example, when in the past a valid identification is sufficient to satisfy the requirement of identifying the customer, this might not be sufficient anymore. Should the customer provide you with a local identification card, where you can see that the “place of birth” is, for example, the “United States of America,” you must now ask if the customer is a citizen or resident of the U.S. If the answer is positive, you need to obtain the SSN and request permission to report the information required under FATCA to the IRS (in non-IGA countries). Also, the importance of entering complete and correct customer information into the institutions database must be emphasized. Reference is made to section c. above.

e. Key FATCA Milestones

April 25, 2014 FFI can finalize its registration through the FATCA registration website June 2, 2014 IRS posts first list of Participating FFIs June 30, 2014 Cut-off for pre-existing accounts July 1, 2014 Date of FFI Agreement for FFIs that have already registered July 1, 2014 Withholding (for U.S. sourced withhold-able payments) begins December 31, 2014 Completion due diligence on Prima Facie FFI March 15, 2015 Annual Reporting to the IRS for non-IGA and Model 2 IGA jurisdictions June 30, 2015 Completion due diligence on pre-existing high value accounts

(˃USD1mln) September 15, 2015 Annual Reporting to the IRS for Model 1 IGA jurisdictions June 30, 2016 Completion due diligence on all other pre-existing accounts July 1, 2016 First certification by the Responsible Officer These above timelines have changed a few times over that past years. It seems like the dates will not change again but in May 2014 the IRS released a statement that they will ease enforcement for FATCA compliance until 2016 for certain taxpayers. They announced that calendar years 2014 and 2015 will be treated as transition periods for enforcing and administering implementation of FATCA FFIs. So long as the FFI makes a good faith effort to comply with its FATCA obligations, it will not be subject to withholding tax liabilities or penalties for failing to comply in 2014 or 2015. f. Record Keeping A participating FFI that produces, in the ordinary course of its business, account statements that summarize the activity (including withdrawals, transfers and closures) of an account (U.S. person or recalcitrant) for any calendar year in which the account was required to be reported must retain a record of such account statements. The record must be retained for the longer of six years or the retention period under the FFI’s normal business procedures. A participating FFI may be required to extend the six year retention period if the IRS requests such an extension prior to the expiration of the six year period.


7

g. FFI Agreement FFIs in non-IGA jurisdictions must comply with the FFI agreement which is published on the website of the IRS. The FFI agreement basically reflects the obligations set by FATCA regulations on the FFIs that register with the IRS and become Participating FFIs (PFFIs). h. Intergovernmental Agreements Because of restrictions imposed by local law and regulation, FFIs in many countries are prevented to report directly to a third party as is the case with FATCA reporting to the IRS, thus potentially exposing the FFI to withholding. This would be inconsistent with FATCA’s objective which is to avoid U.S. tax evasion through increased information reporting. To overcome these restrictions, the Treasury Department, after discussions with some foreign governments, developed two alternative model intergovernmental agreements (IGA), which should lead to an effective and efficient implementation of FATCA, fulfills the objectives of FATCA and further reduces the burdens on FFIs located in partner jurisdictions.

The first Model is the Model 1 IGA, which can be reciprocal or non-reciprocal. FFIs in a partner jurisdiction who signs a Model 1 IGA must comply with the rules to identify and report information about U.S. accounts as set out in the Model 1 IGA. Reporting is done to an authority agreed to in the Model 1 IGA, who will report the information to the IRS on an automatic basis. This will ensure that the IRS receives the same quality and quantity of information about U.S. accounts from FFIs covered by a Model 1 IGA as it receives from FFIs applying these final regulations. A few months after the release of the Model 1 IGA, the IRA released a second model intergovernmental agreement (Model 2 IGA). In contrary to the Model 1 IGA, a partner jurisdiction signing a Model 2 IGA agrees to direct and enable all FFIs that are located in the jurisdiction, and that are not otherwise excepted or exempt pursuant to the Model 2 IGA, to register with the IRS and report directly to the IRS consistent with the FATCA regulations, except as expressly modified by the Model 2 IGA. Both models contemplate a number of simplifications and burden reductions associated with the application of FATCA in the partner jurisdiction if the partners’ jurisdiction fully complies with the agreements. Once the IGA is in place, the partner jurisdiction must implement domestic legislation to enforce the IGA on the FFIs in its jurisdiction. i. FATCA Responsible Officer The FATCA responsible officer (FATCA RO) is a person that must be appointed by each PFFI who will be required to make certain certifications to the IRS. The FATCA RO is expected to be at a sufficiently high level of authority within the PFFI, to confirm and sign off on behalf of the PFFI, on FATCA compliance by the PFFI. Furthermore, the FATCA RO must certify every three years, to the IRS that the PFFI has been FATCA compliant across all operations throughout the certification period. Specifically certify that:


8

The bank’s compliance program meets FATCA’s requirements, i.e., identification, documentation and due diligence of pre-existing accounts1, identification of recalcitrant accounts2, withholding and reporting;

There were no material failures or, if there were material failures3, appropriate actions were taken to remediate and prevent recurrence; and

That the PFFI has not assisted account holders in avoiding FATCA. The first certification will take place, no later than 60 days, after the effective date of the FFI agreement.

III INDEPENDT AUDIT AND COMPLIANCE REVIEW a. Purpose and Goal The FATCA RO can only provide the certification based on a review of the PFFI’s compliance with FATCA. Obviously, the FATCA RO is not in a position to review this by himself and will rely on audits performed by, amongst others, the PFFI’s internal audit department reviews conducted by the compliance department. The audit and review must provide insight to the PFFI’s compliance (or non-compliance) with FATCA and specify any gaps that there may be. Gaps will have to be closed to achieve full compliance with FATCA. Based on the results of the above-mention audit and review, the FATCA RO can certify the PFFI’s compliance with the points mentioned in section II (i) above.

b. What and how to Audit/Review

1. Pre-existing accounts

Pre-existing accounts must be reviewed based on the following indicia specified in the regulation (see also section II (c.): Thresholds FATCA stipulates that only pre-existing accounts with an aggregated balance of $50,000 for accounts held by an individual and $250,000 aggregated balance for accounts held by an entity must be subject to review for identification as U.S. account or non-U.S. account. If the PFFI has identified an account as a U.S. account, the documentation must be made compliant with FATCA. A PFFI may choose to ignore the balance thresholds and identify and documents all U.S. accounts. Enhanced Due Diligence

1 Pre-existing accounts must be made compliant with the FATCA regulation as follows:

High value accounts; within 1 year after the FFI agreement effective date; and

All other accounts; within 2 years after the FFI agreement effective date. 2 Recalcitrant accounts are accounts that belong to an account holder who do not wish to provide the information and/or documentation requested by the PFFI to establish a account’s U.S. or non-U.S. status 3 A material failure is a failure of the participating FFI to fulfill the requirements of the FFI agreement if the failure was the result of a deliberate action by the participating FFI to avoid the requirements of the FFI agreement or was an error attributable to a failure to implement sufficient internal controls.


9

Except for high value accounts (accounts with a (aggregated) balance of $1 million and higher) that are subject to enhanced review, FATCA stipulates that a PFFI may rely on an electronic review solely of all searchable information associated with an account and maintained by the PFFI to determine if there are any of the above described U.S. indicia are applicable to an account. High-value accounts are subject to an enhanced due diligence (EDD) which means that a PFFI must identify accounts to which a relationship manager is assigned and determine whether the relationship manager has actual knowledge that the account holder is a U.S. citizen or resident. Communication to “Potential” Pre-Existing Accounts The PFFI must communicate to its customer that he/she has been identified as a U.S. person or U.S. owned entity based on the above detailed indicia. Simultaneously, request any documentation and/or information required to be FATCA compliant. If the customer does is not a U.S. person, he/she must provide proof to document the same. In order to review compliance with identification of pre-existing customers, the following needs to be done:

• Review based on which criteria the queries were run (e.g., U.S. citizen or resident/ U.S. place of birth/ U.S. address/ U.S. telephone number) and compare with the indicia specified above.

Assess which indicia could not be reviewed through the query and find out how those were tested (e.g. authorized signatories who as U.S. persons/ standing instructions to pay amounts to an account in the U.S.).

Review whether the thresholds were applied, if the PFFI opted to apply these.

Request the files of high value accounts and determine whether enhanced review was conducted by the relationship manager, if applicable.

Review communication sent to the customers and determine whether all customers identified based on the indicia have indeed received a letter.

Review any responses that have been received and review for completeness and correctness.

Review whether changes are made in the PFFIs system(s) where customer information is logged.

2. New Customer Onboarding FATCA requires the PFFI to amend, as of July 1, 2014, its New Customer Onboarding in such a way that the information and documentation required for FATCA compliance is requested at the time of onboarding. In order to review compliance the, following needs to be done:

Review the procedure and forms that are in place as of July 1, 2014 and confirm, at least, if the customer is requested to complete an IRS W-9 form (or other withholding certificate as applicable to the specific entity type) and is requested to provide the PFFI with their specific and unambiguous consent to report his/her information to the IRS as specified in the regulation (if applicable based on domestic legislation on Privacy).

Review a selection (or 100 percent, depending on the total number) of accounts opened by new customers to determine if the information and documents are in line with the New Customer Onboarding requirements.

Review if the information mentioned above (e.g., citizenship; residency; SSN; EIN. GIIN; authorization provided) has been properly logged into the PFFI’s system.


10

4. Non-Participating FFI A PFFI must start withholding on NPFFI customer six months after the FFI agreement effective date. Consequently, the PFFI must determine which FFI customers are not participating by the deadline mentioned above. The NPFFIs must then be flagged as such for withholding purposes. In order to review compliance, the following needs to be done:

• Request and review a query that lists all the FFI customers. • Compare a selection of FFIs that are flagged as “participating” and “non- participating”

to the information received through the IRS website.4 • Determine and document the result of the comparison.

5. Reporting A PFFI must report certain information on its U.S. account holders on an annual basis to the IRS or the “Competent Authority” in the case of a Model 1 IGA jurisdiction. The information that must be reported as specified under section II (b). In order to review compliance, the following needs to be done:

Request a query of the customers (individuals and U.S.-owned entities) that fall under the scope of FATCA as of the end of the year. The query must detail the name, address, account number and account balance as of the end of the year. Unless the PFFI has chosen to report all accounts that belong to a U.S. customer, the balances should be $50,000 for individuals and $250,000 for entity accounts or the equivalent of those amounts in a different currency.

Review the reporting that was submitted to the IRS (or to the Competent Authority, if applicable), choose a sample and compare to the query specified above and determine if the names appear on the reporting and if the information is consistent with the query.

The same process should be applied for reviewing the reporting done on the recalcitrant account holders, NPFFIs and dormant accounts.

6. Withholding Withholding must take place on withholdable payments to recalcitrant account holders and payments made to NPFFIs. Amounts that are withheld must be placed in an account that is opened for that purpose. Once a year, the PFFI must deposit the total amount withheld to an account specified by the IRS. In order to review compliance, the following needs to be done:

• Review a list of all payments received in accounts of recalcitrant account holders and NPFFIs.

• Review if 30 percent of each payment was withheld. • Review the investigation that was performed to determine if the payments were

indeed withholdable payments and conclude if the withholding was legitimate. • Review any amounts transferred to the IRS as being “amounts withheld” and

determine if the amounts withheld by the PFFI and the amount transferred to the IRS are the same.

c. Other Items to be Audited/Reviewed The FATCA RO must also certify, to the best of his knowledge after conducting a reasonable inquiry, that the PFFI did not have any formal or informal practices or procedures in place from

4 http://apps.irs.gov/app/fatcaFfiList/flu.jsf


11

August 6, 2011, through the date of such certification to assist account holders in the avoidance of FATCA requirements. To gain comfort that the PFFI is in compliance with the above requirement, the FATCA RO may request departments responsible for customer onboarding and/or departments that have customer contact and assist with changes to the customer’s due diligence, to confirm that such activities were not practiced since August 6, 2011.

IV CONCLUSION The world has been talking about FATCA for years now. For a long time many were certain that FATCA would not happen. Since the U.S. has started talking about this law, the draft legislation has changed many times and deadlines postponed, but now we know that FATCA is reality and actually happening. Although the majority of the law is now final, there are still certain items that need further guidance and clarification. FATCA is reality and many FFIs find themselves obliged to comply, only to stay in business. In this paper the main obligations and requirements that FATCA stipulates have been discussed. Most importantly how a PFFI can measure its compliance with this law. Unlike most laws and regulations that a financial institution in a regulated environment must comply with, FATCA places an additional burden on the PFFI to ensure the PFFI’s compliance with this complicated and cumbersome U.S. law. The additional burden is that the PFFI must appoint a responsible officer who must make certain certifications to the IRS. The objective of this paper is to set out what is required to enable the FATCA RO to provide the IRS with the certifications. The FATCA RO will have to rely on reviews performed by the Internal Audit department and reviews conducted by the Compliance department. The main areas to be reviewed for compliance are:

Establishment of the pre-existing customer database;

Performing of EDD on specified accounts;

Documenting the pre-existing customer;

Implementing a “New Customer Onboarding” procedure;

Identifying the non-participating FFI in time to ensure timely withholding;

Implementation of procedures and execution of reporting of U.S. accounts; and

Implementation of procedures and execution of withholding on recalcitrant account holders.

In this paper the manner on how to conduct an audit/review on each of the above-mentioned areas. This may vary per FFI since systems, procedures and policies may vary but the thought process should be consistent.


12

Glossary EIN: Employee Identification Number FATCA:

Foreign Account Tax Compliance Act FFI: Foreign Financial Institution FFI agreement: Agreement between the IRS and an FFI that is in effect when an FFI becomes a PFFI FFI agreement effective date: The date that is July 1, 2014 or a later date if the FFI agreement is signed after July 1, 2014 IGA: Intergovernmental Agreement IRS: Internal Revenue Service New customer: A customer that starts a relationship with the PFFI after July 1, 2014 NFFE: Non-Financial Foreign Entity Non-Participating FFI or NPFFI: A Foreign Financial Institution that has not registered to become a Participating FFI and is not domiciled in an IGA jurisdiction Partner jurisdiction: A jurisdiction that signs an IGA with the U.S. PFFI: A Foreign Financial Institution that has not has registered to become a Participating FFI or is not domiciled in a Model 1 IGA jurisdiction Recalcitrant account: An account holder that does not want to or refuses to provide the PFFI with the information and/or documentation that the PFFI needs to determine the account holder’s U.S. or foreign status or that the PFFI needs to report to the IRS or competent authority SSN: Social Security Number U.S.: United States of America Withholdable payments: • Fixed or determinable annual or periodical gains, profits and income (FDAP Income):

payment of interest, dividends, rents, salaries, wages, premiums, annuities, compensations, remunerations, emoluments; and

• Gross proceeds from sale of property that generate interest or dividends from sources within the US.

Resources (1) Website of IRS: http://www.irs.gov/Businesses/Corporations/Foreign-Account-Tax-

Compliance-Act-FATCA (2) Website of U.S. Department of Treasury: http://www.treasury.gov/resource-

center/tax-policy/treaties/Pages/FATCA.aspx (3) Foreign Account Tax Compliance Act on Wikipedia:

http://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance_Act

http://www.irs.gov/Businesses/Corporations/Foreign-Account-Tax-Compliance-Act-FATCA

http://www.irs.gov/Businesses/Corporations/Foreign-Account-Tax-Compliance-Act-FATCA

http://www.treasury.gov/resource-center/tax-policy/treaties/Pages/FATCA.aspx

http://www.treasury.gov/resource-center/tax-policy/treaties/Pages/FATCA.aspx

http://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance_Act

ndependent audit compliance eview of a … · independent audit/ compliance review of a fatca...

Documents