FATCA and CRS in Thailand: A Practical Compliance Guide for Foreign-Owned SMEs

gentlelawlawfirm
Aug 20, 2025
3 min read

GENTLE LAW IBL helps foreign-owned SMEs understand FATCA and CRS in Thailand so you can meet reporting rules, avoid penalties, and keep banking relationships healthy. This guide explains what FATCA and CRS are, who must report, the data you must collect, reporting deadlines, and practical controls you can implement this quarter. Legal bases and official guidance are cited so you can brief management with confidence.

What are FATCA and CRS in Thailand

FATCA is a United States law that requires non-US financial institutions to identify and report US account holders. Thailand and the United States signed a Model 1 intergovernmental agreement and a Competent Authority Arrangement designating the Thai Revenue Department (TRD) as the authority to receive FATCA data in Thailand and exchange it with the IRS.
CRS is the OECD Common Reporting Standard. Thailand implements CRS through the Emergency Decree on Exchange of Information for International Taxation B.E. 2566 (2023), related ministerial regulations, and TRD announcements. TRD’s official CRS guidance sets the reporting framework and timelines.

Who must report under FATCA and CRS in Thailand

Under Thai rules and the CRS framework, Reporting Financial Institutions include banks, custodians, certain investment entities, and specified insurance companies. If you are a non-financial operating company, you are usually out of scope, but you must complete due diligence on counterparties and provide self-certifications when requested by banks. Always align your classification with TRD guidance and the CRS definitions.

What information must be collected

Reporting Financial Institutions must capture and maintain:

Account holder name and address, tax identification number (TIN), and for individuals date and place of birth
Account number, year-end balance or value
Gross amounts such as interest, dividends, and other income paid during the year Follow the TRD schema and due diligence rules in the CRS guidance. For FATCA, identify US indicia and follow TRD instructions consistent with the Competent Authority Arrangement.

FATCA and CRS in Thailand deadlines and process

Data period: calendar year 1 January to 31 December
Report to TRD: by 30 June of the following year via the TRD e-filing channel
TRD exchanges internationally: by 30 September
Pre-report steps: internal due diligence and data readiness from 1 January to 31 March as outlined by TRD guidance These dates are set out in TRD’s CRS guidance timelines.

Penalties and enforcement

TRD notes administrative fines for failure to report and criminal sanctions for intentional false statements or unlawful disclosure of information obtained under the governing law. Build controls to avoid non-compliance and protect customer data.

A practical roadmap for SMEs that bank in Thailand

Map data and counterparties Create a register of accounts you hold with Thai banks, any investment accounts, and counterparties who request FATCA or CRS self-certifications. Align your entity’s classification and confirm controlling persons for look-throughs.
Update onboarding and KYC Use TRD-aligned self-certification forms capturing TINs, place of birth, and tax residency statements.
Clean your master data Validate names, addresses, and TIN formats before June to reduce file rejections at upload.
Document your due diligence Retain screening results and evidence of remediation for at least the minimum period recommended in TRD guidance.
Build a reporting calendar Lock in workback dates for internal sign-off in May so you can file to TRD by 30 June.
Train finance, compliance, and HR Ensure teams can identify reportable accounts and handle data subject queries appropriately.
Align with privacy and security Coordinate with your PDPA program to secure personal data, restrict access, and manage breach response.

Common pitfalls and how to avoid them

Treating FATCA or CRS as “bank only” issues Banks rely on your correct self-certification. Misclassification risks account restrictions.
Missing the 30 June deadline Create internal milestones in Q1 and Q2. Use maker-checker controls for the final file.
Incomplete TIN and birth data Audit legacy records and reach out to customers or controlling persons early.
Improper disclosure of protected data Share data only as permitted under the Emergency Decree and TRD processes.