KYC Privacy and the Common Reporting Standard: Who Sees Your Account Data

KYC is a legal duty, not a privacy choice

Know your customer (KYC) checks are a legal obligation for banks, brokers and crypto exchanges: before they serve you, they must identify you and verify who you are. You meet that obligation with genuine documents. A privacy plan that starts by getting around KYC is not a plan.

Rafael Cintron, who founded Wealthy Expat, sets the same line in the video: no fake apartment contracts, no fake residencies and no invented numbers. Everything you give a bank, a government or an exchange has to be legal and real.

There is a limit on the other side too. In the UK and the EU, the GDPR’s data minimisation principle (opens in a new tab) requires personal data to be “adequate, relevant and limited to what is necessary” for the purpose it is collected for. A firm may ask for what KYC requires; that is not a licence to collect everything.

How the Common Reporting Standard works

The Common Reporting Standard is the OECD’s standard for the automatic exchange of financial account information between tax authorities. The OECD first published it in 2014, and HMRC’s guidance (opens in a new tab) says more than 100 jurisdictions now exchange information under it.

When you open an account, the bank asks for a self-certification: your jurisdictions of tax residence, a tax identification number (TIN) and your date of birth. HMRC’s guidance on self-certification (opens in a new tab) says the bank must confirm that it is reasonable against what it already holds, including the documents collected for KYC. This is where KYC and CRS reporting meet.

Each year, a reporting bank sends its tax authority, for every reportable account, your details and the account’s (opens in a new tab): name, address, jurisdictions of residence, TINs, date of birth, place of birth where required, account number, the balance or value at the end of the year and, depending on the account, the interest, dividends, other income and sale proceeds paid into it. That information is then exchanged with the countries where you are resident for tax.

Your tax residence, not your passport, decides who receives it

CRS reporting follows tax residence. If you are tax resident in two countries, the account is reportable to both, and HMRC’s guidance on residence (opens in a new tab) says that from 1 January 2026 you must declare every jurisdiction where you are tax resident, without relying on a tax treaty’s tie-breaker rule.

A citizenship is not a tax residence. A passport from your second country changes which genuine identity document you can show; it does not change where your account is reported. The United States works the other way: it taxes its citizens on worldwide income wherever they live, and it uses its own system, FATCA, rather than the CRS. Rafael, who is no longer a US citizen, says plainly in the video that a US citizen reports everything.

The OECD has also told banks what to do when a residence or a citizenship comes from an investment program. In its 2022 CRS amendments (opens in a new tab), it repeats that a bank may not rely on a self-certification it knows or has reason to know is incorrect, and that it should take into account the OECD’s information on potentially high-risk citizenship and residence by investment schemes. Second citizenship can be a lawful part of a plan; using it to misstate tax residence is not.

Crypto is moving into the same reporting

The OECD’s Crypto-Asset Reporting Framework (opens in a new tab) (CARF), approved in August 2022 with a set of CRS amendments, provides for the automatic exchange of information on crypto-asset transactions with the jurisdictions where users are tax resident. The amended CRS also brings in certain electronic money products, central bank digital currencies and indirect crypto holdings through derivatives and investment vehicles.

Start dates depend on each country’s law. In the UK, for example, HMRC’s guidance (opens in a new tab) says crypto service providers file their first report between 1 January and 31 May 2027, covering 2026. Plan as though your exchange accounts will be reported like your bank accounts.

Where lawful privacy lives: leaks, not reporting

Reporting to tax authorities is set by law. The risk Rafael describes in the video is a different one: data held by companies reaching people who should never see it. His point is that someone who declares a large crypto holding correctly can, after a leak, become a target precisely because the record is accurate.

The risk is real. In December 2020, Ledger said (opens in a new tab) that about 272,000 detailed customer records from its e-commerce database had been published, including postal addresses, names and telephone numbers. It said the breach had no impact on its hardware wallets or on customers’ funds.

Rafael’s own rule is narrow and lawful: he never has a hardware wallet delivered to his home address. He also notes that a genuine document does not always pass: some providers would not accept his real apartment in Mexico as proof of address because he was logging in from another country. Where a provider asks for your residential address, give it; privacy comes from what you share beyond the requirement, not from changing what the requirement asks.

Before your next account opening

• List every country where you are tax resident, with a TIN for each, and give every institution the same answer.
• Use only documents and addresses you can evidence, and tell each institution when your circumstances change.
• Give what the form requires, and ask why anything beyond it is needed.
• Think about where valuable items are delivered, not only where your accounts are held.
• Ask a tax adviser in each country before you rely on a residence position.

This is general information, not tax or legal advice. If you are weighing where to live and be resident, Build My Strategy sets out the routes that fit your situation.