Tax Evasion Typology Referral

Tax evasion is difficult for a bank because the transaction itself is often ordinary. A salary credit, property purchase, dividend, transfer to an investment company, payment to an adviser or remittance to an overseas account can all be entirely legitimate. The tax risk appears when what the bank observes no longer fits what is known about the customer, the economic purpose of the structure, the disclosed ownership, the expected source of wealth or the explanation given for why money is moving.

The bank therefore does not need to become a tax authority. Its role is to identify facts that may indicate criminal conduct, understand whether those facts create money-laundering or other financial-crime concerns under the law that applies to the bank, and escalate through the appropriate internal and external channels. Whether a particular arrangement breaches tax law is normally a matter for the competent tax authority, investigators, prosecutors and ultimately the courts in the relevant jurisdiction.

That distinction matters. Poor tax understanding can produce two equally damaging outcomes. One is under-reaction, where a relationship is treated as acceptable merely because an accountant, lawyer or wealth adviser is involved. The other is over-reaction, where every offshore company, trust, large transfer, tax-efficient investment or complex family structure is treated as suspicious. A useful control framework asks a narrower question: what evidence supports the customer’s explanation, and what evidence contradicts it?

The global standard and the local-law boundary

FATF includes tax crimes related to direct and indirect taxes within its designated categories of offences. At the same time, FATF explicitly leaves each country to define the relevant offences and the elements that make them serious offences under domestic law. For a global bank, that means there is a common international expectation that serious tax crime belongs inside the financial-crime framework, but there is no single universal definition of criminal tax evasion that can safely be coded into one global rule.

This is why investigators must separate the global risk concept from the local legal conclusion. A bank may observe concealment, false documentation, an unexplained offshore structure or a pattern consistent with undeclared income. Those observations can support suspicion. Whether the conduct is a criminal tax offence, a civil tax issue, an administrative error, aggressive but lawful planning or something else depends on the applicable tax and criminal law.

The OECD’s work on fighting tax crime makes the same practical point from the public-authority side. Effective tax-crime enforcement depends on domestic legal powers, access to information, inter-agency cooperation, international cooperation and attention to professional enablers. Those are government capabilities. A bank contributes evidence and financial intelligence; it does not replace them.

In the United States, for example, the Bank Secrecy Act framework expressly recognises that suspicious activity may signify tax evasion or other criminal activity, but the U.S. filing rules and thresholds are U.S.-specific. In the United Kingdom, the Criminal Finances Act 2017 creates separate corporate offences relating to failure to prevent the criminal facilitation of UK or foreign tax evasion by associated persons in defined circumstances. That is not a global rule and it does not make a bank automatically responsible for a customer’s tax offence. UK government guidance is clear that the corporate offence concerns criminal facilitation by a person acting for or on behalf of the relevant body and provides a reasonable-procedures defence.

A sound global policy therefore uses a group-level taxonomy for tax-crime risk and then overlays jurisdiction-specific rules for suspicious-activity reporting, tax reporting, facilitation offences, confidentiality, legal privilege, data sharing and direct engagement with tax authorities.

Tax evasion, avoidance, error and disagreement are not the same

Tax evasion generally involves deliberate dishonesty or concealment intended to defeat tax that is legally due, but the exact offence and mental element differ by jurisdiction. Tax avoidance generally describes arrangements intended to reduce tax within the law, although anti-avoidance rules can defeat arrangements that formally follow legal steps but fall within specific statutory or judicial anti-abuse provisions. Ordinary error is different again: a customer may misunderstand a filing rule, classify income incorrectly or make an administrative mistake without criminal intent.

Banks should not invent a universal three-column legal test. Instead, investigators should document observable facts. Was information concealed? Was a self-certification inconsistent with other reliable information? Were documents altered or backdated? Did the customer give materially different explanations to different parts of the bank? Is an entity represented as an operating business but unable to show employees, premises, suppliers, customers or decision-making activity? Is a professional adviser asking the bank to ignore information that would normally be required? Those facts are more useful than declaring that a structure is “avoidance” or “evasion” before the legal position is established.

A useful discipline is to distinguish tax motive from criminal evidence. A tax motive is not itself suspicious. Customers routinely choose products, jurisdictions and legal forms partly because of tax consequences. The risk rises when tax motivation is combined with concealment, false statements, sham activity, unexplained ownership, fabricated documents, circular flows or other evidence suggesting that the tax outcome depends on hiding the true facts.

The bank should also preserve uncertainty. An investigation narrative that says “the customer appears to have evaded tax” is weaker than one that says exactly what was observed, what the customer said, what independent evidence was checked, what remains unexplained and why the pattern may be consistent with a tax offence under the relevant jurisdiction’s framework.

Where tax-evasion risk appears in the customer lifecycle

Tax risk can surface at onboarding, during periodic review, through event-driven KYC, in transaction monitoring, through fraud or sanctions investigations, from law-enforcement requests, from adverse information or during tax-transparency due diligence. The strongest cases often emerge from several weak signals becoming meaningful when joined together.

At onboarding, a customer may present an offshore holding company, trust, foundation, partnership or investment vehicle. None is inherently suspicious. The key questions are ownership, control, business purpose, source of wealth, expected activity, tax residence where relevant to the bank’s reporting obligations, and whether the proposed product makes economic sense for the stated purpose.

During the relationship, behaviour may diverge from that baseline. A company described as a passive investment vehicle begins receiving high-volume merchant payments. A customer who declared one country of tax residence begins using addresses, phone numbers, standing instructions or other account information inconsistent with the file. A supposedly dormant holding company starts paying personal expenses. A family trust makes payments that appear unrelated to the documented beneficiary class or stated purpose. These changes justify questions; they do not by themselves prove an offence.

Tax risk also appears at product boundaries. Private banking teams may see wealth structures. Trade-finance teams see invoices and shipping documents. Securities businesses see corporate actions and withholding processes. Payments teams see only limited party, amount, account and remittance information. A good control framework does not pretend every part of the bank has the same visibility.

Offshore structures: test substance, do not criminalise geography

Offshore structures have legitimate uses, including investment pooling, cross-border financing, succession planning, asset holding and access to markets. The location of incorporation is therefore only one risk factor. The stronger analytical question is whether the structure has a credible purpose and whether the facts support that explanation.

For an operating entity, investigators may look for staff, payroll, premises, management activity, customers, suppliers, contracts, licences, tax registrations where relevant and decision-making that is consistent with the stated business. For an investment holding company, the expected evidence is different: it may have few employees but should still have understandable ownership, governance, assets, funding and a reason for existing. A family trust will have yet another evidence pattern.

This is why “substance” must be interpreted according to entity type. An absence of employees is meaningful for a manufacturing company but not automatically suspicious for a special-purpose vehicle. A registered-office address shared with many companies can indicate a corporate-service provider rather than wrongdoing. The risk rises when several facts conflict: unclear ownership, no credible purpose, contradictory explanations, nominee relationships that cannot be explained, unexpected flows and resistance to reasonable verification.

Beneficial-ownership information should be effective-dated and evidence-linked. An investigator reviewing a payment made six months earlier may need to know who owned or controlled the entity at that time, not merely the current registry entry. Where ownership cannot be resolved to the level required by law and policy, the outcome may be enhanced due diligence, restriction, refusal to onboard or exit, depending on the jurisdiction, product and risk appetite. It should not be disguised as a tax conviction.

Undeclared income and the importance of an explainable gap

One common tax-crime pattern is economic activity that appears materially larger than the income or business activity known to the bank. That can arise from deliberate under-declaration, but it can also arise from inheritance, gifts, accumulated savings, asset sales, inter-company transfers, loans, foreign income, one-off business events or simply incomplete customer data.

The correct approach is therefore to quantify the gap and test explanations. If a customer with modest declared employment income receives a large credit, the investigation should establish the payer, purpose, source, supporting documents and relationship between the parties. If the money comes from the sale of a property acquired years earlier, that may explain the bank flow even though the tax treatment of the gain remains outside the bank’s competence.

For businesses, a mismatch may appear between known business activity and account turnover. A customer registered as a small consultancy may suddenly receive retail-like volumes from hundreds of individuals. A cash-intensive business may deposit amounts inconsistent with the scale of the premises or stated operating model. Again, those facts can support further review but must be tested against seasonality, new contracts, business expansion and other legitimate explanations.

Digital-platform income adds another layer. Marketplace sellers, creators, gig workers and small online businesses can receive income from many sources that do not resemble traditional payroll. Banks should avoid assuming that platform activity is undeclared. The useful signal is inconsistency between the customer profile, observed account activity and information the bank is lawfully entitled to use.

Trade mispricing: useful indicator, difficult conclusion

Trade can be used to transfer value, evade customs duties or taxes, disguise proceeds or support other offences. Over-invoicing, under-invoicing, multiple invoicing, false descriptions and phantom shipments are well-known trade-abuse methods. Yet price variance is common in legitimate trade because quality, quantity, delivery terms, freight, insurance, contractual timing, related-party arrangements and market conditions affect price.

A bank should therefore treat price anomalies as investigative leads rather than proof. Trade-finance teams can compare invoices with contracts, transport documents, customer history and, where available, reliable market information. They should ask whether the customer’s business model explains the goods, counterparty, route and price. Where a bank has access to customs or other official information under a lawful mechanism, that can strengthen the assessment. Most transaction-monitoring teams do not have direct access to another country’s customs declarations and should not design controls on the assumption that they do.

Transfer pricing also requires care. Legitimate multinational groups price transactions between related entities under complex tax rules. A bank is not normally equipped to determine whether a transfer-pricing methodology satisfies an arm’s-length standard. What it can identify is a pattern that lacks economic coherence, involves false documents, contradicts the customer’s own description or appears designed to move value without a credible business purpose.

Professional enablers: do not outsource judgement to the adviser

OECD work on professional enablers highlights how lawyers, accountants, financial institutions and other intermediaries can be misused to design or facilitate tax and other white-collar crime. The presence of a reputable adviser can therefore reduce some risks while increasing the need to understand others. It should never substitute for the bank’s own due diligence.

Portfolio-level analysis can be valuable. If many apparently unrelated customers use the same formation agent, nominee, address, payment narrative or structure, the common adviser may be relevant to the risk assessment. But the bank should avoid language such as “the adviser proves evasion.” A template may be a normal professional product. The important question is whether the repeated pattern is combined with concealment, false statements, unexplained flows or other evidence of criminal facilitation.

Legal privilege and professional secrecy also require jurisdiction-specific handling. A bank should not assume that every document involving a lawyer is privileged, nor that privilege can simply be disregarded. When a request touches privileged material, investigators should follow the bank’s legal process and applicable local law rather than make their own universal privilege determination.

For UK-connected businesses, the corporate offences concerning failure to prevent criminal facilitation of tax evasion are an additional control consideration. The practical control themes in the government guidance are risk assessment, proportionate prevention procedures, top-level commitment, due diligence, communication and training, and monitoring and review. Those principles are useful operationally, but the offence itself should always be presented as UK law with specific jurisdictional and factual requirements.

Trusts, foundations and family structures

Trusts and foundations divide legal ownership, control, fiduciary responsibility and economic benefit in ways that can be legitimate but difficult to understand. Tax-evasion risk rises where the bank cannot identify the relevant parties required by KYC rules, where distributions conflict with the stated purpose, where instructions appear to come from an undisclosed controller, or where the structure is used to disguise the person who actually benefits.

Investigators should avoid making assumptions about succession or estate planning. Tax treatment differs widely across jurisdictions. A distribution that is taxable in one country may not be treated the same way in another. The bank’s role is to understand the arrangement, document the parties and purpose, identify unexplained behaviour and escalate suspicious facts under the applicable AML framework.

Authority records should also be interpreted carefully. A power of attorney, trustee mandate or protector role may explain why someone can give instructions, but authority to operate an account is not the same as beneficial ownership and not necessarily the same as entitlement to take value for oneself. Systems should preserve these relationship types separately.

Real estate and high-value assets

Property is relevant because it can absorb large amounts of wealth, support lending and generate rental flows, but a property purchase is not automatically a laundering or tax-evasion event. Useful questions include source of funds, source of wealth, ownership structure, relationship between buyer and seller, financing, unusual third-party payments and major inconsistencies between stated price and reliable valuation information available to the bank.

Under-declared sale values, undisclosed side payments or false loan arrangements can form part of tax or fraud schemes in some jurisdictions. The investigation should record the payment evidence rather than infer the tax result. Mortgage information can also provide useful corroboration because the customer may have supplied income or asset information during underwriting that differs materially from what appears elsewhere in the relationship.

High-value goods and investments create similar questions. The control objective is not to police lifestyle. It is to understand whether the movement of value is consistent with the customer profile and whether unexplained discrepancies create a reportable suspicion.

Crypto-assets: tax transparency is changing quickly

Crypto-assets can complicate tax visibility because value can move through custodial and non-custodial arrangements, across borders and between crypto-assets without using a traditional bank at every stage. A bank may see fiat on-ramps and off-ramps, payments to service providers or incoming proceeds from exchanges, but it usually does not see the customer’s complete on-chain activity unless it has lawful access to appropriate analytics or additional information.

The regulatory landscape is also changing. The OECD’s Crypto-Asset Reporting Framework, together with amendments to the Common Reporting Standard, is intended to expand automatic tax-information exchange. The OECD’s current implementation material anticipates first exchanges under CARF and the amended CRS beginning from 2027 for participating jurisdictions, subject to their domestic implementation timelines. That is a tax-transparency framework, not an instruction for banks to treat every crypto transaction as suspicious.

In the European Union, DAC8 applies from 1 January 2026 and expands administrative cooperation to crypto-asset information. Reporting Crypto-Asset Service Providers collect defined information and report under the directive’s framework, with exchanges for the first 2026 reporting year occurring in 2027. These are EU-specific obligations and should not be applied globally.

A bank investigation may consider whether observed crypto flows fit the customer’s profile, whether counterparties are identifiable, whether the customer gives a coherent source-of-funds explanation and whether there are separate fraud, sanctions or money-laundering concerns. Privacy-enhancing tools or unhosted wallets can increase investigative complexity, but their use does not by itself establish tax evasion.

CRS and FATCA: what the bank actually does

The Common Reporting Standard is often misunderstood in financial-crime discussions. The CRS calls on participating jurisdictions to obtain defined financial-account information from Reporting Financial Institutions and automatically exchange that information with other participating jurisdictions. The Reporting Financial Institution performs due diligence and reports to its domestic tax authority under local implementing law. The international exchange is principally between competent authorities.

That means a bank should not design a process on the assumption that it will receive another country’s CRS data back into its AML case-management system. In most operating models it will not. Tax authorities may use exchanged information for their own compliance and enforcement work and may share intelligence with other authorities where the relevant legal framework permits.

The 2025 consolidated CRS text incorporates amendments expanding scope to certain electronic-money products and central bank digital currencies and strengthening due-diligence and reporting requirements. Implementation timing still depends on participating jurisdictions. The Global Forum has indicated that 2027 is the commonly expected first exchange year under the amended CRS, with some jurisdictions using transitional periods.

FATCA is separate. It is a U.S. statutory framework. The IRS explains that FATCA generally requires foreign financial institutions and certain other foreign entities to report specified information concerning U.S. account holders or face withholding consequences on certain payments, subject to the detailed rules and intergovernmental arrangements. A global bank needs a clear system boundary between FATCA, CRS, AML/KYC and local tax reporting even where some customer data is reused across them.

Self-certification and residence inconsistencies

CRS due diligence can create useful control signals because a financial institution must evaluate self-certifications under the applicable rules. A discrepancy does not automatically prove evasion. Customers move countries, retain old phone numbers, use correspondence addresses, hold multiple residences or make data-entry errors.

The correct workflow is to identify the inconsistency, apply the due-diligence procedures required by local CRS implementation, obtain a valid cure or updated self-certification where appropriate, preserve the evidence and separately assess whether the facts create AML suspicion. Tax-reporting remediation and AML investigation should communicate, but they should not be collapsed into one decision.

Behavioural data such as card usage, device location or transaction geography may be relevant to AML investigation where lawfully collected and appropriately governed. It should not automatically be treated as a tax-residence determination engine. Tax residence is a legal concept and the CRS contains its own due-diligence rules.

From alert to investigation

A good tax-evasion alert should begin with a hypothesis, not a conclusion. Examples include “observed business turnover materially exceeds the expected profile”, “ownership and purpose of the offshore entity remain unexplained”, or “customer-provided tax-residence information conflicts with documents held by the bank”. The case should then gather evidence that could both support and disprove the hypothesis.

Investigators should reconstruct the relevant timeline, identify the parties, trace key flows, compare activity with KYC and product records, review prior explanations and determine which external information can lawfully be used. They should record reasonable alternatives. A large offshore transfer may be an inheritance. A tax-residence inconsistency may reflect a recent move. An unusually low invoice may reflect damaged goods or a long-term contract.

The outcome should be evidence-based: clear the concern with a documented explanation; refresh KYC; request enhanced evidence; place the relationship into enhanced monitoring; refer internally to tax, legal, fraud or specialist financial-crime teams; restrict or exit where policy and law support it; and assess suspicious-activity reporting under the relevant jurisdiction’s rules.

A bank should not tell a customer that an STR or SAR has been filed where tipping-off restrictions apply. It should also avoid using “tax authority referral” as a generic global disposition. In some jurisdictions the appropriate external route is an FIU suspicious-transaction report; in others additional direct tax-reporting or self-reporting mechanisms may exist. The route must be mapped to the legal entity and jurisdiction.

Data and system touchpoints

Tax-evasion investigations often fail because relevant data exists but cannot be joined. The customer master contains legal name, addresses, tax identifiers and residency data. KYC systems hold beneficial ownership, source of wealth and expected activity. Payments systems hold counterparties and references. Securities platforms hold corporate-action and investment activity. Trade systems hold invoices and shipment documents. Tax-reporting systems hold CRS or FATCA classifications and self-certifications. Case systems hold previous investigations and customer explanations.

The architecture should preserve provenance. An analyst needs to know whether an address came from customer declaration, independent verification, a payment message or a third-party database. The same applies to tax residence, beneficial ownership and source-of-wealth data. Derived fields should not overwrite source evidence.

Effective dates matter. A customer’s residence, ownership, directorship, account mandate and business activity can change. Historical reconstruction is essential because an investigation must evaluate facts as they existed when the transaction occurred.

Access also needs governance. Tax information can be sensitive and may be subject to specific statutory restrictions. Data should not be made broadly available to AML teams merely because it would be analytically useful. Legal basis, purpose limitation, access control, retention and audit logging need to be designed explicitly.

Control design across the bank

A practical operating model uses several control layers rather than one “tax evasion rule”. Onboarding establishes identity, ownership, expected activity and reporting classifications. Tax-reporting controls validate CRS or FATCA data under their own rules. Transaction monitoring detects unusual movement. Relationship review tests whether the customer story still makes sense. Investigation joins the evidence. Governance decides reporting, restriction, exit and remediation.

Scenario design should favour discrepancies and networks over simplistic country rules. Examples include unexplained commercial receipts into a personal account, rapid movement through entities without an evident purpose, business turnover materially inconsistent with known activity, unexplained payments to or from an entity whose ownership cannot be established, or repeated structures linked to the same professional intermediary combined with other risk indicators.

Country risk can inform prioritisation but should not substitute for evidence. A jurisdiction associated with secrecy or low taxation can host legitimate business. Conversely, tax evasion can occur entirely domestically.

Controls should also be proportionate to visibility. A payments bank may know little about underlying goods. A trade bank may hold invoices and bills of lading. A private bank may know detailed source-of-wealth information. Expectations should reflect the data each business actually possesses and can lawfully use.

Governance and decision rights

First-line business teams own customer and transaction decisions within policy. Financial-crime teams provide specialist investigation and control expertise. Tax teams own CRS, FATCA and other tax-reporting interpretation. Legal teams advise on privilege, disclosure, information sharing and jurisdiction-specific offences. Data and technology teams maintain lineage and control operation. Internal audit provides independent assurance.

The governance model should define who can make each decision. Who invalidates a self-certification? Who decides that a tax-reporting error needs remediation? Who determines whether a financial-crime case meets the local STR/SAR threshold? Who approves exit? Who contacts a competent authority where direct contact is legally available? Ambiguity in these roles creates both missed reporting and unnecessary customer harm.

Management information should focus on control quality rather than raw alert volumes. Useful measures include ageing of unresolved cases, repeat KYC discrepancies, quality-review findings, unresolved ownership gaps, reporting timeliness, data-quality defects and remediation completion. A high number of tax-related alerts is not evidence of strong detection if most are poorly targeted.

BA, architecture and testing considerations

For a business analyst, the first requirement is traceability from legal or policy obligation to data element, rule, workflow, decision and evidence. “Detect tax evasion” is not a testable requirement. “Identify material unexplained divergence between expected business activity and observed credits, route it to enhanced review, preserve the triggering transactions and allow documented legitimate explanations” is testable.

Data requirements should state source, owner, refresh frequency, effective date, confidence and permissible use. If tax-residence data comes from a self-certification, the system should not silently relabel it as “verified residence”. If ownership comes from a registry, the record should retain the registry date and whether independent verification occurred.

Positive tests should prove that meaningful patterns trigger review: a company with no credible operating footprint receiving high-volume third-party funds; a personal account showing business-like turnover inconsistent with KYC; or repeated complex structures linked to the same intermediary plus inconsistent ownership information.

Negative tests are equally important. A genuine holding company with transparent ownership and a documented investment purpose should not fail simply because it has no employees. A customer who relocates and updates tax residence should not be treated as evasive because historical addresses differ. A legitimate inheritance should explain a temporary lifestyle-income gap when source documentation is credible.

Failure-mode tests should cover unavailable registries, delayed tax-reporting feeds, duplicate alerts, stale customer data and incomplete cross-border payment information. The system should fail visibly and route uncertainty for review rather than convert missing data into a negative finding.

Mini case study: an offshore investment company that no longer fits the story

A private-banking customer has held investments through an overseas company for several years. The structure was originally documented as a family investment vehicle. Ownership was transparent, funding came from a verified business sale and activity consisted mainly of investments and distributions. Nothing about the structure itself created a criminal conclusion.

Two years later, the bank observes a change. The company begins receiving frequent payments from unrelated trading businesses in several countries. Funds are moved quickly into the customer’s personal accounts and used for property purchases. The KYC file contains no explanation for commercial trading activity. The customer says the payments are “investment returns” but cannot identify the underlying investments. A long-standing adviser provides a short letter confirming that the arrangements are “tax compliant” without explaining the counterparties or economic activity.

The investigation does not ask the bank to calculate tax. It asks whether the activity is credible. The analyst traces the payments, identifies common counterparties, checks corporate records available to the bank, reviews the source-of-wealth history and asks for evidence of the investments supposedly producing the returns. The payments appear to originate from operating companies connected to the customer’s wider business network rather than investment funds.

The customer then provides invoices describing consulting services, which conflicts with the earlier “investment returns” explanation. Several invoices are dated after the corresponding payments. This changes the case. The concern is no longer simply that an offshore company exists; it is that the purpose, documents and explanations are inconsistent.

The bank refreshes KYC, escalates to specialist financial-crime and legal teams and evaluates suspicious-activity reporting under the law applicable to the booking entity. The tax team separately considers whether any CRS or FATCA classification or reporting data needs correction. If the jurisdiction provides a lawful direct tax-authority mechanism relevant to the facts, that is handled through the designated function rather than improvised by the investigator.

The case demonstrates the core lesson: the strongest tax-evasion cases are built from contradictions that can be evidenced, not assumptions about wealth, geography or complexity.

Common failure modes

The first failure is treating offshore geography as guilt. This produces unfair customer outcomes and weak intelligence. The second is accepting professional-adviser involvement as proof of legitimacy. Banks remain responsible for their own controls.

The third is confusing tax-transparency reporting with AML investigation. CRS and FATCA have their own due-diligence and reporting frameworks. AML teams may use relevant bank-held facts where lawful, but a tax-reporting discrepancy is not automatically a suspicious-transaction conclusion.

The fourth is assuming access to government data the bank does not actually receive. International CRS exchange occurs between competent authorities. Customs and tax-return data are not ordinary transaction-monitoring inputs for most banks.

The fifth is using legal language too early. Words such as “fraud”, “evasion”, “sham”, “illegal” and “privileged” can imply determinations the investigator is not authorised to make. Case narratives should distinguish observed fact, customer explanation, bank analysis and legal conclusion.

The final failure is poor evidence lineage. If the case cannot show where a fact came from, when it was true and what the analyst did with it, the conclusion becomes difficult to defend to quality assurance, audit, supervisors or authorities.

Key takeaways

Tax crime belongs inside financial-crime risk, but the underlying offences are defined by domestic law. Banks should detect and document indicators, not pretend to be tax courts. Offshore structures, trusts, professional advisers, trade, real estate and crypto-assets can all be legitimate; risk emerges from concealment, false information, unexplained ownership, inconsistent purpose and other evidence that does not fit the customer story.

CRS, FATCA and CARF are tax-transparency frameworks with distinct scope and implementation rules. They should connect to AML controls through governed data and escalation, not be merged into one universal “tax crime” process. Strong investigations quantify discrepancies, test innocent explanations, preserve data lineage and route suspicion through the external reporting channel that actually applies to the bank’s legal entity.

References and further reading

• Financial Action Task Force, FATF Glossary: designated categories of offences: https://www.fatf-gafi.org/en/pages/fatf-glossary.html
• Financial Action Task Force, FATF Recommendations: https://www.fatf-gafi.org/en/topics/fatf-recommendations.html
• OECD, Fighting Tax Crime: The Ten Global Principles, Second Edition: https://www.oecd.org/en/publications/2021/06/fighting-tax-crime-the-ten-global-principles-second-edition_1f0b22cf.html
• OECD, Ending the Shell Game: Cracking down on the Professionals who enable Tax and White Collar Crimes: https://www.oecd.org/en/publications/2021/02/ending-the-shell-game_79ff90e4.html
• OECD, International standards on tax transparency: https://www.oecd.org/en/topics/international-standards-on-tax-transparency.html
• OECD, Consolidated text of the Common Reporting Standard (2025): https://www.oecd.org/en/publications/consolidated-text-of-the-common-reporting-standard-2025_055664b1-en.html
• OECD, Crypto-Asset Reporting Framework and amended CRS implementation material: https://www.oecd.org/en/about/news/announcements/2025/07/oecd-releases-data-exchange-formats-for-the-global-minimum-tax-and-crypto-reporting-and-issues-updated-faqs.html
• OECD Global Forum, Implementation of the amended Common Reporting Standard, March 2026: https://www.oecd.org/en/networks/global-forum-tax-transparency/news-events/2026/global-forum-secretariat-holds-virtual-event-on-implementation-of-the-amended-common-reporting-standard.html
• Internal Revenue Service, Foreign Account Tax Compliance Act (FATCA): https://www.irs.gov/businesses/corporations/foreign-account-tax-compliance-act-fatca
• FinCEN, The Bank Secrecy Act: https://www.fincen.gov/resources/statutes-and-regulations/bank-secrecy-act
• HM Revenue & Customs, Corporate offences for failing to prevent criminal facilitation of tax evasion: https://www.gov.uk/government/publications/corporate-offences-for-failing-to-prevent-criminal-facilitation-of-tax-evasion
• HM Revenue & Customs, Banking Manual BKM509500, updated 9 February 2026: https://www.gov.uk/hmrc-internal-manuals/banking-manual/bkm509500
• European Commission, DAC8: tax transparency for crypto-assets: https://taxation-customs.ec.europa.eu/taxation/tax-transparency-cooperation/administrative-co-operation-and-mutual-assistance/directive-administrative-cooperation-dac/dac8_en

Operational deep dive: tax-transparency data, trade analysis and ownership evidence

The base chapter establishes the central discipline for tax-evasion work: the bank investigates contradictions and suspicious facts without pretending to determine tax liability. This deep dive focuses on three areas where technical misunderstandings regularly damage control design: CRS self-certification, trade-value analysis and beneficial-ownership tracing.

CRS is a due-diligence and reporting framework, not an AML verdict engine

Under the Common Reporting Standard, Reporting Financial Institutions apply due-diligence procedures and report defined financial-account information to the tax authority in the jurisdiction where the reporting obligation sits. Participating tax authorities then exchange the information with each other under the applicable international arrangements. This distinction is fundamental for architecture: the bank is a reporting institution, while the cross-border exchange is principally a competent-authority process.

A financial institution should therefore build its CRS controls around the rules implemented in its jurisdiction. The process normally needs account classification, identification of the account holder and relevant controlling persons, collection and validation of self-certification where required, identification of reportable jurisdictions, report production, correction handling, evidence retention and governance of exceptions.

The 2025 consolidated CRS text reflects amendments intended to strengthen due diligence and reporting and to extend the standard to additional digital financial products. The Global Forum has indicated that 2027 is the commonly expected first exchange year for the amended CRS, while some jurisdictions use permitted transitional periods. System requirements must therefore be driven by the actual domestic implementation date rather than a global date hard-coded across all legal entities.

What a self-certification inconsistency means

A self-certification is not reliable merely because a customer signed it. The CRS includes reasonableness requirements and follow-up procedures where information held by the institution conflicts with the certification. But an inconsistency still needs investigation rather than automatic accusation.

Consider a customer who declares tax residence in Country A while the bank holds a residential address in Country B. That may reflect an outdated address, a temporary assignment, multiple residences or a genuine reporting issue. The correct workflow is to identify the conflicting data, apply the due-diligence procedure required by the bank's local implementation, obtain documentary evidence or a replacement certification where necessary and retain the decision trail.

AML escalation is a separate question. If the customer changes the story repeatedly, provides altered documents, asks staff to suppress reportable information or routes funds through structures that appear designed to conceal the true account holder, the same facts may create financial-crime suspicion. The CRS exception workflow and the AML case should be able to exchange permitted information while retaining separate decision states.

Behavioural data can support an AML hypothesis but should not silently redefine tax residence. Card use, device location and transaction geography may show where a customer spends time; tax residence is a legal concept that depends on the law of the relevant jurisdiction and any applicable treaty rules. A system field called tax_residence_verified should therefore have a clear source and validation method rather than being inferred from behavioural analytics.

CARF and the amended CRS

Crypto-assets created a transparency gap because many arrangements sit outside traditional financial accounts. The OECD's Crypto-Asset Reporting Framework addresses defined crypto-asset transactions, while the amended CRS addresses changes within financial-account reporting, including interaction with crypto-related financial products. The two frameworks are related but not interchangeable.

The OECD released updated technical material and FAQs in 2025. First exchanges under CARF and the amended CRS are expected to begin from 2027 for jurisdictions implementing on that timetable. The European Union's DAC8 applies from 1 January 2026 and provides its own legal implementation for crypto-asset reporting and exchange, with first exchanges concerning the 2026 reporting period occurring in 2027.

For delivery teams, the lesson is to model effective date, legal entity, customer scope, product scope, reportable transaction or account type, jurisdiction and reporting authority explicitly. A single Boolean called CARF_customer or CRS_customer cannot safely express the full obligation.

Trade-value analysis without false precision

Trade mispricing is relevant to tax crime, customs fraud, capital flight, money laundering and other offences, but a bank rarely has enough information to decide from invoice price alone that value is false. Goods differ by grade, quantity, Incoterms, insurance, freight, timing, warranty and negotiated commercial terms. Services and intellectual-property charges can be even harder to benchmark.

The first control layer is therefore internal coherence. Does the product fit the customer's business? Does the counterparty make sense? Does the quantity match the financing? Do transport documents, invoice, purchase order and payment instruction tell the same story? Are there unexplained amendments after financing approval? Is one shipment apparently financed more than once?

Where the bank has reliable external price information, it can use it as a reasonableness indicator. Commodity prices may provide a useful range for standardised goods. Specialist valuation may be needed for equipment or bespoke products. Statistical trade data can support strategic analysis but should not be treated as a transaction-level truth source without understanding classification, timing and coverage limitations.

Mirror statistics: useful for hypothesis generation

Mirror statistics compare one jurisdiction's recorded exports with another jurisdiction's recorded imports. Differences can be informative, but they arise for many legitimate reasons: timing, freight and insurance treatment, re-exports, valuation methodology, classification differences, reporting thresholds and data quality. A large difference is therefore a lead for analysis, not proof of invoice manipulation.

For a bank, access is another constraint. Most banks do not receive transaction-level customs declarations from both sides of a trade. A specialist public-sector unit, FIU, customs authority or tax authority may have much better data. Bank controls should not promise a comparison they cannot actually perform.

Where external data is available lawfully, the design should record the source, reference period, product classification, currency conversion method and confidence limitations. Investigators then compare the external signal with bank-held evidence such as invoices, financing documents, customer history and payment flows.

Multiple invoicing and cross-bank blind spots

A different trade risk arises when the same invoice or shipment is presented to more than one financial institution. A single bank may not know that another bank has already financed the document. Internal duplicate detection can still identify repeated invoice numbers, identical amounts, reused shipping documents or suspicious amendment patterns within the institution.

Cross-bank detection requires a lawful information-sharing mechanism, industry utility or authority involvement. Architecture documentation should distinguish an internal capability from a future ecosystem dependency. Requirements that say “check whether another bank financed this shipment” are not implementable unless the data-sharing route actually exists.

Beneficial-ownership tracing through layers

Tax-evasion schemes may use layered entities, but layered ownership is also common in legitimate groups. The objective is to identify the natural persons or other parties required under the applicable KYC and beneficial-ownership rules and to understand who controls the arrangement.

The data model should capture each relationship separately: shareholder, percentage ownership where relevant, voting rights, control through other means, trustee, settlor, protector, beneficiary, general partner, director and authorised signatory. Relationships should be effective-dated and linked to evidence. This prevents a common error where an account mandate is mistaken for ownership or a current shareholder is incorrectly projected backwards into historical activity.

Registry information is one source, not absolute truth. Some registers are verified more strongly than others; some contain self-reported data; some are not public. A bank should record what it checked and how reliable the source is. Unresolved ownership should be treated as an evidence problem subject to policy, not automatically as tax evasion.

Circular ownership and indirect control can require graph analysis. Systems should be able to identify repeated entities and calculate indirect ownership where policy requires it, while allowing human review for control rights that percentages do not capture. The investigation should preserve the actual chain rather than flatten it into a single “UBO” field with no evidence of how the conclusion was reached.

Information exchange on request belongs to competent authorities

The OECD tax-transparency framework also includes exchange of information on request. This is an authority-to-authority mechanism under legal instruments such as tax treaties and information-exchange agreements. A bank may be compelled or authorised under domestic law to provide information to its tax authority, but it does not normally send an international exchange request itself.

This matters for training. Phrases such as “the bank requests foreign tax records” or “the bank receives partner-country CRS files” create a false operating model. The bank's role is usually to retain accurate customer and account information, meet domestic reporting or production requirements and respond lawfully to competent-authority requests.

Professional enabler networks and portfolio analytics

A bank can add value by identifying common intermediaries across relationships. If many customers use the same adviser, formation agent, registered address or nominee, network analysis can show a repeated pattern that a single-customer investigation would miss. That is a risk signal, not proof of facilitation.

The analysis becomes stronger when the common intermediary is combined with other facts: false documents, concealed ownership, inconsistent customer explanations, unexplained circular flows or structures that cannot be reconciled with the stated purpose. The case should show the network and the contradictory evidence rather than infer criminality from profession or association.

OECD work on professional enablers supports the need for governments to address intermediaries that enable tax and white-collar crime. Banks can contribute transaction intelligence and relationship evidence, but enforcement against an adviser remains a matter for the competent authorities under the applicable law.

Data-quality controls that matter

Tax-related investigations depend heavily on identifiers. Names, dates of birth, tax identification numbers, addresses, entity registration numbers and account numbers need consistent storage and lineage. A mismatch caused by transliteration or formatting can look like concealment if entity resolution is weak.

Controls should distinguish missing, invalid, expired and contradicted information. “No TIN” is not the same as “TIN supplied but failed format validation”; “address changed” is not the same as “customer refused to explain conflicting residence information”. These distinctions improve both tax reporting and AML triage.

The strongest architecture also preserves correction history. If a CRS report is corrected, investigators need to know what changed and why. If beneficial ownership is updated, historical cases need the previous state. If a self-certification is replaced, the old certification should remain available according to retention policy rather than disappear from the record.

Operational takeaway

Tax-evasion controls become reliable when they respect institutional boundaries. Reporting Financial Institutions perform due diligence and domestic reporting; competent authorities exchange CRS information; tax authorities determine tax liability; AML teams investigate suspicious facts; FIUs and other competent authorities receive information through the channels created by local law.

The bank's advantage is not tax adjudication. It is the ability to connect identity, ownership, product, payment and historical relationship information into a coherent evidence trail. When the system preserves those facts accurately, a tax authority or FIU can do far more with the resulting intelligence than it can with an unsupported statement that an account “looks offshore” or a trade price “looks wrong”.

Advanced practice: facilitation risk, escalation design and control governance

Tax-evasion risk becomes difficult when the bank is not merely observing a suspicious customer but may itself be providing products, staff activity or operational processes that could facilitate concealment. This supplement focuses on how a bank controls that risk without turning ordinary tax planning into presumed criminal conduct.

Facilitation risk begins with conduct, not customer tax outcomes

The bank should distinguish three questions. First, is the customer activity suspicious? Second, is a bank employee, agent or other service provider knowingly helping the customer conceal facts or defeat a legal obligation? Third, does a jurisdiction-specific corporate offence or regulatory obligation attach to that conduct?

Those questions should not be collapsed. A customer can commit a tax offence without any bank employee criminally facilitating it. An employee can breach internal policy without committing a criminal facilitation offence. A bank can also have a weak control environment even where no offence has yet been established.

The United Kingdom offers a useful example because Part 3 of the Criminal Finances Act 2017 creates corporate offences for failure to prevent criminal facilitation of tax evasion by associated persons in defined circumstances. UK government guidance emphasises risk assessment, proportionate prevention procedures, top-level commitment, due diligence, communication and training, and monitoring and review. The law is deliberately jurisdiction-specific and should be configured as such in a global bank.

For a group control framework, those themes can still be useful beyond the UK as good governance ideas: know where facilitation risk can arise, define prohibited conduct, train staff, create escalation channels and test whether controls operate. But the legal label must not be exported to entities outside its scope.

Staff incentives and escalation safety

Commercial incentives can create weak controls even without deliberate wrongdoing. A relationship manager whose performance depends entirely on assets gathered or revenue generated may see enhanced due diligence as a threat to customer retention. A trade desk may resist document review because it slows turnaround. A private-banking team may over-rely on advisers introduced by important clients.

A mature control environment makes escalation part of expected performance. Staff should be able to pause an onboarding decision, request additional evidence or refer a concern without being treated as commercially obstructive. Management should review situations where control concerns were overridden and ensure the rationale and decision owner are visible.

This does not require paying staff for filing more suspicious reports. Raw escalation counts can create the opposite problem: low-quality defensive reporting. Better measures include quality-review results, timeliness, completeness of evidence, repeat control failures and whether material concerns reached the correct decision forum.

Professional-enabler network risk

A bank may find that many customers are connected to the same tax adviser, lawyer, accountant, company-formation agent, wealth manager or corporate-service provider. Network analysis can reveal common addresses, nominees, payment beneficiaries, structures and introduction channels.

The common link should be treated as a hypothesis. An adviser with many clients will naturally appear across many legitimate relationships. The analysis becomes meaningful when repeated structural features are accompanied by customer-specific evidence of concealment, false statements, unexplained flows or inconsistent beneficial ownership.

A practical workflow is to identify the common intermediary, map linked customers, compare the structures, review whether the same risk indicators recur and decide whether specialist investigation is warranted. The case should preserve both positive and negative evidence. If most linked customers are transparent and economically coherent, that may weaken an allegation that the adviser is systematically facilitating crime.

OECD guidance on professional enablers is aimed principally at governments and tax-crime enforcement. Banks can use it to understand the threat pattern, but should still apply their own legal obligations and reporting thresholds rather than treat the OECD material as a direct private-sector rulebook.

Boundary cases need a specialist forum

The hardest tax-related cases are not obvious false invoices or hidden cash. They are arrangements that may be aggressive, unusual or heavily tax-driven but are supported by professional advice and formal legal documents. Reviewers can easily polarise: one sees sophistication and assumes legitimacy; another sees complexity and assumes evasion.

A specialist case forum can improve consistency. It may include financial crime, tax, legal, product and relationship representatives. The forum should review the facts, not vote on whether the customer is “good” or “bad”. The output should identify what is known, what remains unexplained, which jurisdictional rules matter and what action is permitted.

The forum should also protect suspicious-report confidentiality. People who do not need to know whether an STR or SAR is being considered should not receive that information merely because they participate in a commercial decision. Case-management design must separate need-to-know reporting information from wider KYC or relationship-risk information.

Transparency data should not be imagined into existence

A recurring architecture error is to describe an “incoming CRS feed” from foreign jurisdictions into the bank. Under the CRS, the international exchange is between competent tax authorities. A Reporting Financial Institution reports to the authority required by its local implementation. The bank does not ordinarily receive the partner jurisdiction’s CRS file for AML consumption.

The bank can, however, use information it lawfully holds through its own CRS due diligence. A self-certification, tax identification number, account classification or remediation history can be relevant to customer-risk assessment where policy and law allow. The distinction is subtle but important: bank-held tax-reporting data may inform an AML case; authority-to-authority exchange data is not assumed to be a bank data source.

If a tax authority later provides information to the bank under a lawful request, notice or information-sharing mechanism, that information should enter the case with its source, permitted use and confidentiality restrictions recorded explicitly.

Tax residence and behavioural analytics

Behavioural data can reveal contradictions but should not determine tax residence automatically. A customer may spend most of the year in one country while remaining tax-resident elsewhere under domestic law or a treaty. Conversely, a customer may declare a residence that conflicts with strong documentary information already held by the bank.

Analytics can therefore generate a review prompt such as “declared tax residence conflicts with current bank-held address and account information”. It should not output “customer tax residence is false”. The workflow must route the case through the due-diligence process required by the applicable CRS implementation and, separately, assess whether the surrounding facts indicate possible deliberate concealment.

UK facilitation controls as a worked jurisdictional example

For a UK-relevant entity, a prevention framework can map tax-evasion facilitation risk by business process. Private banking may face risks around offshore structures and adviser introductions. Corporate banking may face structures, financing and cash-management services. Markets businesses may face withholding or securities transactions. Operations may face requests to alter payment narratives, suppress information or route transactions in ways that staff cannot explain legitimately.

The control should focus on associated-person conduct. Training can use examples such as knowingly helping a customer provide false information, deliberately structuring bank activity to conceal ownership or intentionally bypassing a control because the employee knows the customer is evading tax. The precise legal analysis belongs with UK legal and tax specialists; training should not turn employees into prosecutors.

The current HMRC Banking Manual, updated in February 2026, reiterates that the UK legislation does not hold relevant bodies accountable merely for customers' crimes and does not require them to prevent customers from committing tax evasion. It also notes that legitimate products supplied in good faith are not captured simply because a customer later misuses them. That qualification is important in any educational treatment of the offence.

Data-sharing and privacy boundaries

Tax information can be subject to stronger restrictions than ordinary customer data. A global bank should maintain a data-entitlement matrix covering which teams can see tax self-certifications, tax identifiers, reporting classifications, tax-authority correspondence and AML reporting information.

Purpose limitation should be explicit. If data was collected for a tax-reporting purpose, legal and privacy teams should confirm whether and how it may also be used for AML investigation in the relevant jurisdiction. “The bank already has the data” is not a sufficient legal basis for every secondary use.

Cross-border case collaboration needs similar care. A group investigation may involve legal entities in several countries, but tax secrecy, banking secrecy, data-protection rules and STR/SAR confidentiality can affect what can be shared. Case tooling should support restricted fields and entity-specific notes rather than force all information into one globally visible narrative.

Control assurance

Assurance should test decision quality, not just policy existence. A sample can ask whether self-certification inconsistencies were resolved under the proper tax-reporting procedure, whether AML escalation was separately considered, whether customer explanations were corroborated, whether jurisdiction-specific legal conclusions were properly qualified and whether reporting decisions were made by the authorised role.

Negative testing matters. A transparent offshore investment company should clear when ownership, purpose and source of wealth are supported. A customer who relocates should be able to correct residence information without being labelled evasive. A tax adviser should not be risk-rated solely because other customers use the same firm.

Positive testing should prove that deliberate concealment is not normalised as “complex tax planning”. Seeded cases can include forged documents, conflicting explanations, undisclosed beneficial owners, false self-certification evidence and unusual flows that cannot be reconciled with the stated structure.

Governance takeaway

Tax-evasion controls work best when the bank is precise about institutional boundaries. Tax authorities determine tax liabilities and enforce tax law. FIUs receive suspicious-transaction intelligence under AML frameworks. Banks perform due diligence, monitor relationships, investigate suspicious facts and comply with tax-transparency obligations that apply to them.

The advanced skill is not making a faster accusation. It is knowing exactly which conclusion the evidence supports, which team owns the next decision and which jurisdiction's law provides the external reporting route.

Practice close: requirements, test cases and evidence standards

This section converts tax-evasion learning into delivery artefacts. The purpose is not to build a system that declares a customer guilty of tax crime. The purpose is to help a bank identify evidence that does not fit the customer story, route the case to the right specialists and preserve enough information for a defensible decision.

Business-analysis checklist

A useful requirement set starts with scope. Which legal entity is implementing the control? Which customer segments, products and channels are covered? Which jurisdiction's AML reporting rules apply? Which separate tax-transparency obligations apply to the entity? Which data may legally be used for each purpose?

Customer requirements should describe the information needed to understand the relationship: identity, entity type, ownership and control, expected activity, source of wealth or funds where required, tax-residence and self-certification data where relevant, and the source and effective date of each field.

Detection requirements should be framed as observable conditions. Examples include commercial activity inconsistent with the stated business, a material unexplained mismatch between known customer profile and account flows, unresolved ownership, repeated contradictory explanations, or tax-reporting information that conflicts with other reliable bank-held data.

Investigation requirements should state what evidence is available to the analyst, which questions can be sent to the customer, how responses are stored, how alternative explanations are recorded and how the case is routed to financial crime, tax, legal or product specialists.

Decision requirements should separate KYC remediation, tax-reporting remediation, STR/SAR assessment, relationship restriction and exit. One decision should not silently trigger another unless policy explicitly defines that dependency.

Example acceptance criteria

A requirement such as “detect offshore tax evasion” is not testable. A better criterion is: when an entity classified as a passive family investment vehicle begins receiving repeated third-party commercial payments that materially exceed its expected activity, the system creates a review containing the triggering transactions, current ownership, customer profile and prior explanation history.

Another useful criterion is: when a CRS self-certification conflicts with bank-held information relevant under the applicable due-diligence rules, the tax-reporting workflow records the inconsistency, required follow-up and resolution; any AML escalation is recorded as a separate decision with its own rationale.

For ownership, an acceptance criterion can require the system to preserve each ownership or control relationship with source, effective date and verification status so that a historical investigation can reconstruct who was connected to the customer on the transaction date.

For case closure, the analyst should be able to record a legitimate explanation without forcing a suspicious disposition. Negative outcomes are important evidence of a calibrated control.

Positive test scenarios

A positive test can use a corporate customer that declares a small consulting business but receives high-volume payments from hundreds of unrelated individuals, moves most funds to an overseas entity with unclear ownership and provides invoices that do not match the activity. The expected result is enhanced review, not an automated criminal conclusion.

Another test can involve a customer whose tax self-certification says Country A while the bank holds a newer residential address and other information pointing to Country B. When the customer supplies credible evidence of a recent move and an updated certification, the tax-reporting issue should resolve. If instead the customer provides inconsistent documents and asks staff to keep the old classification to avoid reporting, the facts should be available to financial-crime review.

A trade test can use repeated invoice numbers, unusual amendments and payments inconsistent with the shipment documents held by the bank. The control should surface the documentary inconsistency. It should not claim that the bank has proven customs or tax fraud from price variation alone.

Negative test scenarios

A transparent holding company with no employees should not fail a generic “substance” rule if its purpose is to hold investments, its ownership is clear, governance is documented and flows match the stated activity. This test protects against using operating-company expectations for every legal form.

A private-banking customer who receives a large inheritance should be able to resolve an apparent lifestyle-income gap with credible estate and transfer documentation. The system should retain the explanation rather than continue generating repeated alerts because the customer's salary alone does not explain the wealth.

A customer with an adviser used by many other clients should not be escalated solely because of that network link. Additional customer-specific evidence is required.

Fairness and customer-impact testing

Tax-evasion detection can easily become a proxy for geography, nationality, wealth or legal-form complexity. Test populations should include legitimate international customers, migrants with multiple addresses, family structures, small online businesses, holding companies and customers who move between jurisdictions.

Review whether particular groups experience more document requests, holds or exits without corresponding evidence of risk. Where differences arise, investigate whether the control is using poor proxies such as country alone or whether the underlying portfolio genuinely has different risk characteristics supported by evidence.

Customer communication should also be tested. A request for updated tax-residence information should explain what is needed without accusing the customer of evasion. Where suspicious-report confidentiality applies, front-line scripts must avoid disclosing internal reporting decisions.

Data-quality and lineage tests

Seed contradictory but legitimate records to ensure the system does not overreact. A changed address should be distinguishable from a false address. A missing tax identifier should be distinguishable from an invalid identifier. A registry record should retain its retrieval date and source.

Test historical reconstruction by changing ownership after a transaction and confirming that an investigator can still see the ownership that was effective on the transaction date. Test correction history by replacing a tax self-certification and verifying that the previous record remains accessible according to retention policy.

If a third-party data source is unavailable, the case should show that the evidence is unavailable rather than treating a failed lookup as “no adverse information found”.

Integration and failure-mode testing

Tax-related cases touch multiple systems. Test what happens when the CRS or FATCA platform is unavailable, the KYC system has stale ownership, a payment record lacks full remittance text, or a corporate registry integration times out.

A resilient workflow should degrade visibly. Analysts should know which evidence is missing, whether the case can proceed and what follow-up is needed. Silent default values are dangerous because they can turn uncertainty into false certainty.

Duplicate alert handling also matters. A residence discrepancy, unusual transfer and ownership update may generate several alerts about the same underlying issue. Case-linking should reduce repeated customer contact while preserving which controls fired.

Reporting and escalation tests

The external reporting route must be tested per legal entity. A U.S. SAR workflow should follow U.S. requirements. A UK or EU entity will have different suspicious-reporting channels and legal thresholds. Direct tax-authority reporting should exist only where a specific legal or operational mechanism supports it.

Test tipping-off protections and need-to-know access. A relationship manager may need to know that KYC is under review without being told that an STR or SAR is being prepared. System permissions and notifications should respect that separation.

Where a UK entity has controls linked to the Criminal Finances Act corporate facilitation offences, test the associated-person and prevention-procedure workflow separately from customer AML suspicion. A customer tax concern does not automatically establish employee facilitation.

Quality-assurance questions

A reviewer should be able to answer: What exactly was observed? Which data source supports each fact? What innocent explanations were tested? Which jurisdiction's rule is being applied? Did the analyst distinguish tax-reporting remediation from AML suspicion? Were legal conclusions reserved for authorised specialists? Is the outcome proportionate to the evidence?

The case narrative should survive challenge by someone who did not work the investigation. If it relies on shorthand such as “offshore risk”, “tax haven”, “suspicious adviser” or “aggressive tax scheme” without explaining the facts, the analysis is not complete.

Practical delivery close

The strongest tax-evasion control is not the one with the most scenarios. It is the one that turns contradictory customer, ownership, transaction and tax-reporting information into a traceable investigation without manufacturing facts the bank does not possess.

For architects and BAs, that means explicit data sources, effective dates, evidence provenance, entity-specific rules and separate decision states. For investigators, it means testing explanations and recording uncertainty. For compliance and legal teams, it means mapping the external reporting route to the actual jurisdiction. Together those disciplines make tax-crime referrals useful, proportionate and defensible.

Masterclass: the adviser network that changed the customer story

This is a fictional composite case built from public tax-crime and professional-enabler typologies. It is not based on a named prosecution and it does not assume that any specific adviser, offshore jurisdiction or structure is criminal. Its purpose is to show how a bank can move from weak signals to a defensible financial-crime assessment without deciding the customer's tax liability.

Stage 1: ordinary-looking structures

A bank has twelve unrelated private and small-corporate customers introduced over several years by the same advisory firm. Each customer has a different business background. Several use overseas companies or trusts for investment or family-wealth purposes. At onboarding, ownership is documented and source of wealth appears credible. The adviser provides incorporation documents, tax-residence self-certifications and short explanations of purpose.

Nothing about that pattern is automatically suspicious. Advisers commonly introduce multiple clients, and professional firms often use standard documents and preferred service providers. The bank therefore does not create an alert merely because the same adviser appears repeatedly.

The picture changes when three customers are reviewed for unrelated reasons. Each has started receiving payments from operating companies that were not identified in the original purpose of the structure. Two describe the payments as investment returns. One describes them as consulting income. The payment references are generic and the receiving entities have no obvious investment-management or consulting activity.

Stage 2: a network signal appears

A network analyst notices that the three customers share more than the adviser. Their overseas entities use the same registered office and two of the same directors supplied by a corporate-service provider. That remains explainable because service providers routinely support many clients. The analyst therefore looks for customer-specific contradictions rather than treating the network as proof.

The contradictions are stronger. One customer supplied an invoice dated after the payment it supposedly supports. Another customer's KYC file states that the overseas company is a passive investment vehicle, but the account receives recurring payments labelled as business services. A third customer asks the relationship manager whether the bank can change the account description so that the structure is treated as “non-reporting” for tax purposes, despite the bank's existing classification process.

The relationship manager correctly refuses to promise a tax outcome and escalates the request. The bank's tax-reporting team confirms that account classification must follow the applicable rules and cannot be changed simply because an adviser prefers a different result.

Stage 3: portfolio review without guilt by association

The bank decides to review the remaining adviser-linked relationships on a risk-based basis. The purpose is not to investigate every client as a suspect. The team looks for the same specific contradictions: unexplained commercial receipts, inconsistent entity purpose, altered or implausible documents, unresolved ownership, tax-reporting data that conflicts with other reliable information and unusual payments to the adviser or related service providers.

Most linked customers are coherent. Their ownership is clear, flows match their stated purpose and requested evidence is supplied. Those relationships remain unchanged. This negative evidence is important because it prevents the investigation from becoming a self-confirming theory that the adviser is criminal merely because several customers raised concerns.

Four more customers do show similar issues. The bank now has seven relationships where customer explanations and transaction evidence conflict in comparable ways. The common adviser becomes a relevant network fact, but the case narrative still records the evidence for each customer separately.

Stage 4: separating customer suspicion from adviser suspicion

The bank creates two analytical layers. Customer cases ask whether each relationship presents suspicion requiring action under the local AML framework. The network case asks whether the repeated pattern involving the adviser should be escalated to a specialist financial-crime team and whether any external reporting route applies.

This separation avoids a common mistake. If one customer clears the concern, that does not automatically clear every other customer. Equally, the existence of several suspicious customers does not prove that the adviser knowingly facilitated an offence. Knowledge, intent and the elements of any facilitation offence are legal questions for the relevant authorities.

The bank documents what it can prove: the adviser introduced the customers; similar service providers appear across the structures; several customers provided inconsistent explanations; certain documents appear unreliable; and transaction behaviour does not fit the stated purpose of some entities.

Stage 5: reporting and legal-entity boundaries

The customers are booked in different bank legal entities. The investigation therefore does not create one global reporting decision. Each entity's financial-crime team assesses whether the facts meet the suspicious-reporting threshold under its law and whether group information may lawfully be shared for that assessment.

A UK entity also asks legal counsel whether any facts suggest an associated person of the bank may have criminally facilitated tax evasion, because the UK Criminal Finances Act creates corporate failure-to-prevent offences in defined circumstances. The review finds no evidence that bank staff knowingly helped customers evade tax. That question is therefore closed separately from the customer AML cases.

The distinction matters: suspicious customer activity is not the same as criminal facilitation by bank personnel.

Stage 6: tax-transparency remediation

The bank's tax-reporting specialists separately review CRS and FATCA classifications for the affected accounts. In two cases, customer information changed and updated self-certifications are required. In another, the original classification remains correct despite the customer's request to change it.

The tax-reporting team does not receive foreign CRS exchange data and does not use the AML case as a substitute for the formal due-diligence rules. It uses bank-held customer information and the applicable tax-reporting framework. Any corrections to reporting are recorded through the tax process.

Stage 7: customer communication

The bank needs additional information from several customers. Requests focus on facts: the nature of the payments, contracts, counterparties, ownership and purpose of the entities. The wording avoids accusations such as “prove you are not evading tax”. Customers are given a reasonable opportunity to explain legitimate activity.

Where an STR or SAR is being considered, the bank's communication process respects applicable tipping-off and confidentiality restrictions. Front-line staff are told only what they need to manage the relationship and information request.

Stage 8: outcomes can differ

The seven flagged relationships do not all end the same way. Two customers provide credible evidence showing that the payments were legitimate investment distributions incorrectly described in old KYC records; their profiles are updated. One customer explains a genuine new consulting business and supplies contracts, tax registrations and counterparties consistent with the flows.

The remaining four cannot reconcile the documents and transaction patterns. The bank escalates those cases according to the applicable AML rules, assesses restrictions or exit under policy and preserves the network evidence concerning the adviser for specialist review.

This mixed outcome is a sign of a healthy control. A weak model would either clear every adviser-linked client because a professional firm is involved or exit every client because some cases were suspicious.

What the case teaches investigators

First, a network signal is a way to find relationships that deserve comparison. It is not a substitute for customer-level evidence. Second, contradictory explanations are often more valuable than an abstract risk score. Third, tax-reporting and AML decisions can use some of the same facts while remaining legally and operationally separate.

Fourth, professional advisers should neither be trusted blindly nor treated as suspects by occupation. OECD public work on professional enablers demonstrates that intermediaries can play an important role in tax and white-collar crime, but the bank still needs evidence relevant to the particular relationship.

Finally, the external reporting route belongs to the legal entity. A multinational bank may coordinate analysis centrally while filing locally under different laws, thresholds and confidentiality regimes.

What the case teaches architects

The technology needs a relationship graph capable of linking customer, entity, beneficial owner, director, adviser, formation agent, account and payment counterparty. Each link needs source and effective date. Without those features, investigators see repeated names but cannot tell whether the connection is current, historical or merely coincidental.

Case tooling should also support hypothesis-based notes. Facts, customer statements, analyst inference and legal advice should be distinguishable. Tax-reporting data should have its own provenance and permissions. STR/SAR information should be restricted according to law and policy rather than copied into general customer notes.

The architecture should allow cases to be linked without forcing one disposition across them. A network investigation may contain several customer cases with different outcomes, exactly as in this example.

What the case teaches testers

A good test pack includes both suspicious and legitimate adviser-linked customers. If every customer connected to the same adviser triggers the same outcome, the control is likely relying too heavily on association.

Testers should verify that a corrected self-certification updates the tax-reporting workflow without silently closing an AML case. They should verify that a cleared AML concern does not erase tax-reporting remediation. They should also test access controls so that relationship staff cannot see restricted reporting decisions merely because they can see the linked KYC case.

Final lesson

Tax-evasion investigations become credible when they move from association to contradiction, from contradiction to evidence, and from evidence to the jurisdiction-specific decision the bank is actually authorised to make.

The objective is not to prove a tax offence inside the bank. It is to identify suspicious facts accurately enough that the correct bank function and, where required, the correct competent authority can act on them.

Knowledge check and glossary

Use these questions to test whether the chapter's distinctions are clear enough for real casework.

Does an offshore company indicate tax evasion? No. Offshore entities can have legitimate investment, financing, succession or holding purposes. The investigation should test ownership, control, purpose, expected activity and evidence appropriate to the type of entity. Geography is a risk factor, not a verdict.

What is the most useful bank signal of possible undeclared income? A material, unexplained mismatch between what the bank reasonably knows about the customer and what it observes in the account. The mismatch still needs testing against legitimate explanations such as inheritance, gifts, asset sales, business growth, savings or foreign income.

Can the bank decide whether aggressive tax planning is illegal? Normally it should not try to make a tax-court determination. The bank records the facts, tests explanations, seeks specialist tax or legal input where needed and assesses its AML obligations under applicable local law.

Why are false documents important? Because they change the evidence. An unusual structure may be lawful; an altered invoice, fabricated contract or knowingly false statement can create a much stronger suspicion that the customer is concealing the true facts.

What does FATF say about tax crimes? FATF includes tax crimes related to direct and indirect taxes within its designated categories of offences, while allowing countries to define the relevant offences and seriousness thresholds under domestic law. That is why a global bank needs local legal overlays.

How does CRS information move? A Reporting Financial Institution reports defined information to the competent authority required by its domestic implementation. Participating competent authorities exchange CRS information with one another. A bank should not assume that foreign CRS exchange files are returned to its AML platform.

What does a CRS self-certification inconsistency prove? Nothing by itself. It triggers the due-diligence follow-up required by the relevant CRS implementation. Repeated false information, altered documents or deliberate requests to suppress reportable facts may separately create AML suspicion.

How is FATCA different from CRS? FATCA is a U.S. statutory framework concerning specified U.S. account holders and foreign financial institutions, including reporting and withholding consequences under its detailed rules and intergovernmental arrangements. CRS is a multilateral standard implemented through participating jurisdictions. Banks often reuse some data but should preserve separate rule sets.

What changes with crypto-assets? The OECD's Crypto-Asset Reporting Framework and amended CRS expand international tax transparency. Implementation depends on domestic law. The European Union's DAC8 applies from 1 January 2026 with first exchanges for the 2026 reporting year occurring in 2027. None of these rules makes crypto use itself suspicious.

Can trade price differences prove tax evasion? No. Price differences can result from quality, timing, freight, insurance, contractual terms and market conditions. They are investigative leads that need transaction-level corroboration.

What are mirror statistics? Aggregate comparisons between one jurisdiction's recorded exports and another jurisdiction's recorded imports. They can identify discrepancies worth investigating but are affected by classification, timing, valuation and data-quality differences and should not be treated as proof of a false invoice.

Why are professional advisers relevant? Public OECD work shows that professional enablers can facilitate tax and white-collar crime. A bank can analyse common advisers and structures as network risk, but it still needs customer-specific evidence before drawing conclusions.

Does a lawyer's involvement remove AML concern? No. Nor does it allow the bank to ignore legal privilege. Privilege and professional-secrecy questions are jurisdiction-specific and should be handled through the bank's legal process.

When should a tax concern become an STR or SAR case? When the facts meet the suspicious-reporting threshold under the law applicable to that bank legal entity. The route and threshold differ by jurisdiction. A tax-reporting error alone is not automatically an AML filing decision.

Can the bank refer directly to a tax authority? Only where a specific legal or operational mechanism permits or requires it. In many AML cases the external route is through the relevant FIU. Tax reporting, authority production orders and corporate self-reporting mechanisms are separate processes.

What is the best case-writing style? Separate observed fact, customer explanation, independent evidence, analyst inference and legal conclusion. Avoid unsupported shorthand such as “tax haven customer” or “illegal offshore structure”.

Glossary for delivery teams

Tax crime: conduct treated as a criminal tax offence under the applicable domestic law. FATF includes tax crimes related to direct and indirect taxes within its designated categories of offences but leaves countries to define the relevant offences.

Tax evasion: deliberate unlawful conduct intended to defeat tax obligations, with the exact offence and mental element depending on jurisdiction.

Tax avoidance: arrangements intended to reduce tax within the law, subject to applicable anti-avoidance and anti-abuse rules. Banks should not use the term as a universal legal conclusion.

Tax transparency: frameworks that require defined information to be reported to tax authorities and, where applicable, exchanged internationally. CRS, FATCA and CARF have different legal bases and scopes.

CRS self-certification: customer-provided information used within Common Reporting Standard due diligence. Its validity and reasonableness are assessed under the applicable implementing rules.

CARF: the OECD Crypto-Asset Reporting Framework for automatic exchange of tax-relevant information concerning defined crypto-asset transactions, implemented through participating jurisdictions.

Commercial substance: evidence that an entity's stated purpose is supported by its real activity, governance, assets, people or other features appropriate to the entity type. The expected evidence differs between an operating company, holding company and trust.

Lifestyle or profile gap: a material difference between observed financial activity and the customer profile known to the bank. It is a question to investigate, not proof of undeclared income.

Mirror statistics: aggregate export-import comparisons across jurisdictions used to identify trade discrepancies for further analysis.

Professional enabler: an intermediary who knowingly enables tax or other white-collar crime. The term should not be applied merely because a lawyer, accountant, adviser or corporate-service provider is involved.

Beneficial ownership: the ownership or control information required under the applicable legal and KYC framework. It should be distinguished from account authority, directorship and other relationship types.

Referral threshold: the legal and policy test that determines when suspicious facts must or may be reported externally. It is jurisdiction and entity specific.

Evidence lineage: the record of where a fact came from, when it was valid, how it was verified and how it contributed to the decision.

References and further reading

The chapter uses public first-party sources and treats jurisdiction-specific rules as jurisdiction-specific rather than universal.

Global AML and tax-crime standards

• Financial Action Task Force, FATF Glossary: designated categories of offences: https://www.fatf-gafi.org/en/pages/fatf-glossary.html
• Financial Action Task Force, FATF Recommendations: https://www.fatf-gafi.org/en/topics/fatf-recommendations.html
• OECD, Fighting Tax Crime: The Ten Global Principles, Second Edition: https://www.oecd.org/en/publications/2021/06/fighting-tax-crime-the-ten-global-principles-second-edition_1f0b22cf.html
• OECD, Ending the Shell Game: Cracking down on the Professionals who enable Tax and White Collar Crimes: https://www.oecd.org/en/publications/2021/02/ending-the-shell-game_79ff90e4.html

Tax transparency, CRS and crypto-assets

• OECD, International standards on tax transparency: https://www.oecd.org/en/topics/international-standards-on-tax-transparency.html
• OECD, Consolidated text of the Common Reporting Standard (2025): https://www.oecd.org/en/publications/consolidated-text-of-the-common-reporting-standard-2025_055664b1-en.html
• OECD, Crypto-Asset Reporting Framework and amended Common Reporting Standard: XML formats and interpretative guidance: https://www.oecd.org/en/about/news/announcements/2024/10/crypto-asset-reporting-framework-and-amended-common-reporting-standard-oecd-releases-it-format-for-transmitting-information-and-issues-interpretative-guidance.html
• OECD, Updated crypto-reporting exchange formats and FAQs, 30 July 2025: https://www.oecd.org/en/about/news/announcements/2025/07/oecd-releases-data-exchange-formats-for-the-global-minimum-tax-and-crypto-reporting-and-issues-updated-faqs.html
• OECD Global Forum, Implementation of the amended Common Reporting Standard, 6 March 2026: https://www.oecd.org/en/networks/global-forum-tax-transparency/news-events/2026/global-forum-secretariat-holds-virtual-event-on-implementation-of-the-amended-common-reporting-standard.html

United States

• Internal Revenue Service, Foreign Account Tax Compliance Act (FATCA): https://www.irs.gov/businesses/corporations/foreign-account-tax-compliance-act-fatca
• FinCEN, The Bank Secrecy Act: https://www.fincen.gov/resources/statutes-and-regulations/bank-secrecy-act

United Kingdom

• HM Revenue & Customs, Corporate offences for failing to prevent criminal facilitation of tax evasion: https://www.gov.uk/government/publications/corporate-offences-for-failing-to-prevent-criminal-facilitation-of-tax-evasion
• HM Revenue & Customs, Banking Manual BKM509500: interaction with corporate offences for failing to prevent criminal facilitation of tax evasion, updated 9 February 2026: https://www.gov.uk/hmrc-internal-manuals/banking-manual/bkm509500
• UK legislation, Criminal Finances Act 2017 explanatory material on failure to prevent facilitation of tax evasion: https://www.legislation.gov.uk/ukpga/2017/22/notes/division/6/index.htm

European Union

• European Commission, Directive on Administrative Cooperation (DAC): https://taxation-customs.ec.europa.eu/taxation/tax-transparency-cooperation/administrative-co-operation-and-mutual-assistance/directive-administrative-cooperation-dac_en
• European Commission, DAC8: tax transparency for crypto-assets: https://taxation-customs.ec.europa.eu/taxation/tax-transparency-cooperation/administrative-co-operation-and-mutual-assistance/directive-administrative-cooperation-dac/dac8_en

These sources support the chapter's global-standard, tax-transparency and worked-jurisdiction examples. Local bank procedures must still use the current law, regulator/FIU requirements and tax-reporting rules applicable to the specific legal entity and customer relationship.