FATCA Explained: US Rules for Foreign Accounts

General information for a worldwide audience — not tax advice for your country. Confirm with a qualified advisor where you live.

FATCA is a United States law with a global reach. Its full name is the Foreign Account Tax Compliance Act, and since 2010 it has required banks, brokers, funds and insurers outside the United States — known as Foreign Financial Institutions, or FFIs — to find their US-connected customers and report their accounts to the US Internal Revenue Service (IRS). A bank that does not cooperate faces a 30% withholding tax on payments connected to the United States.

Why would a bank in Dubai, Mumbai or Frankfurt care about a US law? Because almost every internationally active bank touches the US financial system — through dollar clearing, US investments or US counterparties. The 30% withholding threat turns that touchpoint into leverage: comply with FATCA, or lose nearly a third of your US-connected income.

The deeper reason is uniquely American. The United States is one of very few countries that taxes its citizens on worldwide income regardless of where they live. An American living in Dubai for twenty years still files a US tax return every year. FATCA is the enforcement arm of that principle — it makes sure the IRS can see the foreign accounts of people who owe it tax.

The story begins with a scandal. In the late 2000s, investigations revealed that the Swiss bank UBS had helped thousands of Americans hide money in secret Swiss accounts to evade US tax. UBS paid a large settlement, handed over thousands of client names, and the affair demonstrated that voluntary compliance alone was not working.

Congress responded with FATCA, enacted in March 2010 as part of the Hiring Incentives to Restore Employment (HIRE) Act. Instead of chasing individual tax evaders one by one, the law deputised the world's banks: identify your US persons, report their accounts, or face withholding.

The rest of the world objected at first — no country likes another country's law reaching into its banks. The US answer was the intergovernmental agreement (IGA): a treaty-like deal under which the foreign country's own banks report to their own government, which passes the data to the IRS. This preserved a fig leaf of sovereignty while delivering the data. Most major financial centres signed IGAs, and the OECD later built the multilateral CRS system on FATCA's blueprint.

FATCA works through pressure applied at two levels.

Level 1: Foreign financial institutions must participate

Banks, custodians, brokers, funds and certain insurers outside the US register with the IRS (or with their local authority under an IGA) and agree to identify US-person account holders. Identification happens through self-certification at account opening — the W-8BEN form for non-US persons, the W-9 for US persons — plus reviews of existing accounts for US indicia such as a US address, US phone number or standing instructions to a US account.

Level 2: Non-compliance triggers 30% withholding

A bank that will not participate becomes a non-participating FFI. US-source payments to it — dividends, interest and similar withholdable payments — are hit with 30% withholding tax. For most banks, that is commercially fatal, which is why participation is near-universal.

Account holders cannot opt out by refusing paperwork

A customer who refuses to provide a self-certification becomes a "recalcitrant account holder." The bank must still report what it knows and may apply withholding to US-connected payments. Some banks simply close recalcitrant accounts rather than deal with the compliance burden.

The data flows once a year

Participating institutions report account holder identity, account balances and US-source income annually. Under a Model 1 IGA the data goes to the local tax authority first; under Model 2 it goes directly to the IRS.

Many countries refused to let their banks send customer data directly to a foreign government — bank secrecy and data protection laws stood in the way. The intergovernmental agreement solved this. There are two models.

Model 1: Report to your own government

The FFI reports US-person accounts to its own country's tax authority, which automatically forwards the data to the IRS. Most countries, including the UAE, chose this model. It also comes in reciprocal and non-reciprocal flavours — the US sends some data back under reciprocal versions, though far less than it receives.

Model 2: Report directly to the IRS

Used where domestic law prevents government-to-government exchange. The FFI reports straight to the IRS, with customer consent where local law requires it.

In practice the distinction matters little to the account holder: either way, the IRS gets the data. It matters to banks, because Model 1 lets them deal with their own regulator in their own language, which is one reason participation spread so fast.

FATCA's reach depends entirely on who counts as a "US person" — a term of art that is wider than many people expect.

• US citizens, wherever they live and whatever other citizenships they hold. This includes "accidental Americans" who may not know they are citizens.
• Resident aliens: green-card holders, and anyone meeting the substantial presence test — broadly, physical presence in the US for at least 31 days in the current year and 183 days over a three-year weighted count.
• Certain US-owned foreign entities: foreign companies, trusts and similar vehicles with substantial US ownership can themselves be reportable.

Note what is NOT on the list: merely being born outside the US to American parents does not automatically make you a citizen in every case (transmission rules apply), and holding a US visa alone does not make you a resident alien. But the default assumption of every bank compliance officer is to treat doubtful cases as US persons until proven otherwise — because the bank bears the risk of getting it wrong.

Two separate reporting regimes confuse almost everyone. Here is the difference.

FBAR — FinCEN Form 114

The Report of Foreign Bank and Financial Accounts is filed electronically with FinCEN (the Treasury's financial crimes unit), not with your tax return. You must file if the combined maximum value of all your foreign financial accounts exceeded USD 10,000 at any point during the calendar year — even for one day. The deadline follows the tax calendar with an automatic extension to mid-October. Penalties for non-willful violations start at USD 10,000 per violation; willful violations carry far higher penalties.

Form 8938 — Statement of Specified Foreign Financial Assets

This is filed with your IRS income tax return and has higher thresholds that vary with filing status and residence. For a single filer living in the US, the threshold is USD 50,000 on the last day of the year or USD 75,000 at any point; for those living abroad it is USD 200,000 / USD 300,000. Penalties start at USD 10,000 and can reach USD 50,000 for continued failure after IRS notice.

You may need both

The regimes overlap but neither replaces the other. An American in Dubai with USD 60,000 across foreign accounts files the FBAR (over USD 10,000) and, depending on exact thresholds, possibly Form 8938 too. Many expats file both every year.

James is a US citizen who moved to Dubai eight years ago. He has a UAE current account, a UAE savings account, and a brokerage account in Singapore. His total balances peaked at USD 180,000 last year. He files a US tax return every year and claims the foreign earned income exclusion on his salary, so he assumed his banking was covered.

It was not. His salary exclusion covers earned income, not the reporting of the accounts themselves. Because his aggregate foreign balances exceeded USD 10,000, he should have filed an FBAR every year. At USD 180,000 — below the USD 200,000 year-end threshold for a single filer abroad — he likely did not need Form 8938, but the FBAR was mandatory.

When James opened a new UAE account this year, the bank asked him to complete a W-9 and provide his Social Security Number. Under the UAE's Model 1 IGA, the bank will report his accounts to the UAE Federal Tax Authority, which forwards the data to the IRS. The IRS now has an independent record of accounts James never reported on FBARs. His fix: the IRS streamlined filing procedures for non-willful violations, which let him file three years of amended returns and six years of FBARs with reduced penalties — far cheaper than waiting to be caught.

FATCA's most sympathetic victims never chose to be American. "Accidental Americans" include people born in the US to foreign parents who left as infants, and children born abroad to a US parent who transmitted citizenship automatically. They may hold no US passport, have no Social Security Number, and genuinely not know they owe the IRS annual returns.

Banks find them anyway. A US place of birth on a passport is a FATCA indicium, and banks routinely ask such customers for proof they are not US persons — a certificate of loss of nationality, or evidence they never were citizens. Customers who cannot produce it face account restrictions or closure.

The way out has several steps: obtain a Social Security Number, use the streamlined procedures to catch up on filings if the failure was non-willful, and then decide whether to keep or renounce citizenship. Renunciation costs USD 2,350 in State Department fees, requires five years of tax compliance first, and can trigger an exit tax for high-net-worth "covered expatriates." It is a serious, irreversible step that deserves professional advice — but for some accidental Americans, it is the rational end of the story.

For banks, FATCA is a permanent compliance cost: systems to identify US indicia, annual reporting, staff training, and the risk of getting it wrong. Smaller banks in some countries decided the cost exceeded the benefit of American customers and simply stopped serving them — a real phenomenon expats call being "FATCA'd" out of banking.

For non-financial businesses, direct FATCA obligations are limited, but the spillover is real. A UAE company with US shareholders may be asked for ownership certifications by its bank. Payments from US customers can carry FATCA documentation requirements. And any business whose owners include US persons should assume the company's accounts are visible to the IRS through the owners' reporting.

Professional firms feel it too: auditors, company formation agents and wealth managers serving American clients must build FATCA awareness into onboarding. Asking every client "are you a US person for tax purposes?" is now as routine as asking for ID.

FATCA itself is a reporting regime, but the penalties around it are severe.

Failing to file Form 8938 starts at USD 10,000, rising to USD 50,000 if the failure continues after IRS notice, plus a 40% accuracy penalty on underpaid tax attributable to undisclosed foreign assets. FBAR penalties are steeper: non-willful violations up to USD 10,000 per violation, willful violations the greater of USD 100,000 or 50% of the account balance — per year.

Criminal exposure exists for deliberate evasion, and the statute of limitations extends where foreign assets are involved. The IRS Criminal Investigation division has run high-profile cases built substantially on FATCA data.

The practical message: the cost of compliance (a few forms a year) is trivial next to the cost of non-compliance. And with IGAs delivering data automatically, non-compliance is increasingly a bet that the IRS will not look at data it already holds.

Myth 1: "FATCA only targets the rich"

The reporting thresholds for banks have no minimum — FFIs report US-person accounts regardless of balance. The FBAR's USD 10,000 aggregate threshold catches ordinary savers, not just the wealthy.

Myth 2: "My country has no IGA, so I am safe"

Without an IGA, FATCA still applies directly to FFIs, with the 30% withholding as the stick. An IGA makes compliance smoother; its absence does not make you invisible.

Myth 3: "Closing my US ties ends the obligation"

Letting a green card lapse without formal abandonment, or simply moving away, does not end US tax residence. Only formal procedures — filing the expatriation forms, or properly abandoning permanent residence — stop the clock.

Myth 4: "The bank will not really report me"

Banks face the 30% withholding and regulatory sanctions for non-compliance. Their incentive to report is far stronger than any incentive to protect a customer.

Myth 5: "FATCA will be repealed soon"

Repeal bills are introduced in Congress periodically, but none has passed. Plan as if FATCA is permanent.

The UAE signed a Model 1 intergovernmental agreement with the United States, which means UAE financial institutions identify US-person account holders and report them to the UAE Federal Tax Authority, which exchanges the information with the IRS. For customers, this appears as the familiar onboarding paperwork: W-8BEN for non-US persons, W-9 for US persons.

This matters in the UAE more than in many countries because of the large American expatriate community and the volume of US-connected business. An American opening a personal account, a US shareholder opening a corporate account, or a fund with US investors will all encounter FATCA documentation as a matter of routine.

The UAE's FATCA participation sits within a consistent transparency framework: CRS exchanges with 100+ jurisdictions, a UBO register, substance requirements embedded in the corporate tax law, and Pillar Two adoption. None of this changes the UAE's appeal — no personal income tax, a 9% corporate tax with free zone reliefs — but it confirms the direction: the UAE competes on tax rates, not on secrecy.