South African Reporting Financial Institutions (RFIs) should review their Automatic Exchange of Information (AEOI) controls after SARS introduced updates linked to the OECD’s Common Reporting Standard (CRS) Schema 3.0. The changes are aimed at improving data quality, expanding the information covered and strengthening the identification of reportable accounts and controlling persons.

The update was included in SARS’s October 2026 Government Connect issue. It is particularly relevant to financial institutions, payment businesses and other entities that may fall within the AEOI reporting framework. Read the SARS update.

What has changed in the AEOI environment?

SARS says its third-party data environment now supports reporting changes associated with CRS Schema 3.0. The updated environment includes certain additional financial products and institutions, including e-money products, payment institutions, digital wallet platforms and central-bank currency accounts.

The changes also place greater emphasis on self-certification, tax-residency identification, controlling-person information and the accuracy of tax identification numbers. For affected institutions, this means that AEOI reporting should not be treated as a once-a-year data export. The underlying customer-onboarding, account-maintenance and tax-residency processes need to produce reliable information throughout the reporting cycle.

Null submissions have also been clarified

An active RFI that has no reportable information for a reporting period still has to make the applicable null submission. SARS’s updated guide explains that the institution may use an FTI01 null-report form through eFiling or submit a nil data file through an approved secure channel.

Where an FTI01 null submission is used, an FTI02 declaration is not generated or required. Institutions should nevertheless retain evidence supporting their conclusion that there was no reportable information for the relevant period. SARS’s external guide sets out the submission process.

Who should review their controls?

The immediate audience is not every South African SME. The update is directed at RFIs, authorised submitting entities and the teams responsible for FATCA or CRS reporting. However, businesses that operate payment platforms, digital wallets, investment products or other financial services should confirm whether their activities create AEOI obligations.

Finance, tax, compliance and information-technology teams should work together. A reporting error may originate in a customer master file, an outdated self-certification, an incorrect tax-residency indicator or a system mapping problem rather than in the final submission itself.

Practical checks for finance and compliance teams

  • Confirm whether the entity is an RFI and identify the applicable reporting year and reporting period.
  • Review whether newly included products, such as e-money or digital-wallet services, are captured in the reporting population.
  • Test customer tax-residency, controlling-person and Tax Identification Number fields for completeness and consistency.
  • Check that the correct eFiling access rights and Foreign Tax Information activation are in place.
  • Document the process used to determine whether a full submission or null submission is required.
  • For full submissions, reconcile the accepted data displayed on eFiling before filing the related FTI02 declaration.

SARS states that the reporting process is complete only after the relevant data has been successfully processed and the corresponding declaration has been filed. Businesses affected by the update should therefore build a documented review trail rather than relying solely on a successful file upload.

For support with tax and financial compliance controls, businesses can explore Your Financial Partner’s services.