CFC Rules and the Automatic Exchange of Information: What the Tax Authority Already Knows About Your Foreign Structure

The State Has Acquired the Tools for Enforcement

Until recently, the rules on controlled foreign companies (hereinafter — “CFC”) operated in Ukraine largely as a declaratory obligation. The rule existed and reports were filed, but the supervisory authority lacked any instrument to verify the completeness of the reports submitted and of the information they contained. A resident who failed to notify the authority of a shareholding in a Cypriot, Estonian or Polish company stood a good chance of going unnoticed.

That state of affairs is coming to an end. Ukraine’s accession to the Multilateral Competent Authority Agreement on Automatic Exchange of Financial Account Information (CRS MCAA) and the launch of the corresponding mechanism in the Tax Code of Ukraine have given the State Tax Service something it never had before: an independent external source of data on the foreign accounts of Ukrainian residents.

The obligation to declare a CFC and the state’s actual ability to verify compliance with that obligation can now be matched against one another. This is precisely why a question that sounded theoretical only two years ago has today become a matter of managing a concrete risk.

Who Qualifies as a Controlling Person Under the CFC Rules

The legal basis is Article 39-2 of the Tax Code of Ukraine, which defines a controlling person as an individual or legal entity resident in Ukraine that is the direct or indirect owner (controller) of a foreign legal entity or of an entity without the status of a legal person.

The following may be regarded as the classic control criteria:

• holding a share of more than 50% in the capital of the foreign company;
• holding a share of more than 10%, provided that the aggregate share held by Ukrainian residents in that company amounts to 50% or more;
• de facto control over the foreign company, exercised either alone or together with other Ukrainian residents that are related parties, irrespective of the formal size of the shareholding.

The last criterion is frankly the most dangerous and the least intelligible both for business and for enforcement practice, since it is not formalised (not precisely defined). De facto control requires no entry in any register; it is established on the basis of a combination of indicia: the right to issue binding instructions to the company’s management bodies, the right to dispose of the company’s bank account, the existence of a power of attorney granted for a term exceeding one year without restrictions on the transactions to be carried out, participation in negotiating transactions on behalf of the company, and so forth. The list of existing indicia is set out directly in Article 39-2 of the Tax Code of Ukraine and, for the purposes of applying it, should be checked against the version in force, since the provision has been amended repeatedly and, I am confident, will continue to change.

At the same time, the Code contains two safeguards worth relying on in defence. The provisions of subparagraph 39-2.1.6 of paragraph 39-2.1 of Article 39-2 of the Tax Code of Ukraine do not apply to an individual who performs the duties of a director or another officer under the company’s constitutional documents, nor to attorneys, auditors, accountants, trustees, protectors and fund managers acting in the interests of the legal entity in compliance with the applicable professional standards. Most importantly, the burden of proving that an individual exercises de facto control rests with the supervisory authority.

The practical consequence is this: the construction “the company is registered in a nominee’s name, therefore I am not a controller” affords no legal protection. On the contrary, a general power of attorney together with signatory rights over the bank account operates directly as an independent ground for recognising the resident as a controlling person.

The obligations of a controlling person fall into two distinct blocks:

1. Notification of the acquisition or disposal of a shareholding in a foreign company (to be filed within 60 days of the relevant event);
2. The CFC report and, where grounds exist, inclusion of the adjusted profit of the CFC in the taxable base.

These are different violations carrying different sanctions; filing the report, for example, in no way relieves the person of liability for a notification that was never filed.

What the State Tax Service Actually Sees Through CRS

The automatic exchange mechanism is set out in Article 39-3 of the Tax Code of Ukraine, introduced by Law of Ukraine No. 2970-IX of 20 March 2023 “On Amendments to the Tax Code of Ukraine and Other Legislative Acts of Ukraine Regarding the Implementation of the International Standard for Automatic Exchange of Financial Account Information”. The requirements on the application of the Common Reporting Standard by financial agents took effect on 1 July 2023.

The State Tax Service of Ukraine carried out the first reciprocal international automatic exchange as at 30 September 2024. As a result, Ukraine received information from approximately 50 foreign jurisdictions and transmitted data to 51 jurisdictions. The exchange is annual and takes place by 30 September of the year following the reporting year.

It is important to understand the scope of the data. Under CRS, the information transmitted includes, in particular:

• identification details of the account holder (name, address, jurisdiction of tax residence, taxpayer identification number, date of birth);
• the account number and the name of the financial institution;
• the account balance or value at the end of the reporting period;
• amounts of interest, dividends and proceeds from the sale of financial assets credited to the account.

One point is of particular significance: where the account holder is a passive non-financial entity (the typical holding company with no genuine operating activity), the information disclosed covers not only the company itself but also its controlling persons — that is, the ultimate beneficial owner as an individual. It is this rule that transforms CRS from an instrument for monitoring personal accounts into an instrument for monitoring corporate structures.

The first exchange cycle was limited in scope: it covered data on new accounts opened after 1 July 2023, as well as accounts of individuals with a balance or value exceeding USD 1 million. Subsequent cycles cover a wider range of accounts, and the volume of data transmitted grows year on year. The assumption that “my account is too small to be caught by the exchange” loses its foundation with every passing year.

Who Actually Sends Data to Ukraine

The list of reportable jurisdictions maintained by the State Tax Service (updated on 26 December 2025) covers 121 jurisdictions, including all EU member states. This is a list for the purposes of reporting by Ukrainian financial agents. In practice, however, Ukraine received data from approximately 50 jurisdictions for 2023 and from 71 for 2024. The gap is not a technical one: exchange relationships are activated bilaterally, and a state’s presence on the State Tax Service list does not yet mean that it sends data to Ukraine.

Two jurisdictions of considerable importance for the structures of Ukrainian residents activated the exchange with Ukraine only recently:

Austria — information issued by the Austrian Federal Ministry of Finance on 13 May 2025 on the basis of Regulation BGBl. II No. 82/2025: Ukraine was included both in the list of participating states for the 2024 reporting period and in the list of states in respect of which the information collected for the 2024 reporting period was to be transmitted to the competent tax office during the 2025 calendar year;

Switzerland — by a decision of 19 November 2024, Ukraine was added to the list of automatic exchange partners with the status “reziprok” (reciprocal exchange), effective from 1 January 2025. Swiss financial institutions have been collecting data since 1 January 2025, and the first exchange will take place in the autumn of 2026. For a jurisdiction traditionally regarded as the most confidential of all, this is a fundamental change.

What Is Transmitted — and What Is Not

The Tax Code of Ukraine does not itself define the scope of the data: subparagraph 39-3.4.3 of paragraph 39-3.4 of Article 39-3 of the Tax Code of Ukraine refers to Section I of the Common Reporting Standard. Financial agents file the report on reportable accounts annually by 1 July for the preceding calendar year.

The flows mirror one another but are not identical: Ukraine sends data on accounts held by non-residents with Ukrainian financial institutions, and receives data on accounts held by Ukrainian residents abroad. In both directions, the controlling persons of passive non-financial entities are disclosed.

The automatic exchange does not transmit:

• individual transactions or their purpose;
• counterparties to transactions;
• movements of funds within the reporting year.

The practical consequence is that CRS operates as a trigger, not as an evidentiary basis. A discrepancy between the balance received and the income declared provides grounds for an enquiry, while the State Tax Service obtains the detail through a different channel — exchange of information on request. The key question for the client is not “will they see it”, but “what will I be able to explain”.

Two Distinct Regimes of Access to the Data

• CRS data: subparagraph 39-3.4.5 of paragraph 39-3.4 of Article 39-3 of the Tax Code of Ukraine prohibits the supervisory authority from disclosing information on reportable accounts to anyone, including law enforcement bodies, save where such information is provided in accordance with the requirements of the Criminal Procedure Code of Ukraine — meaning that a channel does exist;
• CFC data: under the fourth paragraph of paragraph 72 of Subsection 10 of Section XX of the Tax Code of Ukraine, during the period of martial law such data may not be requested from or transmitted to law enforcement bodies and may not be treated as evidence in criminal proceedings.

Two bodies of data concerning one and the same person are subject to different protection regimes, which may be regarded as an argument in favour of declaring the structure voluntarily rather than waiting for it to be reconstructed from banking data.

CRS 2.0: In Force Since 1 July 2026

By Order of the Ministry of Finance of Ukraine No. 316 of 15 June 2026, amendments were approved to the Procedure for Applying the Common Reporting Standard and Due Diligence in Respect of Financial Account Information. They implement the CRS 2.0 version endorsed by the OECD in 2023; reporting financial institutions apply the updated rules from 1 July 2026. The key innovations are as follows:

• the scope of CRS has been extended to accounts linked to specified electronic money products and central bank digital currencies;
• new concepts have been introduced: “Virtual Asset”, “Relevant Virtual Asset”, “Reportable Virtual Asset Service Provider” and “Exchange Transaction”;
• the due diligence procedures now take into account the risks associated with citizenship or residence by investment schemes (CBI/RBI) and cases of multiple tax residence;
• the list of information that financial institutions collect, verify and report has been updated, and the XML schema of the report is being supplemented with fields for the new categories of products.

For holders of crypto-assets this means that the logic of the CFC and CRS rules now extends to virtual assets as well.

The Moratorium on Penalties Is a Deferral, Not an Amnesty

The transitional provisions of the Tax Code of Ukraine (Subsection 10 of Section XX) temporarily provide that, from 1 January 2022 and for the duration of martial law, as well as for six months following the month in which martial law is terminated or lifted, no penalties shall be applied to taxpayers for the violations set out in paragraphs 1 to 8 of paragraph 120.7 of Article 120 of the Tax Code of Ukraine. Equally, no administrative or criminal liability applies in respect of violations connected with the application of Article 39-2 of the Tax Code of Ukraine.

There is a trap here that goes underestimated. The relief from liability is conditional: it operates provided that the controlling person discharges its outstanding obligations within six months of the termination or lifting of martial law. If that deadline is missed, the relief falls away and sanctions for the entire period are assessed in full.

The scale of the sanctions under paragraph 120.7 of Article 120 of the Tax Code of Ukraine illustrates the price of delay:

• failure to file a CFC report — a penalty of 100 subsistence minimums for an able-bodied person as established on 1 January of the reporting year;
• late filing of the report — 1 subsistence minimum for each calendar day, but not more than 50 subsistence minimums;
• failure to reflect in the report information on existing CFCs, or information specified by the Tax Code of Ukraine — 3% of the CFC’s income or 25% of the CFC’s adjusted profit for the relevant year (whichever is greater), but not more than 1,000 subsistence minimums for each instance;
• failure to notify the acquisition or disposal of a shareholding, or the commencement or cessation of de facto control, within the established deadline — 300 subsistence minimums for each such instance;
• failure to submit, or incomplete submission of, transfer pricing documentation or other copies of primary documents concerning the CFC at the request of the supervisory authority — 3% of the CFC’s income, but not more than 1,000 subsistence minimums;
• failure to file the report within 30 calendar days following the last day of the deadline for payment of the financial sanctions (penalties) provided for by this paragraph — 5 subsistence minimums for each day, but not more than 300 subsistence minimums.

It should be noted that payment of a penalty does not release the person from the obligation to file the report and the supporting documents provided for by Article 39-2 of the Tax Code of Ukraine. The costliest element of this construction is the penalty of 300 subsistence minimums for each instance of failure to notify. An owner of a foreign company who has never filed a single notification therefore incurs a substantial penalty before any question of the report or of the tax itself even arises.

No less important: the moratorium concerns reporting penalties. It does not extend to the tax liability as such. If the adjusted profit of a CFC was to be included in the taxable base and the tax was not paid, that is a separate violation of a different category, and interest on it accrues under the general rules.

The limits of the relief also merit separate consideration. The wording “paragraphs one to eight of paragraph 120.7” covers only four types of violation: failure to file the report, late filing, failure to reflect information in the report, and failure to notify the acquisition of a shareholding or the commencement of de facto control. Outside the moratorium remain the sanctions for failure to submit documentation at the request of the supervisory authority and the penalty of 5 subsistence minimums per day. This conclusion follows from an analytical reading of the provision rather than from an express statutory reservation — but the practical implication is unambiguous: once a request concerning a CFC has been received, the moratorium should not be counted upon.

There is also a countervailing argument that goes underestimated. The fourth paragraph of paragraph 72 of Subsection 10 of Section XX of the Tax Code of Ukraine provides that information and documents obtained by the supervisory authority under Article 39-2 of the Tax Code of Ukraine during the period from 1 January 2022 to the last calendar day of the month in which martial law is terminated or lifted constitute information with restricted access: it may not be requested from or transmitted to law enforcement bodies upon their request or within the procedures of the Criminal Procedure Code of Ukraine, and it may not be treated as evidence in criminal proceedings within the meaning of Article 84 of the Criminal Procedure Code of Ukraine. Reports filed within this period enjoy a regime that will not be available to reports filed after it ends.

Three Risks That Are Frequently Underestimated

1. Permanent Establishment Instead of a CFC

The most common mistake made by Ukrainian beneficial owners is to assume that filing a CFC report exhausts their tax obligations in respect of the foreign company.

It should be emphasised that such a simplified understanding is not entirely correct. Where a foreign company is in fact managed from the territory of Ukraine — key management decisions are taken here, and the person who concludes contracts and performs the core functions is located here — the supervisory authority may characterise the situation as the activity of a permanent establishment of a non-resident in Ukraine, with the corresponding taxation of profit in Ukraine. This approach has already been applied by the administrative courts, in particular in disputes concerning companies registered in EU member states where the Ukrainian resident was the sole de facto manager.

The key point is that the mere filing of CFC reports does not rebut the existence of a permanent establishment. These are parallel regimes, not alternative ones.

In assessing this risk, the Supreme Court has provided a benchmark: in order to recognise a non-resident’s activity as a permanent establishment, it is sufficient to establish the regular nature of its business activity carried out through representatives who conclude contracts and perform key functions on the territory of Ukraine.

2. The Beneficial Owner of Income and the Principal Purpose Test

The second risk arises at the moment payments are made from Ukraine to a foreign structure — dividends, interest, royalties. A reduced rate under a double taxation convention is available only if the recipient is the actual (beneficial) owner of the income within the meaning of Article 103 of the Tax Code of Ukraine.

The Supreme Court has developed an extensive body of case law on this matter, as a result of which it published a separate review of judicial practice concerning beneficial owners of income, which is worth using as a working benchmark. The general principle is that the category of beneficial owner of income applies primarily to payments of dividends, interest and royalties, and that a shell company which lacks independent authority to dispose of the income and passes it on in transit is not entitled to the benefit.

An additional layer is the principal purpose test, implemented through the Multilateral Convention (MLI): if one of the principal purposes of the structure was to obtain benefits under a tax convention, those benefits may be denied.

3. The Tax Residence of the Controller

The final and most frequently ignored risk concerns the person themselves. Departure abroad, and even the acquisition of tax residence in another state, does not automatically terminate Ukrainian residence. The criteria for the tax residence of an individual are set out in subparagraph 14.1.213 of paragraph 14.1 of Article 14 of the Tax Code of Ukraine and are applied sequentially:

• place of residence in Ukraine;
• where there is also residence abroad — the place of permanent residence;
• the centre of vital interests (closer personal or economic ties);
• presence in Ukraine for not less than 183 days during the tax year;
• Ukrainian citizenship.

One provision of direct relevance to the popular Estonian structures deserves separate attention: the acquisition of electronic residency (e-residency) status is not regarded as a sufficient condition for determining the location of the centre of vital interests.

For the owner of a foreign structure this is directly material: the obligations under Article 39-2 of the Tax Code of Ukraine arise precisely by reason of the controller’s Ukrainian status. The question “am I still a Ukrainian resident” therefore logically precedes the question “must I file a CFC report” — and calls for documentary analysis rather than self-assessment.

What Can Be Done Now: A Practical Course of Action

1. Inventory. Compile a complete list of foreign legal entities, entities without the status of a legal person (trusts, partnerships, foundations) and bank accounts to which the resident has any connection — including those where the resident is not the formal owner but holds a power of attorney or the right to dispose of the account.
2. Control test. Assess each position against the criteria of Article 39-2 of the Tax Code of Ukraine, separately verifying the indicia of de facto control.
3. Reconciliation with the CRS profile. Determine precisely which data on each structure has most likely already reached, or will reach, the State Tax Service of Ukraine: the jurisdiction, the type of entity (active or passive non-financial entity), and the disclosure of controlling persons.
4. Review of what has been filed. Verify whether notifications of the acquisition of shareholdings and CFC reports were filed for all periods from 2022 onwards, and whether what was filed corresponds to the actual circumstances.
5. Assessment of related risks. Analyse the permanent establishment risk, the correctness of the application of treaty rates, and the tax residence status of the controller.
6. Remediation plan. Draw up a timetable for filing the reports, taking into account the six-month period following the termination of martial law — without leaving it to the final month, since preparing the CFC financial statements for several years takes time and requires the involvement of a foreign accountant.

The CFC and CRS rules are not two separate obligations but elements of a single system in which the state has acquired the ability to match what has been declared against what is actual. The key change lies not in the appearance of new rules, but in the appearance of data that makes the existing rules enforceable.

The moratorium on penalties creates a window for putting matters in order — but that window has a clear closing date tied to the termination of martial law. Those who use it to bring their structure into compliance voluntarily will enter the next stage with a managed risk. Those who count on going unnoticed will face penalties, additional assessments and the need to prove their position in an administrative dispute — already confronted with data obtained through the automatic exchange channel.

This material is of an informational nature and does not constitute legal advice in any particular matter. The assessment of risks under the CFC rules always depends on the specific circumstances: the ownership structure, the jurisdiction, the nature of the company’s activity and the personal status of the controller. For the analysis of any individual situation, we recommend seeking a bespoke consultation.