FATCA governance — roles, policies, and the annual control calendar

Strong governance keeps FATCA operations predictable, evidence-rich, and reviewer-ready. This guide defines roles and responsibilities, a lean policy stack, and a practical control calendar you can execute with limited resources.

1) Roles and responsibilities — RACI lens

• Responsible Officer (RO): ultimate attestation; sponsors the policy stack; approves issues, material failures and remediation; signs certification.
• Tax Lead (FATCA): owns procedures, control calendar, reporting dossier, GIIN monitoring and corrections; chairs the monthly FATCA operations call.
• Operations / onboarding / client tax: runs W-8/W-9 lifecycle, renewals, change-in-circumstances workflow and exception queue.
• IT / data: maintains data dictionary, mapping for Form 8966 or local schemas, export jobs, validation gates and secure evidence storage.
• Compliance / legal: policy governance, privacy and consent, record retention and breach or escalation protocols.
• Internal audit / second line: independent testing per plan and remediation tracking to closure.

2) Lean policy stack — what to publish and keep

1. FATCA policy: scope, roles, IGA model, governance, retention, escalation and independence statements.
2. Procedures: documentation lifecycle, GIIN monitoring, reporting, corrections and re-filings, and withholding-agent interplay.
3. Control calendar: who, what and when; KRIs; evidence artifacts; maker-checker sign-offs.
4. Data and privacy note: consent for Model 2, data exports, minimization, redaction and access controls.

Keep versions and change logs. Store PDFs in the FATCA dossier with a clear index.

3) Annual control calendar — baseline

4) Committee cadence and reporting

• Monthly FATCA Ops call: KRIs, renewals, GIIN exceptions, open corrections and privacy issues.
• Quarterly governance update: trends, audit points, remediation status and technology changes.
• RO brief before certification: executive summary, dossier heatmap and draft disclosure wording.

5) Evidence management — what passes review

• Central FATCA dossier with stable paths, PDF/A where reasonable and bookmarked reports.
• Index or evidence map linking files to controls; versioning and change logs.
• Access control and privacy: PII minimization, redaction and least-privilege access.
• Retention schedule, for example 7 years, and secure archive procedures.

6) Issues, remediation and validation

1. Record findings with severity, owner and ETA; include clear remediation tasks.
2. Track validation evidence, including before/after, re-test and approvals, before closure.
3. Escalate material failures to the RO with draft disclosure wording prepared early.

Related reading

• FATCA Model 1 vs Model 2
• FATCA responsible officer certification for FFIs
• FATCA for Foreign Banks: Operating Model & Reporting