U.S. TIN collection & formatting for FATCA — name/TIN hygiene, common reject patterns & validation tips

Author: Alexander Fölsche, CPA (US), Wirtschaftsprüfer (Germany), Swiss Licensed Audit Expert

Clean U.S. Taxpayer Identification Numbers (TINs) are essential for FATCA due diligence and reporting. This guide shows how to collect the right TIN type, apply formatting and validation, avoid common reject patterns, and keep reviewer-ready evidence.

Scope: U.S. TINs for FATCA onboarding, GIIN/treaty alignment and reporting, including Form 8966 / local IGA and interplay with 1042-S. Covers SSN, ITIN, EIN, formatting rules, validation tips and evidence.

1) TIN types and when they apply

TIN type Who uses it Pattern Notes
SSN U.S. individuals AAA-GG-SSSS, 9 digits No zeros in the full 9-digit sequence; avoid known invalid prefixes.
ITIN Non-U.S. individuals with U.S. tax nexus 9XX-7X-XXXX / 9XX-8X-XXXX / 9XX-9X-XXXX Always begins with 9; middle two digits in ranges 70–88, 90–92, 94–99.
EIN U.S. entities and some trusts/estates XX-XXXXXXX, 9 digits Two-digit prefix plus seven digits; hyphen after the first two digits for display.

Collect the TIN type alongside the number to apply the right validation rules and downstream mappings.

2) Formatting and basic validations that catch most errors

  • Digits only + canonical display: store numeric digits; display with standard hyphen formats. ITINs display like SSNs but begin with 9.
  • Length checks: exactly 9 digits for SSN, ITIN and EIN, with no spaces and no letters.
  • SSN sanity: reject obvious invalids, such as all zeros, 000-XX-XXXX, XXX-00-XXXX or XXX-XX-0000.
  • ITIN sanity: must start with 9; range checks for the 4th–5th digits.
  • EIN hyphen rule: presentational hyphen after two digits; store digits only for matching.
  • Name control hygiene: for entities, normalize legal name and reduce punctuation noise for consistent matching.

If your onboarding system cannot enforce rules, create a TIN normalizer that strips symbols, validates pattern and re-renders the number for display.

3) Name/TIN matching — practical tips

  1. Source of truth: take the legal name from registration or KYC; keep trading names and DBAs as aliases.
  2. Normalization: upper-case, remove punctuation, normalize spaces and keep a name-control field for entities.
  3. Consistent capture: ensure W-8/W-9 name fields match KYC; avoid abbreviations in one place and full names in another.
  4. Audit trail: store the form image and normalized values; log who performed changes and when.

4) Common reject patterns and quick fixes

Reject pattern Likely cause Fix
Wrong TIN type, e.g. ITIN entered for entity No TIN-type field; UI does not distinguish Capture TIN type; enforce form-type ↔ TIN-type rules.
Hyphen or space artifacts Stored with formatting; downstream expects digits only Store digits only; render view with format on output.
Name mismatch vs form/KYC DBA captured as legal; punctuation or case differences Normalize; keep alias map; align W-8/W-9 with KYC legal name.
All-zero or invalid SSN blocks No sanity checks; manual input error Add rule checks and reject obvious invalids at entry.

5) Controls and evidence reviewers expect

  • Data entry rules documented, with UI validations or helper scripts in place.
  • Normalization service for digits-only storage and formatted display, with versioned logic.
  • Exception queue for missing or invalid TINs with owners and due dates; evidence of outreach.
  • Renewal/change flow tied into W-8/W-9 lifecycle and corrections processes.
  • Dossier artifacts: copies of forms, change logs, exception closures and reporting receipts.

6) Quick technical appendix — regex and display rules

# Store: digits only, strip whitespace and dashes
```

# Display:

# SSN:  NNN-NN-NNNN

# ITIN: NNN-NN-NNNN, must start with 9

# EIN:  NN-NNNNNNN

# Basic regex:

SSN/ITIN digits only: ^\d{9}$
EIN digits only:      ^\d{9}$
EIN display:          ^\d{2}-\d{7}$

# Simple SSN sanity:

Not allowed: 000-xx-xxxx, xxx-00-xxxx, xxx-xx-0000

# ITIN sanity:

Must start with 9
Digits 4-5 in 70-88, 90-92, 94-99
```
TIN hygiene starter kit
Validation checklist, exception queue template and client communication snippets.

Related reading