FATCA Voluntary Review: Independent or with Internal Audit
We perform an independent, practical review of your FATCA compliance, operating processes and internal controls, and regulatory filings, including Form 8966 and local portal submissions. Engagements can be conducted independently or in cooperation with your Internal Audit function.
Who it’s for
- Banks and other FATCA reporting entities seeking an objective health-check ahead of RO certification.
- Institutions that have recently changed systems, outsourcers, or operating models and want assurance that the controls still work.
- Groups looking to align FATCA and QI practices and remove friction across processes, data, and evidence.
Scope of the review
Compliance & Control Framework
Review of governance, RACI, control calendar, KRIs, control design and operation, evidence retention, and escalation routes.
- Policies and procedures: design adequacy and practical use
- Roles and responsibilities, training, and reviewer checkpoints
- Evidence packs and audit trail completeness
Processes & Data Flows
Walk-throughs from customer and transaction source systems to FATCA mapping and reporting outputs, including remediations.
- Residence / US indicia logic and remediation workflows
- Data quality checks, exception handling, and tie-outs
- Interfaces to local portals, including EU, CH, LI, UK and other relevant jurisdictions
Filings & Corrections
Sampling-based review of FATCA filings, including Form 8966 and local XML, with schema, consistency, corrections, and re-filing checks.
- Sampling of reported accounts and withholding where relevant
- Validation of key fields, including TINs, GIINs, classifications, and balances
- Receipts, acknowledgements, and re-submission workflow
How we work
-
1) Scoping & planning
Agree perimeter, sampling approach, data access, and Internal Audit involvement where applicable. The scope is right-sized for institution complexity.
-
2) Walk-throughs & testing
Process walk-throughs, control re-performance, sample testing of filings, and evidence checks. Practical findings are classified by severity and impact.
-
3) Findings & remediation
Actionable, prioritized remediation plan with owners, target dates, and suggested control hardening, from quick wins to structural fixes.
-
4) Close-out & briefings
Formal delivery of reports, management briefing, and, if desired, an RO brief check ahead of certification.
Deliverables you receive
Reviewer Report
Structured report summarizing scope, approach, testing performed, detailed findings, and an overall conclusion tailored for reviewers.
Management Letter
Executive-level synthesis with risk-ranked recommendations and a practical remediation roadmap.
Issue Register
Trackable register with root cause, risk, remediation steps, owner, and target date — ready to plug into your control framework.
RO Brief Check
Optional short-form note to support the Responsible Officer’s consideration ahead of FATCA certification.
Independent or with Internal Audit — your choice
We can conduct the review fully independently, or jointly with your Internal Audit function. In a co-sourced setup, we align on scoping, sampling, and documentation standards to ensure the output is usable for both management and audit committees.
Timeline & effort
- Typical duration: 3–6 weeks depending on perimeter, data availability, and sampling depth.
- Effort for your team: upfront scoping workshop, structured document drop, 3–5 SME walk-throughs, and review sessions.
- Pricing: fixed-fee options available once scope is agreed.
Why choose us
- Hands-on FATCA expertise with reviewer-ready documentation standards.
- End-to-end view: governance → data → filings → remediation.
- Pragmatic, scalable controls that fit small and mid-size institutions.