FATCA and CRS data moves into the new Form 166 framework

SEBI issued Circular HO/38/14/(18)2026-MIRSD-POD2/I/25560/2026 on 11 November 2026, telling registered intermediaries that qualify as Reporting Financial Institutions to align their FATCA and Common Reporting Standard processes with section 508 of the Income-tax Act, 2025, Rules 238 to 240 of the Income-tax Rules, 2026 and Form 166.

Why the framework changed

SEBI’s earlier FATCA and CRS circulars of 2015 and 2024 referred to section 285BA of the Income-tax Act, 1961, Rules 114F to 114H and Form 61B. The Income-tax Act, 2025 and Income-tax Rules, 2026 replaced that statutory framework from 1 April 2026.

Automatic Exchange of Information reporting for reportable accounts now rests on section 508, Rules 238 to 240 and Form 166. SEBI’s new circular translates that change into specific onboarding, KYC and reporting actions for the securities market.

Who is affected?

The circular is addressed to all SEBI-registered intermediaries, stock exchanges and depositories. The substantive reporting obligation, however, applies to a registered intermediary only if it qualifies as a Reporting Financial Institution under Rule 238.

Intermediaries should therefore document their entity classification rather than assume that SEBI registration alone answers the question. The definitions of “Financial Institution” and “Reporting Financial Institution” in Rule 238 must be applied to the entity’s actual business and role.

Four system fields require attention

SEBI identifies four areas that registered intermediaries must review and update in accordance with the 2026 Rules:

1. Self-certification validity. Collection procedures must capture the validity indicator, so the record shows whether the client’s FATCA/CRS self-certification is usable for due diligence.
2. Controlling-person capacity. Systems must identify whether a controlling person acts as settlor, trustee, protector, beneficiary or in another role.
3. Account classification. Records must capture the account type and whether the account is new or pre-existing.
4. Form 166 XML fields. XML-generation software must include all newly mandatory data. SEBI expressly warns that missing required fields will cause validation errors on the Income Tax portal.

Client certifications must reach the KRA system

Registered intermediaries must upload the FATCA and CRS certifications obtained from clients to the systems of KYC Registration Agencies. Keeping a signed form only in an internal file is therefore not the complete process.

The intermediary remains solely responsible for obtaining and reporting the certification and for related compliance. Use of a KRA, technology vendor or outsourced onboarding provider does not transfer that regulatory responsibility.

What may investors be asked to provide?

The circular does not require every investor to submit a fresh form automatically. An affected intermediary may nevertheless seek information where an existing record is absent, incomplete, inconsistent or does not contain the new classification fields.

1. country or countries of tax residence;
2. tax identification number or the permitted explanation where one is unavailable;
3. place of birth and other identity details required by the applicable self-certification;
4. entity classification and controlling-person information; and
5. the controlling person’s capacity, such as settlor, trustee, protector or beneficiary.

Investors should respond only through the intermediary’s verified channel, review pre-filled data carefully and keep an acknowledged copy. A change in tax residence, address, entity status or controlling persons should not wait for the next routine review.

What intermediaries should do now

1. Confirm scope. Record the Rule 238 analysis supporting RFI or non-RFI status for every relevant legal entity.
2. Map old and new fields. Compare legacy Form 61B data, current KYC records and Form 166 requirements; do not assume that a renamed form has an identical schema.
3. Revise onboarding. Update self-certification forms, digital journeys, validation rules and exception queues to capture the validity indicator and required classifications.
4. Fix trust and entity records. Capture each controlling person’s capacity separately instead of storing only a name and tax residence.
5. Upgrade XML generation. Test Form 166 output against the Income Tax portal validations, including mandatory fields and permitted code values.
6. Complete the KRA workflow. Verify that certifications are uploaded, accepted and traceable to the correct client and account.
7. Assign ownership. Define responsibility across compliance, operations, technology, onboarding teams, KRAs and vendors while retaining the intermediary’s own accountability.
8. Preserve evidence. Maintain the certification, validation result, classification rationale, change history, KRA acknowledgement and filed XML audit trail.

Important date distinction

The new income-tax regime took effect on 1 April 2026. SEBI’s circular was issued on 11 November 2026 and directs affected intermediaries to bring their securities-market processes into line with that regime. The circular does not state a separate future implementation date or a grace period.

That distinction matters for project planning: this should be treated as a current compliance remediation and validation exercise, not as a change that can be deferred to the next reporting cycle.

What the circular does not say

1. It does not declare every demat, broking, mutual-fund or portfolio account reportable.
2. It does not replace the Rule 238 entity and account-classification tests.
3. It does not give a universal deadline for every client to submit a new self-certification.
4. It does not shift responsibility from the intermediary to the client, KRA or software vendor.

Reviewed on 13 November 2026. SEBI Circular HO/38/14/(18)2026-MIRSD-POD2/I/25560/2026 is dated 11 November 2026; the underlying Income-tax Act, 2025 and Income-tax Rules, 2026 framework took effect on 1 April 2026.