Hack or admin error at the IRS?

On the first or second day of every month the IRS updates its GIIN list https://apps.irs.gov/app/fatcaFfiList/flu.jsf

The GIIN list is a list of FFI’s in ‘approved status’ – usually as of the twenty fifth date of the previous month. The GIIN list is a critically important artefact for both FATCA and CRS compliance.

When validating a W-8 the requestor of a W-8 checks that the requestee has a GIIN on the IRS database – provided the FATCA status of the requestee requires a GIIN. The obligation on requestors is twofold if the requestee’s FATCA status requires a GIIN.

1. To make sure that a GIIN is extant on the IRS database before validation of the W-8 and
2. To make sure that the GIIN remains extant on the IRS database.

A GIIN being removed from the IRS list may imply that the FFI has lost its GIIN. As a result there has been a Change in Circumstances (CiC) that may mean that the requestee is an NPFFI. (Non Participating FFI.)

This event is a CiC trigger that typically causes the requestor of the W-8 to treat its existing W-8 as valid for only 90 more days and resolicit for a new W-8. If after 90 days there has not been a superseding W-8 the requestor will class the requestee as an NPFFI and commence FATCA withholding.

There is therefore a corollary. The IRS is obligated to keep its GIIN list up to date and protected. Presently the GIIN list is either out of date or it appears it may have been hacked. At the time of writing November 18, 2019, 11:45AM GMT the website shows the date as July 25, 2019 instead of October 25, 2019. Further, the list of FFIs in approved status appears to be 180,000 less than it ought to be. Previously, the list of FFIs in approved status was more than 345K. The list on the portal at the time of writing is 165,000.

FFI have been thrown into confusion. Have they lost their approved status? Have their counterparties lost their approved status? Has the IRS website been hacked? Is it a case of human error?

No one appears to know. It could be an administrative error. It could be a hack or it could be a functional error of the site.

However, this is already causing problems – If an FFI's counterparties are no longer on the list as having a GIIN, should they now presume a Changes in Circumstances is triggered against them and therefore a new W-8 should be solicited? FFIs whose own GIIN appears to be no longer extant face copious impromptu requests for resolicitation with regards to their FATCA status.

What is clear is that if regulators want the regulated to meet their obligations, then the support technologies, including GIINs, TINs and LEIs that regulators are increasingly adopting, must be available 24x7 with clear guidelines on what to do when these centralised data references fail.