Under the Foreign Account Tax Compliance Act (FATCA), a Global Intermediary Identification Number (GIIN) can disappear from the Internal Revenue Service (IRS) list because the institution behind it has lost control of a recurring compliance obligation. The immediate task may be reinstatement, but the more important question is whether FATCA registration has been built into the institution’s operating model.

Scope: Institutions Dealing Directly with the IRS

This article covers foreign financial institutions (FFIs) that comply directly with the IRS under the FFI Agreement: participating FFIs outside intergovernmental agreement (IGA) jurisdictions and reporting Model 2 FFIs. For reporting Model 2 FFIs, the applicable Model 2 IGA modifies those obligations.

It may also be relevant to other entities that certify directly through the FATCA Registration System, although the requirements applicable to each entity, branch and classification must be considered separately.

Reporting Model 1 FFIs ordinarily report to, and are supervised for IGA purposes by, their local tax authority. Significant non-compliance is addressed through the competent authority process under the applicable Model 1 IGA.

They are therefore outside the direct IRS certification and termination path examined here, unless the institution, a branch or another entity in its structure participates in a separate capacity. This distinction matters: a GIIN may look universal, but the route by which compliance is established and enforced is not.

A Public Identifier with Private Dependencies

A GIIN is often treated like permanent reference data: it is entered during onboarding, copied into tax forms and stored in counterparty systems. then assumed to remain valid. This static assumption confuses the identifier with the status it evidences.The GIIN is valuable because the institution appears on the IRS FFI List as an approved registration. The list is refreshed monthly and used throughout payment and custody chains to validate FATCA status.

This is where governance often becomes fragile. FATCA due diligence may sit with operations, reporting with tax, entity data with company secretarial teams, and payment documentation with treasury or fund administration. Meanwhile, registration credentials, portal access and notification channels may be controlled by an individual or held in an unattended mailbox. Each team can complete its own task, yet the institution may still be unable to support the responsible officer’s conclusion. Control ownership is fragmented even though the certification is singular.

Once a GIIN is removed, this governance weakness quickly becomes an operational problem. Withholding agents and counterparties may be unable to validate the institution’s claimed status. Documentation may be challenged, payments delayed, onboarding interrupted, and FATCA withholding considered under the applicable payment rules. A failure originating in an unattended portal can therefore spread across the very functions needed to remediate it.

The underlying issue is usually not the absence of a rule, but the failure to align ownership, information, systems and behaviour. Locally reasonable arrangements can still produce an institution-wide failure if no one has end-to-end accountability, reliable escalation routes and accessible evidence.

How a GIIN Goes Missing

The IRS does not generally move from a missed obligation to removal without a process. A failure to submit a required periodic certification, an indication that the institution cannot certify, or a certification resulting in failure to certify may constitute an event of default. The IRS ordinarily posts a notice of default to the FATCA Registration System message board and asks the institution to remediate within 60 days. If the default is not addressed, further notice and ultimately termination may follow. A notice of termination provides a 90 day period in which to remediate or appeal before FATCA status is terminated and the GIIN removed from the FFI List.

This sequence makes contact data and portal access part of the control environment. The IRS states that the responsible officer remains responsible for the certification deadline whether or not the contact information is correct or an email alert is received. A stale address is therefore an explanation of how the institution missed the warning, not a defence to the underlying obligation.

The practical danger is silence. A notice left on the message board can outlive the person who controlled the account, the adviser who managed the filing or the transaction that changed the group structure. By the time a payment team discovers that the GIIN no longer validates, the institution may be dealing simultaneously with the IRS, withholding agents, custodians and clients.

Periodic Certification is More Than a Portal Submission

For a participating FFI, periodic certification concerns compliance with ongoing FATCA requirements. It is due by 1 July of the year following the relevant certification period, with subsequent periods generally covering three calendar years. The submission is infrequent, but the matters certified are continuous.

Periodic certification is more than a portal submission. Revenue Procedure 2017-16 requires a participating FFI to perform, or arrange for, a review of its compliance during the certification period (the FFI Compliance Review). The responsible officer must consider the results of that review when making either a certification of effective internal controls or, where necessary, a qualified certification.

The FFI Agreement does not prescribe the QI Agreement’s independent-reviewer model or a standardised review methodology. That flexibility does not make the review a formality. The FFI Compliance Review must give the responsible officer a defensible basis for certification, supported by work proportionate to the institution’s business, account population, change history and control risks.

When the Notice Arrives

A notice of default requires disciplined triage. The institution should first preserve access to the FATCA account and the complete message trail, establish the precise registration and branches affected, and identify every outstanding certification period. It should then distinguish a late administrative submission from wider failures in due diligence, withholding, reporting or governance. That distinction will shape both the certification and the remediation plan.

If termination has occurred, the IRS instructs the entity not to seek a fresh GIIN. Reinstatement must be pursued through the existing registration. The entity is expected to submit all required certifications, explain the non-compliance, provide a remediation plan, correct contact details and respond comprehensively to IRS enquiries. The IRS indicates that review may take 60 to 180 days after all requested information has been received, and the entity will not reappear on the FFI List while that review remains outstanding.

Restoring the number is therefore not the same as restoring confidence. Counterparties may need evidence of the reinstatement process, revised withholding documentation and an explanation of the control changes. The institution must manage legal remediation and market communication as connected workstreams.

The WTS Hansuke Six-Step GIIN Continuity Framework

The most durable response is to treat GIIN continuity as an operating model rather than a triennial filing project. The following six steps provide a practical structure for doing so.

These steps are mutually reinforcing. Monitoring without ownership produces alerts without action. Evidence without a reliable perimeter may support the wrong entities. Recovery planning without portal resilience begins too late. Continuity emerges from the complete system, not from any isolated control.

The six steps also provide the architecture for the WTS Hansuke GIIN Continuity Maturity Rubric. Used as pre-work for a focused diagnostic workshop, it tests not simply whether a control exists, but whether it is evidenced and embedded. The resulting pattern often reveals a different risk profile from the one suggested by policy documents alone, allowing the workshop to concentrate on the most consequential gaps and the priorities for the next 90 days.

A Limited Qualified Intermediary Connection

Some participating FFIs are also QIs. Where that is the case, the QI Agreement applies alongside the FFI Agreement and brings its own compliance and review requirements. A FATCA failure should therefore be assessed for consequences under the QI regime, but those rules should not be imported into the FATCA analysis of an FFI that is not a QI.

The practical point is coordination. For a dual status institution, the same underlying weakness, such as poor account documentation, fragmented ownership or deficient withholding controls, may affect more than one agreement. The response should identify those connections without overstating their relevance to the wider FFI population.

From Reinstatement to Continuity

A missing GIIN is conspicuous, but it is rarely the first control failure. The earlier indicators are more prosaic: an inaccessible portal, an outdated responsible officer, an unrecorded classification change, a review assembled close to the deadline or evidence held by a provider without clear institutional ownership.

The lesson is not that every institution needs a large FATCA programme. It is that the operating model must be proportionate, explicit and capable of surviving ordinary organisational change. When responsibilities, information and controls remain aligned, periodic certification becomes the output of an established process. When they do not, the GIIN can become the first visible sign that legal status and operational reality have separated.

The useful next step is to establish where the institution sits across the six elements of the continuity framework, identify the weakest dependency and determine whether the responsible officer has the evidence needed for the next certification. That assessment is modest in form, but it often reveals whether FATCA compliance is genuinely embedded or merely remembered when the portal demands attention.

About the Author

Ali Kazimi is Managing Director at WTS Hansuke and advises the financial services sector on automatic exchange of information, including FATCA and the Common Reporting Standard (CRS), operational taxes and tax governance frameworks. His professional background includes senior industry and advisory roles, and he is a Fellow of the Institute of Chartered Accountants in England and Wales.