Global Forum peer reviews: what they assess and how a small administration prepares

A Global Forum peer review examines a tax administration’s international work against a fixed standard, and for exchange on request and automatic exchange the result is published under the jurisdiction’s name.

For a small administration the stakes are practical as well as reputational. A weak rating draws attention from partner jurisdictions, and a failed security assessment can stop exchanged data arriving at all.

What the Global Forum reviews

The Global Forum on Transparency and Exchange of Information for Tax Purposes brings together 172 jurisdictions.^[1] It monitors two standards.

Exchange of information on request, usually shortened to EOIR, covers a tax authority’s ability to obtain and provide information when a partner jurisdiction asks for it. Automatic exchange of information, or AEOI, covers the annual exchange of financial account information under the Common Reporting Standard. A separate standard, the Crypto-Asset Reporting Framework, extends automatic exchange to crypto-asset transactions, with exchanges starting from 2027 for most committed jurisdictions.^[2]

Each standard has its own review process. AEOI also has a third process alongside it: an assessment of whether the administration can keep the information it receives secure.

Exchange on request: ten elements and four ratings

EOIR reviews assess a jurisdiction against ten essential elements.^[3]

Each element, and the jurisdiction overall, is rated Compliant, Largely Compliant, Partially Compliant or Non-Compliant. Reviews look at the legal framework and at practice over a defined review period. In recent reviews that period has typically covered three years of requests received and sent.^[4]

Since January 2025, EOIR has been monitored through an enhanced monitoring process, which combines regular progress reporting with in-depth reviews where needed.^[3]

Ratings move. Dominica received an overall rating of Partially Compliant in its 2020 review and Largely Compliant after a supplementary review in 2023.^[4] Barbados followed the same path, from Partially Compliant in 2020 to Largely Compliant after its supplementary review in 2022.^[5]

Automatic exchange: legal frameworks first, then practice

AEOI reviews are organised around three core requirements: collecting the information domestically from financial institutions, exchanging it with partners, and keeping it confidential and secure.^[6]

The legal frameworks for the first two receive one of three determinations: In Place, In Place But Needs Improvement, or Not In Place.^[6] On this measure most jurisdictions are now in good shape. In the Global Forum’s 2025 update, 114 of the 118 jurisdictions assessed had legal frameworks that were fully or substantially in place, with 73 receiving an overall determination of In Place and 41 In Place But Needs Improvement.^[7]

Practice is reviewed separately. The first stage was a desk-based review of whether each jurisdiction was on track. The second is an in-depth review that includes an on-site visit.^[6]

Where the reviews are now concentrating

Read together, those results show where the attention has moved. Legislation is largely in place. What the Global Forum now looks at is whether the rules are applied, and in particular whether reporting financial institutions comply. Its 2024 update noted that further efforts were needed to make the standard effective, particularly its implementation by reporting financial institutions.^[8]

That is administrative work. It means knowing which financial institutions should be reporting, checking that what they send is complete and accurate, following up when it is not, and keeping a record of having done so. In a large administration that can be the job of a dedicated unit. In a small one it can fall to one or two people who also carry other responsibilities.

The security assessment that can stop data arriving

For AEOI, confidentiality and data safeguards are reviewed on their own track, covering both the Common Reporting Standard and the Crypto-Asset Reporting Framework.^[9] A jurisdiction is assessed before it first receives data, assessed again once exchanges are under way, and a third round of assessments has begun for jurisdictions that have completed both.^[9]

The assessments are carried out by information security management specialists drawn from other member administrations. Where they find issues, they make recommendations. Where the issues are serious, a jurisdiction’s clearance to receive AEOI data can be suspended until they are resolved.^[9] Because of their confidential nature, the results of these assessments are not published.^[6]

The requirement has two parts: laws that protect the confidentiality and proper use of exchanged information, and information security management arrangements that follow international good practice standards.^[10]

For a small administration this can be the most demanding part of the review. The evidence an assessor is likely to look at, such as access controls, incident handling, and how exchanged data is stored and who can see it, depends on systems and procedures across the whole organisation, not only in the exchange unit.

How a small administration prepares

Start from the review period, not the review date. Practice is judged on what happened over a defined period of several years. Records that were not kept at the time are difficult to reconstruct later. Logging requests received and sent, response times and follow-ups as part of routine work means the evidence already exists when the review arrives.

Keep a record of compliance work with financial institutions. Given where reviews are concentrating, being able to show which institutions were expected to report, which did, and what happened when they did not is likely to matter.

Treat information security as an organisation-wide question. The exchange team cannot meet the safeguards requirement on its own. Where the administration, or the systems it relies on, are certified against a recognised information security standard such as ISO 27001, the certificate and its scope should be ready to show. Where they are not, it is better to find the gaps before an assessor does.

Use the support that exists. Developing country members can ask for a pre-assessment of their information security framework, which identifies what needs improving and helps build a realistic plan before the formal assessment.^[10] In 2025 the Global Forum Secretariat delivered bilateral technical assistance to 111 jurisdictions, the highest number since its capacity-building programme began in 2011.^[2]

Treat the review as a cycle. As with a TADAT assessment, one review records a position and a series of reviews records a trajectory. A move from Partially to Largely Compliant is the kind of progress a supplementary review exists to capture.

What this means for small administrations

Three conclusions follow.

Legal frameworks are mostly in place, though not always complete. Over a third of jurisdictions still have frameworks rated In Place But Needs Improvement. The bigger shift is towards whether an administration can show the rules are applied, which comes down to records and routine.

Both tracks carry real consequences. A weak EOIR rating can count against a jurisdiction in the EU’s assessment of non-cooperative jurisdictions, which expects a rating of Largely Compliant or better.^[11] A failed confidentiality assessment can suspend the flow of data, which removes the benefit the whole effort is meant to deliver.

Preparation is mostly continuous. The administrations in the best position at review time are those whose ordinary procedures already produce the evidence a reviewer will ask for.