Tax reporting and data residency

Define tax ownership, account and transaction records, CRS/FATCA classification, withholding, customer statements, retention, residency, transfers, and deletion.

Tax reporting and data location are separate control domains, but both depend on a reliable jurisdiction map. Record where the customer is resident, which entity provides the account, where the data is stored and accessed, and which party files each report.

Do not infer tax residence from nationality

Obtain a valid self-certification and apply the locally required reasonableness and indicia checks. Citizenship, phone country, funding currency, and IP address may be indicators, but none alone proves tax residence.

Responsibility matrix

Activity	Partner	MyStocks / appointed provider
Tax self-certification	Collect, validate, refresh, and retain	Receive only fields required for operations/reporting
Reporting-financial-institution analysis	Confirm own entity status	Confirm platform/custody entity status
Transaction and position records	Retain customer-facing ledger and statements	Provide orders, executions, dividends, fees, FX, and custody data
Withholding	Disclose customer treatment and reconcile	Apply/report where contractually assigned
CRS/FATCA or local filing	File where legally assigned	Provide agreed data extract and corrections support
Customer tax advice	Do not provide unless authorised	API output is information, not personal tax advice

Minimum tax data set

Legal name, address, date of birth/incorporation, and account identifier.
Jurisdiction(s) of tax residence and taxpayer identification number or documented exception.
Entity classification, controlling persons, and their tax residences where applicable.
Self-certification version, signature/consent, date received, validation result, and expiry/change status.
Gross proceeds, dividends, interest/distributions, withholding, fees, currency, and FX metadata.
Corrections, cancellations, account closure, and report-submission identifiers.

Re-document when circumstances conflict with an existing self-certification. Do not silently overwrite the original; preserve the effective dates and correction trail.

Statement and reporting controls

Reconcile reportable cash and positions to the same ledger used for customer statements.
Use immutable execution and corporate-action records; distinguish trade date from settlement date.
Preserve local-market currency, USD ledger effect, FX rate/source, and tax withheld.
Validate report schemas, record counts, totals, duplicates, and jurisdiction codes before submission.
Track acceptance, rejection, correction, and customer-notification status.

See Statements and confirms, tax lots and gains endpoints, and the daily Reconciliation workflow.

Data residency and transfer register

For each data category, record:

Question	Required evidence
What is processed?	Data inventory and classification
Why is it processed?	Purpose and lawful basis/contractual necessity
Where is it stored?	Primary region, replicas, logs, backups, and disaster recovery
Who can access it?	Entity, role, country, support access, and authentication controls
Who receives it?	Broker, custodian, KYC vendor, cloud provider, tax authority, regulator
What enables the transfer?	Adequacy, contract, consent, statutory gateway, or other approved mechanism
How long is it retained?	Record-specific schedule and deletion/hold rule

“Hosted in region” is not a complete answer if support, telemetry, backups, or subprocessors can access the data elsewhere. Evaluate the entire processing chain.

Production evidence

Executed DPA and controller/processor responsibility record.
Current data map, subprocessor register, transfer mechanism, and transfer-risk assessment where required.
Tax responsibility matrix by entity, product, account type, and jurisdiction.
Valid self-certification workflow and change-in-circumstances process.
Sample annual statement/report, reconciliation, submission receipt, and correction test.
Retention schedule covering financial records, KYC, disputes, legal holds, backups, and sandbox deletion.

Reference standards

See Privacy, retention, and residency for platform retention and production-certification requirements.