API Endpoint: FATCA GIIN

The fatca-giin endpoint checks a Global Intermediary Identification Number against the IRS FATCA Foreign Financial Institution list.

POST `/api/v1/validate/fatca-giin`

https://www.tincomply.com/api/v1/validate/fatca-giin

Checks a GIIN against the IRS FATCA Foreign Financial Institution (FFI) list and returns the registered institution name and country.

Request body

Field	Type	Description
`giin`required	string	The 19-character GIIN, including the dots.

Response object: `fatcaGiinResult`

Field	Type	Description
`giin`	string	The GIIN checked.
`name`	string	Registered institution name.
`country`	string	Registered country.
`found`	bool	True when the GIIN is on the FFI list.
`message`	string	Human-readable summary of the result.
`completed`	bool	False when the upstream source was unavailable. The request is retried automatically; call request-details with the request id later to get the finished result.

What to do with this result

When you see	Do this
found is true and name matches	Accept the GIIN on the W-8BEN-E and keep the request id with the form.
found is true but name differs	The GIIN belongs to another institution. Ask the entity to confirm its GIIN.
found is false	The GIIN is not on the FFI list. Request a corrected W-8BEN-E; without a verified GIIN, FATCA withholding may apply to withholdable payments.
completed is false	The source was unavailable. Keep the request id and call request-details later; the result fills in once the retry succeeds.

Sample request

curl -X POST https://www.tincomply.com/api/v1/validate/fatca-giin \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"giin":"29SR4B.99999.SL.372"}'

import requests

response = requests.post(
    "https://www.tincomply.com/api/v1/validate/fatca-giin",
    headers={"X-API-Key": "YOUR_API_KEY"},
    json={
        "giin": "29SR4B.99999.SL.372",
    },
)
response.raise_for_status()
print(response.json()["fatcaGiinResult"])

using System.Text;

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-API-Key", "YOUR_API_KEY");

var body = """
{
  "giin": "29SR4B.99999.SL.372"
}
""";
var response = await client.PostAsync(
    "https://www.tincomply.com/api/v1/validate/fatca-giin",
    new StringContent(body, Encoding.UTF8, "application/json"));

Console.WriteLine(await response.Content.ReadAsStringAsync());

const response = await fetch("https://www.tincomply.com/api/v1/validate/fatca-giin", {
  method: "POST",
  headers: {
    "X-API-Key": "YOUR_API_KEY",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    giin: "29SR4B.99999.SL.372",
  }),
});
const data = await response.json();
console.log(data.fatcaGiinResult);

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String body = """
            {
              "giin": "29SR4B.99999.SL.372"
            }
            """;
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://www.tincomply.com/api/v1/validate/fatca-giin"))
            .header("X-API-Key", "YOUR_API_KEY")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        // Parse with your JSON library (Jackson, Gson) and read fatcaGiinResult.
        System.out.println(response.body());
    }
}

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
)

func main() {
	body := []byte(`{
	  "giin": "29SR4B.99999.SL.372"
	}`)

	req, err := http.NewRequest("POST", "https://www.tincomply.com/api/v1/validate/fatca-giin", bytes.NewReader(body))
	if err != nil {
		log.Fatal(err)
	}
	req.Header.Set("X-API-Key", "YOUR_API_KEY")
	req.Header.Set("Content-Type", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	var data map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		log.Fatal(err)
	}
	fmt.Println(data["fatcaGiinResult"])
}

$body = @'
{
  "giin": "29SR4B.99999.SL.372"
}
'@

$response = Invoke-RestMethod -Method Post `
    -Uri "https://www.tincomply.com/api/v1/validate/fatca-giin" `
    -Headers @{ "X-API-Key" = "YOUR_API_KEY" } `
    -ContentType "application/json" `
    -Body $body

$response.fatcaGiinResult

Sample response

{
  "id": "Gf5hJ7kL9zXc2vB4nM6qW8eR",
  "request": {
    "giin": "29SR4B.99999.SL.372",
    "requestDate": "2026-10-01T14:02:11Z",
    "requestedServices": "fatca-giin"
  },
  "fatcaGiinResult": {
    "giin": "29SR4B.99999.SL.372",
    "name": "IBM Ireland Profit Sharing Scheme",
    "country": "IRELAND",
    "message": "GIIN match found",
    "found": true,
    "completed": true
  }
}

Errors

Requests that cannot be processed return HTTP 400 with an object keyed by field name, each listing what was wrong. Authentication, permission and other status codes are covered in Errors & service status.

This endpoint requires an API key with the Validate permission.

See how this check works in the portal and what it costs: FATCA & LEI Validation