I suspected as much, however that avenue appears all far too convenient. Even with a multilateral framework agreement as comprehensive as CRS, it's only as strong as the weakest link. If FIs don't authenticate the client's tax residency, then the whole system is underpinned by honesty through self-certification?
On the balance of probability, there appear to be no safeguards which︀ prevent a bank customer from stating they're a tax resident of a non-CRS country, even︁ if in fact he or she isn't?