This is how the information flows:
- Financial institution (FI) collects information.
- FI submits information via online portal or API to their competent authority ("CA", usually their local tax authority, FSA, or FIU).
- The competent authority sends the data to each relevant jurisdiction's CA.
- The new CA receives the data.
Countries enter into MCAAs (Mutual Competent Authority Agreements) with each other to establish with whom they shall share data with and receive data from.
CRS is basically just XML files, which are designed by automatically parsable. The software vendors making CRS XML parsers sell them to the CAs, not to the banks. Every software I've seen/heard of has been installed on-premises (on the CA's servers). Due to data protection and other privacy laws, the vendor doesn't have access to the data.