[Topfi]

But neither of your described scenarios applies to either of the two.

Both FATCA and GDPR apply to entities/companies that deal with citizens from their respective jurisdiction. FATCA applies e.g. to foreign banks handling US customers, GDPR to foreign data processors handling EU user data.

If you don't want either to apply to you, easy, just don't handle US customers money/process EU user data.

[kstrauser]

The penalty for non-compliance comes down to: you can't do business with the US government anymore, which is a huge bummer for any financial institution. If you don't care about that, say because you're a credit union servicing a small town in Brazil and you had a single American move there, I imagine you'd also ignore it.

[Topfi]

I am by no means an expert, but as far as I am aware FATCA violations carry slightly higher penalties then what you suggest and are very much not limited to "you can't do business with the US government anymore".

Also, even if "you're a credit union servicing a small town in Brazil" and even if the penalty was as limited as you think it is, I doubt even a smaller institution could survive loosing access to US securities, etc.