Hong Kong Passes Crypto Tax Reporting Law, Putting Crypto Service Providers Under CARF From 2027

Hong Kong's Legislative Council on 4 November 2026 passed the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026. The law brings the OECD's Crypto-Asset Reporting Framework (CARF) into the Inland Revenue Ordinance (Cap. 112), so that crypto-asset service providers with a connection to Hong Kong will collect tax information about their customers' crypto transactions and report it to the Inland Revenue Department (IRD), which will exchange it with partner tax authorities.

According to the government's statement on the passage, CARF will be implemented in Hong Kong next year, when relevant service providers will start collecting the required information, and the IRD will begin exchanging it with partner jurisdictions from 2028. The same bill updates Hong Kong's existing Common Reporting Standard (CRS) regime; the amended CRS takes effect in 2028, with the first exchanges under the new standard from 2029.

Who Has to Comply and What They Must Do

The obligations fall on reporting crypto-asset service providers. The IRD describes these as any individual or entity that, as a business, carries out exchanges between crypto-assets, or between crypto-assets and fiat currency, for or on behalf of customers, whether as a counterparty, as an intermediary or by running a trading platform. The IRD's examples, taken from the OECD, include dealers trading on their own account with customers, crypto ATM operators, exchanges acting as market makers, brokers, and firms that subscribe tokens from an issuer to resell them. Central bank digital currencies, specified electronic money products and crypto-assets that cannot be used for payment or investment are outside the reporting scope.

A provider falls under Hong Kong's rules if it is tax resident in Hong Kong, is incorporated or organised under Hong Kong law, is managed from Hong Kong, or has a regular place of business there, including a branch. Providers with links to several jurisdictions follow the CARF hierarchy of these tests, which is designed to avoid duplicate reporting.

The IRD's summary of the bill sets out four main duties. First, every provider that meets the nexus rules must register an account on a new IRD CARF Portal by 31 January of the year after it first meets the criteria, even if it has nothing to report. For a provider in scope from 1 January 2027, that points to 31 January 2028. Second, providers must obtain tax-residence self-certifications from new customers at onboarding and check that they are reasonable; for existing customers this must be done within 12 months of the rules coming into operation. Third, they must file annual returns covering exchanges between crypto-assets and fiat, exchanges between crypto-assets, and transfers, including transfers to external wallet addresses, with customer identification and aggregated figures per crypto-asset type. Fourth, they must keep due diligence and reporting records for six years after the relevant return's due date, an obligation that survives the provider's dissolution and then passes to its former directors.

Penalties and Changes to the Common Reporting Standard

The bill creates offences for failing to register, carry out due diligence or report, for giving incorrect or incomplete information, and for failing to tell the IRD after discovering that a return was misleading or inaccurate. Some penalties are calculated per day of continuing offence after conviction or per customer involved. A customer who knowingly or recklessly gives false information in a material particular in a self-certification also commits an offence. As an alternative to prosecution, the IRD can impose an administrative financial penalty, which the provider may contest with written representations and appeal to the independent Board of Review.

The CRS amendments widen the existing regime for banks and other financial institutions to digital money products, derivatives that reference crypto-assets, and investment entities that invest in crypto-assets. Reporting institutions will have to report more detail on account holders and accounts. To prevent double reporting, an institution that is also a reporting crypto-asset service provider reports crypto-asset gross proceeds under CARF rather than under the CRS, although it may choose to report under both.

Background and What Comes Next

The OECD published CARF in 2023. Hong Kong committed to a first CARF exchange in 2028 on condition that domestic legislation was in place by 2026. The government consulted on the proposals between December 2025 and February 2026, gazetted the bill on 22 May 2026 and introduced it for first reading on 3 June 2026. The IRD's bill pages set the start dates at 1 January 2027 for CARF and 1 January 2028 for the amended CRS.

Several practical pieces are still outstanding. The IRD has said it will build the CARF Portal and publish the data schema for returns, and the bill empowers the Commissioner of Inland Revenue to publish the lists of reportable and partner jurisdictions; none of these had been published on the IRD's CARF page as of 4 November 2026. The government said the IRD will issue guidance and has set up a dedicated team to answer industry questions. Exchanges will happen on a reciprocal basis and subject to data confidentiality and security safeguards.

CARF is a tax reporting regime and sits alongside, not in place of, Hong Kong's licensing rules. Virtual asset trading platforms still need a licence from the Securities and Futures Commission, but licensed platforms, dealers and other crypto businesses that meet the nexus tests will now also have to prepare onboarding, data and reporting systems for the IRD before the 1 January 2027 start date.