The HKSAR Government issued a consultation paper¹ in December 2025 on implementing the new Crypto-asset Reporting Framework (CARF), the amended Common Reporting Standard (CRS), and measures to strengthen CRS administration in Hong Kong. The Inland Revenue (Amendment) (Crypto-asset Reporting Framework and Amended Common Reporting Standard) Bill was gazetted on 22 May 2026² and introduced to the Legislative Council on 3 June 2026. Upon enactment, CARF and amended CRS will take effect in Hong Kong on 1 January 2027 and 1 January 2028 respectively.

CARF is a new tax transparency framework for the reporting and automatic exchange of information with respect to crypto-assets.  The key features of CARF are summarised as follows.

“Crypto asset” is defined under CARF as a digital representation of value that relies on a cryptographically secured distributed ledger or a similar technology to validate and secure transactions.  It represents a right to value, which can be traded or transferred in a digital manner including both fungible and non-fungible tokens.

Accordingly, all crypto assets (with following exceptions) fall within the scope of CARF (covered crypto-assets).

• central bank digital currencies (CBDCs);
• specified electronic money products (SEMPs); and
• crypto-assets which reportable crypto-asset service providers (RCASPs) have adequately determined cannot be used for payment or investment purposes.

An RCASP refers to any individual or entity that, as a business, provides services executing exchange transactions in relation to crypto-assets for or on behalf of customers. Examples of RCASPs include crypto-asset brokers or dealers, operators of certain crypto-asset automated teller machines, and crypto-asset exchanges, etc. 

The following types of transactions are reportable under CARF:

• exchanges between covered crypto-assets and fiat currencies;
• exchanges between one or more forms of covered crypto-assets; and
• transfer of covered crypto-assets.

An RCASP would be regarded as an HKRCASP and subject to due diligence and reporting obligations in Hong Kong if it fulfills one of the following nexus criteria. The following criteria would be assessed in a prescribed hierarchy, under which tax residence in Hong Kong ranks first.

• an individual or entity is a tax resident in Hong Kong³ ;
• an entity that (1) is incorporated or organised under the laws of Hong Kong and (2) has a legal personality in Hong Kong or has an obligation to file tax returns or tax information returns to the Inland Revenue Department (IRD) with respect to the income of the entity;
• an entity managed from Hong Kong; or
• an individual or entity that has a regular place of business in Hong Kong.

An RCASP would also be regarded as an HKRCASP if the RCASP has a branch in Hong Kong through which relevant transactions are effectuated. However, the relevant due diligence and reporting obligations will be limited to the transactions that are effectuated through the branch in Hong Kong.

An HKRCASP is not required to comply with the due diligence and reporting requirements in Hong Kong if the requirements are completed in a partner jurisdiction with a higher reporting nexus or substantially similar nexus (upon election).

For each reporting period (generally refers to each calendar year), an HKRCASP is required to apply due diligence procedures to identify each reportable user / person (including both crypto-asset users and controlling persons⁴ for passive entity account holders) and report prescribed information in respect of the reportable users/persons (e.g. tax residence, taxpayer identification number of the reportable users/persons, etc) and reportable transactions (e.g. type of covered crypto-assets, aggregate fair market value of the transaction, etc).

An HKRCASP is required to obtain self-certifications from the reportable users/persons at the time when taking in new customers to identify (1) the tax residence of a crypto-asset user or its controlling person and (2) whether the crypto-asset user or its controlled person is a reportable users/persons. For any pre-existing customers, self-certifications must be obtained no later than 12 months after CARF becomes effective in Hong Kong (i.e. 1 January 2028). The HKRCASP must confirm the reasonableness of such self-certifications for identifying their tax residence. 

The administrative measures implemented under CARF are largely mirrored from the strengthened administration of the CRS regime introduced in March 2026, which are summarised as follows.

(i) Mandatory registration requirement

All HKRCASPs are required to register an account in the CARF Portal, regardless of whether the HKRCASPs has any CARF information to report to the IRD by 31 January of the following year where the entity becomes an HKRCASP.

(ii) Record-keeping requirements

• HKRCASPs are required to keep sufficient records of (1) the steps taken and information collected for carrying out due diligence procedures and (2) information for ascertaining the correctness and accuracy of CARF information reported to the IRD for a period of six years from the end of the calendar year to which the evidence or records relate or the return due date, whichever is later.
• An entity or individual that has ceased to be an HKRCASP but has not been dissolved will still be subject to the above record-keeping requirements. The entity or individual is also required to inform the IRD within one month of its cessation or any change of contact details following such a cessation.
• Any person who is a director (or a trustee or person who was responsible for the management, if there was no director) of the HKRCASP immediately before its dissolution is required to ensure that sufficient records of the HKRCASP are kept until the end of the above six-year record-keeping period. These persons will also be required to inform IRD within one month of the dissolution or any change of contact details following such dissolution.

(iii) Penalty for non-compliance

The Bill introduces new penalty provisions related to HKRCASPs’ non-compliance and wrongdoings. Please refer to Annex B of the Legislative Council Brief⁵ for the key proposed penalties, where the financial penalty would also be referenced to the number of affected accounts. Examples of the penalty provisions are imposition of fines for committing the following offences without reasonable excuse, (i) failure to register an account in the CARF Portal, (ii) providing incorrect or incomplete information when furnishing returns, statements or information, and (iii) failure to carry out due diligence obligations.

Separately, the Bill proposes to put in place an “administrative penalty” mechanism for non-compliance without reasonable excuse, which is modelled from the “additional tax” mechanism under the profits tax regime.  HKRCASPs which have committed certain offences without reasonable excuse can be liable to an administrative penalty provided that no prosecution has been initiated for the same facts. For example, if an HKRCASP discovers certain information is inaccurate in the return and without reasonable excuse fails to notify the IRD within a reasonable time, the HKRCASP could be subject to a fine either at the higher of level 3 (HK$10,000), or a fine of HK$1,000 for each impacted crypto-asset user.

The amendments to the existing CRS framework in Hong Kong are summarised as follows: 

The scope of reportable assets is now expanded to include the following assets:

• Digital money products including SEMPs and CBDCs; 
• Derivatives reference covered crypto-assets; and
• Investment entities investing in covered crypto-assets.

The definitions of “depository entities” and “depository accounts” are amended accordingly to cover digital money providers and accounts that hold SEMPs and CBDCs. 

Reporting obligations under the amended CRS are expanded to cover (i) the role of controlling person⁴ in relation to the entity account holder and the role(s) of equity interest holders in an investment entity, (ii) whether the account is a pre-existing or new account, (iii) whether a valid self-certification has been obtained, (iv) whether the account is a joint account and the number of joint holders, and (v) the type of financial account.

The Bill introduces various measures to strengthen the due diligence requirements under the amended CRS.  Key changes are summarised as follows:

• In circumstances where a self-certification cannot be obtained and validated by a reporting financial institution (RFI) with respect to a new account in time, the RFI is required to apply the due diligence procedures for pre-existing accounts to the new account until the self-certification is obtained and validated by the RFI. 
• In case an account holder or a controlling person⁴ is a tax resident in 2 or more jurisdictions, such account holders or controlling persons⁴ cannot rely on the tiebreaker rules contained in any tax arrangements and must declare all jurisdictions of tax residence.
• RFIs should not rely on a self-certification or documentary evidence where it knows or has reason to know that it is incorrect or unreliable.

1.  For more details, please refer to our previously issued Hong Kong SAR Tax Alert - Issue 2, January 2026.

2.  The Bill can be accessed via this link: https://www.legco.gov.hk/yr2026/english/bills/b202605221.pdf

3.  An RCASP is a Hong Kong tax resident if:

  (a) where the RCASP is an individual, the individual ordinarily resides in Hong Kong or stays in Hong Kong for more than 180 days during a year of assessment (YOA) or for more than 300 days in two consecutive YOAs.

  (b) where the RCASP is a company or an entity other than a company, it is incorporated in Hong Kong / constituted under the laws of Hong Kong, or if the company/entity is incorporated / constituted outside Hong Kong, it is normally controlled or managed in Hong Kong.

4.  Controlling person refer to an individual who exercises control over an entity.

5.  The Legislative Council Brief can be accessed via this link: https://www.legco.gov.hk/yr2026/english/brief/tsybr200800360c_20260520-e.pdf