Hong Kong Passes Crypto Tax Reporting Law, With Data Collection Starting in 2027

Crypto transactions enter Hong Kong's tax information network

Hong Kong's Legislative Council passed legislation on November 4, 2026, requiring covered cryptocurrency businesses to collect customer and transaction information from 2027, ahead of automatic exchanges with overseas tax authorities beginning in 2028.

The Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 creates two related schedules. The Crypto-Asset Reporting Framework, known as CARF, starts in 2027. Changes to the Common Reporting Standard, or CRS, begin in 2028, with the first international exchanges under that updated standard in 2029.

The government's November 4 announcement says Hong Kong will exchange information with partner tax jurisdictions annually, on a reciprocal basis and subject to confidentiality and security safeguards. Reciprocity means participating authorities send information as well as receive it.

For customers, the practical change is that covered providers will need information such as tax residence and taxpayer identification numbers alongside transaction details. For businesses, the law brings registration, customer checks, record retention and reporting duties, backed by penalties.

Financial Services and the Treasury Secretary Christopher Hui linked adoption of the standards to Hong Kong's position as a financial centre.

"Implementing the latest international standards for automatic exchange of information in tax matters is crucial to maintaining Hong Kong's reputation as an international financial and commercial centre," Hui said.

Hui also said alignment would give crypto businesses, financial institutions and digital asset users greater confidence to operate and invest in Hong Kong over the long term. The immediate task for providers is to prepare their customer records and reporting systems before collection begins.

Two standards follow different timetables

CARF and CRS address different parts of financial activity. CARF focuses on transactions involving crypto assets, while the amended CRS broadens financial account reporting to cover additional digital financial products and relevant crypto asset holdings.

Hong Kong has exchanged financial account information under CRS annually since 2018. The new legislation extends that tax information network into a market where customers can trade digital assets through businesses operating across borders.

The legislative and implementation timetable spans several years:

• December 2025 to February 2026: The government consulted financial institutions, professional bodies and crypto businesses.
• May 22, 2026: The bill was gazetted, formally publishing the proposed legislation.
• June 2026: The bill was introduced to lawmakers.
• July 15, 2026: The government issued its consolidated response to submissions considered by the Bills Committee.
• November 4, 2026: The Legislative Council passed the bill.
• 2027: CARF takes effect and covered providers begin collecting specified information.
• 2028: CARF information exchanges begin, and the amended CRS takes effect.
• 2029: Financial account exchanges under the amended CRS begin.

PwC's May tax bulletin described proposed commencement dates of January 1, 2027, for CARF and January 1, 2028, for the amended CRS. The government's passage announcement confirms the implementation years.

PwC also identified a separate bill, gazetted in March, dealing with administration of the existing CRS. Those administrative changes were scheduled for January 1, 2027, ahead of the broader change in the products covered by the amended CRS in 2028. Businesses therefore face related changes at different stages rather than a single reporting deadline.

Which businesses and transactions are covered?

Reporting obligations apply to crypto service providers with a reporting connection, described in the legislation as a nexus, to Hong Kong. Covered activities include facilitating transactions for customers through exchanges, brokers, dealers and certain crypto ATM operators.

Acting Secretary for Financial Services and the Treasury Joseph Chan said implementation measures include registration with the Inland Revenue Department, retention of due diligence records and sanctions for breaches of reporting and customer checking requirements. Due diligence means checking the information needed to identify customers and determine their reporting status.

CARF reporting covers exchanges between cryptocurrencies and ordinary currencies, trades between different crypto assets and certain transfers involving external wallets. A customer who exchanges one token for another can therefore generate a reportable transaction even without converting the proceeds into cash.

Providers must collect identifying information about reportable customers, including their tax residence and taxpayer identification numbers, together with relevant transaction details. Tax residence identifies the jurisdiction whose tax rules apply to a person based on that jurisdiction's residence criteria.

The Inland Revenue Department has launched a self-assessment tool to help individuals and entities determine whether they have a Hong Kong reporting nexus and fall within the registration, due diligence and reporting requirements. This assessment matters because a business first needs to establish whether the framework applies to it before designing its compliance process.

Tokens, digital money and the boundary with CRS

The amended law defines a crypto asset as a digital representation of value that uses cryptographically secured distributed ledger technology, or similar technology, to validate and secure transactions. Its ownership or associated rights must be capable of being traded or transferred digitally.

A distributed ledger is a shared record of transactions maintained across a network. Cryptography provides mathematical methods for securing that record and checking that transactions are authorised.

The definition includes tokens representing claims, membership rights or property rights against a person or entity that can be exchanged digitally for ordinary currency or other crypto assets. It also includes fungible and non-fungible tokens that can be traded or transferred digitally. Fungible tokens are interchangeable units; a non-fungible token represents something distinct.

CARF's reporting scope has exclusions. Central bank digital currencies, specified electronic money products and certain assets that cannot be used for payments or investment fall outside it. The amended CRS brings certain digital financial products, including central bank digital currencies, specified electronic money products and financial instruments linked to cryptocurrencies, into financial account reporting.

The legislation also contains measures intended to prevent duplicate reporting where relevant crypto assets fall within both frameworks. Providers handling several kinds of digital products will need to identify which reporting regime applies to each part of their business.

Why Hong Kong kept the international rules

The Organisation for Economic Co-operation and Development announced CARF in 2023 in response to the rapid growth of digital asset markets. Its purpose is to give participating tax authorities a common format for exchanging information about crypto transactions involving their residents.

The Financial Services and the Treasury Bureau's July 15 response explains why Hong Kong rejected suggestions for reporting requirements based on transaction volume or data type that were outside the agreed CARF rules.

The response addressed submissions from KPMG, the Liberal Party, PwC and Professor Yi Haibo of Shenzhen Polytechnic University. The bureau said the definitions, reporting duties and customer checking requirements reflected international consensus, leaving Hong Kong no room to introduce its own departures in those areas.

The government warned that failing to adopt the required rules could lead to Hong Kong's framework being judged unqualified during OECD peer reviews and receiving unfavourable ratings. It connected that risk directly to the city's reputation as an international financial centre.

Hong Kong's approach therefore combines common international reporting requirements with local arrangements for administration, enforcement and business support. Providers operating across participating jurisdictions should encounter a shared core standard, while still needing to meet Hong Kong's registration and filing procedures.

Penalties extend to false declarations and missing records

The enforcement framework includes an administrative penalty mechanism as an alternative to prosecution. People who knowingly provide false information in self-certifications may also face penalties. A self-certification is a declaration customers provide about matters such as their tax residence.

The July government response said penalties calculated according to the number of crypto asset users or controlling persons involved would have no cap. Controlling persons are the individuals who ultimately control an entity, information that can help tax authorities identify the people behind an account or customer relationship.

The bureau said this approach was intended to make penalties proportionate to the nature and seriousness of breaches. It compared the structure with existing CRS penalties calculated by the number of financial accounts involved and noted that Singapore also used comparable penalties without a cap.

For a provider with many affected customers, a single failure in its reporting process could therefore expose it to penalties calculated across a large number of people. Accurate customer information and reliable record systems become important operational requirements.

The Inland Revenue Department will consider the nature and seriousness of each case. The government said businesses could explain unintentional administrative errors or first offences to the department. The legislation also provides appeal arrangements and a reasonable-excuse defence for specified record retention failures.

Records must survive a provider's dissolution

Closing a Hong Kong reporting crypto business will not end its record retention obligations. The amendments allow specified people associated with a dissolved provider to jointly appoint someone to carry out those duties.

The people covered include former directors or, where there was no director, trustees or people responsible for management. The July response described allowing them to designate one specified officer or a person employed in an executive capacity by the dissolved entity.

The appointed person's responsibilities include notifying the Inland Revenue Department of the dissolution, keeping records, updating contact details and complying with relevant notices from an assessor. Responsibility for offences connected with those transferred duties falls to the appointed person.

Monetary penalties and appeal provisions for record retention failures also extend to specified and appointed people, with a reasonable-excuse defence. The government said exemptions and defences under section 758 of the Companies Ordinance would count as reasonable excuses for specified offences.

These arrangements give the tax authority a continuing point of contact after a business disappears. They also allow former officers to place the duties with an identified person rather than leaving each of them responsible for performing the same tasks.

How information exchanges will be protected

Hong Kong will exchange CARF information with eligible partner tax jurisdictions under confidentiality and data security conditions. The government's July response sets out checks that apply before a jurisdiction can receive information and grounds for stopping exchanges later.

Participating jurisdictions must pass OECD assessments of confidentiality and data safeguards before receiving information from partners. Transmission will be suspended if a jurisdiction cannot meet the prescribed standards.

The Multilateral Competent Authority Agreement on CARF also allows a jurisdiction to suspend exchanges by written notice where another jurisdiction has seriously failed to comply with confidentiality and safeguard provisions.

Within Hong Kong, the Inland Revenue Department requires staff to take an oath of secrecy when appointed and to receive training on information security and confidentiality. The bureau said the department also conducts security risk assessments, external audits and system updates.

Providers were advised to follow guidance from the Privacy Commissioner for Personal Data, including taking practicable steps to keep personal information accurate and allowing people to review and correct their personal and transaction data. For customers, the reporting process therefore includes both disclosure obligations and protections governing how their information is handled.

Preparation meets a wider reporting gap

The Inland Revenue Department has established a dedicated support team, a CARF website, guidance, frequently asked questions and a self-assessment tool. The July response also set out plans for stakeholder briefings, self-certification templates and a dedicated CARF Portal.

The planned portal will include a tool for entering data and generating submission files, plus a testing environment. Providers using their own software or software from another supplier will be able to submit test files for validation before making formal submissions. No portal launch date was given.

CARF's practical reach remains a major issue internationally. Blockchain analytics firm Chainalysis estimated that potentially taxable activity recorded on blockchains exceeded $457 billion worldwide in 2025. Its analysis put about 14% within CARF's practical reporting reach and 86% outside it.

Using those rounded shares and $457 billion as a reference gives roughly $64 billion within reach and $393 billion outside. The activity outside practical coverage included decentralised exchange transactions, direct transfers between people, income received on blockchains and cryptocurrency payments. Hong Kong's new obligations focus on identifiable service providers within the reporting framework, while substantial activity takes place through other channels.

The tax legislation also arrives alongside Hong Kong's broader digital asset regulatory programme. In October, the government outlined licensing plans for dealing, custody, advisory and asset management services, alongside existing regimes for trading platforms and stablecoin issuers.

For businesses, those developments create parallel responsibilities: permission to conduct regulated services and duties to collect and report tax information. The next fixed milestones are the start of CARF collection in 2027 and the first international exchanges in 2028.

Key Points

• Hong Kong's Legislative Council passed the crypto tax reporting bill on November 4, 2026.
• Covered providers must begin collecting CARF information in 2027, with international exchanges starting in 2028.
• The amended CRS takes effect in 2028, followed by its first exchanges in 2029.
• Reporting covers crypto trades and certain external wallet transfers, with customer tax residence and identification information required.
• Providers face registration, customer checking, record retention and reporting duties, backed by penalties.
• Partner jurisdictions must meet confidentiality and data security standards to receive information.
• The Inland Revenue Department is providing compliance support and plans a dedicated reporting portal with file testing.