New Crypto-Asset Reporting Framework and Amended Common Reporting Standard for Hong Kong

The Hong Kong Government has gazetted the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 (the CARF Bill) which was introduced to Legco for First and Second Readings on 3 June 2026 and is currently before a Bills Committee for clause-by-clause scrutiny; it has not yet been enacted. The CARF Bill will amend the Inland Revenue Ordinance (Cap. 112) (the IRO) to implement the OECD’s Crypto-Asset Reporting Framework (CARF) and amendments to the existing Common Reporting Standards (CRS), following a public consultation the Government ran between December 2025 and February 2026.

Part 2 of the CARF Bill (implementing CARF) will commence on 1 January 2027, and Part 3 (implementing the amended CRS) will commence on 1 January 2028. Hong Kong has committed to conducting its first automatic exchange of tax information on crypto-asset transactions under CARF in 2028, conditional on the necessary domestic legislation being in place.

The CARF Bill should be read and interpreted alongside the separate Inland Revenue (Amendment) (Automatic Exchange of Information) Ordinance 2026 (the Amendment Ordinance) which was passed on 17 June 2026. That Ordinance addressed concerns raised in the OECD’s second-round peer review of Hong Kong’s Automatic Exchange of Information and CRS implementation by introducing mandatory registration for all Reporting Financial Institutions (RFIs), along with emphasizing record-keeping obligations and a strengthened penalty regime, effective from 1 January 2027. It is separate from, but closely linked to, the CARF/CRS Bill discussed in this newsletter.

What is the Crypto-Asset Reporting Framework?

The Crypto-Asset Reporting Framework (CARF) is the international tax transparency standard published by the Organisation for Economic Co-operation and Development (OECD) on 8 June 2023 providing for the automatic exchange of tax relevant information on Crypto-Assets. It is set out in Part 1 of the International Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and the 2023 update to the Common Reporting Standard and contains three key parts:

• a set of model rules and accompanying commentary intended for incorporation into domestic legislation, enabling jurisdictions to gather information from Reporting Crypto-Asset Service Providers (RCASPs) that have a sufficient connection to the implementing jurisdiction. These rules are built around four core pillars: (i) which categories of crypto-assets fall within scope; (ii) which entities and individuals are caught by the data collection and reporting obligations; (iii) which transactions must be reported; and (iv) the due diligence procedures required to identify Crypto-Asset Users and Controlling Persons and to establish the relevant tax jurisdiction(s) for reporting and exchange purposes;
• a Multilateral Competent Authority Agreement (the CARF MCAA), with associated commentary, providing the legal basis for the automatic exchange of CARF information between competent authorities (with bilateral agreements or arrangements available as an alternative); and
• a prescribed electronic (XML) schema, used both by competent authorities to exchange CARF data between jurisdictions and by RCASPs to submit CARF information to tax authorities, where domestic law permits.

Crypto-Assets subject to CARF

Under CARF, a crypto-asset refers to a digital representation of value that relies on a cryptographically secured distributed ledger or similar technology to validate and secure transactions. The crypto-asset must represent a right to value, and the ownership of, or right to, that value must be capable of being digitally traded or transferred to other individuals or entities. The definition is functional and captures both fungible and non-fungible tokens.

Relevant crypto-assets are those in respect of which RCASPs must fulfil due diligence and reporting requirements. Relevant crypto-assets are all crypto-assets except:

• central bank digital currencies;
• specified electronic money products and;
• crypto-assets that, as adequately determined by the RCASP, cannot be used for payment or investment purposes.

Who is Affected: Reporting Crypto-Asset Service Providers (RCASPs) and Hong Kong Nexus

Definition of RCASP

Under CARF, an RCASP is any individual or entity that, as a business, provides a service effecting exchange transactions (that is, exchanges between relevant crypto-assets, and between relevant crypto-assets and fiat currencies) for or on behalf of customers. This includes acting as a counterparty or as an intermediary to such exchange transactions, or making available a trading platform. According to the OECD, examples of RCASPs include dealers acting for their own account to buy and sell relevant crypto-assets, operators of crypto-asset ATMs, crypto-asset exchanges acting as market makers that take a bid-ask spread as commission, brokers buying or selling crypto-assets on behalf of clients, and individuals or entities that subscribe for relevant crypto-assets from an issuer for resale or distribution to customers.

This definition is broader than the existing definition of virtual asset service provider¹ under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) licensing regime. The existing definition currently only requires operators of Virtual Asset Trading Platforms (VATP) to be licensed, although legislative amendments are in progress to extend the licensing requirement to providers of virtual asset dealing, advisory, management and custodian services. CARF is expected to bring over-the-counter dealers, intermediaries and brokers operating or managed in Hong Kong within scope, even where they fall outside the AMLO licensing regime.

Hong Kong Nexus Rules

An RCASP will be subject to the due diligence and reporting requirements in Hong Kong if it is:

• an individual or entity that is a tax resident in Hong Kong;
• an entity that is incorporated in Hong Kong or organised under Hong Kong laws, and either has legal personality there or an obligation to file tax returns in respect of its income to Hong Kong’s Inland Revenue Department (IRD);
• an entity that is managed from Hong Kong; or
• an individual or entity that has a regular place of business in Hong Kong, including a branch.

An RCASP may have connecting factors (nexuses) with a number of jurisdictions simultaneously, meaning it could fall within the due diligence and reporting obligations of more than one jurisdiction at the same time. To guard against an RCASP becoming subject to duplicative reporting obligations across jurisdictions, CARF establishes a tiered (“cascading”) order of priority as between these nexus criteria.

Reportable Transactions and Information under CARF

The following three types of transactions are relevant transactions reportable under CARF:

• an exchange between relevant crypto-assets and fiat currencies;
• an exchange between one or more forms of relevant crypto-assets; and
• transfers of relevant crypto-assets (including reportable retail payment transactions, other transfers to and by a reportable user, and transfers to external wallet addresses).

An RCASP meeting the Hong Kong nexus rules (HKRCASP) must report the required information in respect of its crypto-asset users who are reportable users (individuals and entities), or whose controlling persons are reportable persons (entities only) for each calendar year or other appropriate reporting period.

A reportable user or reportable person is an individual or entity that is a tax resident in Hong Kong. The required information includes:

• the RCASP’s identification information: name, address and identifying number (if any);
• identification information for each reportable user or reportable person: name, address, jurisdiction(s) of residence, taxpayer identification number(s), date and place of birth (if applicable); and
• for each type of relevant crypto-asset that the RCASP has effected relevant transactions during the calendar year (or other applicable reporting period): aggregated transaction information including the gross amount paid or received or fair market value (if applicable), the number of units and transactions involved in acquisitions and/or disposals against fiat currencies or other relevant crypto assets, or transfers of relevant crypto-assets.

Crypto-Asset Service Providers’ Due Diligence Obligations

An HKRCASP must apply due diligence procedures to identify reportable users and reportable persons, obtaining self-certifications from crypto-asset users and controlling persons when onboarding new customers and confirming the reasonableness of those self-certifications for identifying the relevant jurisdiction(s) of residence. The HKRCASP is not expected to carry out an independent legal analysis of the relevant tax laws to confirm reasonableness.

For pre-existing crypto-asset users, the HKRCASP must obtain self-certification and confirm its reasonableness within 12 months of CARF coming into operation in Hong Kong. Since Part 2 of the Bill will commence on 1 January 2027, this points to a deadline around 1 January 2028 for pre-existing customers.

Where circumstances change in a way that causes the HKRCASP reasonably to know that an original self-certification is incorrect or unreliable, it must not continue to rely on it, and must either obtain a fresh, valid self-certification or a reasonable explanation and documentation supporting the validity of the original. The CARF Bill also proposes allowing an HKRCASP to elect to apply the same due diligence procedures to crypto-asset users or controlling persons who are not in fact reportable users or reportable persons.

Registration and the CARF Portal

The IRD will develop a dedicated CARF Portal to provide HKRCASPs with a channel for submitting CARF returns and information, and will publish a data scheme specifying the required data structure and format. All HKRCASPs meeting the nexus rules and obligations must register an account on the CARF Portal, regardless of whether they have any reportable CARF information. Registration must be made on or before 31 January of the calendar year following the calendar year in which the entity first meets any of the nexus criteria.

HKRCASPs’ Record-Keeping Obligations

HKRCASPs must keep sufficient records of:

• the evidence relied on and the steps taken in carrying out due diligence procedures in relation to crypto-asset users and controlling persons; and
• the information needed to ascertain the correctness and accuracy of CARF information reported to the IRD.

These records must be kept for six years after the due date of the relevant CARF return, and the obligation continues regardless of whether the individual or entity has ceased to be an RCASP or has been dissolved. If a dissolved entity was an RCASP at any time in the preceding six years, every person who was a director (or, if there was no director, a trustee, or the person responsible for management) of the entity immediately before dissolution must ensure the record-keeping requirement continues to be met.

Penalties and Enforcement

The CARF Bill proposes penalties for offences committed by HKRCASPs and their service providers, including:

• non-compliance with registration, due diligence, reporting and other requirements;
• the provision of incorrect or incomplete information; and
• failure to notify the IRD on discovering that a return, information or statement is misleading, false or inaccurate. For this last offence (failing without reasonable excuse to notify the Commissioner within a reasonable time of discovering that a return, information or statement is misleading, false or inaccurate), the fine on conviction is the higher of a fixed fine at level 3 (currently HK$10,000) or HK $1,000 multiplied by the number of crypto-asset users and controlling persons who are the subject of the offence.

A more serious offence - providing information or a return that is misleading, false or inaccurate in a material particular with intent to defraud – carries, on summary conviction, the higher of a fine at level 5 or HK$10,000 multiplied by the number of affected users and controlling persons, together with up to 6 months; imprisonment (with higher penalties available on conviction on indictment). It will also be an offence to knowingly or recklessly provide information that is misleading, false or incorrect in a material particular when making a self-certification.

The CARF Bill also contains a new administrative penalty mechanism² as an alternative to prosecution for certain offences. Where an HKRCASP commits a relevant offence without reasonable excuse, and no prosecution has been imitated for the same facts, it may instead be liable to a financial penalty. The HKRCASP concerned will have the right to submit written representations and evidence to the Commissioner (or Deputy Commissioner) who will assess the financial penalty. An HKRCASP will have a right to appeal a financial penalty to the independent Board of Review within one month of receiving a notice of assessment. The CARF Bill also empowers an assessor to enter the business premises of an HKRCASP or its service providers and inspect records, and amends the existing power to issue search warrants.

Lists of Reportable and Partner Jurisdictions

The CARF Bill empowers the Commissioner to publish, in a manner of their choice:

• a list of reportable jurisdictions for determining whether a crypto-asset user or a controlling person of an entity crypto-asset user is a reportable user or reportable person; and
• a list of partner jurisdictions for determining the jurisdictions in which an RCASP is subject to CARF’s due diligence and reporting requirements.

Both lists will be published and updated in due course.

The Amended CRS (“CRS 2.0”)

New Digital Financial Products Brought Into Scope

Part 3 of the CARF Bill expands the definition of “depository account” under the CRS to include two new categories of digital money product. The first is a Specified Electronic Money Product (SEMP), broadly defined as a product that is:

1. a digital representation of a single fiat currency;
2. issued on receipt of funds for the purpose of making payment transactions;
3. represented by a claim on the issuer denominated in the same fiat currency;
4. accepted in payment by a person other than the issuer; and
5. by virtue of the regulatory requirements applicable to the issuer, redeemable at any time and at par value for the same fiat currency on the holder’s request.

A de minims exclusion applies for low-value SEMP accounts whose rolling average 90-day end-of-day balance or value does not exceed HK$78,000 in any consecutive 90-day period, which broadly aligns with the existing low-value account thresholds under the CRS. This could bring existing Stored Value Facility Licensees, such as Octopus, AlipayHK, WeChat Pay HK, PayMe and BoC Pay, within the CRS reporting framework for the first time.

The second new category is Central Bank Digital Currency (CBDC), meaning a digital fiat currency issued by a central bank. Any digital currency issued in the future by the Hong Kong Monetary Authority would likely fall within this definition. An entity holding SEMPs or a CBDC for a customer’s benefit is treated as a “depository institution”, and where that entity is a Hong Kong tax resident or has a Hong Kong branch, it will be an RFI subject to the CRS’s existing due diligence and reporting requirements for depository accounts.

The amended CRS also expand the definition of “investment entities” to include entities engaged in crypto-asset-related investment activities, whether actively or passively managed; where such an entity is a Hong Kong tax resident or has a Hong Kong branch, it will be subject to the CRS’s due diligence and reporting requirements.

Enhanced Due Diligence for All RFIs

The CRF Bill also introduces extensive amendments to the due diligence procedures applicable to all RFIs (not only those newly caught by the digital-asset expansion), including:

• further information to be included in CRS returns, including whether a valid self-certification has been obtained, whether an account is a joint account and, if so, the number of holders, and the capacity in which a reportable controlling person exercises control;
• enhanced scrutiny of self-certifications, which must be treated as potentially unreliable in a wider range of circumstances, including citizenship-by-investment or residence-by-investment cases, missing taxpayer identification numbers where these are universally issued, or inconsistencies with AML/KYC information;
• temporary self-certification relief for new accounts in exceptional cases where a valid self-certification cannot be obtained within the reporting period, provided the account remains a new account and a valid self-certification is ultimately obtained;
• no reliance on tax treaty tie-breaker provisions: account holders and controlling persons with multiple tax residencies must have all jurisdictions of tax residence reported, rather than a single jurisdiction selected under a treaty tie-breaker rule; and
• a broader concept of “change of circumstances” which includes changes affecting aggregated accounts, with RFIs expected to take into account the latest AML/KYC information and updates; and
• a requirement for RFIs not otherwise bound by AML/KYC procedures consistent with the FATF Recommendations to apply substantially similar procedures when identifying controlling persons.

Interaction Between CARF and the Amended CRS

CARF does not provide a blanket reporting exemption for relevant crypto transactions between related entities. Instead, intra-group relief operates indirectly, principally through the “active entity” concept. An entity qualifies as an active entity if, broadly it does not function as or hold itself out as an investment fund, and (a) 80% or more of its activities consist of holding stock in, or providing financing and services to, one of more subsidiaries engaged in a trade or business other than that of a financial institution (holding or group financing activities); or (b) it is primarily engaged in financial or hedging transactions with or for related entities that are not financial institutions, the group as a whole is primarily non- financial-institution in nature, and the entity does not provide financial or hedging services to entities outside the group (an intra-group treasury or hedging centre).

If an RCASP determines, on the basis of self-certification, that an entity crypto-asset user is an active entity, it is not required to look through that entity to identify its controlling person. Listed corporate groups tend to receive broader relief in practice, as their subsidiaries will typically qualify as “excluded persons”, whereas private groups will need to consider carefully whether their holding or treasury entities meet the active entity definition.

Separately, where an entity is both an RFI and an RCASP, the CARF Bill proposes that gross proceeds from the sale or redemption of covered crypto-assets will not need to be reported again under the amended CRS, provided that the same information has already been reported under CARF, so as to avoid duplicate reporting of the same transactions.

Preparing for CARF Implementation

Although the CARF Bill remains subject to Legislative Council scrutiny and amendment, crypto-asset businesses, virtual asset trading platforms and traditional financial institutions should begin assessing whether they have a Hong Kong nexus under CARF or fall within the expanded CRS, reviewing onboarding and self-certification processes, and considering how due diligence under CARF can be coordinated with existing AML/KYC procedures. An HKRCASP may engage a third-party service provider to carry out its due diligence and reporting obligations, but doing so does not relieve the HKRCASP of its own statutory liability under CARF.