Preparing for the Crypto-Asset Reporting Framework and the related amendments to the CRS and AEOI frameworks in Hong Kong

In March and May 2026, the Hong Kong Government introduced two bills to reform the automatic exchange of information framework and Common Reporting Standard ("CRS") under the Inland Revenue Ordinance ("IRO").

The first piece is the Inland Revenue Amendment (Automatic Exchange of Information) Ordinance 2026, which was passed by the Legislative Council on 17 June 2026 (the "AEOI Ordinance") and the second piece is the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 (the "CARF/CRS Bill") which is currently progressing through the Legislative Council.¹

Part One – AEOI Ordinance 

The AEOI Ordinance was passed to address the concerns identified by the OECD during its second-round peer review of Hong Kong AEOI and CRS implementation in 2024. Key concerns identified were: 

• Inadequate identification of the RFI population — many Financial Institutions ("FIs"), meaning custodial institutions, depository institutions, investment entities or specified insurance companies² which are resident in Hong Kong and should be a Reporting Financial Institution ("RFI") were, however, not registered with the Inland Revenue Department ("IRD"), making comprehensive compliance monitoring impossible.
• Insufficient penalty deterrence — the existing fixed fines were disproportionately low relative to the scale of potential non-compliance, particularly for large RFIs.
• Lack of administrative enforcement tools — sole reliance on criminal prosecution was cumbersome and unlikely to be deployed for minor or technical breaches.

Mandatory registration requirements

The AEOI Ordinance imposes mandatory registration requirements for all RFIs irrespective of whether they maintain any reportable accounts. This triggers annual nil-filing obligations for RFIs without reportable accounts.

Registration deadlines

• Existing RFIs (as at 31 December 2026): by 31 March 2027
• New RFIs (becoming an RFI on or after 1 January 2027): by 31 January of the year following the calendar year in which the entity first becomes an RFI. 

Enhanced record-keeping obligations

The AEOI Ordinance amends the commencement date for calculating the 6-year retention period, which will run from the last day of the relevant reporting period or the CRS return due date, whichever is the later. Entities that cease to be RFIs but are not dissolved must notify the IRD within one month of its cessation and continue to observe the record-keeping obligation.

For RFIs that are dissolved, the record-keeping obligation will be imposed on their former director, trustee, or person responsible for management immediately before dissolution, who must ensure records are kept for the full 6-year period and must notify the IRD within one month of the RFI's dissolution. 

New penalty system

The AEOI Ordinance creates a new category of per-account penalty calculations for offences such as failure to carry out due diligence, incorrect/incomplete information on returns. Under the current regime, an RFI with 500,000 accounts that fails to carry out proper due diligence faces a flat HK$10,000 fine. Under the new regime, the same failure could result in HK$500 million exposure (HK$1,000 × 500,000 accounts).

A new offence is created for failing to register on the AEOI portal, and the penalty accrues for each day where the offence continues.

The AEOI Ordinance will take effect on 1 January 2027.

Part Two – the CARF/CRS Bill

CARF/CRS Bill seeks to amend the Inland Revenue Ordinance by incorporating the Crypto-Asset Reporting Framework ("CARF") and expanding the existing Common Reporting Standard ("amended CRS"), in each case promulgated by the OECD. The CARF will come into operation on 1 January 2027, and the amended CRS will come into operation on 1 January 2028. ³

Part Two A - The creation of the new CRAF regime applicable to crypto asset service providers 

From AMLO Regime to CARF

Starting from 1 June 2023, any business that operates a virtual asset exchange platform in Hong Kong, or holds itself out as carrying on such a business⁴ and where client assets come into direct or indirect possession of the platform operator must be licensed under the licensing regime for Virtual Asset Trading Platform ("VATP") and be subject to additional anti-money laundering requirements under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance ("AMLO")⁵. The VATP regime created an identifiable and regulated population of licensed crypto exchange platform operators subject to AML requirements. With the implementation of CARF⁶, licensed crypto exchange platform operators ("Licensed VATPs") will be further brought into an intentional tax-transparency perimeter. Hong Kong's traditional FIs have been subject to the CRS since 2017, and the CARF bridges the gap by imposing equivalent reporting standards for crypto assets service providers (see definition below, which should include the VATP operators) who may not come within the original definition of an RFI.

What is CARF? 

Developed by the OECD and approved by the G20 in 2022, CARF is designed to address the gap in tax transparency arising from transactions related to crypto-assets, which can be transferred and held without traditional financial intermediaries and therefore fall outside the CRS. Hong Kong has committed to the first exchanges in 2028. The legislative timetable — passing the CARF/CRS Bill implementing CARF with rules taking effect from 1 January 2027 — is the minimum necessary to allow Reporting Crypto-Asset Service Providers a year of due diligence and data collection before the first reporting cycle in 2028.

The CARF applies to a Hong Kong Reporting Crypto-Asset Service Provider ("HKRCASP"). HKRCASP is defined as a Reporting Crypto-Asset Service Provider (RCASP) that meets the Hong Kong Nexus Requirement. ⁷

Key definitions unpacked 

(a) RCASP is defined widely under the CARF/CRS Bill to mean an individual or entity that provides, as a business, a service of effectuating exchange transactions⁸ on behalf of customers, including acting as a dealer, an intermediary or by making available a trading platform. This definition is broader than the current scope of the VATP regime, which captures VA crypto-asset trading platforms in relation to their centralised electronic matching platform, off-platform trading services and incidental services only. (NB: Legislative proposals are expected to be introduced to broaden the licensing regime to cover service providers engaging in virtual asset dealing, virtual advisory, virtual management and VA custodian services). 

(b) Hong Kong Nexus Requirement. An RCASP becomes an HKRCASP and is subject to CARF if it has a Hong Kong nexus. The nexus rules incorporate the OECD's general interpretation of tax residency. An RCASP is regarded as an HKRCASP if such individual or entity is a tax resident in Hong Kong.⁹ Further, where the RCASP is an entity, it satisfies the Hong Kong nexus requirement if it is incorporated or organised under Hong Kong laws, is managed from Hong Kong, has a regular place of business in Hong Kong or has a Hong Kong branch¹⁰.

Licensed VATPs will likely fall within the definition of HKRCASPs and thus be subject to CARF by virtue of carrying on a business in Hong Kong. Crypto businesses operating outside the current VATP Regime, such as over-the-counter dealers, intermediaries, and brokers that operate in or are managed in Hong Kong, will fall within the scope of CARF by virtue of the broad definition of HKRCASP. The aforementioned businesses will likely be captured under the virtual asset licensing regime after it is amended to cover virtual asset dealing, virtual asset advisory, virtual asset management and virtual asset custodian services.

Due diligence obligations applicable to HKRCASP

In-scope HKRCASPs must be registered with the IRD within one calendar year after they first meet any constituent criteria of HKRCASPs, regardless of whether they have reportable transactions¹¹.

HKRCASPs must set up procedures to achieve the following due diligence and identification requirements¹²: 

• Identify the tax residence of its customer who is a "crypto-asset user" (i.e. those who become HKRCASP's customers for the purpose of carrying out an exchange transaction involving crypto assets or a transfer of crypto assets); 
• For an entity "crypto-asset user" that is not "an active entity" (discussed below), identify the controlling person¹³ of such a user; 
• Identify whether a "crypto asset user" is a "reportable user". A crypto asset user is a "reportable user" if it is a "reportable person", which is defined to include an individual or entity that is a tax resident of a reportable jurisdiction¹⁴ (but does not include an excluded person¹⁵); 
• Identify whether the controlling person is a "reportable person";
• Keep records of evidence relied on and actions taken to carry out the aforesaid due diligence identifications for at least 6 years; and
• Implement the self-certification procedures when onboarding new customers, pursuant to which the HKRCASP obtain from its customers self-certifications that enable it to determine the tax residency of its individual and entity "crypto asset users", together with the requirement that the HKRCASP shall verify the reasonableness of a self-certification before it seeks to rely on its contents.

Reporting and record-keeping obligations applicable to HKRCASPs

HKRCASPs are required to furnish annual returns on all "relevant transactions" concluded for each crypto asset. "Relevant transaction" is defined as an exchange transaction¹⁶ or a transfer¹⁷ of "relevant crypto-assets"¹⁸. Key information to set out in such returns includes: 

• Particulars and TIN of each crypto asset user that is a reportable user; 
• Particulars and TIN of each entity crypto asset user, the controlling person of which is a reportable person; 
• The aggregate fair market value, the aggregate units of crypto assets involved and the number of "relevant transactions"; and
• The aggregate fair market value, the aggregate units involved and the number of "reportable retail payment transactions"¹⁹.

Further, HKRCASPs must keep the information used to prepare the annual return for six years.²⁰

The CARF also imposes notification requirements when an HKRCASP changes its office address, ceases to meet the definition of an HKRCASP, or is dissolved²¹. 

While an HKRCASP may engage a third-party service provider to perform the due diligence and reporting obligations under CARF, it does not absolve such HKRCASP from its statutory liabilities under CARF. It is advisable that crypto businesses and service providers familiarise themselves with the scope of CARF and ascertain the extent of their reporting obligations thereunder without further delay.

No blanket intra-group reporting exemption

CARF does not provide for a blanket reporting exemption for relevant crypto transactions conducted between related entities. Instead, intra-group relief operates through two indirect mechanisms within the framework. A listed corporate group receives broad relief, as its subsidiaries qualify as "excluded person", whereas private groups are advised to carefully consider whether their group entities meet the definition of "active entity" by virtue of their group holding entities or intra-group treasury activities.

An entity qualifies as an "active entity" if, among others: 

(a)    Such entity does not hold itself as an investment fund, and 80% or more of its activities consist of holding the stock and providing financing and services to one or more subsidiaries that engage in trades/business (other than the business of financial institutions) (Holding or group financing activities); and 

(b)    Such an entity is primarily engaged in financial or hedging transactions with, or on behalf of "related entities" that are not "financial institutions"; the group as a whole is primarily non- "financial institution" in nature, and the entity does not provide financial or hedging services to entities that are not "related entities"(Intra-group treasuring /hedging centre).

If an RCASP determines at the due diligence stage that an "entity crypto-asset user" is an "active entity" on the basis of self-certification of such user, it is not required to look through such an entity to identify its controlling person.

Part Two B - amended CRS (commonly known as CRS 2.0), which scopes in digital financial assets and enhances the due diligence requirements for all RFIs 

The amended CRS to scope in new digital financial products

Key changes to be included in the amended CRS involve bringing digital money products and investment activities referencing crypto-assets within the CRS framework. 

Under the amended CRS, the definition of "depository account" is expanded to include two categories of digital money products. The first category is "Specified Electronic Money Products" ("SEMPs"), which is defined as any product that is²²:

(a)    a digital representation of a single fiat currency;

(b)    issued on receipt of funds for the purpose of making payment transactions;

(c)    represented by a claim on the issuer denominated in the same fiat currency;

(d)    accepted in payment by a natural or legal person other than the issuer; and

(e)    by virtue of regulatory requirements to which the issuer is subject, redeemable at any time and at par value for the same fiat currency upon request of the holder of the product.

A de minimis exclusion applies under the amended CRS for low-value SEMPs accounts whose rolling average 90-day end-of-day account balance does not exceed HK$78,000 in any consecutive 90-day period²³, broadly aligned with the existing low-value account thresholds applicable to Depository Accounts under the CRS. The definition of SEMPs could capture existing Stored Value Facilities licensees, such as Octopus, AlipayHK, WeChat Pay HK, PayMe, and BoC Pay, which will be subject to the CRS reporting framework for the first time. The second category to be captured is Central Bank Digital Currency ("CBDC"), which means a digital fiat currency issued by a central bank²⁴. Any digital currencies to be issued by the Hong Kong Monetary Authority will likely fall under the definition of CBDC.

The amended CRS treats an account holding SEMPs or CBDC as a "depository account". The entity that holds the SEMPs or CBDC for a customer's benefit is to be treated as a "depository institution". To the extent that such an entity is a Hong Kong tax resident²⁵ or has a Hong Kong branch, it will be regarded as an RFI and be subject to the pre-existing due diligence and reporting requirement for a "depository account" under the CRS framework.  

The amended CRS also expands the definition of "investment entities" to include entities engaged in crypto-asset-related investment activities, whether actively or passively²⁶. To the extent that such an entity is a Hong Kong tax resident or has a Hong Kong branch, it will be subject to the pre-existing due diligence and reporting requirements as an RFI.

Enhanced CRS due diligence requirements on RFIs

While the expansion of the CRS to digital financial products is significant, the CARF/CRS Bill also introduces extensive amendments to the due diligence procedures applicable to RFIs.

Key changes include:

• Further information to be included in the return – RFIs will be required to provide additional information when filing returns in respect of reportable accounts and reportable persons, including whether a valid self-certification has been obtained from the account holder, whether the account is a joint account and, if so, the number of account holders. Where a controlling person is reportable, the RFI must also report the capacity in which that person exercises control.²⁷
• Enhanced scrutiny of self-certifications – RFIs must treat self-certifications as potentially unreliable in a wider range of circumstances, including citizenship-by-investment or residence-by-investment cases, missing TINs where universally issued, or inconsistencies arise between the self-certification and AML/KYC information.²⁸
• Temporary self-certification relief for new account — In exceptional cases, RFIs may temporarily apply pre-existing account due diligence procedures to new accounts where a valid self-certification for the new accounts cannot be obtained to meet its due diligence procedure within the reporting period , but the account remains a new account and a valid self-certification must still be obtained.²⁹ 
• No reliance on treaty tie-breaker provisions³⁰ — Account holders and controlling persons with multiple tax residencies must report all jurisdictions of tax residence and cannot rely on treaty tie-breaker rules to select a single jurisdiction.³¹ In Asia, this is of particular relevance where individuals may have 'ties' to multiple jurisdictions in e.g., the Chinese Mainland, Singapore and Hong Kong. 
• Broadened concept of "change of circumstances" — RFIs must monitor a broader range of changes, including those affecting aggregated accounts, and reassess reportable status where relevant new information is obtained.³² RFIs must take into account the latest AML/KYC information and updates when determining CRS status and identifying changes in circumstances.³³
• Controlling person identification — RFIs that are not otherwise required to apply AML/KYC procedures consistent with the FATF Recommendations must apply substantially similar procedures when identifying controlling persons.³⁴

As the CRS 2.0 rules move into their final rollout stages, these changes will likely require RFIs to revisit onboarding procedures, self-certification forms, AML/KYC integration processes and CRS governance frameworks ahead of the amended CRS becoming effective on 1 January 2028. The updated regime is expected to widen the scope of reportable financial information and require a deeper look-through into multi-layered holding structures, including corporate and dispersal vehicles. In practical terms, there will be less scope for taxpayers to use layered structures to obscure asset transparency.

Where an entity is both an RFI and an RCASP, transactions to be reported under the CARF regime are proposed to be exempt from duplicate reporting under the enhanced CRS regime.³⁵

If you have any questions on this topic, please get in touch with your usual Withers contact or the authors of this article.