Hong Kong’s Legislative Council passed the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 on November 4, 2026. The Hong Kong crypto tax law imports the OECD’s Crypto-Asset Reporting Framework and the latest amendments to the Common Reporting Standard, requiring covered businesses to collect customer and transaction data for tax administration. It creates no new tax rate and no new levy on crypto transactions. The change is about visibility for existing tax administration, not a new charge on investors.
Hong Kong crypto tax law starts with provider registration
Covered reporting crypto-asset service providers, or RCASPs, must register with the Inland Revenue Department from January 1, 2027 and begin collecting customer and transaction information for the same date. The businesses in scope include exchanges, brokers, dealers and certain operators of crypto ATMs that effect transactions for or on behalf of customers. A Hong Kong connection is also required through factors such as local tax residence, management or business presence.
The registration timetable gives affected businesses a clear operational deadline. Companies within the RCASP definition will need to determine whether they qualify, complete the required registration and prepare controls for customer due diligence, data collection and annual reporting. The IRD is expected to publish guidance and provide technical assistance through a dedicated team and a secure CARF Portal for submissions.
This is not a rule that makes every crypto transaction taxable. Nor does it imply that a user’s underlying tax obligations change. Its central function is to give the Inland Revenue Department a standardized view of activity handled by service providers, allowing existing tax rules to be administered more consistently across borders.
What reporting crypto-asset service providers must collect
The reporting scope covers three main forms of activity: crypto-to-fiat purchases and sales, crypto-to-crypto exchanges and certain transfers to external wallets. For reportable customers, providers must collect identifying information including customer names, addresses, tax residence, taxpayer identification numbers and dates of birth. They must also capture the transaction information required by the Crypto-Asset Reporting Framework, known as CARF.
For new customers, providers are expected to obtain self-certifications identifying tax residence and then assess whether those certifications are reasonable. For existing customers, the rules allow a period of up to 12 months after implementation for the same process. If circumstances change and a provider knows that a certification is unreliable, it cannot simply continue relying on it.
Records must be retained for six years after the relevant return deadline. This retention rule sits alongside registration, due diligence and annual reporting duties. It is also separate from the obligation to keep information secure, as exchanges with other jurisdictions are intended to occur on a reciprocal basis and under conditions designed to protect confidentiality and data security.
The Crypto-Asset Reporting Framework was published by the OECD in 2023 as a template for the automatic annual exchange of tax information on crypto-asset transactions. Its functional definition can include both fungible and non-fungible tokens, subject to the framework’s exclusions. Central bank digital currencies, specified electronic money products and certain assets that cannot be used for payments or investments sit outside the relevant crypto-asset category.
Automatic information sharing starts later than collection
The implementation sequence matters for service providers and customers. Registration and data collection begin on January 1, 2027, but the first automatic CARF exchanges with eligible partner jurisdictions are scheduled for 2028. That distinction prevents the collection timetable from being confused with the international exchange timetable. The exchanges are not automatic on day one.
The amended Common Reporting Standard follows a separate schedule. The CRS has governed the exchange of financial account information between tax authorities since Hong Kong began participating in 2018. The amended CRS takes effect in 2028, with the first exchanges of financial account information under the updated rules beginning in 2029. Legislation also includes provisions intended to avoid duplicate reporting where a transaction falls within both CARF and the amended CRS.
For RCASPs, the practical work therefore extends across several years. They first need systems for registration and customer information. They then need reporting processes capable of delivering accurate annual returns to the IRD. Finally, they need to understand how qualifying records are transmitted under reciprocal arrangements with partner tax authorities. The first exchanges in 2028 depend on the domestic framework and the participation of eligible jurisdictions rather than a universal automatic release of every customer’s information.
Consultation and legislative milestones
The government consulted financial institutions, professional groups and digital asset businesses between December 2025 and February 2026. The legislation was gazetted on May 22, 2026 and introduced for its first reading on June 3, 2026. It then passed on November 4, 2026, establishing the path to domestic implementation from January 1, 2027 and the amended CRS timetable from January 1, 2028.
Secretary for Financial Services and the Treasury Christopher Hui said the changes support international efforts to address cross-border tax evasion and are important to Hong Kong’s standing as an international financial and commercial centre. His framing emphasized tax transparency and cooperation rather than the creation of a new cryptocurrency tax.
The distinction is essential for interpreting the Hong Kong crypto tax law. There is no new crypto tax rate, no new levy on crypto transactions and no automatic change to what individual users owe under Hong Kong’s existing tax system. Instead, the law creates reporting visibility by placing standardized information collection and exchange duties on qualifying businesses.
What businesses should prepare before 2027
RCASPs should use the period before January 1, 2027 to map their products and customer flows against the reporting rules. That includes identifying relevant crypto-to-fiat purchases and sales, crypto-to-crypto exchanges and qualifying external-wallet transfers, as well as checking whether a business meets the Hong Kong nexus criteria. The same review can support the design of self-certification forms, data controls, retention policies and annual reporting workflows.
The law applies by business type and reporting connection rather than by naming a particular exchange or token. Providers that fall within the definition must comply even if their activity level differs. Conversely, a company should not assume that every crypto service is automatically an RCASP, because the statutory test concerns services that effect exchange transactions and the applicable connection to Hong Kong.
Hong Kong’s approach also avoids treating CARF as a standalone global tax. The OECD supplies the reporting model, while the Inland Revenue Department administers the Hong Kong process and the Hong Kong Legislative Council determines the domestic legislation. Partner authorities receive qualifying information through reciprocal arrangements that carry confidentiality and security conditions.
For users, the practical message is that covered service providers will know more about their activity and tax residence. For providers, the burden is larger because registration, due diligence, record collection, six-year retention and annual reporting all require auditable systems. The Hong Kong crypto tax law ultimately joins international tax visibility to a staged timetable: domestic duties from 2027, first CARF exchanges in 2028, the amended CRS in 2028 and the first updated CRS exchanges in 2029, without imposing a new crypto tax.