Hong Kong’s CARF Crypto Tax Bill Heads Into Legislative Review

Hong Kong’s Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 entered legislative review on 3 June 2026, and the Inland Revenue (Amendment) (Automatic Exchange of Information) Bill 2026 had already cleared the Legislative Council on 17 June 2026. Read together, the two statutes put the city on a two-step path to crypto tax transparency that runs from registration through reporting and lands the first automatic exchange of crypto transaction data with partner jurisdictions in 2028.

Hong Kong crypto tax reporting is no longer a draft idea. The bills extend a reporting machinery Hong Kong has run on banks since 2018 to every reporting crypto-asset service provider with a nexus in the city, and the registration, due-diligence and penalty architecture that comes with it is the part of the story most coverage skips.

Two Bills, One Transparency Machine

The AEOI Bill and the CARF Bill look like separate items on the LegCo agenda. They are not. Both respond to the same Organisation for Economic Co-operation and Development push for tax transparency on cross-border financial flows, and both are scheduled to bite on the same horizon.

The government gazetted the CARF Bill on 22 May 2026 and read it into LegCo for the first time on 3 June 2026, according to the Inland Revenue Department. The AEOI Bill, a separate but parallel statute that updates the administrative framework for the existing automatic exchange of information regime, passed the full Legislative Council on Wednesday 17 June 2026.

Christopher Hui, Hong Kong’s Secretary for Financial Services and the Treasury, framed both bills as the city keeping its side of the bargain with the OECD after a peer review flagged room to tighten the local administrative setup.

What the CARF Bill Actually Does

CARF is a tax transparency standard the OECD developed in 2023. It tells reporting crypto-asset service providers, or RCASPs, what customer data they must collect on crypto-asset transactions and how they must hand it to tax authorities each year, per the CARF rules the Inland Revenue Department has published.

An RCASP is any individual or entity that, as a business, makes exchange transactions in relevant crypto-assets happen for or on behalf of customers, whether by acting as counterparty, intermediary or trading platform operator. Three categories of transaction are reportable: exchanges between relevant crypto-assets and fiat currencies, exchanges between one or more forms of relevant crypto-assets, and transfers of relevant crypto-assets including transfers to external wallet addresses.

Every RCASP that meets the Hong Kong nexus rules must register an account in a dedicated CARF Portal the Inland Revenue Department will run. The registration must be completed by 31 January of the calendar year following the year the nexus first applies, and it is required even if the RCASP has nothing to report.

• Dealers acting for their own account to buy and sell relevant crypto-assets to customers
• Operators of crypto-asset ATMs that exchange relevant crypto-assets for fiat currencies or other relevant crypto-assets
• Crypto-asset exchanges that act as market makers and take a bid-ask spread as commission
• Brokers in relevant crypto-assets that complete buy or sell orders on behalf of clients
• Individuals or entities subscribing relevant crypto-assets from an issuer for reselling and distributing them to customers, where applicable

What the AEOI Bill Adds on Top

The AEOI Bill is the older administration update that the CARF Bill rides on top of. Hong Kong has exchanged bank-account information with partner tax jurisdictions each year under the OECD Common Reporting Standard since 2018, and the OECD’s peer review told the city it had to harden the administrative scaffolding around that system.

The amendments starting 1 January 2027 require reporting financial institutions to register with the Inland Revenue Department before they submit AEOI information, sharpen the due-diligence record-keeping rules, and raise penalties to lift deterrence. The Inland Revenue Department’s own the IRD’s CRS amendment bill page shows the same calendar mapped across the CRS rules.

Hong Kong has all along been supporting international efforts in enhancing tax transparency and combatting cross-border tax evasion. As an international financial centre, Hong Kong has an obligation to enhance the AEOI administrative framework to address the OECD’s views.

Christopher Hui, Secretary for Financial Services and the Treasury, said that in the LegCo passage statement the government released on 17 June. The press release ties the upgrade to keeping Hong Kong’s favourable rating in the OECD peer review and to expanding the city’s network of Comprehensive Avoidance of Double Taxation Agreements.

Who the Net Catches

An RCASP lands inside Hong Kong’s CARF regime if any of four nexus conditions is true: it is tax resident in Hong Kong; it is incorporated or organised under Hong Kong law with legal personality in the city or an obligation to file tax returns to the Inland Revenue Department; it is managed from Hong Kong; or it has a regular place of business in Hong Kong, including a branch. Where a firm has nexus in more than one CARF jurisdiction, the rules set a cascading hierarchy so the same transaction is not reported twice.

The definition of crypto-asset under CARF is functional. It covers a digital representation of value that relies on cryptographically secured distributed ledgers or similar technology and represents a right to value that can be transferred in a digital manner. The definition includes both fungible and non-fungible tokens.

Three categories sit outside the regime: central bank digital currencies, specified electronic money products, and crypto-assets that a reporting crypto-asset service provider adequately determines cannot be used for payment or investment purposes. Anything that does not fall inside those carve-outs is in scope, which is why the typical Hong Kong exchange, broker or ATM operator cannot assume it is too small to register.

Penalty Teeth and the Six-Year Trail

CARF in Hong Kong is not a soft regime. The Inland Revenue Department will keep records on RCASPs for six years after the due date of the CARF return to which the information relates, and that record-keeping window survives both the firm’s exit from reporting status and the firm’s dissolution. Directors and responsible officers can be on the hook after the entity is gone.

On the penalty side, the framework layers three types of sanction. The bill proposes new offences for non-compliance with registration, due-diligence, reporting and other requirements, for provision of incorrect or incomplete information, and for failure to notify the Inland Revenue Department of misleading or inaccurate return data. Penalties for some offences scale by days of continuing offence or by number of crypto-asset users involved, per the CARF Portal and penalty framework that KPMG lays out.

An administrative-penalty mechanism sits next to the criminal route, modelled on the profits-tax “additional tax” mechanism. The Commissioner can impose a financial penalty in lieu of prosecution where no prosecution has been initiated for the same facts, with a right of written representation and appeal to the independent Board of Review. HK$10,000 is the level-3 fine floor for one set of offences, with HK$1,000 added per impacted crypto-asset user on top, and per-account penalties can scale to HK$20,000 for severity-tier cases.

• HK$10,000: level-3 fine cap for a single CARF-related offence
• HK$1,000: per impacted crypto-asset user, added on top of the base fine
• HK$20,000: maximum per-account penalty for severity-tier offences
• Six years: record-keeping window after the due date of each CARF return

Why 2028 Is the Date That Matters

CARF rules take effect in Hong Kong on 1 January 2027. The first automatic exchange of crypto transaction data under CARF with partner jurisdictions is then scheduled for 2028. The amended Common Reporting Standard takes effect a year later, on 1 January 2028, and is the heavier of the two regimes in pure reporting volume because it pulls digital money products, derivatives referencing crypto-assets, and investment entities investing in crypto-assets into the existing bank-account information machinery.

For pre-existing crypto-asset users, RCASPs have a 12-month grace window after CARF comes into operation in Hong Kong to obtain and validate self-certifications of tax residence. New customers must self-certify at onboarding. Where circumstances change and the original self-certification becomes unreliable, the RCASP must obtain a fresh self-certification or reasonable supporting documentation.

The Sleeper in Hong Kong’s Crypto Story

Most of the public conversation around Hong Kong crypto in 2026 has been about licensing. The Securities and Futures Commission pushed Type 1 and Type 7 regulated activity upgrades, and Standard Chartered extended Standard Chartered’s G-SIB crypto custody launch in Hong Kong to regulated digital-asset safekeeping. That licensing push and the CARF regime are not opposing forces. They are the same policy in two registers: build a regulated on-ramp for crypto, then bring every transaction on that on-ramp into the tax net.

The condition Hong Kong set on itself is plain. Per the Inland Revenue Department, the city committed to conducting the first automatic exchange under CARF in 2028 on the condition that the necessary domestic legislation is in place by 2026. KPMG’s tax alert notes that 1 January 2027 will “considerably broaden the scope of due diligence and reporting obligations for financial institutions and crypto-asset” firms. The bills now in LegCo are the last legal step before that schedule locks in.

Frequently Asked Questions

When does Hong Kong’s CARF regime take effect?

CARF rules take effect in Hong Kong on 1 January 2027, with the first automatic exchange of crypto transaction data with partner jurisdictions scheduled for 2028. The amended Common Reporting Standard takes effect on 1 January 2028.

What is a Reporting Crypto-Asset Service Provider?

An RCASP is any individual or entity that, as a business, provides a service effectuating exchange transactions in relevant crypto-assets for or on behalf of customers, including by acting as counterparty, intermediary or trading platform operator. Examples include dealers acting for their own account, crypto-asset ATM operators, exchanges acting as market makers, brokers acting on behalf of clients, and entities subscribing crypto-assets from issuers for resale.

Which crypto-asset transactions are reportable under CARF?

Three categories are reportable: any exchange between relevant crypto-assets and fiat currencies, any exchange between one or more forms of relevant crypto-assets, and any transfer of relevant crypto-assets, including reportable retail payment transactions and transfers to external wallet addresses.

Who has to register on the CARF Portal?

Any RCASP meeting at least one of the four Hong Kong nexus conditions must register, including being tax resident in Hong Kong, being incorporated or organised under Hong Kong law with legal personality or an IRD filing obligation, being managed from Hong Kong, or having a regular place of business in Hong Kong such as a branch. Registration must be completed by 31 January of the calendar year following the year the nexus first applies.

What happens if a firm fails to register or misreports?

The penalty regime layers criminal prosecution with an administrative-penalty mechanism. A level-3 fine of HK$10,000 applies to certain single offences, with HK$1,000 added per impacted crypto-asset user. Per-account penalties can scale to HK$20,000 in more serious cases. Records must be kept for six years after the due date of each CARF return.