Hong Kong CARF Bill: LegCo Resumes Debate Ahead of a 2027 Start

The Legislative Council resumes the Second Reading debate on the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 on Wednesday 4 November 2026. If Members support it, the Bill goes to the committee of the whole Council and then to Third Reading, according to the LegCo Secretariat notice of 2 November. For Hong Kong CARF compliance, the operative date is in clause 1(3): Part 2, the crypto-asset reporting rules, comes into operation on 1 January 2027.

The Bill adds Part 8B and Schedule 17EA to the Inland Revenue Ordinance (Cap. 112). A crypto-asset service provider with a Hong Kong nexus becomes an “HKRCASP” that registers with the Commissioner, runs due diligence on its users, files returns on an assessor’s notice and keeps records. The text described is the Bill as gazetted on 22 May 2026; any committee-stage amendments would change the enacted text.

Related reading: our CARF crypto tax reporting guide

Hong Kong CARF dates from the LegCo debate to the first exchange

Who the Bill turns into an HKRCASP

The first test is functional. The IRD describes a reporting crypto-asset service provider as an individual or entity that, as a business, effectuates exchanges between relevant crypto-assets, or between relevant crypto-assets and fiat currency, for customers, including as counterparty, intermediary or trading platform operator. Its examples range from own-account dealers and brokers to crypto ATM operators.

Section 50N(1) then makes the provider an HKRCASP if it is tax resident in Hong Kong; an entity incorporated or organised under Hong Kong law that has legal personality in Hong Kong or an obligation to file tax returns or tax information returns with the IRD in respect of that entity’s income; an entity managed from Hong Kong; or a person with a regular place of business in Hong Kong. Section 50N(2) provides a separate branch-nexus route alongside the regular-place-of-business limb in section 50N(1), and section 50N(3)(b) confines a provider caught only by the branch route to transactions effectuated through the Hong Kong branch. A Hong Kong branch can also constitute a regular place of business. Under the OECD’s December 2025 CARF FAQ, where that is the provider’s highest nexus in a CARF-implementing jurisdiction, the general reporting perimeter covers relevant transactions of the entity as a whole, subject to relief for other qualifying branches and an exceptional temporary branch-only approach during staggered implementation (see the FAQ below). The interaction between these rules and sections 50N(1) to (3) must be assessed before the Hong Kong reporting perimeter is fixed.

Sections 50N(4) to (7) and (9) relieve a provider of Hong Kong due diligence where it complies with the OECD rules in a partner jurisdiction through a connection the Bill ranks at least as high, and section 50N(8) relieves it for relevant transactions effectuated through a branch in a partner jurisdiction where that branch complies there. An entity tax resident and compliant in a partner jurisdiction, for example, is relieved of due diligence owed only because of Hong Kong incorporation, management or a place of business. Registration survives: section 50O(1) applies “despite” those subsections. So does the return, because each relief is conditional on the provider having to furnish one under section 50Q(1), carrying its identity, the partner jurisdiction and the relief criterion it meets (section 50Q(6)).

Section 50Y requires the new rules to be applied consistently with the “CARF publications”, defined in section 50M as Part I of the OECD’s June 2023 CARF document and the OECD CARF FAQs as updated from time to time. EU member states apply the same OECD framework through DAC8, Council Directive (EU) 2023/2226; our Luxembourg DAC8 CARF reporting article covers one implementation.

Registration by 31 January, and a return that waits for a notice

Registration is due on or before 31 January of the calendar year after the year in which the provider first meets a section 50N(1) or (2) criterion (section 50O(2)). A provider that first meets one in 2027 registers by 31 January 2028 (a calculation from section 50O(2) and the 1 January 2027 start). The IRD’s CARF page gives no separate date for providers that met a criterion before Part 2 starts, so that case is worth confirming with the IRD. The page also says every provider meeting the nexus rules registers on the CARF Portal even with nothing to report; portal and data schema details are still to come.

Under section 50Q, an assessor’s written notice triggers the return and specifies the deadline, and the return covers the calendar year before the notice year unless the Commissioner sets another period. Hong Kong’s CRS uses a similar notice mechanism, with notices issued in January and returns due within five months of the notice date, per the IRD’s AEOI Portal page. Until the IRD announces the CARF timetable, any CARF filing date in a project plan is a placeholder.

A provider with no reportable users still answers its notice: sections 50Q(4)(b)(iii) and 50Q(7) require the return to state that it maintains no relationship with a reportable user or with a user whose controlling person is a reportable person.

What a Hong Kong CARF return carries, asset by asset

Section 50R splits the return into identity data (name, address, jurisdiction of residence and TIN, plus date and place of birth for individuals and for each reportable controlling person, with that person’s role) and aggregates per type of relevant crypto-asset. The aggregates cover acquisitions and disposals against fiat (gross amount net of fees, units and number of transactions), exchanges against other crypto-assets at fair market value, reportable retail payment transactions, other transfers by transfer type where known, and transfers to wallet addresses not known to belong to a virtual asset service provider or financial institution as defined by the FATF.

Valuation follows prescribed rules. Fair market value is set in a single fiat currency at the time of each transaction, using a reasonable method applied consistently (section 50R(6)). Where the provider maintains no reference trading pair for a transferred asset, section 50R(10) imposes an order: internal book value, then a reliable third-party price aggregator, then the provider’s most recent valuation, and a reasonable estimate only as a last resort. Section 50R(11) requires the fallback method to be reported per asset, so it has to be stored with the figure.

Two carve-outs trim the identity fields: no TIN where the jurisdiction issues none or its law does not require collection, and place of birth only where Hong Kong law otherwise requires it and it sits in electronically searchable data (section 50R(14)). Retail payment services can widen the population of crypto-asset users. For a reportable retail payment transaction (a transfer of relevant crypto-assets in consideration of goods or services for a value exceeding HK$390,000), the merchant’s customer is treated as a crypto-asset user in addition to the merchant where the provider must verify that customer’s identity under domestic anti-money laundering rules, subject to the crypto-asset user definition in section 50M(1) (section 50R(4)(b)). The customer’s transaction is reported only if that user is a reportable user, meaning a crypto-asset user who is a reportable person: resident in a reportable jurisdiction and not an excluded person.

Self-certification and the 1 January 2028 cut-off for existing users

The proposed CARF due diligence procedures require self-certifications for new individual and entity crypto-asset users and, where applicable, their controlling persons. For pre-existing crypto-asset users, the IRD states that self-certifications must be obtained and their reasonableness confirmed within 12 months after the CARF rules commence. On the proposed 1 January 2027 commencement date, that period ends on 1 January 2028. Individual-user and entity-user due diligence must therefore both be included in the implementation scope.

For individual users, Schedule 17EA, Part 3, section 2(1) sets the self-certification requirement. The provider confirms its reasonableness against what it holds, including AML/KYC documentation. For an individual user whose self-certification fails that check, section 2(2) requires a valid self-certification, or a reasonable explanation and documentation supporting it, before the provider effectuates relevant transactions for that user.

Onboarding is only the first checkpoint. Once a change of circumstances gives reason to know a self-certification is incorrect or unreliable, the provider cannot rely on it (section 2(3)), and section 3 treats new information from AML/KYC re-documentation as a possible change of circumstances. A provider that is also a CRS reporting financial institution may rely on due diligence completed under Schedule 17D, and any HKRCASP may rely on a self-certification already collected for other tax purposes if it meets Part 5 of Schedule 17EA (Schedule 17EA, Part 2).

Retention follows two periods: due diligence evidence for six years after the calendar year it relates to, or the return record period where a return covers it (section 50P(1)(a)(iii)), and return records for six years after the return’s due date (section 50S(2)). Address changes and ceasing to be an HKRCASP are notified within one month (section 50S(3) and (4)).

Penalties that multiply by the number of users

For several new section 80R offences, the maximum fine is the higher of a fixed level and an amount per crypto-asset user and controlling person who is the subject of the offence.

Section 82E lets the Commissioner or a deputy commissioner, personally, assess a financial penalty in lieu of prosecution for the registration, due diligence, return, accuracy and error-reporting failures, capped at the fine available on conviction, where no prosecution has been brought on the same facts. The provider gets a notice of intention and a representation date that cannot fall within 21 days of it. Where an individual provider, or the person acting for a non-corporate one, is about to leave Hong Kong, the authority may assess without giving that notice (section 82E(5)). Appeals go to the Board of Review (section 82F).

Outsourcing leaves the liability in place. Section 50U lets a service provider perform the duties, but the HKRCASP is not relieved of them, and engaging one is not in itself a reasonable excuse (sections 80R(2) and 82E(2)). Users carry exposure too: knowingly or recklessly making a materially misleading, false or incorrect self-certification is an offence carrying a level 3 fine (new subsections 80(2ZD) and (2ZE)).

Amended CRS: the 2028 half of the Bill

Part 3 amends the CRS rules in Part 8A from 1 January 2028. According to the IRD, it brings central bank digital currencies, specified electronic money products, derivatives referencing relevant crypto-assets and investment entities investing in them into CRS scope, and adds fields such as self-certification status and account type. Gross proceeds from relevant crypto-assets already reported under CARF need not be reported again under the amended CRS, though institutions may elect to report under both. Our Luxembourg CRS reporting guide covers the account-based mechanics.

Frequently Asked Questions

Is a stablecoin from an HKMA-licensed issuer a relevant crypto-asset for Hong Kong CARF?

Only if it falls outside the specified electronic money product definition, which the OECD standard excludes from relevant crypto-assets. The OECD’s December 2025 CARF FAQs, one of the Bill’s CARF publications, treat substantive restrictions on redemption at par at any time as incompatible with that definition and let a provider rely on the product’s regulatory authorisations for the redemption condition. Licensing background is in our article on the Hong Kong Stablecoins Ordinance.

An offshore exchange runs some transactions through a Hong Kong branch. What is in scope?

The separate branch nexus and the regular-place-of-business nexus must be considered independently. Under the OECD’s December 2025 CARF FAQ, where a Hong Kong branch creates the provider’s highest nexus in a CARF-implementing jurisdiction, the reporting and due diligence perimeter generally covers relevant transactions of the entity as a whole, including those effectuated outside the branch. Relief can apply for other branches in implementing jurisdictions. Exceptionally, branch-only compliance may be permitted during the initial years of staggered implementation unless the relevant jurisdiction provides otherwise. The Hong Kong reporting perimeter therefore depends on the applicable nexus hierarchy, partner-jurisdiction relief and the enacted Hong Kong provisions.

Related Articles

• CARF Crypto Tax Reporting: The OECD framework and the data it requires.
• CARF Reporting in Luxembourg: DAC8 Crypto Filing by 30 June: One EU member state’s DAC8 rules.
• CRS Reporting Luxembourg: CRS account reporting mechanics.

Sources and References

• LegCo Secretariat notice, 2 November 2026: IRD
• The Bill, gazetted text: IRD PDF
• IRD, Crypto-Asset Reporting Framework: IRD CARF page
• IRD, Amendment Bill and amended CRS: IRD Bill page
• IRD press release, 20 May 2026: IRD press release
• IRD, AEOI Portal: IRD AEOI Portal page
• OECD, CARF and 2023 update to the CRS (8 June 2023): IRD-hosted OECD PDF
• OECD, CARF FAQs (December 2025): OECD PDF
• Council Directive (EU) 2023/2226 (DAC8): EUR-Lex

Before the Third Reading and after: what to have ready for 1 January 2027

If the Bill passes Third Reading, the Ordinance operates from Gazette publication and clause 1(3) fixes 1 January 2027 for Part 2. Three items do not depend on the IRD schema: a nexus memo per legal entity covering section 50N and any relief, an onboarding self-certification flow checked against KYC files, and a valuation policy recording the fallback method per asset. After the vote, compare the enacted text with the gazetted Bill and track the IRD’s CARF Portal and schema announcement, which sets the route for the first 31 January registration.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.