Hong Kong Passes Crypto Reporting Law as CARF Moves Into Force in 2027

News update — November 5, 2026

Hong Kong’s Legislative Council has passed a bill bringing the city into the OECD’s Crypto-Asset Reporting Framework (CARF), setting a new timetable for crypto-service providers to collect information for tax reporting. The government says the framework will begin in 2027, with the first automatic exchanges of crypto-asset tax information with partner jurisdictions planned for 2028.

The change is about information reporting, not a new crypto tax rate. It does not itself determine whether a particular person owes tax on a trade. Instead, it creates a system in which covered providers collect prescribed customer and transaction details and report them to tax authorities, which can then exchange information under international agreements.

What Hong Kong’s lawmakers approved

On November 4, the Legislative Council passed the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026. The Hong Kong government says CARF implementation will start in 2027. Its Inland Revenue Department (IRD) describes January 1, 2027 as the start date for registration, due-diligence and reporting requirements for providers with the required Hong Kong connection.

The bill also updates the Common Reporting Standard (CRS), the existing framework for exchanging financial-account information. That is a separate track: amended CRS rules take effect in 2028, and exchanges under the amended standard are planned to begin in 2029. Keeping these dates distinct matters. CARF’s first international exchange is scheduled one year earlier than the amended CRS exchange.

Which crypto businesses are covered

CARF applies to reporting crypto-asset service providers (RCASPs) that meet the framework’s connection, or “nexus,” tests for Hong Kong. In broad terms, the IRD says a business may have a relevant nexus if it is tax-resident, incorporated or organised, managed, or has a regular place of business in Hong Kong. A provider can have connections to more than one jurisdiction; CARF includes rules intended to prevent duplicate reporting.

The definition is based on what a provider does, not simply on whether it calls itself an exchange. A business that facilitates crypto-to-fiat or crypto-to-crypto transactions for customers—whether as a counterparty, intermediary or operator of a trading platform—can fall within the RCASP definition. The IRD lists examples including certain brokers, dealers, exchanges and crypto ATMs. Firms should assess their actual activities and jurisdictional connections rather than assume that a product label or offshore incorporation settles the question.

What information and transactions are in scope

The framework requires due diligence on reportable users and annual reporting of specified information. The IRD says this can include identifying details such as a user’s name, address, tax residence and taxpayer identification number, together with aggregated transaction information by crypto-asset and transaction type. The law is designed to send information to tax authorities—not to publish customers’ trading histories publicly.

Reportable activity includes exchanging relevant crypto-assets for fiat currency, swapping one relevant crypto-asset for another, and transfers of relevant crypto-assets. The IRD’s description includes transfers to external wallet addresses. This means the framework reaches beyond a narrow record of buys and sells on a platform; covered providers may also have reporting obligations around certain transfers they effect for customers.

Not every digital asset is automatically within the relevant-asset definition. The IRD identifies exclusions for central bank digital currencies, specified electronic-money products, and crypto-assets that a provider has adequately determined cannot be used for payment or investment. That assessment is functional and belongs to the provider’s compliance process.

What the law does—and does not—mean for users

For customers using covered services, the practical change is that identity and tax-residency information, and transaction data, may be collected in a standardised way and reported to the IRD. The department can exchange information with participating jurisdictions where the customer is tax-resident, subject to the framework and applicable arrangements. Hong Kong says those exchanges will be reciprocal and subject to data-confidentiality and security conditions.

This is not a declaration that every transfer is taxable, nor a calculation of anyone’s tax bill. CARF is a transparency and reporting framework: it gives tax authorities information that may help them check compliance under their own tax laws. Whether a person has a tax obligation depends on the relevant jurisdiction’s rules and individual circumstances. Anyone with cross-border activity or uncertainty about reporting should consult a qualified tax professional rather than infer a liability from a data-reporting rule alone.

The framework also does not mean that every decentralised or self-hosted activity is automatically reported in the same way as activity at a covered provider. The obligations attach to reporting providers and the transactions they effectuate for reportable users, according to jurisdictional scope. The IRD’s published guidance explains the provider tests, reportable transactions and required procedures; it also notes that guidance and technical support will be provided as implementation approaches.

What crypto firms should prepare for

For providers, the work is operational as well as legal. They will need to determine whether they meet Hong Kong’s nexus rules, identify reportable users and their tax residences, maintain records, classify relevant assets and transactions, and prepare processes for annual reporting. Providers operating across borders may need to coordinate their CARF obligations with other jurisdictions’ rules and avoid inconsistent or duplicate submissions.

The IRD says it will develop a dedicated CARF portal and publish a data schema for returns. Hong Kong’s government has also said the department will issue guidance and provide technical support. Those implementation details will be important: the legislation sets the obligation and broad calendar, while technical specifications will shape how firms collect, validate and transmit the data.

A defined timetable, with implementation details still to come

Hong Kong’s passage of the bill is a concrete step toward the OECD’s broader effort to standardise cross-border crypto tax-information exchange. The immediate milestone for covered providers is 2027, when registration, due diligence and collection/reporting obligations begin. The first CARF information exchanges are scheduled for 2028; amended CRS exchanges follow in 2029.

Important details remain for the implementation phase, including the final reporting schema, portal procedures and jurisdiction lists. The practical takeaway for users is not that a new tax automatically applies, but that information held by covered providers is moving into a more structured reporting system. For crypto businesses, the priority is to map their Hong Kong nexus and prepare their compliance systems against the official guidance as it develops.