Hong Kong’s CARF Explained: Reporting Scope, Compliance Obligations and Preparations for Businesses

Key Takeaways

• Legislative developments: On 4 November 2026, the Legislative Council of Hong Kong passed the relevant CARF bill. Under the timetable announced by the Government, CARF is scheduled to take effect from 2027, with the first automatic exchange of tax information commencing in 2028.
• Entities in scope: CARF primarily applies to qualifying Reporting Crypto-Asset Service Providers (RCASPs). Whether a business is required to fulfil reporting obligations in Hong Kong depends on its business activities and its nexus with Hong Kong.
• Reporting scope: The framework covers exchanges between Relevant Crypto-Assets and Fiat Currencies, exchanges between different Relevant Crypto-Assets, and qualifying Transfers of Relevant Crypto-Assets.
• Compliance obligations: Relevant service providers must fulfil applicable obligations relating to customer due diligence, registration, information reporting and record-keeping, and should assess their customer-information and transaction-data management systems in advance.
• What to watch: As of 10 November 2026, the final text of the Bill, as considered and amended, had yet to be formally gazetted. The detailed requirements will be governed by the ordinance as finally gazetted and subsequent guidance from the Inland Revenue Department (IRD).

Hong Kong CARF: Legislative Developments and Implementation Timeline

On 4 November 2026, the Legislative Council of Hong Kong passed the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 (the “Bill”), which provides for the implementation in Hong Kong of the Crypto-Asset Reporting Framework (CARF) and the latest amendments to the Common Reporting Standard (CRS).

Under the timeline announced by the Government, CARF will be implemented in Hong Kong in 2027. Relevant service providers will then be required to collect information specified under CARF for the IRD to exchange with partner tax jurisdictions from 2028. The amended CRS will take effect from 2028, and the IRD will begin exchanging information under the revised standard from 2029.

This means that Hong Kong’s crypto-asset market is approaching the introduction of a cross-border tax information reporting mechanism specifically designed for crypto-asset transactions.

For crypto-asset exchanges, brokers and other relevant service providers, the implementation of CARF entails a series of compliance tasks, including mandatory registration, customer due diligence, information reporting and record retention. For crypto-asset users, transactions conducted through relevant service providers may become subject to the automatic exchange of tax information.

This article outlines the key requirements of Hong Kong CARF based on relevant thematic guidance issued by the IRD, as well as the CARF Rules and Commentary and frequently asked questions published by the Organisation for Economic Co-operation and Development (OECD).

Hong Kong CARF Reporting Scope: Service Providers, Users, Information and Transactions

Entities within the Scope of Hong Kong CARF: Business Criteria and Nexus with Hong Kong

CARF obligations apply to Reporting Crypto-Asset Service Providers (RCASPs) that meet the relevant criteria. Whether such a service provider is required to conduct CARF due diligence and reporting in Hong Kong must also be determined by reference to the Nexus Rules.

• Condition 1: In the course of business, the provider effects exchange transactions involving Relevant Crypto-Assets for or on behalf of customers, including acting as a counterparty or intermediary, or providing a platform for exchange transactions.
  • Examples that meet the criterion: Dealers, crypto-asset ATM operators, crypto-asset exchanges, brokers and distributors.
  • Examples that do not meet the criterion: Entities that effect Transfers only, rather than exchanges; entities that only participate in transaction validation; and entities that provide services only infrequently and solely for non-commercial reasons.
• Condition 2: The provider has a reporting nexus with Hong Kong.
  1. An individual or Entity that is tax-resident in Hong Kong;
  2. An Entity that is incorporated or established under Hong Kong law and has legal personality in Hong Kong, or that is required to file a tax return or tax information return with the IRD in respect of its income;
  3. An Entity that is managed from Hong Kong; or
  4. An individual or Entity that has a permanent establishment in Hong Kong, including a branch.

An RCASP may have a reporting nexus in more than one tax jurisdiction and may therefore be required to fulfil due diligence and reporting obligations in multiple jurisdictions. To prevent duplicate reporting by RCASPs across jurisdictions, CARF establishes a clear hierarchy of rules for applying the nexus criteria above.

Reportable Users under CARF: Tax Residence and Controlling Persons

Reportable Users are individuals or Entities that are tax residents of a Reportable Jurisdiction under the tax laws of that jurisdiction.

For Entity Crypto-Asset Users, the due diligence process generally requires looking through to their Controlling Persons. A Reportable Jurisdiction, in this context, means a jurisdiction specified in the list published by the IRD.

CARF Information to Be Reported: Users, Service Providers and Transactions

During each reporting period, a Hong Kong Reporting Crypto-Asset Service Provider (HKRCASP) must collect the relevant information on Reportable Users and Reportable Persons and submit it to the IRD:

1. Identification details for each Reportable User or Reportable Person: name, address, jurisdiction(s) of residence, tax identification number (TIN), and date and place of birth (where applicable);
2. Identification details of the HKRCASP itself: name, address and identification number (where applicable); and
3. Transaction information: details of each type of Relevant Transaction involving Relevant Crypto-Assets effected by the HKRCASP during the reporting period, including the gross amount, aggregate number of units and number of relevant transactions relating to the acquisition and/or disposal of Relevant Crypto-Assets against Fiat Currency or other Relevant Crypto-Assets, or the Transfer of Relevant Crypto-Assets. (For exchanges between Relevant Crypto-Assets and Fiat Currencies, the gross amount must be reported in the Fiat Currency paid or received. For exchanges between different Relevant Crypto-Assets or Transfers of Relevant Crypto-Assets, the aggregate fair market value must be reported.)

CARF Asset and Transaction Scope: Relevant Crypto-Assets, Excluded Categories and Transaction Types

The IRD explains that a Crypto-Asset is a digital representation of value that relies on a cryptographically secured distributed ledger or similar technology to validate and secure transactions, and whose rights can be traded or transferred digitally. This is a functional definition that covers not only fungible tokens but also qualifying non-fungible tokens (NFTs).

CARF requires due diligence and reporting in respect of “Relevant Crypto-Assets”. In principle, this covers all Crypto-Assets, except for three categories: Central Bank Digital Currencies (CBDCs), Specified Electronic Money Products, and Crypto-Assets that the provider has adequately determined cannot be used for payment or investment purposes.

Further analysis is needed to determine which transactions involving Relevant Crypto-Assets fall within the reporting scope. The IRD divides them into three categories:

1. Exchanges between Relevant Crypto-Assets and Fiat Currencies, such as exchanging a Crypto-Asset for Hong Kong dollars or another Fiat Currency through a trading platform;
2. Exchanges between different Relevant Crypto-Assets, such as using one Crypto-Asset to acquire another;
3. Transfers of Relevant Crypto-Assets, including qualifying Reportable Retail Payment Transactions, other Transfers involving Reportable Users, and transfers of Crypto-Assets to external wallet addresses.

Hong Kong CARF Compliance Requirements: Customer Due Diligence, Registration and Reporting, and Record-Keeping

CARF Customer Due Diligence: Identification of Tax Residence and Review of Self-Certifications

An HKRCASP must use due diligence procedures to identify Reportable Users and Reportable Persons, with a focus on determining the jurisdiction in which they are tax-resident.

For new customers, an HKRCASP must obtain self-certifications from users and their Controlling Persons (for certain Entities), and assess their reasonableness against the AML/KYC information in its possession. For customers who already have a relationship with the provider before CARF takes effect, the collection and review of self-certifications must be completed within 12 months after CARF implementation begins.

This due diligence is an ongoing obligation. If circumstances relevant to the self-certification provided by a user or its Controlling Persons change during the service relationship, the HKRCASP must obtain a new valid self-certification or a reasonable explanation for the original self-certification, together with relevant supporting documents.

The Hong Kong Government previously proposed in the Bill that HKRCASPs be permitted to apply the same due diligence procedures to users who are not Reportable Users and to the Controlling Persons of Entity Users who are not Reportable Persons. The scope of persons subject to due diligence should be determined in accordance with the latest official requirements.

Hong Kong CARF Registration and Reporting: Registration Deadlines and Information Submission Requirements

All crypto-asset service providers that fall within the definition of an HKRCASP must register. The IRD will establish a CARF portal for registration and information reporting. Regardless of whether a provider has any information to report in a given year, every crypto-asset service provider with CARF obligations in Hong Kong must complete registration by 31 January of the year following the year in which it first meets the Nexus Rules.

The information to be reported has been outlined above. The IRD will also publish the structure and electronic format for submissions. The detailed reporting requirements should be monitored as further information becomes available.

CARF Record-Keeping: Due Diligence Evidence and Supporting Documentation for Reporting

Under the Bill, the Hong Kong Government proposes requiring HKRCASPs to retain adequate records relating to CARF due diligence and reporting. These include: (i) evidence of the due diligence procedures and records of the steps taken; and (ii) records used to establish the correctness and accuracy of the reported information. Records must be retained for six years, regardless of whether the HKRCASP ceases to provide the relevant services or the Entity is dissolved.

Accordingly, in addition to registration, due diligence and information reporting, service providers must retain supporting documentation and establish a traceable record-keeping system.

Preparing for Hong Kong CARF Compliance: Status Assessment, Customer Due Diligence and Data Management

Implementation of Hong Kong CARF will bring crypto-asset service providers in Hong Kong into a systematic international tax information reporting and automatic exchange framework. It will impose new statutory obligations on relevant businesses, including registration, customer due diligence and information reporting. Its impact will also extend to customer management processes, transaction monitoring and data storage systems, as well as compliance arrangements for corporate mergers and acquisitions. Providing incorrect or incomplete information, or failing to fulfil other obligations under CARF, may result in administrative or criminal penalties, including fines.

With regard to implementation details, the IRD has stated that it will issue supplementary guidance from time to time. It has also indicated that businesses may develop their own CARF-compatible data systems in accordance with the guidance to create data files that meet the requirements. Before the systems are formally put into use, businesses may submit the final data files to the IRD for validation. In addition, the IRD will not identify HKRCASPs solely through their voluntary registration. It will also refer to profits tax returns, business registration records and relevant registers maintained by regulators such as the Securities and Futures Commission (SFC) to determine whether service providers fall within CARF’s regulatory scope.

Under the currently announced timeline, CARF will not be implemented in phases and no grace period has been established. The relevant amendments to the Inland Revenue Ordinance are expected to take effect on 1 January 2027. Although the first exchange of information between Hong Kong and other Reportable Jurisdictions will not take place until 2028, CARF obligations applicable to crypto-asset service providers will be legally binding under Hong Kong law from 2027. Businesses should therefore complete their compliance preparations as early as possible.

In practice, businesses can assess compliance gaps and improve their data systems and operating procedures in the following areas:

CARF Status Assessment: Business Model, Hong Kong Nexus and Cross-Border Reporting Arrangements

An HKRCASP is responsible for meeting CARF obligations in Hong Kong. Taking into account its business model, services and group structure (where applicable), a business should assess whether it qualifies as a Reporting Crypto-Asset Service Provider, whether it has a reporting nexus with Hong Kong under the Nexus Rules, whether any exemptions apply, and whether it has obligations in other jurisdictions. This assessment will help determine whether the business falls within the scope of Hong Kong CARF.

Updating CARF Due Diligence Processes: Self-Certifications and Remediation of Existing Customer Records

Given the new customer due diligence requirements under CARF, businesses should identify gaps between their existing AML/KYC data fields and those required for CARF self-certifications. They should update onboarding procedures and customer information management systems in line with the statutory requirements for obtaining and reviewing self-certifications, so that all CARF due diligence data requirements are covered. For Entity Users, due diligence should also extend to their Controlling Persons. These steps must be completed for pre-existing customers within the prescribed period. Due diligence obligations apply regardless of a user’s risk rating or level of activity.

Optimising CARF Data Systems: Data Collection, Reporting and Record-Keeping

CARF compliance requirements pose challenges to businesses’ data management capabilities, particularly for crypto-asset exchanges with large user bases and high transaction volumes. Service providers must monitor and follow up on changes to users’ self-certifications and tax residence status. They must also compile and submit, in the prescribed format, reporting information such as customer identification details, transaction amounts or fair market values, numbers of asset units and transaction counts, while retaining records for six years. Businesses therefore need to establish or enhance data systems aligned with CARF requirements to manage data collection, storage, reporting and exception monitoring efficiently and rigorously.

Managing Ongoing CARF Compliance: Staff Training, Monitoring Guidance and Record Handover

In addition to making targeted improvements to key processes, businesses should recognise that CARF compliance is an ongoing responsibility and plan accordingly. They should provide dedicated training for staff in finance, legal, compliance and technology functions, and monitor subsequent implementation rules and guidance issued by the IRD, including updates to the list of partner tax jurisdictions. CARF compliance extends across the entire corporate lifecycle, not just day-to-day operations. For example, when a business is dissolved or acquired, record-keeping obligations may continue to apply to relevant management personnel and the entity following the change. Provisions addressing due diligence and the transfer and handover of records may therefore be included in relevant agreements for compliance purposes.

Conclusion: Preparing for Hong Kong CARF and Monitoring Further Guidance

Returning to the point made at the outset, the passage at third reading of the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 marks an important milestone in Hong Kong’s local implementation of CARF. It signals a further strengthening of tax transparency in crypto-asset transactions and cross-border information exchange in Hong Kong.

Establishing effective compliance mechanisms while navigating the broader shift towards tax transparency and pursuing business expansion is likely to remain an important issue in the period ahead. As the 2027 implementation date approaches, relevant businesses should familiarise themselves with the requirements, identify reporting scenarios that may arise in their operations, and monitor implementation guidance, reporting systems and technical specifications to be published by the IRD.

As of the date of publication, the final text of the Bill, as considered and amended, is still awaiting formal gazettal. Details of Hong Kong’s CARF regime should be read in accordance with the ordinance as formally gazetted and subsequent guidance issued by the IRD. For details of the Bill’s consideration and legislative progress, please refer to the official bill progress page of the Legislative Council of Hong Kong.

Official News

https://www.info.gov.hk/gia/general/202611/04/P2026110400308.htm

Progress of the Bill

https://www.legco.gov.hk/en/legco-business/council/bills.html?bill_key=10005&session=2026