CARF comes to Hong Kong: what crypto-asset tax reporting means for investors and platforms

Context

Since 2018, the Common Reporting Standard (CRS) has given tax authorities a yearly view of their residents' financial accounts abroad. Crypto-assets largely fell outside it. Exchanges and brokers that were not financial institutions in the traditional sense had no CRS obligations, and many crypto-assets did not count as financial assets under the standard.

The OECD responded in 2023 with two pieces of work: a new Crypto-Asset Reporting Framework (CARF) and an update to the CRS itself. Dozens of jurisdictions, including most major financial centres, have committed to implementing CARF. Hong Kong committed to conducting its first CARF exchanges in 2028, on condition that domestic legislation is in place by 2026.

What changed

On 22 May 2026, the government gazetted the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026. It was introduced into the Legislative Council for first reading on 3 June 2026. If passed, the CARF rules will apply from 1 January 2027, and the amended CRS from 1 January 2028.

According to the Inland Revenue Department (IRD) and the government's Legislative Council brief, the bill covers the following main areas.

Who must report. A reporting crypto-asset service provider (RCASP) is any individual or entity that, as a business, carries out exchange transactions for customers, whether as a counterparty, an intermediary or by operating a trading platform. Dealers, brokers, exchanges and crypto ATM operators are typical examples.

Hong Kong nexus. An RCASP is subject to Hong Kong rules if it is tax resident in Hong Kong, incorporated or organised under Hong Kong law, managed from Hong Kong, or has a regular place of business (including a branch) in Hong Kong. A cascading hierarchy prevents duplicate reporting across jurisdictions.

What is reported. Three types of transactions: exchanges between crypto-assets and fiat currencies, exchanges between crypto-assets, and transfers of crypto-assets, including transfers to external wallet addresses. Reports aggregate gross amounts, units and numbers of transactions by asset type for each reportable user. Central bank digital currencies and specified electronic money products are excluded, because they are covered by the amended CRS instead.

Due diligence. RCASPs must obtain self-certifications of tax residence from new customers at onboarding, and from existing customers within 12 months of the rules taking effect.

Registration, records and penalties. All RCASPs meeting the nexus rules must register on a new CARF Portal by 31 January of the year after they first meet the criteria, even if they have nothing to report. Records must be kept for six years. The bill proposes offences for non-compliance and for knowingly or recklessly giving false self-certifications, as well as an administrative penalty mechanism as an alternative to prosecution.

The amended CRS

The 2023 CRS update matters as much for traditional wealth as for crypto. It brings specified electronic money products and central bank digital currencies into scope, covers certain indirect investments in crypto-assets through derivatives and investment vehicles, and expands the information reported, for example whether an account is jointly held and the role of each controlling person. For trusts and private investment companies, this means more granular reporting on who holds which role.

Implications for investors, families and businesses

For individual investors, the practical message is simple. Within a few years, crypto activity through regulated platforms will be visible to tax authorities in the same way as bank and brokerage accounts. Mainland residents should note that this adds to the overseas income checks already under way through CRS.

For families and family offices holding digital assets, the question is how holdings are structured and documented. Entity customers will be asked for controlling person details. Good records of cost basis and transfers between wallets will become essential.

For businesses in the crypto sector, CARF is an operational project: deciding whether they are an RCASP, mapping nexus across jurisdictions, upgrading onboarding flows to collect self-certifications, and building reporting systems. Licensed virtual asset trading platforms already have strong KYC processes, but tax residency is a different data set.

For businesses outside the sector, the amended CRS may affect stored-value and payment products and require updated customer documentation.

Questions to consider

• Do we hold crypto-assets through platforms that will be subject to CARF, and in which jurisdictions?
• Can we explain the cost basis and history of our holdings if asked?
• Are our self-certifications of tax residence up to date and accurate?
• If we operate a crypto business, do we meet any of the Hong Kong nexus criteria, and when must we register?
• How will the amended CRS change what is reported about our trusts or holding companies?

Closing

CARF closes one of the last significant gaps in international tax transparency. The bill still has to pass, but its direction is clear and broadly shared across major financial centres. Investors and businesses that start preparing now, through cleaner records and accurate self-certifications, will find the transition straightforward.