CARF in Hong Kong: What the Crypto-Asset Reporting Framework Means from 2027

Hong Kong is preparing to bring crypto-asset transactions within the scope of automatic exchange of tax information. The Crypto-Asset Reporting Framework (CARF), developed by the OECD as a global standard for tax transparency in digital assets, is to be implemented here through the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026. The Bill was gazetted on 22 May 2026 and read for the first time in the Legislative Council on 3 June 2026.

On the proposed timetable, crypto-asset service providers with a Hong Kong nexus will begin conducting due diligence on their users from 1 January 2027, file their first returns in June 2028, and the Inland Revenue Department will make its first automatic exchange of crypto-asset data with partner jurisdictions in September 2028.

The consequence is straightforward. The tax authority of the jurisdiction in which a user is resident will receive, annually and without any need to request it, a summary of what that user bought, sold, exchanged and transferred through a Hong Kong service provider.

This guide covers both sides of the regime: what CARF requires of crypto-asset businesses, and what it means for investors and holders. It also sets out the international rollout timetable and a practical readiness plan for the coming twelve months.

What CARF is, and why it exists

The Common Reporting Standard (CRS) has governed automatic exchange of financial account information since 2017, and Hong Kong has exchanged data under it since 2018. CRS was built around banks, custodians and insurers. Crypto-assets can be held and transferred without any traditional financial institution in the chain, and the CRS definitions were never drafted with them in mind.

The OECD published CARF in 2022 and finalised it in 2023 to close that gap. It is a purpose-built reporting standard for crypto-assets, and it sits alongside an amended CRS (commonly called "CRS 2.0") which brings digital money products and crypto-asset derivatives into the existing regime. On the OECD Global Forum's commitments list as updated in June 2026, 76 jurisdictions have committed to implementing CARF. The OECD has published a CARF Multilateral Competent Authority Agreement as the mechanism for exchange.

CARF does not impose any new tax. Hong Kong has not introduced a capital gains tax, and CARF does not alter the substantive tax treatment of crypto-assets in any jurisdiction. What it alters is visibility.

The international rollout

Implementation is proceeding in waves, and the wave a jurisdiction falls into determines when its data begins to move.

• First wave: data collection from 1 January 2026, first exchanges in 2027. 46 jurisdictions, including the EU member states (which implement CARF through DAC8), the United Kingdom, Japan, Korea and Brazil, began collecting data at the start of 2026.
• Second wave: data collection from 1 January 2027, first exchanges in 2028. 29 jurisdictions, including Hong Kong, Singapore, Switzerland, Canada, Australia and the UAE.
• United States: first exchanges committed by 2029. The US also operates a separate domestic broker reporting regime under Form 1099-DA, covering gross proceeds on 2025 transactions, which is already in force.

Singapore's position is a useful comparison. Its first exchange, like Hong Kong's, covers the 2027 calendar year and is scheduled for September 2028. Singapore is, however, further advanced procedurally, having enacted its CARF regulations and published an IRAS e-Tax Guide in August 2026 while the Hong Kong Bill remains in committee.

A number of significant economies, among them India, Argentina and Viet Nam, have not committed at all.

For a Hong Kong business or investor, one point deserves particular attention: the first wave is already collecting. A Hong Kong resident dealing through an EU or UK exchange has been within scope since January 2026. The 2027 commencement date is when Hong Kong's own providers begin reporting, not when the framework begins to affect people in Hong Kong.

Hong Kong's implementation

As at August 2026 the Bill has not been enacted. It remains before a Bills Committee for clause-by-clause scrutiny, and its detail may still change. The architecture and the commencement dates, however, reflect settled Government policy. The Bill does two things.

• Part 2 (CARF) is to commence on 1 January 2027.
• Part 3 (amended CRS) is to commence on 1 January 2028.

The proposed timetable is as follows.

• 1 January 2027. CARF due diligence begins. New users must provide a self-certification.
• 1 January 2028. Deadline for obtaining self-certifications from pre-existing users, being twelve months from commencement. Amended CRS due diligence begins.
• 31 January 2028. Registration deadline on the IRD's CARF Portal, being 31 January of the calendar year following the year in which the nexus is first established.
• June 2028. First CARF returns due, covering the 2027 reporting period.
• September 2028. IRD's first exchange of CARF data with partner jurisdictions.
• June 2029 and September 2029. First returns and first exchange under the amended CRS.

Part one: CARF for crypto-asset businesses

Who is a Reporting Crypto-Asset Service Provider?

A Reporting Crypto-Asset Service Provider (RCASP) is any individual or entity which, as a business, provides a service effectuating exchange transactions in relevant crypto-assets for or on behalf of customers, whether as counterparty, as intermediary, or by making a trading platform available.

In practice the definition captures centralised exchanges, brokers and dealers, over-the-counter desks, crypto-asset ATM operators, certain custodial wallet providers and NFT marketplaces, and individuals who subscribe for and resell crypto-assets to customers. Investment funds which merely invest in crypto-assets are excluded.

One point is easily missed. The RCASP definition is wider than the VASP licensing perimeter. An over-the-counter dealer, an intermediary or a broker managed from Hong Kong may be an RCASP carrying full CARF obligations even where it does not require, or does not yet hold, a licence under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. Falling outside the licensing regime does not mean falling outside CARF.

The Hong Kong nexus tests

An RCASP is caught in Hong Kong if it meets any of four tests, which are applied in ranked order. It is:

• tax resident in Hong Kong;
• incorporated or organised under Hong Kong law, with legal personality or a tax filing obligation here;
• managed from Hong Kong; or
• maintaining a regular place of business in Hong Kong.

For individuals, only the residence and place-of-business tests can apply. Incorporation and management are entity-only tests. The ranking exists to prevent the same provider reporting the same users in two jurisdictions, so an entity which meets a higher-ranked test in another CARF jurisdiction may be relieved here. A group whose entities, management and staff are spread across Hong Kong, Singapore and elsewhere should map this carefully rather than assume it resolves neatly.

What is within scope

A relevant crypto-asset is any digital representation of value which relies on a cryptographically secured distributed ledger, whether fungible or non-fungible, and which can be used for payment or investment purposes. The following are excluded:

• central bank digital currencies (CBDCs), which are dealt with under the amended CRS instead;
• specified electronic money products (SEMPs), likewise; and
• crypto-assets which the provider has adequately determined cannot be used for payment or investment purposes, such as closed-loop assets.

Note what is not excluded. Stablecoins are within scope, as are NFTs where they can be used for payment or investment purposes.

Due diligence

An RCASP must obtain a valid self-certification from each user identifying the jurisdiction or jurisdictions in which that user is tax resident, and must confirm the reasonableness of that self-certification against information already held, including AML and KYC records. Further obligations include:

• determining whether entity users are excluded persons, such as governmental entities, listed corporations, international organisations and central banks;
• identifying the controlling persons of entity users unless the entity is "active";
• obtaining a fresh self-certification where a change of circumstances renders the original unreliable;
• applying enhanced scrutiny where a user claims residence in a jurisdiction identified as high-risk for citizenship or residence by investment schemes; and
• obtaining self-certifications from pre-existing users within twelve months of commencement, that is, by 1 January 2028.

The twelve-month exercise on the existing user base is, in our experience, the most commonly underestimated part of a regime of this kind. Building a self-certification step into new user onboarding is a product change. Obtaining one from every existing user, following up with those who do not respond, and settling a policy for accounts which never respond at all, is a programme of work that needs to be resourced.

What must be reported

For each reporting period, an RCASP reports its own identifying details together with, for each reportable user, that user's name, address, jurisdiction or jurisdictions of residence, taxpayer identification number, and date and place of birth. For controlling persons, their role must also be reported. The transaction information is then reported by type of crypto-asset:

• crypto-to-fiat exchanges, showing aggregate gross amounts paid and received, unit counts and the number of transactions;
• crypto-to-crypto exchanges, showing aggregate fair market value, units and transaction counts;
• retail payment transactions above US$50,000 (approximately HK$390,000), showing fair market value and units;
• transfers, subdivided by type and including airdrops, staking income and mining income, showing fair market values and unit counts; and
• transfers to wallet addresses not associated with a known virtual asset service provider or financial institution, that is, transfers out to unhosted wallets, showing aggregate fair market value and units.

The final category is significant. Moving assets to a self-custody wallet does not take the transaction outside the reporting net, because the transfer out is itself a reportable event.

Why CARF is operationally more demanding than CRS

CRS reporting is essentially a year-end exercise, concerned with balances and gross proceeds on an account. CARF requires an RCASP to track every relevant transaction across the year, classify it by type, value it as at the time it occurred, and aggregate it by asset. Returns are to be filed through the IRD's CARF Portal in a prescribed XML format, and records must be kept for six years after the return is due.

For a provider whose systems were built for trading and settlement rather than tax reporting, this is as much a data engineering problem as a legal one. Fair market valuation methodology, transaction classification logic, and the ability to reproduce a defensible audit trail years after the event all need to be designed now rather than in 2028.

Penalties

The Bill introduces a penalty regime materially stricter than the existing CRS provisions, with per-user multipliers which scale exposure to the size of the user base.

• Failure to register or to file a return without reasonable excuse: a fine at level 3 (HK$10,000), together with HK$500 for each day the offence continues.
• Due diligence failures, incorrect information, or failure to notify errors: a fine at level 3 (HK$10,000) or HK$1,000 per crypto-asset user, whichever is higher.
• Knowingly or recklessly providing false information: a fine at level 4 (HK$25,000) or HK$5,000 per user, whichever is higher.
• Providing false information with intent to defraud: on summary conviction, a fine at level 5 (HK$50,000) or HK$10,000 per user, whichever is higher, together with six months' imprisonment; on indictment, a fine at level 6 (HK$100,000) or HK$20,000 per user, whichever is higher, together with three years' imprisonment.

Administrative penalties are available as an alternative to prosecution in specified cases, capped at the level a court could impose, with a right of appeal to the Board of Review. Service providers engaged by an RCASP face parallel liability, and outsourcing the reporting function does not transfer the statutory obligation: the RCASP remains liable.

For a platform with tens of thousands of users, it is the per-user calculation rather than the headline figure that determines the real exposure.

Part two: CARF for investors and holders

What will be reported about you

If you hold crypto-assets through a Hong Kong service provider, and you are tax resident in a jurisdiction with which Hong Kong exchanges information, then from 2028 that jurisdiction will receive an annual summary of your activity. It will include your identity and taxpayer identification number, together with the aggregate value and volume of your fiat trades, crypto-to-crypto exchanges, large retail payments, staking, mining and airdrop receipts, and transfers out, including transfers to your own self-custody wallet.

Three points are commonly misunderstood.

Reporting follows tax residence. It does not follow nationality, and it does not follow the location of the exchange. A person who is tax resident only in Hong Kong, dealing solely through Hong Kong providers, may find that little or nothing is exchanged. A person who is tax resident in the United Kingdom, the EU, Australia or Canada will be reported to that jurisdiction, whatever identity documents they hold. Dual residence means reporting to both.

It has already begun elsewhere. First-wave jurisdictions have been collecting data since 1 January 2026. If you use an EU or UK based exchange, your 2026 data has already been captured and will be exchanged in 2027, irrespective of Hong Kong's own commencement date.

Self-custody is not a way out. Transfers to unhosted wallets are a specifically reportable category, and the framework was drafted with that behaviour in contemplation.

The Hong Kong tax position

Hong Kong does not tax capital gains. Where crypto-assets are held as a long-term capital investment, a gain on disposal is generally not chargeable to profits tax. That conclusion does not follow automatically, however. The Inland Revenue Department's published position in DIPN 39 is that the ordinary badges of trade apply, and that the intention at the time of acquisition is always relevant. The analysis considers the frequency of transactions, the holding period, how the acquisition was financed, the taxpayer's stated intention and the objective evidence supporting it, in order to determine whether a person is trading rather than investing. Frequent, leveraged, short-horizon activity carried on in Hong Kong bears a close resemblance to a trade, and trading profits sourced in Hong Kong are chargeable to profits tax.

Separately, crypto-assets received as employment income, as consideration for services, or as business receipts have always been taxable in the ordinary way. Mining and staking rewards received in the course of a business carried on in Hong Kong fall on the taxable side of that line.

What CARF changes is that the IRD, and for non-residents their home authority, will hold the transaction data against which those positions can be tested. A capital account characterisation which has never been documented becomes considerably harder to sustain once the underlying transaction data is in the authority's hands.

Steps to take before 2027

• Check that your self-certifications are accurate. You will be asked to provide one. An incorrect or incomplete declaration of tax residence is an offence under the Bill and carries penalties in its own right. A certification given at an earlier stage of life and never revisited is a common source of error.
• Settle your tax residence position in advance. If you have relocated, divide your time between jurisdictions, or hold residence permits elsewhere, establish where you are actually resident before you certify rather than afterwards.
• Reconcile your own records. Cost basis, acquisition dates, and transfers between your own wallets and exchanges. The reported data is aggregated and will not distinguish an internal transfer from a disposal. If you cannot explain the difference, the authority's starting assumption may not be the one you would prefer.
• Address historical positions deliberately. CARF operates prospectively, but data about 2027 activity naturally invites questions about how a position was built. Where there is an unresolved historical exposure, dealing with it voluntarily is almost always preferable to dealing with it after an enquiry has opened.
• Review your holding structures. Companies, trusts and family office structures are all within scope. Entity users are reported, and the controlling persons of passive entities are looked through to. A structure established for other purposes should be checked against how it will actually be reported.

The amended CRS

The amended CRS, commencing on 1 January 2028 in Hong Kong, is easily overlooked because CARF has attracted the attention. It is relevant to a wider group of institutions.

• Digital money products come within scope. Specified electronic money products and CBDCs become reportable and are treated broadly in the same way as deposit accounts. SEMPs with a rolling 90-day average end-of-day balance at or below HK$78,000 (approximately US$10,000) are excluded as low-risk, which keeps most ordinary stored-value payment accounts outside the regime.
• Crypto-asset derivatives are added to the definition of financial assets.
• Due diligence is enhanced. Reporting financial institutions must apply AML and KYC procedures substantially similar to the 2012 FATF Recommendations, must report all reportable residence jurisdictions rather than selecting one by reference to a treaty tie-breaker, and must apply broader change of circumstances triggers.
• Additional data points are required, covering valid self-certification status, controlling person roles, whether an account is pre-existing or new, joint account status and the number of holders, and the type of financial account.
• Dual reporting: note the change of position. The FSTB consultation had proposed dual reporting as the default. The Bill as introduced takes the opposite approach, so that relief from dual reporting is the default and gross proceeds from the sale or redemption of covered crypto-assets are not reportable under the amended CRS to the extent they have already been reported under CARF. A reporting financial institution may instead elect, for a clearly identified group of accounts, to report under both. Institutions whose planning was based on the consultation paper should revisit it.

A twelve-month readiness plan

For crypto-asset businesses

• Scope the group. Determine, entity by entity, whether each group company is an RCASP and whether any Hong Kong nexus test is met. The "managed from Hong Kong" test catches more groups than is generally expected. Run the same analysis against the nexus rules of other jurisdictions to identify overlap.
• Classify the assets. Map every supported asset against the relevant crypto-asset definition and against the CBDC, SEMP and non-payment exclusions. Where an exclusion is relied on, document the basis of the "adequate determination".
• Redesign onboarding. Build a valid self-certification step into new user onboarding, to be live before 1 January 2027, and integrate it with existing AML and KYC processes so that the reasonableness check operates as a system control rather than a manual one.
• Plan for the existing user base. Self-certifications from pre-existing users are due by 1 January 2028. Model response rates, design the follow-up cycle, and settle the policy for non-responders, including whether transactions will be restricted.
• Build the data layer. Transaction capture and classification, fair market valuation methodology, aggregation by asset type, the US$50,000 retail payment threshold, transfer typing for airdrops, staking and mining, and unhosted wallet identification. The XML output follows from all of this.
• Establish governance and records. A named accountable owner, written policies and procedures, six-year record retention, an error notification process, and a route to remediation.
• Diarise registration. The CARF Portal registration deadline of 31 January 2028 applies whether or not the RCASP holds any reportable information.
• Review vendor contracts. Where a third-party reporting vendor is used, statutory liability remains with the RCASP. Allocate responsibility, audit rights and indemnities accordingly.
• Check the licensing position. Confirm whether the activities require VASP licensing under the AMLO as that perimeter expands. CARF status and licensing status are distinct questions, but they frequently arise together.

For investors, holders and family offices

• Confirm and document the tax residence position for each relevant year.
• Review self-certifications already provided to Hong Kong and overseas providers, and correct anything inaccurate.
• Rebuild a complete transaction and cost basis record across all venues and wallets.
• Document the basis for treating holdings as capital rather than trading, contemporaneously rather than retrospectively.
• Identify and resolve historical exposures while voluntary routes remain available.
• Review entity, trust and family office structures against how controlling persons will be reported.

Matters still to be settled

Three points should temper any final decision. The Bill remains subject to scrutiny by the Legislative Council and its detail may change before enactment. IRD guidance and the CARF Portal specifications have yet to be issued, and the practical answers to valuation and classification questions will largely be found there. The consultation timetable indicated that the Portal would open for registration in or around September 2027, but the IRD has since said only that further details will be announced in due course. Finally, the list of exchange partners will develop over time. The September 2028 first exchange is expressed to be subject to the progress of partner jurisdictions, so which jurisdictions receive Hong Kong data in the first year is not yet fixed.

None of this is a reason to defer preparation. The obligations requiring the longest lead time, namely user data collection, transaction classification and systems build, must be operating on 1 January 2027 regardless of how the remaining detail is settled.

How we can help

Alan Wong LLP advises crypto-asset businesses, investors and family offices on the Hong Kong CARF and amended CRS regime. Our work in this area includes RCASP scoping and nexus analysis, the design of due diligence and self-certification processes, reporting and governance frameworks, vendor contracting, and the interaction with VASP licensing under the AMLO. We also advise individuals, funds and private wealth structures on tax residence, on the trading versus capital characterisation of digital asset holdings, and on resolving historical positions before the first exchange takes place. To discuss how CARF applies to your business or your holdings, or to request a tailored readiness assessment, please get in touch.

This article is general information current as at August 2026 and reflects the Bill as gazetted on 22 May 2026, which remains subject to change. It is not legal or tax advice and should not be relied on as such.