Hong Kong lawmakers on Wednesday passed a bill that will require crypto exchanges, brokers and other digital asset service providers to collect tax information on their customers from Jan. 1, 2027, with the city's tax authority set to begin sharing that data with partner jurisdictions in 2028.

The Legislative Council approved the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 on Nov. 4, the government said in a statement. The law brings into Hong Kong the Crypto-Asset Reporting Framework, or CARF, a tax transparency standard the Organisation for Economic Co-operation and Development published in 2023, along with the OECD's update to its Common Reporting Standard for bank and investment accounts.

For investors, the practical effect is that crypto trading through a Hong Kong platform will no longer sit outside the cross-border tax reporting that has covered bank and brokerage accounts in the city since 2018. Platforms licensed by the Securities and Futures Commission, and any other business that meets the law's nexus tests, will have to ask customers where they are tax resident and report their annual activity to the Inland Revenue Department (IRD).

Secretary for Financial Services and the Treasury Christopher Hui said in the statement that adopting the standards was important to Hong Kong's standing as a financial center. He said alignment would "reinforce the confidence of crypto-asset service providers," financial institutions and users of digital assets.

What Hong Kong crypto platforms must report

The law applies to what the OECD calls reporting crypto-asset service providers: any business that carries out exchanges between crypto assets, or between crypto and fiat money, for customers. According to IRD guidance, that covers trading platforms, dealers buying and selling for their own account, brokers, operators of crypto ATMs and market makers that earn a bid-ask spread.

A provider falls under Hong Kong's rules if it is tax resident in the city, incorporated there, managed from there or has a regular place of business there, such as a branch. The framework sets an order of priority among those tests so that a firm with ties to several jurisdictions does not report the same users twice.

Three kinds of transactions are reportable: crypto-to-fiat trades, crypto-to-crypto swaps and transfers, including transfers to external wallet addresses. For each customer who is tax resident in a reportable jurisdiction, providers must send the IRD the customer's name, address, tax residence and taxpayer identification number, along with aggregated figures for each type of crypto asset. Those figures include the gross amounts paid or received, the number of units and the number of transactions.

The definition of crypto asset is broad and covers non-fungible tokens as well as fungible ones. Central bank digital currencies and specified electronic money products are excluded, as are tokens that a provider determines cannot be used for payment or investment.

New customers must give a self-certification of tax residence when they sign up. For existing users, providers have 12 months after the rules start to collect the same declarations, the IRD said. Knowingly or recklessly giving false information in a self-certification will be an offense.

Registration deadline and the 2028 data swap

Every provider that meets the nexus rules must open an account on a new IRD reporting portal, even if it has nothing to report. Under the bill as described by the IRD, registration is due by Jan. 31 of the year after a firm first meets the criteria, which for providers already operating in the city points to January 2028. Firms must keep due diligence and reporting records for six years after each return is due, and that duty survives if the company is dissolved.

The law sets penalties for failing to register, carry out due diligence or report, and for filing incorrect or incomplete information. Some fines will scale with the number of days an offense continues or the number of users involved. The IRD will also be able to impose financial penalties as an alternative to prosecution, with a right of appeal to the Board of Review.

The second half of the law updates the Common Reporting Standard, which Hong Kong banks, insurers and fund managers already follow. From 2028, the standard will cover central bank digital currencies, specified e-money products, derivatives that reference crypto assets and investment entities that hold crypto. Institutions must also report more detail, such as whether an account is joint and whether a valid self-certification is on file. The IRD will begin exchanging information under the amended standard in 2029.

To prevent double reporting, a financial institution that is also a crypto service provider will report crypto sale proceeds under CARF rather than the amended standard, according to the IRD.

The timing matters for Hong Kong's push to grow its licensed digital asset market, which now includes products such as tokenized money market funds. Elsewhere in the region, crypto taxation remains unsettled: South Korea has pushed back its crypto gains tax.

The government said exchanges will run on a reciprocal basis and only with partners that meet data confidentiality and security standards. The IRD has set up a dedicated team to answer industry questions and said it will issue guidance. The department also plans to publish a data schema for returns and lists of reportable and partner jurisdictions, with dates still to be announced.