From the journal

Hong Kong Gazetted Crypto-Asset Reporting Framework Bill on 22 May 2026

The Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 was gazetted in Hong Kong on 22 May 2026 and had its first reading in the Legislative Council on 3 June 2026. The bill implements the OECD Crypto-Asset Reporting Framework and 2023 CRS amendments. Crypto-asset service providers with a Hong Kong reporting nexus must register with the Inland Revenue Department, conduct client due diligence, file annual returns, and maintain records from 1 January 2027.

2 min read

The Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 was gazetted on 22 May 2026 and had its first reading in the Legislative Council on 3 June 2026. The bill is at the legislative stage and remains subject to LegCo scrutiny and amendment before enactment.

The bill amends the Inland Revenue Ordinance (Cap. 112) to insert a new reporting and due diligence regime for crypto-asset service providers (CASPs). CARF provisions take effect on 1 January 2027; the amended Common Reporting Standard provisions apply from 1 January 2028. Automatic exchange of tax information on crypto-asset transactions with partner jurisdictions is planned to commence in 2028, aligned with the OECD CARF global implementation calendar.

CASPs with a Hong Kong reporting nexus must register with the Inland Revenue Department (IRD), apply due diligence procedures to identify account holders and their tax residences, file annual returns with the IRD, and maintain records. Virtual asset trading platforms (VATPs) already licensed by the Securities and Futures Commission (SFC) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) must assess whether the CARF reporting nexus criteria apply to their activities and build reporting infrastructure before 1 January 2027.

Reporting nexus under CARF is determined by reference to the CASP's tax residence, place of incorporation, place of management and control, and, in certain cases, the residence of account holders. The bill defines these trigger conditions, but the IRD has not yet published detailed guidance on nexus analysis for specific business models. Entities operating across multiple jurisdictions will need to assess potential duplicate reporting obligations under the OECD's framework for avoiding overlap.

Licentium advises virtual asset businesses, crypto-asset service providers, and financial intermediaries on Hong Kong regulatory obligations. If you are assessing your CARF nexus position or building reporting infrastructure ahead of the 2027 implementation date, our team and partner network can assist. Work we undertake includes CARF nexus analysis, IRD registration procedures, CRS compliance for virtual asset intermediaries, AMLO licensing advisory, and AML/CFT programme design for SFC-licensed VATPs.

Source: Inland Revenue Department, Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026, gazetted 22 May 2026

Crypto Regulatory

More from the journal

See all
Illia Prokopiev

From Cloud Concentration to AI Dependence: The UK’s Critical Third Parties Regime

The United Kingdom now directly oversees designated technology suppliers whose service failures could threaten financial stability. The question is whether the first cloud designations show a legal expansion toward AI-model providers, and what the present regime requires. This analysis assumes the quoted statement concerns the UK financial-services Critical Third Parties regime and assesses the law through 14 July 2026.

Alberta Regulated iGaming Market Launched on 13 July 2026 with 22 Operators

Alberta's regulated private iGaming market launched on 13 July 2026, making Alberta the second Canadian province to permit private online gambling operators after Ontario. The Alberta Gaming, Liquor and Cannabis Commission serves as market regulator and the Alberta iGaming Corporation oversees commercial operations and operator contracts. Twenty-two operator sites went live on day one, including FanDuel, DraftKings, BetMGM, and BetRivers. Operators must fully launch or exit the Alberta market by 13 October 2026.

European Commission Presents Cybersecurity and AI Action Plan on 7 July 2026

On 7 July 2026, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence. The plan directs the Commission and ENISA to evaluate advanced AI models before they reach the EU market, establish a secure testing platform for critical-sector organisations, and launch an EU Grand Challenge on AI-powered cybersecurity solutions. It operates alongside the AI Act, NIS2 Directive, DORA, Cyber Resilience Act, and Cyber Solidarity Act, and introduces no new directly binding obligations.