Hong Kong Crypto Tax Reporting Law: What Starts in 2027 and 2028

Starting in 2027, a crypto trade made through a Hong Kong service provider stops being a private matter between a customer and an exchange. On Wednesday, November 4, the city's Legislative Council passed a bill that brings Hong Kong crypto tax reporting in line with a global standard, and the clock on it is already running.

The law is the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026. It puts two rulebooks from the Organisation for Economic Co-operation and Development (OECD) into Hong Kong law. One, the Crypto-Asset Reporting Framework (CARF), covers crypto transactions. The other is an updated version of the Common Reporting Standard (CRS), the system banks already use to share account data across borders.

None of it happens overnight. The rules phase in over three years, so the easiest way to understand them is as a sequence of dates.

Eight dates that explain Hong Kong's crypto tax law

• 2018: Hong Kong begins exchanging financial account information with partner jurisdictions every year under the original CRS, according to the Hong Kong government's announcement. Bank and brokerage accounts were in scope. Crypto mostly was not.
• 2023: The OECD publishes CARF, a template for the annual automatic exchange of tax information on crypto transactions, and amends the CRS to cover digital financial products. (The government dates CARF to 2023; CoinDesk dates its release to October 2022.)
• 2023: Hong Kong opens a licensing regime for crypto exchanges, part of its push to attract digital asset firms.
• November 4, 2026: Lawmakers pass the CARF and amended CRS bill. Secretary for Financial Services and the Treasury Christopher Hui says aligning with the standards "will reinforce the confidence" of crypto firms, financial institutions and digital asset users who operate and invest in the city.
• 2027: CARF takes effect. Relevant crypto service providers must start collecting the specified customer and transaction information.
• 2028: Hong Kong begins sending CARF data to partner jurisdictions. The amended CRS also takes effect that year.
• 2029: The Inland Revenue Department (IRD) starts automatic exchange of financial account information under the amended CRS.
• Ongoing: The IRD says it will publish guidance and has set up a dedicated technical support team for firms that need to comply.

What exchanges will have to collect

The government release describes the obligations in broad terms. CoinDesk's coverage, by Olivier Acuna, fills in the specifics.

According to CoinDesk, covered exchanges and other covered providers will collect:

1. Customer names and addresses.
2. Tax residency and identification numbers.
3. Records of crypto purchases and sales.
4. Crypto to crypto trades.
5. Transfers to external wallets.

The IRD will then pass customer details and annual transaction totals to the tax authorities of the places where those customers are tax residents. CoinDesk notes the information is not made public. The government says the exchange is reciprocal and runs "on the premise of data confidentiality and security."

Why a US reader should pay attention

Hong Kong is not acting alone. CARF is an international template, and the point of it is that tax offices swap data with each other on a fixed schedule. If you hold crypto on a platform that operates across borders, the paper trail around your account is getting longer, not shorter. That holds even while Washington's own crypto rules stay unsettled after the midterm results.

The practical takeaway is simple. Keep your own records of what you bought, when, and at what price, especially for coins you later moved off an exchange or cashed out to a bank account. Transfers to external wallets are one of the activities named in the Hong Kong rules, and those are exactly the moves people tend to forget when tax season arrives.

It also helps to know where you stand with each platform you use. If you have dormant balances sitting on a foreign exchange, now is a reasonable time to decide whether to withdraw them and consolidate. Recent events, including the $6.3 billion Binance hack, are a reminder that every extra account is another place to monitor.

Gaps in the new rules so far

Several details are still missing from the public record. Neither the government release nor CoinDesk lists penalties for providers that fail to report. The number of partner jurisdictions that will receive Hong Kong data was not given either, and the official statements do not name any specific exchange.

The phrase "relevant service providers" also does a lot of work in the government text. The IRD guidance promised before 2027 should define it more precisely, and that guidance will decide which platforms carry the reporting burden.

For more coverage of rules shaping the market, see our crypto section. The next date to circle is the IRD's guidance release, since it will show how wide the 2027 net is cast.