The Common Reporting Standard, Ten Years On: Where Hong Kong Stands in 2026

In March 2016 I wrote a short explanation of the common reporting standard, opening with the line that Hong Kong was "soon going to adopt a CRS". At that point more than 90 countries had committed and none of us knew how well it would work.

It works. In 2024 information on over 171 million financial accounts was exchanged automatically under the CRS, representing nearly EUR 13 trillion in assets, and by November 2025 some 116 jurisdictions had commenced annual exchanges. The system I described as a coming thing is now the background condition of holding money across borders.

The interesting questions are no longer about whether CRS will happen. They are about what Hong Kong has just changed, what is arriving next, and where the standard genuinely still bites.

What Hong Kong actually built

The Inland Revenue (Amendment) (No. 3) Ordinance 2016 came into effect on 30 June 2016. Self-certification became compulsory for accounts opened on or after 1 January 2017, and Hong Kong made its first exchanges in September 2018.

The scope has widened steadily since. Schedule 17E to the Inland Revenue Ordinance now lists reportable jurisdictions across four tranches added in 2018, 2019, 2021 and 2026, the last adding Ecuador, Oman and Thailand. The Department does not publish a headline total, and a figure circulating in professional commentary — 126 — dates from the 2019 amending ordinance and is out of date.

A more meaningful number is how many partners Hong Kong actually sends to. According to the OECD's 2025 peer review update, that figure rose from 40 in 2018 to 84 in 2025.

Reporting financial institutions file the annual return through the AEOI Portal, which the Commissioner designated in July 2017. The Department issues electronic notices in January and, on its own description, institutions are normally required to furnish the information in early June. I mention that because a specific date is often quoted as though it were statutory. The obligation runs from the notice, and the notice is what you should read.

The 2026 Ordinance, which is the real news

The change that matters this year is domestic. The Inland Revenue (Amendment) (Automatic Exchange of Information) Ordinance 2026 was passed by the Legislative Council on 17 June 2026, gazetted on 26 June 2026, and comes into operation on 1 January 2027.

It does three things.

Registration becomes mandatory for everyone. Every reporting financial institution must register on the AEOI Portal, whether or not it has anything to report. Institutions already carrying on business but not yet registered must register by 31 March 2027. The nil-return problem — an entity that quietly concluded it had no reportable accounts and therefore did nothing — has been closed.

Records must be kept for six years, and the obligation survives the entity. Where an institution is dissolved, responsibility for those records falls on former directors or trustees personally. Anyone who has been in the habit of winding up a redundant investment company and disposing of its files should stop.

Penalties rise, and can be calculated per account. The existing scheme is modest: making a misleading, false or incorrect self-certification is an offence under section 80(2E) of the Inland Revenue Ordinance carrying a fine at level 3, which is HK$10,000, and institutional offences under sections 80B to 80F run to level 5 with imprisonment in the more serious cases. Under the new Ordinance, penalties may be calculated by reference to the number of financial accounts involved, and a new administrative penalty mechanism is introduced as an alternative to prosecution.

The driver is not hard to identify. The OECD has been conducting its second round of peer review on Hong Kong's implementation since 2024. Hong Kong's ratings going into it were good — legal framework in place, effectiveness on track, on both core requirements — and this legislation is what protecting that rating looks like.

Trusts: the part most often stated wrongly

Trusts are where I still see confident advice that is simply incorrect, so it is worth setting out.

A trust is either a reporting financial institution — most commonly because it is an investment entity, meaning its income comes primarily from financial assets and it is managed by another entity that is a financial institution — or a passive non-financial entity. A trust managed solely by individual trustees is not an investment entity.

If the trust is a reporting financial institution, the account holders are the settlor, the beneficiaries and any other natural person exercising ultimate effective control. If the trust is a passive non-financial entity holding an account with a bank, the controlling persons are the settlor, the trustee, the protector, the beneficiaries or class of beneficiaries, and, in the Department's guidance, the enforcer.

Note two things that people get wrong. There is no 25% threshold for trusts. That threshold applies to corporations; the persons listed above are always treated as controlling persons whether or not any of them controls anything.

And on discretionary beneficiaries, the familiar statement — reported only in years when a distribution is made — is half right. It is correct where the trust is itself a reporting financial institution. Where the trust is a passive non-financial entity, the default is the opposite: discretionary beneficiaries are reported whether or not a distribution is received. Hong Kong permits an institution to align the two treatments, but that is an option the institution may take on notification from the trustee, not an automatic rule you can rely on.

What is arriving, and when

Two further layers are coming, and Hong Kong's timing is not what most commentary assumes.

The OECD published an amended CRS on 8 June 2023, extending the standard to certain electronic money products and central bank digital currencies, catching indirect investments in crypto-assets through derivatives and investment vehicles, and requiring reporting of the role by which each person is a controlling person. The commonly expected first exchange year is 2027, and 84 of 124 jurisdictions plan to start then.

Hong Kong is not among them. The Government's stated intention is to implement the amended CRS with effect from 1 January 2028, with first exchanges in 2029. Hong Kong has also not signed the addendum to the multilateral competent authority agreement that provides the exchange mechanism for the amended standard; as at the end of July 2026 that addendum had 78 signatories, including Singapore, Macao, Japan and Korea.

The crypto-asset reporting framework runs ahead of it. Hong Kong has committed to conducting first automatic exchanges of crypto-asset transaction information under CARF in 2028, conditional on the necessary domestic legislation being in place by 2026. A public consultation ran from December 2025 to February 2026 and the implementing Bill was gazetted on 22 May 2026 with first reading on 3 June 2026.

That Bill is not yet law. The Department's own pages on CARF and the amended CRS carry a disclaimer that their contents are based on a Bill subject to scrutiny by the Legislative Council. The lists of CARF reportable and partner jurisdictions do not yet exist, and the reporting portal and its data schema have not been published. If you hold crypto-assets through a structure, the honest position today is that the obligation is coming, the shape of it is drafted, and the detail is not settled.

What has not changed

FATCA continues alongside all of this. Hong Kong operates under a Model 2 intergovernmental agreement in force since 6 July 2016, under which financial institutions report directly to the Internal Revenue Service with account holder consent.

And the underlying point from 2016 stands, only more firmly. The use of a trust or a holding company does not prevent the exchange of information; in most cases it makes the reporting outcome more complicated rather than less. Structures should be chosen for what they do — governance, succession, asset protection, commercial efficiency — and built on the assumption that the relevant tax authority will see them.

---

This article is general information about Hong Kong's automatic exchange of information regime as at August 2026. It is not advice on any particular structure or filing obligation, and parts of the framework described here are still before the Legislative Council. To review your position, write to us at [email protected].