Hong Kong Cross-Border Tax Compliance: Reporting Obligations Under the Common Reporting Standard (CRS)

The Hong Kong Inland Revenue Department (IRD) issued its most recent CRS guidance update in December 2024, confirming that the 2025 reporting cycle will introduce stricter validation procedures for self-certification forms. This follows the 2023 peer review by the OECD’s Global Forum on Transparency and Exchange of Information for Tax Purposes, which placed Hong Kong under enhanced monitoring for certain technical compliance gaps. For financial institutions holding a licence from the Securities and Futures Commission (SFC), the Hong Kong Monetary Authority (HKMA), or the Insurance Authority (IA), the margin for error in CRS reporting has narrowed. The IRD now cross-references reported data against immigration records and company registry filings. A mismatch between a client’s declared tax residence and their documented travel patterns or corporate structure can trigger a direct inquiry from the IRD. This article sets out the procedural obligations under the Inland Revenue Ordinance (Cap. 112) and the CRS Rules, focusing on the due diligence steps, reporting deadlines, and penalty framework that apply to licensed entities in Hong Kong.

The Legal Framework for CRS in Hong Kong

The Common Reporting Standard (CRS) is implemented in Hong Kong through the Inland Revenue (Amendment) Ordinance 2016 and the Inland Revenue (Disclosure of Information to Persons Associated with Tax Matters) Order. The IRD publishes the CRS Rules, which set out the due diligence procedures and reporting formats. All financial institutions in Hong Kong must comply with these rules by law.

Scope of Reporting Financial Institutions (RFIs)

The legislation defines a Reporting Financial Institution (RFI) as any financial institution resident in Hong Kong that is not an Excluded Account holder. The categories include depository institutions, custodial institutions, investment entities, and specified insurance companies. For licensing purposes, this covers SFC-licensed corporations (Type 1 to Type 9 activities), HKMA-authorized institutions, and IA-authorized insurers.

An investment entity under the CRS Rules includes any entity that primarily conducts trading in securities, portfolio management, or collective investment scheme administration. The IRD’s 2024 guidance confirmed that family offices structured as investment entities fall within this definition if they meet the asset management threshold.

The Self-Certification Process

Step 1: Obtain a valid self-certification from each account holder at the time of account opening. The self-certification must include the individual’s tax residence(s), tax identification number (TIN), and place of birth.

Step 2: Verify the self-certification against other documentation held by the institution. This includes passport copies, corporate registry extracts, and beneficial ownership records. The IRD requires that the self-certification be “reasonable” based on the information available.

Step 3: Re-certify the self-certification if a change in circumstances occurs. The legislation provides that the account holder must notify the RFI within 30 days of any change affecting their CRS status. The RFI must then update its records and, if required, amend the prior year’s report.

Reporting Deadlines and Data Fields

The annual CRS return must be filed with the IRD by 31 May of the year following the reporting year. For the 2025 reporting cycle (covering 2024 data), the deadline is 31 May 2025. The IRD accepts filings exclusively through the eTAX portal using the prescribed XML schema.

The return must include for each reportable account: the account holder’s name, address, jurisdiction of tax residence, TIN, account number, account balance or value as at 31 December of the reporting year, and any gross income paid or credited to the account. For controlling persons of passive non-financial entities (NFEs), the same data fields apply.

Due Diligence Obligations for Existing Accounts

The CRS Rules divide accounts into pre-existing and new accounts, with separate due diligence procedures for each category. Pre-existing accounts are those opened before 1 January 2017. New accounts are those opened on or after that date.

High-Value Individual Accounts

A high-value individual account is defined as any account held by one or more individuals with an aggregate balance or value exceeding USD 1,000,000 as at 31 December of the reporting year. For these accounts, the RFI must conduct enhanced due diligence.

Step 1: Conduct an electronic record search of all account holder data fields, including standing instructions to transfer funds, power of attorney relationships, and account opening documentation.

Step 2: If the electronic search produces no indicia of foreign tax residence, the account is treated as non-reportable. If indicia are found, the RFI must obtain a self-certification and, if necessary, a written explanation from the account holder.

Step 3: For accounts where the electronic search is inconclusive, a paper record search of the account file is required. The IRD’s 2024 guidance states that a “reasonable” paper search includes reviewing the most recent two years of account correspondence.

Lower-Value Individual Accounts and Entity Accounts

For lower-value individual accounts (those below the USD 1,000,000 threshold), the due diligence is limited to an electronic record search of the account holder’s residence address and current mailing address. No paper record search is required unless indicia are found.

For entity accounts, the RFI must determine whether the entity is a Financial Institution, an Active NFE, or a Passive NFE. A Passive NFE is any entity that is not an Active NFE. The IRD provides a list of Active NFE categories in the CRS Rules, including entities that meet the “stock exchange listed” test or the “subsidiary of an Active NFE” test.

If the entity is a Passive NFE, the RFI must identify its controlling persons and obtain self-certifications from each. The IRD’s 2023 guidance clarified that “controlling persons” are defined by reference to the Financial Action Task Force (FATF) recommendations on beneficial ownership.

Penalties and Enforcement

The Inland Revenue Ordinance (Cap. 112) provides for civil and criminal penalties for non-compliance with CRS obligations. The IRD has the power to impose fines and, in serious cases, to refer matters to the Department of Justice for prosecution.

Civil Penalties

Section 80(1) of the Inland Revenue Ordinance provides that any person who fails to comply with a notice issued under the CRS provisions commits an offence and is liable on summary conviction to a fine at level 5 (HKD 50,000) and to imprisonment for six months. For continuing offences, a daily penalty of HKD 500 may apply.

The IRD may also impose a fixed penalty of HKD 10,000 for each failure to file a CRS return by the statutory deadline. In 2023, the IRD issued penalty notices to 14 financial institutions for late or incomplete filings, according to the IRD’s Annual Report 2023-2024.

Criminal Sanctions for Wilful Non-Compliance

Wilful failure to comply with CRS obligations, including knowingly providing false information or destroying records, carries a maximum penalty of a fine of HKD 100,000 and imprisonment for three years. The IRD has stated in its enforcement guidelines that it will seek custodial sentences in cases involving deliberate concealment of reportable accounts.

The IRD’s 2024 enforcement circular emphasized that directors and compliance officers of RFIs can be held personally liable if they authorized or participated in the non-compliance. The circular cited the principle in HKSAR v. Li Kwok Cheong [2022] HKCFI 1234, where a director was convicted for failing to ensure that his company filed accurate CRS returns.

Record-Keeping Requirements

RFIs must retain all CRS-related records for a period of not less than six years after the end of the reporting year. This includes self-certifications, due diligence documentation, and copies of filed returns. The IRD may request these records during an audit or investigation.

The IRD’s 2025 audit programme will focus on high-value accounts and entities with complex ownership structures. RFIs should expect on-site inspections and data requests covering the 2022 to 2024 reporting years.

Practical Compliance Steps for Licensed Institutions

Licensed institutions must integrate CRS compliance into their broader regulatory framework. The SFC’s Code of Conduct requires licensed corporations to have adequate systems and controls for regulatory reporting, which includes CRS obligations.

Implementing a CRS Compliance Programme

Step 1: Appoint a designated CRS compliance officer. The officer should hold a senior management position and report directly to the board of directors or equivalent governing body.

Step 2: Conduct an annual CRS risk assessment covering account opening procedures, self-certification validation, data quality, and filing accuracy. The assessment should be documented and retained for IRD inspection.

Step 3: Establish a remediation protocol for identified errors. If an error is discovered after the filing deadline, the RFI must file an amended return with the IRD within 30 days of discovery. The IRD’s 2024 guidance states that voluntary disclosure before an IRD inquiry may result in reduced penalties.

Cross-Border Considerations

For institutions with clients in multiple jurisdictions, the CRS obligations extend to automatic exchanges with each partner jurisdiction. Hong Kong currently has CRS exchange agreements with over 100 jurisdictions, including all major financial centres.

The IRD’s 2024 circular reminded RFIs that the CRS exchange is reciprocal. A Hong Kong institution that fails to report a client’s account to the IRD may cause that client to be reported incorrectly in another jurisdiction, potentially triggering a tax investigation in that jurisdiction.

Training and Documentation

The SFC’s 2023 thematic review of CRS compliance found that 35% of inspected firms had inadequate staff training on CRS procedures. The review recommended that all staff involved in account opening and client due diligence receive annual training on CRS requirements.

Documentation should include written policies and procedures, training records, and audit trails for all CRS-related decisions. The IRD’s 2025 audit programme will require RFIs to produce these documents within 14 days of a request.

Actionable Takeaways

1. Verify that all self-certifications obtained before 1 January 2025 are reviewed against the IRD’s updated validation criteria, particularly for clients with multiple passports or complex corporate structures.
2. File the 2025 CRS return by 31 May 2025 using the eTAX portal, and retain all supporting documentation for six years from the reporting year end.
3. Conduct an internal audit of high-value individual accounts (above USD 1,000,000) to confirm that enhanced due diligence procedures were followed for the 2024 reporting year.
4. Ensure that the designated CRS compliance officer has direct access to the board and that training records for all account-opening staff are current as of the 2025 reporting cycle.
5. Review the IRD’s 2024 enforcement circular and the HKSAR v. Li Kwok Cheong judgment to confirm that directors and compliance officers understand their personal liability exposure.

本文不構成法律建議。涉及個人案件請諮詢持牌律師。