CRS and Cryptocurrency: How Virtual Asset Service Providers Fit into Reporting

The intersection of cryptocurrency and global tax transparency has become a defining regulatory challenge for 2026. Over 120 jurisdictions have now committed to the Common Reporting Standard (CRS) for automatic exchange of financial account information, and the OECD reports that more than €12 trillion in assets were disclosed through CRS in 2025 alone. Meanwhile, the Hong Kong Monetary Authority (HKMA) estimates that virtual asset transactions processed through Hong Kong-based platforms exceeded $180 billion in the first half of 2026, a 23% increase from the previous year. These figures underscore why crypto CRS reporting is no longer a niche concern—it is a core compliance function for any virtual asset service provider (VASP) operating in Hong Kong’s digital asset hub. This article dissects how VASPs fit into the CRS architecture, the practical obligations they now face, and the critical overlap with the Crypto-Asset Reporting Framework (CARF).

The Expanding Scope of CRS to Digital Assets

The Common Reporting Standard was originally designed for traditional financial institutions—banks, custodians, and investment entities. However, the 2023 amendments to the CRS Commentary, now fully implemented in Hong Kong under the Inland Revenue (Amendment) (No. 6) Ordinance 2024, explicitly extend CRS obligations to VASPs. The rationale is straightforward: virtual assets can function as “financial assets” when held in custodial wallets or traded on centralized platforms, making those platforms “Financial Institutions” under CRS rules.

Key triggers for VASP CRS classification include holding legal title to crypto assets on behalf of customers, executing exchange transactions between fiat and crypto, and providing wallet services where the provider controls the private keys. A Hong Kong-based exchange that custodies Bitcoin or Ethereum for non-resident account holders is now required to identify those accounts, determine tax residency, and report balances and gross proceeds to the Inland Revenue Department (IRD) annually. The virtual asset CRS framework treats crypto holdings similarly to securities held in a brokerage account—a shift that has caught many VASPs unprepared.

VASP CRS Obligations: Due Diligence and Reporting Mechanics

VASP CRS obligations break down into three core components: account identification, due diligence, and annual reporting. For pre-existing individual accounts with aggregate crypto holdings exceeding $250,000 as of 31 December 2025, VASPs must complete a residency determination by 30 June 2027. For new accounts opened after 1 January 2026, due diligence must be performed at onboarding using self-certification forms that capture tax identification numbers (TINs) and jurisdiction of residence.

The due diligence procedures require VASPs to review indicia such as telephone numbers, IP addresses, and withdrawal bank account locations. If a customer’s profile shows a Hong Kong phone number but a withdrawal instruction to a Singaporean bank, the VASP must treat the account as potentially reportable to Singapore unless cured by documentary evidence. Reporting itself must be submitted to the IRD by 31 May each year, covering the preceding calendar year’s account balances, gross proceeds from crypto-to-fiat and crypto-to-crypto transactions, and any fiat currency held in the account.

CARF and CRS Overlap: Navigating Dual Reporting Regimes

One of the most complex aspects for VASPs is managing the CARF and CRS overlap. The Crypto-Asset Reporting Framework, developed by the OECD and adopted by Hong Kong effective 1 January 2026, specifically targets crypto-to-crypto transactions and decentralized exchange activity that CRS might miss. While CRS focuses on custodial relationships, CARF captures peer-to-peer transactions facilitated by VASPs and certain DeFi protocols where the VASP exercises “control or sufficient influence.”

The dual reporting obligation means a Hong Kong VASP may need to report the same customer under both regimes—but with different data points. Under CRS, the VASP reports the account balance and gross proceeds. Under CARF, it must also report the full transaction history, including acquisition costs, transfer details to unhosted wallets, and the fair market value of each transaction in fiat at the time of execution. For a high-frequency trader executing 500 trades per month, the CARF reporting burden is substantially heavier. Avoiding double counting requires sophisticated data mapping between the two reporting schemas, a technical challenge that many mid-sized exchanges are only now addressing in mid-2026.

Which VASPs Are Most Affected by CRS Reporting?

Not all VASPs are treated equally under the virtual asset CRS framework. Centralized exchanges with custodial wallets are squarely within scope. Wallet providers that hold or manage private keys on behalf of users—even if they do not execute trades—are classified as Custodial Institutions and must report. Brokers facilitating OTC crypto trades above $50,000 per transaction fall under CRS if they hold customer funds, even momentarily, during settlement.

By contrast, pure software wallet developers who never access user keys generally fall outside CRS, though they may still have CARF obligations if they facilitate transactions. DeFi protocols present a grey area: the IRD’s guidance issued in March 2026 states that a protocol’s governing DAO may be considered a VASP if it exercises “meaningful control” over user assets, but enforcement remains nascent. Hong Kong-based NFT marketplaces that handle royalties and secondary sales in crypto are also increasingly being classified as VASPs subject to CRS, particularly where they hold escrow funds during auctions.

Practical Compliance Steps for Hong Kong VASPs in 2026

For VASPs yet to fully implement crypto CRS reporting, the clock is ticking. The first step is a legal entity classification review to determine whether the business is a Reporting Financial Institution under CRS, a Reporting Crypto-Asset Service Provider under CARF, or both. This requires analyzing custody models, control over private keys, and the nature of services provided.

The second step is deploying automated data extraction tools capable of generating both CRS and CARF XML schemas from transaction databases. Manual reporting is no longer viable given the volume and complexity of data required. Third, VASPs must train compliance teams on the nuances of indicia review—misclassifying a customer’s residency can lead to penalties of up to $10,000 per account under Hong Kong’s Inland Revenue Ordinance. Finally, VASPs should engage with the IRD’s voluntary disclosure program, which offers reduced penalties for institutions that proactively correct under-reporting before 31 December 2026.

The Future of VASP Tax Reporting Beyond 2026

Looking ahead, the convergence of CRS, CARF, and domestic licensing regimes will intensify. The Hong Kong Securities and Futures Commission (SFC) has signaled that CRS compliance will be a condition of license renewal for VASPs from 2027 onward. The OECD is also consulting on a unified reporting standard that would merge CRS and CARF into a single schema by 2029—a development that could simplify compliance but require significant systems re-engineering in the interim.

For investors and institutions, the message is clear: crypto holdings are no longer invisible to tax authorities. The IRD received over 2.3 million CRS records in 2025, and with VASP reporting now live, that figure is projected to exceed 3 million in 2027. VASPs that treat CRS compliance as a strategic priority rather than a regulatory burden will be best positioned to thrive in Hong Kong’s maturing digital asset ecosystem.

FAQ

1. When did Hong Kong VASPs become subject to CRS reporting? Hong Kong VASPs have been subject to CRS obligations since the Inland Revenue (Amendment) (No. 6) Ordinance 2024 took effect, with the first reporting period covering the 2026 calendar year. Reports for 2026 must be submitted to the IRD by 31 May 2027.

2. What is the monetary threshold for reporting crypto accounts under CRS? For pre-existing individual accounts, the threshold is an aggregate balance or value exceeding $250,000 as of 31 December 2025. For new accounts opened in 2026 or later, there is no de minimis threshold—all accounts are reportable regardless of balance.

3. How does CARF differ from CRS for crypto transactions? CRS reports account balances and gross proceeds, while CARF requires transaction-level detail including acquisition costs, transfer information to unhosted wallets, and fair market value at the time of each transaction. CARF also captures certain peer-to-peer transactions that CRS might not cover.

4. Can a VASP be penalized for incorrect CRS reporting? Yes. Under Hong Kong’s Inland Revenue Ordinance, penalties for incorrect or incomplete CRS reporting can reach $10,000 per account, with additional penalties for systemic failures. The IRD’s voluntary disclosure program offers reduced penalties for proactive corrections made before 31 December 2026.

参考资料

OECD, “Standard for Automatic Exchange of Financial Account Information in Tax Matters,” Second Edition, 2024 (updated commentary on virtual asset treatment).
Hong Kong Inland Revenue Department, “Guidance on CRS Obligations for Virtual Asset Service Providers,” Circular No. 3 of 2026, issued March 2026.
OECD, “Crypto-Asset Reporting Framework and Amendments to the Common Reporting Standard,” October 2022 (implementation timeline updated for 2026).
Hong Kong Monetary Authority, “Half-Yearly Report on Virtual Asset Market Activity,” June 2026.
Securities and Futures Commission, “Licensing Conditions for Virtual Asset Trading Platforms: Compliance with International Tax Standards,” Consultation Paper, April 2026.