Hong Kong's Legislative Council has passed the Inland Revenue (Amendment) (Automatic Exchange of Information) Bill 2026, introducing stricter registration, due diligence, and penalty requirements for Reporting Financial Institutions (RFIs). The amendment ordinance was gazetted on 26 June 2026, and its provisions come into operation on 1 January 2027.
For financial institutions operating in Hong Kong, this is not a routine compliance refresh. It changes how firms register with the Inland Revenue Department (IRD), raises the bar on due diligence record-keeping, and introduces a new, more calibrated penalty structure. Below, we break down what's changing, why Hong Kong is making these changes now, and how your business should prepare before the effective date.
What Is the AEOI Regime and Why Is Hong Kong Updating It?
Since 2018, Hong Kong has automatically exchanged financial account information with partner tax jurisdictions each year, following the Common Reporting Standard (CRS) developed by the OECD. Under this framework, Reporting Financial Institutions, including banks, custodial institutions, certain investment entities, and specified insurers, are required to identify account holders' tax residency, primarily through customer self-certification and due diligence procedures, and report reportable accounts to the IRD annually. The IRD then exchanges that information with the tax authorities of partner jurisdictions on a reciprocal basis.
This system exists to help tax authorities detect and combat cross-border tax evasion, while Hong Kong maintains strict standards around data confidentiality and security. Account holders whose only tax residence is Hong Kong are not reported under the regime.
The OECD periodically reviews how well each participating jurisdiction implements its CRS commitments. Since 2024, the OECD has been conducting its second round of peer review on Hong Kong's AEOI implementation. Having taken the OECD's views into account, the Hong Kong government proposed amending the Inland Revenue Ordinance (Cap. 112) to close identified gaps, resulting in the Amendment Bill that has now passed into law.
Secretary for Financial Services and the Treasury Christopher Hui has framed the update as a matter of maintaining Hong Kong's standing as an international financial centre. Addressing the OECD's concerns in a timely manner helps preserve a favourable peer review rating, reassures partner tax jurisdictions, and supports Hong Kong's ongoing efforts to expand its network of Comprehensive Avoidance of Double Taxation Agreements, giving Hong Kong businesses greater tax certainty when they expand overseas.
What's Changing: Old Framework vs. New Requirements
| Area | Previous Framework |
New Requirements |
|---|---|---|
| Registration | RFIs generally registered with the IRD only once they had reportable accounts to disclose. | All RFIs must register in the AEOI Portal, regardless of whether they currently have anything to report. |
| Due diligence records | Due diligence obligations existed, but administrative record-keeping expectations were less prescriptive. | Enhanced requirements for maintaining and producing due diligence records used to identify reportable accounts. |
| Penalties | Penalty provisions existed but offered limited flexibility between full prosecution and no action. | New sanctions for non-compliance; penalties scaled to number of accounts involved; administrative penalty mechanism as a faster alternative to prosecution. |
| Deadlines | No fixed registration cut-off tied to this amendment. | Existing unregistered RFIs: register by 31 March 2027. Newly qualifying RFIs: register by 31 January of the following year. |
What Are the Key Changes for Financial Institutions?
1. Mandatory Registration for Reporting Financial Institutions
Under the new section 50AB of the Inland Revenue Ordinance, all RFIs in Hong Kong must register with the Commissioner of Inland Revenue via the AEOI Portal, closing a gap in the previous framework, where registration was effectively triggered only by reportable activity.
- Existing RFIs that have not yet registered must do so by 31 March 2027.
- Newly qualifying RFIs (institutions that become RFIs on or after 1 January 2027) must register by 31 January of the year following the calendar year in which they first qualify.
This means even institutions with no reportable accounts in a given year (for example, a newly licensed entity still onboarding clients) will need to register on time.
2. Stricter Due Diligence Record-Keeping
RFIs already conduct due diligence to identify account holders' tax residency, typically through self-certification forms collected at onboarding and periodically refreshed when account details change. The amendment ordinance strengthens the administrative expectations around how those records are maintained, giving the IRD stronger grounds to verify that due diligence was properly carried out, not just that a report was ultimately filed.
3. A Revised, More Deterrent Penalty Structure
The ordinance introduces:
- New sanctions for non-compliance without reasonable excuse, including failure to register or the provision of incorrect or incomplete information.
- Penalties scaled to the number of financial accounts involved for certain offences, such as failure to carry out due diligence procedures, aligning the size of the penalty with the scale of the breach, rather than applying a flat rate regardless of exposure.
- An administrative penalty mechanism as an alternative to prosecution for certain offences, intended to make enforcement faster and more cost-effective for both the IRD and affected institutions.
Ongoing Compliance Obligations RFIs Should Not Overlook
The amendment builds on obligations RFIs already carry under the existing AEOI framework. Institutions preparing for 2027 should keep the full picture in view, not just the new items:
- Self-certification collection. New accounts require self-certification of tax residency at onboarding; pre-existing accounts are subject to due diligence procedures to identify reportable status.
- Six-year record retention. Self-certifications and related due diligence records must generally be kept for six years, a baseline the new record-keeping requirements build on.
- Annual reporting cycle. Reportable account information continues to be filed with the IRD annually for exchange with partner jurisdictions.
- Entity classification accuracy. For corporate account holders, correctly classifying the entity as an Active or Passive Non-Financial Entity remains critical, since passive entities can trigger reporting on their controlling persons.
When Do the New Rules Take Effect?
All amendments come into operation on 1 January 2027. Institutions should treat the months beforehand as a compliance runway rather than a deadline to react to, particularly given the 31 March 2027 registration cut-off for existing RFIs, which falls only three months after the effective date.
How Should Financial Institutions Prepare? A Practical Checklist
- Confirm RFI status. Determine whether your institution currently qualifies or is likely to qualify as an RFI under the CRS framework and correctly identify whether corporate clients are Active or Passive NFEs.
- Register early. Don't wait until close to the March 2027 deadline. Early registration in the AEOI Portal reduces last-minute administrative risk and gives you time to resolve any registration issues.
- Audit due diligence documentation. Review how self-certifications and account-holder due diligence are captured, stored, and retrievable, and confirm your six-year retention practices meet the enhanced standard.
- Reassess internal compliance ownership. With penalties now scaled to the number of accounts involved, the cost of a lapse grows with the size of your reporting book, making this a governance issue for senior management, not only a tax filing task.
- Review onboarding workflows. Ensure new-account processes reliably capture valid self-certifications before an account is opened, reducing the risk of gaps discovered later during an IRD review.
- Watch for IRD guidance. The IRD has indicated it will issue further guidance and maintain communication with industry to support the transition. You are advised to monitor these updates and align your internal implementation timeline accordingly.
Where to Next?
The AEOI Amendment Ordinance doesn't change the underlying purpose of Hong Kong's automatic exchange regime. Rather, it tightens how that regime is administered and enforced. For RFIs, the practical impact comes down to three things: registering on time, keeping due diligence records that can withstand scrutiny, and treating compliance as a governance priority given the new account-scaled penalties.
Institutions that start preparing now, rather than in the weeks before the March 2027 registration deadline, will have more room to resolve gaps quietly.
How Ascentium Can Help
Navigating Hong Kong's evolving tax compliance landscape requires more than a checklist. It takes informed judgement about how new rules apply to your specific structure. Ascentium Hong Kong's advisors work directly with businesses to translate regulatory change like the AEOI amendments into practical, accountable compliance plans, not one-size-fits-all templates.
