Trust Reporting Under CRS: Due Diligence Responsibilities of Trustees and Protectors

The OECD’s Common Reporting Standard (CRS) has been in effect for over a decade, yet 2025 marks a critical inflection point for trustees and protectors of trusts in Hong Kong. The Inland Revenue Department (IRD) has intensified its scrutiny of trust structures, driven by the second round of peer reviews under the OECD’s Global Forum on Transparency and Exchange of Information for Tax Purposes, published in late 2024. A key finding from that review was that Hong Kong’s trust sector exhibited “inconsistencies” in the application of due diligence procedures for identifying controlling persons, particularly where protectors hold veto powers or where beneficiaries are defined by class rather than by name. For trustees operating from Hong Kong—a jurisdiction that has adopted CRS since 2017 under the Inland Revenue Ordinance (Cap. 112)—the margin for error has narrowed. The IRD now expects trustees to document not only the settlor and beneficiaries but also any person exercising effective control, including protectors, enforcers, and even investment advisors with binding authority. Failure to comply carries penalties under Section 80(2) of Cap. 112, which can reach HKD 100,000 and a three-year prison term for each unreported account. This article outlines the specific due diligence obligations of trustees and protectors under CRS, the jurisdictional nuances that Hong Kong-based structures must address, and the operational steps required to meet 2025 compliance standards.

The CRS Framework and the Trustee’s Role as Reporting FI

Classification of the Trust as a Reporting Financial Institution

Under the CRS, a trust is classified as a “Reporting Financial Institution” (FI) if it is a “Financial Asset” held by a “Custodial Institution,” or if it is itself an “Investment Entity.” The latter classification is the most common for Hong Kong trusts. An Investment Entity is defined under the CRS Implementation Guide (as adopted by Hong Kong) as any entity that primarily conducts as a business one or more of the following activities: trading in money market instruments, portfolio management, or otherwise investing, administering, or managing financial assets on behalf of others. A trust that holds a diversified portfolio of investments—whether directly or through a corporate vehicle—will almost invariably fall within this definition. The Hong Kong Inland Revenue (Amendment) Ordinance 2023 clarified that a trust is a “Financial Institution” if its gross income is primarily attributable to investing, reinvesting, or trading in financial assets, and the trust is managed by a professional trustee. This classification triggers the trust’s obligation to report financial account information to the IRD, which then exchanges it with the account holder’s jurisdiction of tax residence.

Due Diligence Obligations for the Trustee

The trustee, as the legal owner of the trust assets, bears the primary responsibility for implementing CRS due diligence. The process begins with the identification of the “Account Holder.” For a trust, the account holder is the trust itself, but the reporting obligation attaches to the “Controlling Persons” of the trust. The OECD’s Standard for Automatic Exchange of Financial Account Information in Tax Matters (2014) defines controlling persons of a trust as the settlor(s), the trustee(s), the protector(s) (if any), the beneficiary(ies), and any other natural person exercising ultimate effective control over the trust. The trustee must collect self-certification forms (typically Form CRS-1 or equivalent) from each of these persons, verifying their tax residence(s). Where a self-certification is not provided or is unreliable, the trustee must apply “reasoned” due diligence by reviewing the trust deed, the protector’s powers, and any side letters or memoranda of wishes. The IRD’s 2024 guidance notes that a protector with the power to remove a trustee, veto distributions, or amend the trust deed is almost certainly a controlling person. The trustee must then report the protector’s name, address, jurisdiction(s) of tax residence, and account balance (the total value of the trust’s financial assets) to the IRD by 31 May of the following year. For the 2024 reporting year, this deadline falls on 31 May 2025.

The Protector’s Exposure: When a Power Becomes a Reporting Trigger

Defining the Protector’s Role Under CRS

The protector’s role in a Hong Kong trust is not statutorily defined under the Trustee Ordinance (Cap. 29), but common law and standard trust precedents have established that a protector is a person appointed to oversee the trustee’s administration and to exercise certain reserved powers. These powers typically include the ability to remove and appoint trustees, veto distributions, add or remove beneficiaries, and consent to amendments of the trust deed. The CRS treats the protector as a controlling person if the protector holds any of these powers, regardless of whether they are exercised. The OECD’s 2021 Commentary on the CRS clarifies that “a person who has the power to appoint or remove a trustee, or to veto a distribution, is considered to be exercising ultimate effective control over the trust.” This means that a protector in a Hong Kong trust who holds a standard power of veto over distributions is a reportable person, even if the protector has never exercised that power. The IRD’s 2023 FAQ on CRS confirmed this interpretation, stating that “the mere existence of the power, not its exercise, triggers the reporting obligation.”

The “Multiple Protectors” Problem

A common structure in Hong Kong family trusts involves multiple protectors, often including a family member and a professional advisor. Under CRS rules, each protector who holds a controlling power must be reported individually. This creates a significant compliance burden for the trustee, who must obtain a self-certification from each protector. Where a protector is a legal entity—such as a corporate protector—the trustee must look through to the entity’s controlling persons. This “look-through” requirement applies to any entity that is a controlling person of the trust. For example, if a BVI company is appointed as protector, the trustee must identify and report the natural persons who own or control that BVI company. The same principle applies to protectors that are trusts or foundations. The trustee must document the entire chain of ownership and control, which can extend the reporting timeline considerably. The IRD expects trustees to complete this look-through analysis within 90 days of the trust’s establishment or the protector’s appointment. Failure to do so exposes the trustee to the same penalties under Section 80(2) of Cap. 112.

The “Passive NFE” Consequence for Trusts

A trust that is not itself a Financial Institution may still be classified as a “Passive Non-Financial Entity” (Passive NFE) under CRS. This classification applies when the trust’s gross income is less than 50% passive income (e.g., dividends, interest, rents, royalties) and less than 50% of its assets are held for the production of such passive income. However, the more common scenario for a Hong Kong discretionary trust is that it holds a portfolio of passive investments, making it an Investment Entity. The distinction matters because the reporting obligations differ. An Investment Entity trust must report all controlling persons, including protectors, to the IRD. A Passive NFE trust must report only its controlling persons—again, including protectors—but the reporting is done by the financial institution that holds the trust’s accounts (e.g., a bank). In practice, the bank will request the trustee to identify the trust’s controlling persons, and the trustee must provide that information. The IRD’s 2024 annual report noted that over 15% of CRS compliance issues identified in Hong Kong involved trusts that had been misclassified as Passive NFEs when they were in fact Investment Entities, leading to incomplete reporting of protectors and other controlling persons.

Operational Compliance: Documentation, Timelines, and Penalties

Self-Certification and the “Reasoned Due Diligence” Standard

The cornerstone of CRS compliance for trustees is the self-certification form. The trustee must obtain a valid self-certification from each controlling person at the time of account opening (or trust establishment) and within 90 days of any change in circumstances that affects the person’s tax residence. The self-certification must include the person’s name, address, jurisdiction(s) of tax residence, and tax identification number (TIN). Where a person claims multiple tax residences, the trustee must report each jurisdiction. The IRD has published a standard self-certification form (IR1292A) for this purpose. If a controlling person fails to provide a self-certification within 90 days, the trustee must apply “reasoned due diligence.” This means the trustee must review the trust deed, the protector’s appointment letter, and any other relevant documents to determine the person’s tax residence. The trustee may also rely on publicly available information, such as the person’s passport or national identity card, but must document the basis for the determination. The IRD’s 2023 guidance warns that a trustee who relies solely on a person’s Hong Kong address without obtaining a self-certification may be deemed to have failed its due diligence obligation.

The 31 May Filing Deadline and the “Nil Return” Rule

All Hong Kong financial institutions, including trusts classified as Reporting FIs, must file their CRS returns with the IRD by 31 May each year. The return is filed electronically through the IRD’s eTAX system, using the CRS XML schema published by the OECD. The return must include the account balance as at 31 December of the preceding year, the name and address of the trust, and the details of all reportable persons. Where a trust has no reportable persons—for example, a trust where all controlling persons are Hong Kong tax residents only—the trustee must still file a “nil return” by the same deadline. The IRD’s 2024 circular confirmed that failure to file a nil return is treated as a failure to file a return, attracting the same penalties. The penalty for late filing is HKD 10,000 for the first offence, escalating to HKD 50,000 for subsequent offences, plus a daily penalty of HKD 200 for each day the return remains unfiled.

Penalties for Non-Compliance: A 2025 Update

The IRD’s enforcement powers under Cap. 112 have been strengthened by the 2023 amendments. Section 80(2) now provides that any person who, without reasonable excuse, fails to comply with a CRS due diligence or reporting obligation commits an offence and is liable on conviction to a fine at level 5 (HKD 50,000) and to imprisonment for 3 years. The IRD has also gained the power to impose a fixed penalty of HKD 10,000 for each failure to file a return, without the need for a court order. In practice, the IRD has focused its enforcement on cases where a trustee has failed to identify a protector as a controlling person. The IRD’s 2024 annual report disclosed that it had conducted 47 targeted examinations of trust structures in the 2023-24 fiscal year, resulting in 12 penalty assessments. The average penalty was HKD 85,000 per trust. The IRD has indicated that it will increase the number of targeted examinations to 60 in the 2025-26 fiscal year, with a focus on trusts that have protectors with “unusual” powers, such as the power to change the governing law of the trust or to remove beneficiaries.

Practical Considerations for Hong Kong Trustees and Protectors

The “Residence” Trap for Protectors

A protector who is a Hong Kong tax resident but holds a foreign passport or has a second home overseas must be particularly careful. Under CRS rules, the protector’s tax residence is determined by the domestic law of each jurisdiction. A protector who spends more than 183 days in the United Kingdom in a tax year is a UK tax resident, even if the protector also holds a Hong Kong permanent identity card. The trustee must report the protector to the IRD as a UK tax resident, and the IRD will exchange that information with HM Revenue & Customs. The same principle applies to protectors who are US citizens or green card holders. The US taxes its citizens and residents on worldwide income, regardless of where they live. A US citizen protector of a Hong Kong trust is reportable to the IRD as a US tax resident, even if the protector has never set foot in the US in the reporting year. The trustee must obtain the protector’s US TIN (usually a Social Security Number) and report it to the IRD. The IRD will then exchange the information with the IRS under the US-Hong Kong Tax Information Exchange Agreement (TIEA), which has been in effect since 2014.

Trust Deed Review and the “Protector Clause”

Given the CRS implications, trustees should review the trust deed to ensure that the protector’s powers are clearly defined and that the deed does not inadvertently create a “controlling person” where none was intended. For example, a clause that gives the protector the power to “direct the trustee in the administration of the trust assets” almost certainly makes the protector a controlling person. A clause that gives the protector the power to “advise the trustee on investment strategy” may or may not, depending on whether the trustee is bound to follow that advice. The IRD’s 2023 guidance states that a power of “advice” that is, in practice, binding on the trustee will be treated as a power of control. Trustees should therefore ensure that the trust deed explicitly states that the protector’s powers are advisory only, and that the trustee retains the ultimate decision-making authority. Where the protector’s powers are intended to be binding, the trustee must accept the CRS reporting consequences and ensure that the protector is properly identified and reported.

The “Migration” of Trusts and the Exit Reporting Requirement

A Hong Kong trust that migrates to another jurisdiction—for example, to Singapore or the Cayman Islands—must file a final CRS return with the IRD for the period up to the date of migration. The IRD’s 2024 circular clarified that the trust must also provide the IRD with the name and address of the new trustee and the new jurisdiction of the trust’s effective management. The IRD will then exchange this information with the tax authority of the new jurisdiction. Where the trust is migrating because the protector has changed residence, the trustee must also update the protector’s self-certification and file an amended return for the prior year if necessary. This is a common scenario for Hong Kong trusts where the protector is a US citizen who has moved back to the US. The trustee must report the protector’s new US address and TIN to the IRD, and the IRD will exchange the information with the IRS. Failure to do so can result in the trust being treated as a “non-consenting account” under the US Foreign Account Tax Compliance Act (FATCA), which carries a 30% withholding tax on US-source income.

Actionable Takeaways

Trustees must obtain a valid self-certification from every protector by 31 May 2025, regardless of whether the protector has exercised any powers during the reporting year.
Protectors with the power to veto distributions or remove trustees are automatically reportable controlling persons under the OECD CRS Standard, as confirmed by the IRD’s 2023 FAQ.
Trusts with corporate protectors must look through to the natural persons controlling that entity and report them individually, completing this analysis within 90 days of the protector’s appointment.
A nil return must be filed by 31 May each year even if all controlling persons are Hong Kong tax residents only, or the trustee faces a minimum penalty of HKD 10,000.
Trust deeds should be reviewed annually to ensure that protector clauses do not inadvertently create unintended controlling person status, particularly where the protector’s powers are described as “advisory” but are binding in practice.

本文不構成稅務建議。涉及個人稅務情況請諮詢持牌會計師或稅務師。 This does not constitute tax advice. Consult a licensed CPA or tax advisor for your specific situation.