For most Hong Kong businesses the regulatory story of 2026 is not a single new statute. It is that several regimes introduced over the past few years have moved out of the consultation stage and into the operational stage — which means they now show up as filing deadlines, notifications and evidence requests rather than as news items.
That shift changes what a compliance function has to do. Reading a bill is optional; filing a notification is not. Here is where we see the pressure in client work this year, and what each item actually asks of a management team.
Tax: Pillar Two is now a filing obligation, not a policy debate
Under Pillar Two of the OECD’s BEPS 2.0 framework, a global minimum tax of 15% applies to multinational enterprise groups with annual consolidated revenue of EUR 750 million or above in at least two of the four fiscal years immediately preceding the current one. It operates through the Income Inclusion Rule, which imposes top-up tax on the parent entity in respect of constituent entities taxed below 15%, and the Undertaxed Profits Rule.
Hong Kong’s implementing legislation was enacted on 6 June 2025, and the regime applies to fiscal years beginning on or after 1 January 2025. The Inland Revenue Department opened the first phase of its Pillar Two Portal on 19 January 2026, so an in-scope entity can now file a top-up tax notification electronically.
What it asks of you. If your group is in scope, the work is data work: effective tax rate calculations by jurisdiction, the GloBE information return and supporting schedules, and a defensible record of the elections and safe harbours you relied on. If your group is not in scope, the useful exercise is a short written conclusion saying so, with the revenue test applied to the right four years. We have seen groups spend a quarter on analysis they could have closed with a one-page memo and the consolidated accounts.
Corporate: the Significant Controllers Register
Since 1 March 2018, when the Companies (Amendment) Ordinance 2018 commenced, Hong Kong companies have been required to keep a Significant Controllers Register, introduced to make the beneficial ownership of companies more transparent and to meet Hong Kong’s international obligations. The register is not a filing at incorporation that can then be forgotten: the duty is a continuing one, and it requires reasonable steps to identify each significant controller, to record the required particulars, and to keep the register up to date as ownership and control change.
Where this bites. Two places. First, after any share transfer, director change or group restructuring — the register is one of the first documents asked for. Second, in third-party due diligence: when a counterparty asks who ultimately controls your company, an answered and consistent register shortens the process considerably, and an empty or stale one lengthens it.
Financial services: stablecoin issuance became a licensed activity
Following implementation of the regulatory regime for stablecoin issuers under the Stablecoins Ordinance on 1 August 2025, the business of issuing fiat-referenced stablecoins is a regulated activity in Hong Kong and a licence is required. The Hong Kong Monetary Authority maintains a public register of licensed stablecoin issuers.
Why a non-financial company should care. Settlement is where this reaches ordinary businesses. If a customer, supplier or treasury counterparty proposes to move value in a tokenised instrument, checking the issuer against the HKMA register is a five-minute control that answers most of the question. If your business starts accepting or holding such instruments, be clear about who bears the redemption risk, what happens on a de-peg, and how the arrangement is treated in your accounts.
Data: the PDPO remains the obligation you meet every week
The Personal Data (Privacy) Ordinance (Cap. 486) has not been replaced, and that is precisely why it is easy to under-attend to. The six Data Protection Principles cover purpose and notice, accuracy and retention, use limitation, security, openness, and access and correction. In our reviews the recurring gaps are unglamorous: no inventory of where personal data sits, retention periods that exist in policy but not in systems, and processor contracts that were never updated to bind the vendor.
Three provisions are worth keeping in front of management:
- Erasure. Personal data must not be kept longer than is necessary; failing to erase data that is no longer required is an offence, and the sanction is a fine rather than a warning letter.
- Direct marketing (Part 6A). Using personal data in direct marketing requires the data subject’s consent, and silence is not consent. Contravention carries substantial fines and, in the more serious case of providing data to a third party for gain, imprisonment. Marketing lists inherited from an acquisition are the usual trigger.
- Use limitation. Data collected to deliver a service is not automatically available for analytics, model training or a new product line.
On artificial intelligence specifically, the Privacy Commissioner has published guidance for organisations that use personal data in AI systems. Confirm the current edition on the Commissioner’s website before relying on a summary — including this one.
Employment and operations
Payroll parameters are a standing compliance item rather than a once-a-year one: Hong Kong’s statutory minimum wage and the continuous employment rules under the Employment Ordinance have both been revised in recent years. Before a payroll system change or an annual planning cycle, confirm the current figures and thresholds with the Labour Department rather than inheriting last year’s settings in the system configuration.
A monitoring routine that takes an afternoon a quarter
- One named owner per regime. Tax, corporate, privacy, employment, sector-specific. A regime with no owner is a regime nobody monitors.
- A compliance calendar with dates, not topics. Filing windows, notification deadlines, review dates. Dates can be delegated; topics cannot.
- An evidence file. When a regulator or auditor asks, the answer should be a document, not a person’s recollection.
- A short board summary. One page: what changed, what is due, what is overdue. Boards act on this; they rarely act on a 40-page update.
- A 90-day pre-deadline checklist for anything with a filing date, so the work is not compressed into the last fortnight.
How we help
We run regulatory readiness reviews for Hong Kong companies: mapping which regimes apply to a group, testing the evidence behind each obligation, and preparing the filings and notifications. If you would like a view on where your group actually stands — rather than where the policy manual says it stands — talk to us.