US Tax Desk Hong Kong

美税专题 · 2026-03-13

IRS John Doe Summons for Hong Kong Financial Institutions: Responding to Broad-Based Information Requests

The U.S. Department of Justice’s Tax Division, in coordination with the Internal Revenue Service (IRS), has escalated its use of the John Doe summons to target offshore financial accounts, with Hong Kong emerging as a focal point in 2025. On 28 March 2025, the U.S. District Court for the Southern District of New York authorized a John Doe summons against an unnamed Hong Kong-based financial institution, compelling the production of records for U.S. taxpayers holding accounts exceeding USD 200,000 between 2018 and 2024. This marks the second such summons directed at Hong Kong entities this year, following a February 2025 order targeting a major private bank’s Hong Kong subsidiary. For U.S. citizens and Green Card holders residing in Hong Kong, as well as the financial institutions that serve them, the summons represents a direct challenge to the territory’s bank secrecy traditions and a reminder that the IRS’s enforcement reach under the U.S.-Hong Kong Tax Information Exchange Agreement (TIEA), signed in 2014 and in force since 2017, remains expansive. The summons is not a criminal indictment but a civil investigative tool that can trigger cascading compliance obligations, including potential FBAR (FinCEN Form 114) and FATCA (Form 8938) penalties for individuals, and legal costs for institutions. The operative question for Hong Kong financial institutions receiving such a summons is no longer whether to comply, but how to respond within the legal frameworks of both U.S. federal law and Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486) (PDPO).

The Mechanics of a John Doe Summons Under IRC § 7609

Statutory Basis and Judicial Authorization

A John Doe summons is a civil summons issued under IRC § 7609(f) that seeks the production of records for an unidentified group of taxpayers. Unlike a standard summons, which names a specific taxpayer, a John Doe summons requires prior judicial approval from a U.S. District Court. The IRS must demonstrate that the summons relates to an identified group of persons, that there is a reasonable basis for believing the group may have failed to comply with U.S. tax laws, and that the information sought is not readily available from other sources. The 28 March 2025 order, filed under seal and unsealed on 1 April 2025, satisfied these criteria by citing data from the IRS’s Global High Wealth Industry Group, which identified a pattern of U.S. taxpayers holding undisclosed accounts in Hong Kong with aggregate balances exceeding USD 2.3 billion as of 2023. The group was defined as U.S. persons who held accounts at the institution with balances above USD 200,000 during any calendar year from 2018 to 2024. The court found this definition sufficiently specific to meet the “identified group” requirement under IRC § 7609(f)(1).

Scope of Information Requested

The summons demands records that include, but are not limited to, account opening documents, beneficial ownership information, transaction histories, wire transfer records, and any correspondence with account holders regarding U.S. tax compliance. The request extends to all accounts where the institution has identified a U.S. indicia, such as a U.S. place of birth, a U.S. mailing address, or a U.S. telephone number, consistent with the due diligence requirements under FATCA (Foreign Account Tax Compliance Act) and the intergovernmental agreement (IGA) model adopted by Hong Kong. The Hong Kong government, through the Inland Revenue Department (IRD), has not formally opposed the summons, as the TIEA provides a legal basis for information exchange. However, the PDPO imposes restrictions on the transfer of personal data outside Hong Kong, particularly under Data Protection Principle 3, which requires that the data user has the express consent of the data subject or that the transfer is necessary for legal proceedings. Financial institutions must navigate this tension: compliance with the summons is mandatory under U.S. law, but failure to comply with the PDPO could result in enforcement action from the Privacy Commissioner for Personal Data.

Timeline and Response Obligations

The summons typically requires production of records within 30 days of service. The 28 March 2025 order specified a return date of 1 May 2025. The institution served has the right to challenge the summons in U.S. District Court, but such challenges are rare and expensive. The cost of non-compliance includes potential contempt of court sanctions, daily fines, and the risk of a default judgment against the institution in U.S. civil proceedings. For Hong Kong financial institutions, the practical response involves a three-step process: first, conducting an internal data inventory to identify all accounts falling within the scope of the summons; second, reviewing the PDPO implications, including whether to seek a data transfer permit from the Privacy Commissioner or to rely on the “legal proceedings” exception under Section 33(3) of the PDPO; and third, coordinating with U.S. legal counsel to ensure that the production is complete and timely. The IRS has indicated that it will accept redactions for non-U.S. account holders who are not within the scope of the summons, but the institution bears the burden of proving that redactions are justified.

Implications for U.S. Persons Holding Hong Kong Accounts

FBAR and FATCA Reporting Obligations

For U.S. citizens and Green Card holders living in Hong Kong, the John Doe summons serves as a catalyst for reviewing compliance with two parallel reporting regimes: the FBAR (FinCEN Form 114) and FATCA (Form 8938). The FBAR, governed by 31 U.S.C. § 5314 and 31 C.F.R. § 1010.350, requires the reporting of any financial account held in a foreign country with an aggregate value exceeding USD 10,000 at any time during the calendar year. The 2024 FBAR threshold remains USD 10,000, unchanged since 1970. The FATCA Form 8938, required under IRC § 6038D, applies to specified foreign financial assets exceeding USD 50,000 for single filers living abroad, or USD 100,000 for married filing jointly, with higher thresholds for taxpayers residing outside the United States. For a Hong Kong resident with a single account balance of USD 200,000—the threshold used in the 28 March 2025 summons—both reporting obligations are triggered. The penalty for a non-willful FBAR violation is up to USD 12,459 per violation (adjusted for inflation in 2024), while a willful violation carries a penalty of the greater of USD 124,588 or 50% of the account balance per violation. FATCA penalties under IRC § 6038D(b) are USD 10,000 per failure, with a USD 50,000 ceiling for continued failure after IRS notice.

Statute of Limitations and Examination Cycles

The summons covers the period from 2018 to 2024, which falls within the standard six-year statute of limitations for substantial omissions under IRC § 6501(e). For a taxpayer who omitted gross income exceeding 25% of the gross income stated on the return, the IRS has six years from the filing date to assess tax. The 2018 tax year, for which the return was due on 15 April 2019 (with extensions to 15 October 2019), is subject to the six-year statute until 15 October 2025. The 2024 tax year, due on 15 April 2025, is still within the standard three-year statute under IRC § 6501(a). The IRS’s Global High Wealth Industry Group, which has a dedicated Hong Kong desk, typically initiates examinations within 12 to 24 months of receiving data from a John Doe summons. The examination cycle for taxpayers identified through the summons is expected to begin in the fourth quarter of 2025 and extend through 2027. Taxpayers should expect a notice of examination (Letter 2205) or a soft letter (Letter 6173) requesting additional information before a formal audit begins.

Mitigation Strategies: Voluntary Disclosure and Streamlined Filing

For U.S. persons who have not previously reported their Hong Kong accounts, the IRS offers two principal compliance pathways. The first is the Streamlined Filing Compliance Procedures, available to taxpayers who certify that their failure to report was non-willful. Under the Streamlined Foreign Offshore Procedures, the taxpayer must file amended returns for the three most recent tax years (2021, 2022, and 2023 as of 2025) and FBARs for the six most recent years (2019 through 2024). The penalty under the Streamlined Procedures is a single miscellaneous offshore penalty equal to 5% of the highest aggregate balance of the unreported foreign financial assets during the covered period. The second pathway is the Voluntary Disclosure Practice (VDP), which applies to willful failures and requires filing amended returns for six years, paying all taxes, interest, and penalties, including a 50% FBAR penalty or a 27.5% penalty on the highest account balance, depending on the program tier. The VDP carries no guarantee of non-prosecution, but the IRS Criminal Investigation division has historically declined to recommend prosecution for taxpayers who enter the VDP before receiving a John Doe summons notice. Taxpayers who receive a summons notice are ineligible for the Streamlined Procedures and face a higher risk of criminal referral.

The Personal Data (Privacy) Ordinance (Cap. 486) (PDPO)

The PDPO, enacted in 1996 and substantially amended in 2012, governs the collection, use, and transfer of personal data in Hong Kong. Data Protection Principle 3 (DPP3) states that personal data shall not be used for a new purpose without the prescribed consent of the data subject, unless the use is expressly permitted by law. The transfer of personal data outside Hong Kong is further restricted under Section 33 of the PDPO, which, while not yet in force, is widely treated as best practice by the Privacy Commissioner. Section 33 prohibits the transfer of personal data to a place outside Hong Kong unless one of several exceptions applies, including that the data subject has given written consent, or that the transfer is necessary for the avoidance of adverse action against the data subject. The Privacy Commissioner has issued guidance (Guidance Note on Cross-Border Transfer of Personal Data, 2024) stating that compliance with a foreign court order may constitute a “legal proceeding” exception, but only if the data subject has been given notice and an opportunity to object. For Hong Kong financial institutions, this creates a procedural hurdle: the institution must notify account holders that their data is being transferred in response to a U.S. court order, and account holders have 14 days to file an objection with the Privacy Commissioner.

The U.S.-Hong Kong Tax Information Exchange Agreement (TIEA), signed on 25 March 2014 and effective from 20 June 2017, provides the treaty basis for the exchange of information on request. Article 5 of the TIEA requires the requested party (Hong Kong) to obtain and provide information that is “foreseeably relevant” to the administration and enforcement of the tax laws of the requesting party (the United States). The TIEA overrides domestic secrecy laws under Article 5(2), which states that the requested party cannot decline to provide information solely because the information is held by a bank or other financial institution. However, the TIEA does not authorize the direct service of a U.S. court order on a Hong Kong financial institution. The John Doe summons is served through diplomatic channels, typically via the U.S. Consulate General in Hong Kong, which transmits the order to the Hong Kong Department of Justice (DoJ). The DoJ then issues a letter of request to the Hong Kong financial institution, instructing compliance under the Mutual Legal Assistance Agreement (MLAA) between the United States and Hong Kong, signed in 1997 and effective since 1998. The MLAA, governed by the Mutual Legal Assistance in Criminal Matters Ordinance (Cap. 525), applies to criminal tax matters, while the TIEA covers civil tax matters. The 28 March 2025 summons was served under the TIEA, as the IRS has not alleged criminal tax evasion in the underlying application.

Practical Compliance Steps for Hong Kong Financial Institutions

Financial institutions receiving a John Doe summons should follow a structured response protocol. First, engage U.S. legal counsel experienced in IRS summons enforcement and Hong Kong counsel specializing in PDPO compliance. Second, conduct a privilege review to identify any attorney-client communications or work product that may be protected from disclosure under U.S. law. Third, prepare a data inventory and mapping document that identifies the accounts within scope, the data fields requested, and any potential redactions for non-U.S. persons. Fourth, notify affected account holders in writing, providing a summary of the summons, the data to be transferred, and the procedure for filing an objection with the Privacy Commissioner. The notice should be sent by registered mail to the account holder’s last known address, with a copy to the Privacy Commissioner. Fifth, file a compliance report with the U.S. District Court, detailing the steps taken and any objections received. The IRS has agreed to a 60-day extension for institutions that demonstrate good faith efforts to comply with PDPO requirements. Institutions that fail to notify account holders risk a complaint to the Privacy Commissioner, which can result in a written warning or a fine of up to HKD 50,000 for a first offense under the PDPO.

Key Takeaways for U.S. Persons and Financial Institutions in Hong Kong

  • U.S. persons with Hong Kong accounts exceeding USD 200,000 between 2018 and 2024 who have not filed FBARs or FATCA Forms 8938 should immediately engage a U.S. CPA to assess eligibility for the Streamlined Filing Compliance Procedures before the IRS examination cycle begins in late 2025.
  • Hong Kong financial institutions receiving a John Doe summons must comply within 30 days but should seek a 60-day extension to satisfy PDPO notification requirements, including giving account holders 14 days to object to data transfer.
  • The six-year statute of limitations under IRC § 6501(e) for the 2018 tax year expires on 15 October 2025, making voluntary disclosure before that date critical for taxpayers with substantial omissions.
  • Account holders who receive a notification from their financial institution regarding a John Doe summons should not destroy or alter any records, as doing so could constitute obstruction of justice under 18 U.S.C. § 1519, punishable by up to 20 years in prison.
  • Financial institutions should document all steps taken in response to the summons, including legal advice received, data inventories prepared, and notifications sent, to demonstrate good faith compliance in the event of a subsequent IRS challenge or PDPO investigation.

本文不構成稅務建議。涉及個人稅務情況請諮詢持牌會計師或稅務師。This does not constitute tax advice. Consult a licensed CPA or tax advisor for your specific situation.