TAPA FSR & TSR 2026: What Hong Kong Operators Need to Know

TAPA APAC has confirmed that Version 2026 of its two flagship supply-chain security standards, the Facility Security Requirements (FSR) and the Trucking Security Requirements (TSR), will publish in English in September 2026. That announcement carries three concrete deadlines that every certified operator, prospective applicant, and procurement team in Hong Kong needs to have on their calendar.

The Facility Security Requirements set out the minimum security baseline for warehousing and in-transit storage within a supply chain. FSR covers physical security, personnel controls, process controls, and information security across three certification levels — A, B, and C — calibrated to the risk profile and value of the cargo being handled. In Hong Kong, FSR is most commonly held by operators in the airport cargo precinct, by bonded warehouses serving the Greater Bay Area, and by third-party logistics providers handling electronics, pharmaceuticals, and luxury goods.

The Trucking Security Requirements apply to road transport of cargo. TSR covers vehicle hardening, driver vetting, route planning, real-time monitoring, incident response, and the contractual relationships between consignors, primary carriers, and any sub-contracted operators. TSR is structured in three levels (1, 2, 3). For Hong Kong, TSR is most relevant to cross-boundary trucking operations connecting to Shenzhen, Dongguan, and Guangzhou, where high-value inland legs are increasingly subject to TAPA requirements written into shipper contracts.

Different organisations face different decisions in the months ahead. The following is a sorting guide, not advice.

• If you currently hold a Version 2023 certificate that expires after 2027

You have natural runway. The decision in front of you is whether to send your security team to Version 2023 training before 31 July, or wait for Version 2026 training in September. If your internal auditors are not yet qualified on the version your management system is built around, the July window is worth considering. If they are already qualified, waiting for the new training is reasonable.

• If your Version 2023 certificate expires in late 2026 or in 2027

You face a genuine choice. You can pursue a Version 2023 recertification audit before 30 September, which extends your runway and gives your team time to absorb the new standard before the next cycle. Or you can let the certificate lapse and recertify under Version 2026 when the new programme is ready. Audit-slot availability in Q3 2026 is expected to tighten significantly; if a 2023 recertification is your preferred path, booking the audit window early matters.

• If you do not yet hold TAPA certification

Starting a new Version 2023 certification in June with a 30 September audit deadline is, realistically, very tight. A typical first-time FSR or TSR certification takes three to six months for a single site, and longer for multi-site or fleet scopes — and that is before allowing time to close audit findings. For most new applicants, the more practical path is to use the months between now and September for gap analysis, to build the security management system, to plan any infrastructure investment, and to certify under Version 2026 once it publishes. Organisations that prepare during the gap will be in a position to certify months ahead of those who wait until September to begin.

• If you are a shipper or buyer who specifies TAPA in supplier contracts

Two things are worth doing this quarter. Review your standard contract language to confirm whether it references "the current version" of FSR and TSR or specifically Version 2023, and decide how you want to handle the transition period. Inform your key suppliers of your expectations regarding Version 2026 adoption so they can plan their own audit calendars accordingly.

Several elements of the Hong Kong regulatory landscape interact with TAPA compliance in ways that are easy to miss if you treat the standard as a standalone exercise.

The Personal Data (Privacy) Ordinance governs how CCTV footage, visitor logs, employee background screening, and biometric access data are collected, retained, and accessed. Version 2026's expected expansion of biometric and analytics-based controls makes a parallel Privacy Impact Assessment worthwhile. Designed together, the two assessments produce a coherent control set; designed separately, they tend to surface conflicts at audit.

The Protection of Critical Infrastructure (Computer Systems) Ordinance, passed in 2025 and entering operation in phases, designates transport and logistics among its in-scope sectors. For larger logistics operators, particularly those embedded in airport and port operations, the cyber elements of TAPA 2026 and the obligations of the new ordinance overlap meaningfully. A single integrated cyber security programme that addresses both will generally be more efficient than two parallel compliance tracks.

The Hong Kong Customs Authorized Economic Operator (AEO) programme shares substantial common ground with FSR in physical security, personnel security, and business-partner due diligence. With mutual recognition arrangements in place between Hong Kong and several major trading partners, alignment of TAPA and AEO documentation creates real downstream benefits in clearance speed and supplier credibility.

Greater Bay Area cross-border trucking arrangements, including the expanded cross-boundary cargo channels and the integration of Heung Yuen Wai, Liantang–Heung Yuen Wai, and Shenzhen Bay control points, have changed the operating reality for TSR-certified fleets. Version 2026 is expected to tighten requirements on continuous GPS visibility across the boundary, electronic locking integrity, driver authentication, and incident response across two jurisdictions. Telematics specifications being finalised this year should be checked against both the anticipated TSR direction and the Mainland's road transport and personal information rules.

The Occupational Safety and Health Ordinance sets boundaries on how restricted access zones, segregation of high-value areas, and after-hours operations can be implemented without compromising fire egress and worker safety. This rarely surfaces as a TAPA finding directly, but a poorly designed restricted area can create labour-side liability that outweighs the cargo-loss risk it was meant to prevent.

The TAPA 2026 transition is one of the more substantial changes the standard has seen in recent cycles, and the calendar between now and September leaves less room than it appears. The most useful thing most organisations can do this month is simply to map their own situation against the three dates above and decide which path applies.