Hong Kong’s Securities and Futures Commission (SFC) has issued a directive that will reshape how brokers and licensed virtual‑asset platforms secure client accounts. In a new circular, the regulator has ordered firms to phase out one‑time password (OTP) logins within twelve months and replace them with phishing‑resistant authentication methods such as passkeys. The SFC also warned that firms will be held accountable for client losses stemming from preventable hacks, signaling a tougher stance on operational security in the digital asset sector.
The End of OTP Logins
OTPs delivered via SMS or email have long been a standard method of two‑factor authentication. They are simple and familiar but vulnerable to phishing, SIM‑swapping, and malware interception. The SFC’s circular argues that OTPs no longer meet the standard of robust client protection. By mandating their replacement, the regulator is pushing the industry toward stronger cryptographic solutions that cannot be easily stolen or replicated.
Passkeys, which rely on public‑key cryptography and are tied to a user’s device, are among the alternatives highlighted. Unlike OTPs, passkeys cannot be intercepted through phishing websites or compromised through text message hijacking. They represent a shift toward authentication methods that are resistant to social engineering, one of the most common attack vectors in financial crime.
A Twelve‑Month Transition
The SFC has given brokers and licensed crypto platforms twelve months to comply. This transition period is designed to allow firms to upgrade systems, test new authentication methods, and educate clients. The regulator emphasized that firms must not only adopt stronger technology but also ensure that implementation is seamless and does not disrupt client access.
The timeline reflects a balance between urgency and practicality. While the SFC wants vulnerabilities addressed quickly, it recognizes that large brokers and crypto platforms operate complex systems that cannot be overhauled overnight.
Accountability for Client Losses
The circular’s most striking element is the warning that firms will be held accountable for client losses resulting from preventable hacks. This shifts responsibility squarely onto brokers and platforms, making clear that inadequate security will not be excused. The SFC’s stance reflects a broader regulatory trend in which financial institutions are expected to anticipate risks and implement safeguards rather than react after breaches occur.
By tying accountability to authentication standards, the regulator is sending a message that security is not optional. Firms that fail to protect clients will face consequences, whether in the form of fines, license reviews, or reputational damage.
Implications for Brokers and Platforms
For internet brokers, the directive means rethinking long‑standing login systems. Many firms have relied on OTPs as a cost‑effective solution, but they will now need to invest in more advanced authentication technologies. Licensed virtual‑asset platforms face similar challenges, but the stakes are higher. Crypto exchanges are frequent targets of phishing campaigns and account takeovers, and the loss of digital assets can be immediate and irreversible. By mandating stronger authentication, the SFC is addressing one of the most persistent vulnerabilities in the crypto sector.
Market Reaction and Industry Response
The directive has sparked debate within Hong Kong’s financial community. Some brokers argue that OTPs remain adequate when combined with other safeguards, while others welcome the move as overdue. Crypto platforms, which have faced repeated attacks globally, are generally supportive of stronger standards, though they caution that implementation costs will be significant.
Industry associations are expected to play a role in coordinating responses, sharing best practices, and lobbying for clarity on technical requirements. The SFC’s circular sets out broad principles but leaves room for firms to choose specific solutions.
Global Context
Hong Kong’s move fits into a wider global trend of regulators demanding stronger authentication. The European Union has promoted multi‑factor authentication under its Payment Services Directive, while U.S. regulators have warned against reliance on SMS‑based OTPs. By explicitly banning OTP logins, Hong Kong is going further than many jurisdictions, positioning itself as a leader in cybersecurity standards for financial services.
Challenges Ahead
Implementing passkeys and other advanced authentication methods requires technical expertise, infrastructure investment, and client education. Firms will need to ensure that new systems are user‑friendly, especially for older clients who may be less comfortable with unfamiliar technology. There is also the question of interoperability. Brokers and platforms must ensure that authentication works across devices, operating systems, and international markets.
Finally, enforcement will be critical. The SFC must monitor compliance, investigate breaches, and impose penalties where necessary. Without consistent enforcement, the directive risks becoming symbolic rather than transformative.
Hong Kong’s order to eliminate OTP logins marks a decisive shift in financial cybersecurity. By requiring phishing‑resistant authentication and holding firms accountable for client losses, the SFC is raising standards while reinforcing investor protection. The twelve‑month transition gives brokers and crypto platforms time to adapt, but the directive makes clear that stronger safeguards are now mandatory. As Hong Kong positions itself as a digital asset hub, this move underscores that trust and security must anchor innovation.
