The Hong Kong SFC requires cryptocurrency platforms and brokers to eliminate OTP login verification within 12 months

According to The Block, the Hong Kong Securities and Futures Commission (SFC) has issued a circular requiring licensed virtual asset trading platforms and internet brokers to stop using one-time passwords (OTP) for user login and device binding within 12 months, and instead adopt stronger authentication methods such as passkeys and device binding.

This move is due to the fact that in the 2025 Hong Kong cybersecurity incident, phishing attacks accounted for as much as 57%. The SFC also requires institutions to establish monitoring systems for suspicious logins, transactions, and withdrawals, and to promptly notify customers of any unusual account activities. Large brokers must implement the new authentication measures immediately. The SFC emphasizes that if internal controls are found to be deficient and result in customer losses, relevant responsibilities will be pursued.