Hong Kong · The Block
Hong Kong SFC orders crypto services, online brokers to phase out OTP logins
Compiled by KHAO Editorial — aggregated from 2 sources. See llms.txt for citation guidance.
◎ Multiple-sources
The Hong Kong Securities and Futures Commission issued a circular ordering internet brokerage firms and virtual asset trading platforms to overhaul their security infrastructure by eliminating one-time passwords for user logins and device registration.
Key facts
- To protect client accounts from increasingly sophisticated and varied phishing attacks, a comprehensive approach combining prevention, detection, response, and education is necessary," said Dr
- The SFC requires implementation "as soon as practicable," with a deadline of 12 months from the circular's issuance date, and said large internet brokerage firms should adopt the new authentication
- The Hong Kong Securities and Futures Commission issued a circular ordering internet brokerage firms and virtual asset trading platforms to overhaul their security infrastructure by eliminating
- In addition to preventative measures, the SFC said firms must implement detection and surveillance systems to identify suspicious login, trading, and withdrawal activities
Summary
The enforcement action comes as part of the regulator's ongoing campaign against account takeovers, fraud, and spoofing operations targeting online financial intermediaries. According to the statement, firms must stop using OTPs for customer login and device binding and adopt alternatives such as passkeys and device binding that can prevent impersonation. The SFC requires implementation "as soon as practicable," with a deadline of 12 months from the circular's issuance date, and said large internet brokerage firms should adopt the new authentication methods immediately. "To protect client accounts from increasingly sophisticated and varied phishing attacks, a comprehensive approach combining prevention, detection, response, and education is necessary," said Dr. Yip Chi-hang, Executive Director of the Intermediaries Division of the SFC.