Hong Kong SFC Orders Brokers and Crypto Platforms to Replace OTP Logins Within 12 Months

Hong Kong’s Securities and Futures Commission (SFC) has issued a circular requiring internet brokers and virtual asset trading platform operators to adopt authentication methods that can effectively prevent impersonation scams for client logins and device binding. According to Foresight News, the SFC said it is continuing efforts to combat impersonation scams and account takeover incidents targeting internet brokers and virtual asset trading platforms. As part of these efforts, the regulator is requiring firms to stop using one-time passwords (OTPs) for client logins and device binding, citing related risks. The SFC said stronger alternative authentication options are already available, including passkeys and bound devices, which it described as more robust and better able to prevent impersonation scams. The SFC said these anti-impersonation authentication methods should be implemented as soon as practicable, but must be adopted within 12 months from the date of the circular. It added that large internet brokers should adopt the measures immediately. Beyond preventive monitoring controls, the SFC said internet brokers and virtual asset trading platforms should also implement effective detection and surveillance measures to identify suspicious login, trading, and withdrawal activity. It said firms should promptly notify clients of important account activity and respond in a timely manner to hacking incidents. The regulator also said firms should regularly warn and remind clients about emerging impersonation scams and other cybersecurity risks.