Hong Kong Requires Crypto Platforms to Stop Using One-Time Passwords for Logins by July 8, 2027

Hong Kong crypto platforms must stop using one-time passwords (OTPs) for client logins and device registration by July 8, 2027. According to NS3.AI, a July 9 circular said OTPs do not meet the phishing-resistant authentication standard for those two processes. The circular leaves other uses of OTPs unchanged. The Securities and Futures Commission (SFC) said firms can be held accountable for client losses when inadequate measures fail to prevent large-scale unauthorized transactions following hacking incidents.