Alisa Davidson
Printed: July 09, 2026 at 8:29 am Up to date: July 09, 2026 at 8:29 am
Edited and fact-checked:
July 09, 2026 at 8:29 am
In Temporary
Hong Kong SFC bans OTPs for crypto platforms, mandating stronger authentication to fight phishing scams, and holding senior administration accountable.
The Hong Kong Securities and Futures Fee (SFC) has issued a round requiring digital asset buying and selling platforms and web brokerages to switch one-time password (OTP) authentication with extra sturdy safety strategies, as spoofing and fraud assaults on buyer accounts proceed to accentuate.
The regulator cited rising threats from impersonation scams, noting that phishing and spoofing assaults accounted for 57% of all safety incidents reported to the Hong Kong Cybersecurity Incident Response Centre in 2025. In response, the SFC is now mandating that platforms part out OTPs for each buyer login and system binding processes — practices it has flagged as more and more insufficient in opposition to refined trendy assaults.
Companies are required to undertake stronger options, reminiscent of passkeys and bound-device authentication, which the SFC describes as providing extra resilient and fraud-resistant verification. Whereas all lined entities should comply inside 12 months of the round’s issuance, giant web brokerages are anticipated to implement the brand new measures instantly.
Broader Safety Obligations and Accountability
Past authentication upgrades, the round outlines a wider set of obligations spanning detection, response, and consumer training. Digital asset buying and selling platforms and brokerages should implement surveillance programs able to figuring out suspicious login, buying and selling, and withdrawal exercise. Companies are additionally required to inform purchasers promptly of serious account occasions and reply swiftly to any hacking incidents. Ongoing consumer warnings about rising cyber threats and impersonation scams are anticipated as nicely.
The SFC made clear that senior administration at these companies bears final accountability for the adequacy of account safety controls. Establishments discovered to have insufficient inner safeguards will probably be held accountable for any ensuing consumer losses — a pointed sign to compliance groups throughout Hong Kong’s digital asset sector.
The round builds on earlier regulatory indicators. The SFC had been monitoring OTP-related dangers since late 2024 and, in a February 2025 round, strongly inspired licensed firms to maneuver away from OTPs — making right this moment’s mandate a agency regulatory deadline somewhat than a voluntary advice. For crypto platforms working in Hong Kong, the message is unambiguous: legacy authentication strategies are not acceptable.
Disclaimer
In keeping with the Belief Venture tips, please be aware that the knowledge offered on this web page is just not supposed to be and shouldn’t be interpreted as authorized, tax, funding, monetary, or every other type of recommendation. It is very important solely make investments what you possibly can afford to lose and to hunt unbiased monetary recommendation in case you have any doubts. For additional info, we advise referring to the phrases and situations in addition to the assistance and help pages offered by the issuer or advertiser. MetaversePost is dedicated to correct, unbiased reporting, however market situations are topic to vary with out discover.
About The Creator
Alisa, a devoted journalist on the MPost, focuses on crypto, AI, investments, and the expansive realm of Web3. With a eager eye for rising traits and applied sciences, she delivers complete protection to tell and have interaction readers within the ever-evolving panorama of digital finance.
Extra articles
Alisa, a devoted journalist on the MPost, focuses on crypto, AI, investments, and the expansive realm of Web3. With a eager eye for rising traits and applied sciences, she delivers complete protection to tell and have interaction readers within the ever-evolving panorama of digital finance.
Extra articles