Hong Kong SFC Gives Crypto Exchanges 12 Months to Ditch OTPs

The move follows a wave of phishing and social-engineering attacks that inflicted substantial financial damage across the crypto ecosystem in early 2026. The SFC said the directive addresses escalating threats from credential theft and account hijacking. Sophisticated phishing operations also drove the decision. Hong Kong's own cybersecurity assessments showed fraud and counterfeiting accounted for a large share of documented breaches in 2025.

The SFC framed the authentication upgrade as part of a broader set of market safeguards. The regulator also encouraged users to maintain strong security practices. It said customers should access accounts only through verified official websites and authorized platform applications. Users should report any suspected unauthorized access or questionable transaction activity immediately.

For traders using Hong Kong platforms, the shift eliminates the most common vector for account compromise: intercepted SMS codes. Phishing kits that clone login pages and forward OTPs in real time become ineffective against passkey-based authentication, which ties the approval to the specific device and domain.

The one-year transition period gives platforms time to implement the changes. The SFC said larger brokers and exchanges should proceed with immediate adoption given their substantial user bases. The safest approach is to already use a hardware wallet or passkey where supported. Not all platforms offer that yet.