Back to Markets
Crypto▲ Bullish
SFC Orders Crypto Platforms to Ditch OTPs, Adopt Passkeys
Hong Kong's SFC gives crypto exchanges 12 months to replace OTPs with passkeys; senior management liable for client losses. Large brokers must move immediately.
Continue with
The Securities and Futures Commission told every licensed crypto exchange and online broker in Hong Kong to ditch one-time passwords and adopt phishing-resistant login systems. They have 12 months to comply. Large internet brokers do not get that grace period; they are expected to move immediately.
The directive, Circular 26EC35, arrived July 9. It follows Circular 26EC32, issued June 2, which focused on countering AI-enabled cyber threats. The SFC is building a layered regulatory response to an escalating threat environment.
The circular targets two areas: client login authentication and device binding. The regulator wants platforms to make it harder for attackers to impersonate users or hijack sessions, even if the password is stolen.
OTPs are explicitly called out as inadequate. Those six-digit codes sent by text are increasingly easy to intercept through SIM-swapping and man-in-the-middle attacks. Sophisticated phishing pages relay codes in real time. The SFC's recommended alternatives include passkeys and bound devices. Passkeys use cryptographic key pairs tied to a specific device. There is nothing for a phisher to steal or relay.