Hong Kong Bans SMS Login Codes: What Brokers Need to Know

Recently, the Hong Kong Securities and Futures Commission (SFC) issued new regulatory directives requiring significant upgrades to customer authentication systems. The measures require all licensed internet brokers and Virtual Asset Trading Platform (VATP) operators to stop using One-Time Passwords (OTPs) delivered via SMS or email for customer login and device binding.

Instead, regulated firms must adopt phishing-resistant authentication methods, specifically Passkeys based on the FIDO2/WebAuthn standards or secure hardware-based device binding. Most firms have been given 12 months to implement the new requirements, while large internet brokers are expected to comply immediately.

Which That Must Comply

The new SFC requirements apply to intermediaries licensed under Hong Kong's Securities and Futures Ordinance (SFO) and cover two main categories:

• Licensed Internet Brokers: Firms providing online trading services under regulated activities including:
• Type 1 (Dealing in Securities),
• Type 2 (Dealing in Futures Contracts),
• Type 3 (Leveraged Foreign Exchange Trading), and
• Type 9 (Asset Management).
• Virtual Asset Trading Platforms (VATPs): SFC-licensed operators providing trading and custody services for digital assets.

Could Other Regulators Follow?

The SFC's proactive approach could influence the direction of cybersecurity regulation well beyond Hong Kong. Financial regulators, including CySEC in Cyprus, the Financial Conduct Authority (FCA) in the United Kingdom, and the Monetary Authority of Singapore (MAS), often monitor developments in other leading financial centres when shaping their own supervisory expectations. If Hong Kong's transition away from SMS-based OTPs proves successful, it could provide a practical model for other regulators seeking to reduce the growing number of retail account takeover attacks.

• Phishing in Crypto - How to Ensure Top Email Security
• Trezor Warns Wallet Users of Phishing Attack Linked to Ledger Hack
• Phishing Campaign Targets Users of Crypto Exchange GMO Coin

The move is also likely to accelerate the adoption of common authentication standards across the financial industry. Large international firms operating across multiple jurisdictions face increasing costs when maintaining different authentication systems for different markets.

More on this topic, together with additional insights and practical takeaways, can be found in our full analysis on the Finance Magnates Intelligence Portal.