Recently, the Hong Kong Securities and Futures Commission (SFC) issued new regulatory directives requiring significant upgrades to customer authentication systems. The measures require all licensed internet brokers and Virtual Asset Trading Platform (VATP) operators to stop using One-Time Passwords (OTPs) delivered via SMS or email for customer login and device binding.
Instead, regulated firms must adopt phishing-resistant authentication methods, specifically Passkeys based on the FIDO2/WebAuthn standards or secure hardware-based device binding. Most firms have been given 12 months to implement the new requirements, while large internet brokers are expected to comply immediately.
Which That Must Comply
The new SFC requirements apply to intermediaries licensed under Hong Kong’s Securities and Futures Ordinance (SFO) and cover two main categories:
- Licensed Internet Brokers: Firms providing online tradingservices under regulated activities including:
- Type 1 (Dealing inSecurities),
- Type 2 (Dealing in Futures Contracts),
- Type 3 (LeveragedForeign Exchange Trading), and
- Type 9 (Asset Management).
- Virtual Asset Trading Platforms(VATPs):SFC-licensed operators providing trading and custody services for digitalassets.
Could Other Regulators Follow?
The SFC’s proactive approach could influence the direction of cybersecurity regulation well beyond Hong Kong. Financial regulators, including CySEC in Cyprus, the Financial Conduct Authority (FCA) in the United Kingdom, and the Monetary Authority of Singapore (MAS), often monitor developments in other leading financial centres when shaping their own supervisory expectations. If Hong Kong’s transition away from SMS-based OTPs proves successful, it could provide a practical model for other regulators seeking to reduce the growing number of retail account takeover attacks.
The move is also likely to accelerate the adoption of common authentication standards across the financial industry. Large international firms operating across multiple jurisdictions face increasing costs when maintaining different authentication systems for different markets.
More on this topic, together with additional insights and practical takeaways, can be found in our full analysis on the Finance Magnates Intelligence Portal.
Looking to stay ahead of these evolving regulatory and fintech standards? Meet and network with the decision-makers shaping the future of global trading at the upcoming iFX EXPO Asia, taking place from 7–9 October 2026 at the Hong Kong Convention and Exhibition Centre. Register today to secure your spot.
