Hong Kong SFC orders crypto platforms, online brokers to phase out OTP logins

What happened

Hong Kong SFC orders internet brokers, crypto platforms to replace OTP logins with passkeys within 12 months following 57% spoofing surge.

Confirmed

Global impact / market context

Stronger authentication reduces fraud risk, protecting user funds and platform reputations. The rule forces firms to invest in newer security tech, shaping cost structures and potentially improving market trust in Hong Kong’s digital finance ecosystem.

Confirmed

Hong Kong’s Securities and Futures Commission (SFC) has mandated that internet brokers and cryptocurrency platforms replace one‑time‑password (OTP) authentication with passkey technology within the next 12 months, after a 57% rise in spoofing attacks targeting OTPs.

Confirmed

What to watch

1. Implementation timelines: watch whether platforms meet the 12‑month deadline or request extensions, as delays could trigger regulatory penalties and affect user onboarding. Confirmed
2. Cost impact: monitor capital expenditures on passkey infrastructure and integration, which may raise operating expenses for smaller brokers and crypto exchanges. Confirmed
3. Security outcomes: track reductions in spoofing incidents and any reported breaches after passkey rollout, influencing investor confidence in platform safety. Confirmed

Evidence

• theblock.co