Hong Kong's Securities and Futures Commission (SFC) has mandated stricter login protocols for internet brokerages and licensed cryptocurrency platforms, moving beyond the use of one-time passwords (OTPs) for customer authentication. This decision comes in response to the increasing risks of account impersonation and phishing attacks targeting financial accounts.

Significance of the Decision

This regulatory action is pivotal for enhancing the security framework of online financial services in Hong Kong. With a notable spike in cyber incidents, the SFC aims to mitigate risks associated with account takeovers and fraudulent activities that are on the rise.

Facts and Figures

  • Hong Kong reported 15,877 cyber incidents in 2025, a 27% increase from the previous year.
  • Phishing accounted for 57% of all reported cyber incidents.
  • Firms are required to implement the new controls promptly and fully comply within 12 months.

According to the SFC, the current reliance on OTPs is inadequate as these codes can be vulnerable to interception via phishing schemes. The directive emphasizes the adoption of advanced security measures such as passkeys and reinforced device binding. Financial institutions are urged to act swiftly, particularly larger brokerages that manage extensive customer portfolios.

Furthermore, firms must enhance their monitoring of unusual account activity and immediately inform clients of significant account changes. Regular user warnings about impersonation scams and potential cybersecurity threats are also mandated. Ultimate responsibility for internal controls lies with senior management, with a clear warning that inadequate security measures may result in accountability for customer losses.

Future Prospects and Next Steps

The SFC’s move aligns with Hong Kong’s broader framework for virtual asset regulation, which has required compliance with cybersecurity standards since 2023. As cyber threats continue to evolve, stakeholders will be watching for how these regulations adapt and what further measures may be introduced to protect investor assets.

Disclaimer: This material is for informational purposes only and is not financial advice.