Hong Kong's Securities and Futures Commission has issued a directive requiring all licensed virtual-asset service providers and internet brokers to retire one-time password authentication within a twelve-month window. The shift represents a significant tightening of security standards in a jurisdiction that has positioned itself as a gateway for institutional crypto adoption. Under the new framework, platforms must transition to phishing-resistant methods—primarily passkeys and hardware security keys—that cryptographically bind authentication to specific devices or services, making them substantially harder to compromise through social engineering or credential theft.
The underlying rationale reflects a sobering reality: OTP systems, despite their ubiquity, remain vulnerable to sophisticated phishing attacks and SIM-swapping schemes that have historically drained retail investors of substantial holdings. A bad actor can redirect SMS messages, intercept time-based codes, or trick users into revealing OTPs through convincing fake login portals. By mandating passkey adoption—which leverages public-key cryptography and device-bound authentication—regulators are effectively forcing platforms to implement defenses that cannot be defeated by traditional phishing tactics. This aligns Hong Kong with international regulatory momentum; the US and EU have similarly prioritized passwordless authentication as part of broader cybersecurity modernization efforts.
Equally important is the SFC's clarification that platforms will be held liable for client losses arising from preventable security breaches. This accountability clause transforms the directive from mere guidance into enforceable policy backed by financial consequences. For crypto platforms already operating in a highly regulated environment, the compliance cost is non-trivial—legacy systems must be overhauled, user experience redesigned, and recovery mechanisms established for users unfamiliar with passkey workflows. However, this structural requirement may ultimately accelerate industry-wide security maturation and reduce the attack surface that has historically made crypto platforms targets for sophisticated threat actors seeking high-value accounts.
The twelve-month timeline provides reasonable runway for implementation without allowing indefinite delays. As Hong Kong continues navigating the balance between innovation and consumer protection, this mandate signals that regulatory frameworks are tightening around custodial security standards, potentially creating competitive pressure on exchanges in other jurisdictions to adopt similar requirements.