Hong Kong SFC Sets New Security Benchmark, Mandates Phishing-Resistant Authentication

On July 9, the Securities and Futures Commission of Hong Kong issued a circular directing virtual asset trading platforms and online brokers to phase out the use of one-time passwords delivered via SMS or apps for customer login and device binding. This mandate sets a clear deadline, aiming to tackle the root cause of increasing account takeover and phishing attacks in the sector.

The Problem with SMS OTPs

The SFC highlighted that OTP-based authentication carries inherent risks, making it vulnerable to attacks like SIM swapping and man-in-the-middle interceptions. These methods no longer provide adequate protection for user assets against sophisticated fraudsters.

The regulator emphasized that stronger, readily available alternatives exist in the market. These solutions are designed to verify the authenticity of the service domain, significantly reducing the success rate of phishing attempts.

New Standards and Implementation Timeline

The circular specifically advocates for the adoption of "passkeys" or "device binding" as phishing-resistant authentication methods. Passkeys, often based on public-key cryptography, eliminate passwords and can cryptographically confirm that a login attempt is directed to the legitimate service.

  • All Firms: Must implement the new authentication methods within 12 months from the date of the circular.
  • Large Online Brokers: Are required to adopt these measures immediately.

A Holistic Security Framework: Beyond Prevention

Beyond hardening the login process, the SFC's requirements extend to building a comprehensive security operation framework. The focus shifts from mere prevention to active detection and swift response.

Platforms must establish effective surveillance mechanisms to detect suspicious login patterns, anomalous transactions, and withdrawal activities in real-time. Upon identifying high-risk events, immediate notification to the affected client and a prepared incident response plan for breaches are mandatory.

Furthermore, ongoing client education is underscored. Firms have a duty to regularly alert their users about emerging phishing tactics and other cybersecurity threats, empowering them to be the first line of defense.

This move represents a significant step in Hong Kong's evolving regulatory approach to virtual assets, prioritizing proactive risk management and operational resilience to foster a more secure trading ecosystem.