Hong Kong regulator bans OTP logins for crypto platforms

Hong Kong's financial regulator has ordered all licensed virtual asset trading platforms and online brokerages to phase out the use of onetime passwords for customer logins, mandating a shift to more secure, phishing-resistant authentication methods. The directive, issued by the Securities and Futures Commission on Thursday, July 9, 2026, requires firms to adopt technologies such as passkeys and device binding to combat a surge in account takeovers and financial fraud.

The SFC's circular explicitly prohibits the use of OTPs delivered via SMS, email, or app-based logins for both customer authentication and device registration. The regulator stated these methods are increasingly vulnerable to interception through phishing, SIM-swapping, and real-time relay attacks, making them inadequate for protecting high-value accounts. Instead, firms must implement stronger alternatives that tie access to a specific, trusted device using cryptographic verification.

Affected entities, which include licensed virtual asset platforms, securities and futures brokers, and leveraged foreign exchange traders, have a 12-month deadline to achieve full compliance. However, the SFC expects large internet...