Hong Kong’s Securities and Futures Commission (SFC) today issued a circular requiring internet brokers and virtual asset trading platform operators to cease using one-time passwords (OTPs), which are vulnerable to impersonation and fraud risks, during customer login and device binding processes, and instead adopt stronger authentication methods such as Passkeys and bound devices. Large internet brokers must implement the new authentication scheme immediately, while other institutions must complete implementation within 12 months from the date of the circular. The SFC emphasized that while strengthening preventive monitoring, relevant institutions must also implement effective detection and surveillance measures to identify suspicious login, trading, and withdrawal activities in real time, promptly notify customers of important account changes, and regularly warn about emerging cybersecurity risks.