Hong Kong regulator ends OTP crypto logins

TLDR

Hong Kongs Securities and Futures Commission has ordered licensed crypto platforms and online brokers to end OTP based logins and adopt stronger, phishing resistant authentication within 12 months.

1. The new rules ban one time passwords via SMS, email or apps for logins and device registration, and require passkeys, device binding and hardware keys instead.
2. The move responds to sharp growth in phishing and spoofing, which have driven hundreds of millions of dollars in crypto losses and over half of Hong Kongs reported cyber incidents.
3. Users and platforms should expect significant login experience changes over the next year, with tighter monitoring of suspicious activity and possible ripple effects in other jurisdictions.

Deep Dive

1. What Changed

The SFC has issued a circular that tells all licensed virtual asset trading platforms and internet brokers in Hong Kong to phase out OTP based authentication for customer logins and device registration. Reports from outlets such as TradingView and Cointelegraph confirm that one time passwords delivered via SMS, email or app generated codes are explicitly prohibited under the new standard for access control and device binding, and that firms have up to 12 months to comply, with large brokers expected to move faster. Acceptable alternatives include passkeys, registered devices verified cryptographically and hardware security keys, which the regulator describes as phishing resistant solutions.

2. Why It Matters For Security

The directive is driven by a surge in credential theft and account hijacking. According to recent coverage of the SFC circular, spoofing attacks accounted for about 57 percent of security incidents reported to Hong Kongs Cyber Security Accident Coordination Center in 2025, and phishing scams caused roughly 306 million dollars of 482 million dollars in global crypto losses in one quarter. OTPs are vulnerable because attackers can relay codes in real time via fake login pages, SIM swaps or man in the middle setups, while passkeys and device bound credentials tie access to a specific private key or hardware device that cannot be simply typed into a phishing site.

3. What To Watch Next

Platforms must redesign login flows, withdrawal confirmations and account recovery to support passkeys or hardware keys, and they are also required to monitor suspicious logins, trades and withdrawals and promptly notify customers of important account events. Senior management is explicitly held responsible for losses linked to weak controls, which increases pressure to invest in security rather than treat it as a checkbox. Outside Hong Kong, other regulators already discuss similar measures, so this move could become a template for broader tightening of crypto account security.

Conclusion

By banning OTP logins and mandating phishing resistant authentication, Hong Kong is pushing its regulated crypto platforms closer to bank grade security and away from widely exploited legacy methods. For crypto users, the headline means more friction in the short term and potentially fewer catastrophic account takeovers in the long term, while for exchanges and brokers it marks another step toward higher operational standards that may influence global norms around digital asset security.