TLDR
Hong Kongs regulator has ordered licensed crypto platforms to stop using one-time passwords for logins and device binding and move to phishing-resistant authentication within about a year.
- The Securities and Futures Commission (SFC) now bans SMS, email and app OTPs for logging in or registering new devices, pushing firms toward passkeys and similar methods.
- Platforms that fail to upgrade by July 2027 risk enforcement and may be held financially liable for user losses from phishing-related account takeovers.
- For users this means more secure but potentially more complex login flows in Hong Kong today, and it could become a template for other major crypto jurisdictions.
Deep Dive
1. What Hong Kong Has Changed
Hong Kongs SFC has issued a circular that bans one-time passwords for client logins and new device registration on licensed crypto trading platforms and internet brokers, covering SMS, email and app-based OTPs as standalone login factors.Hong Kong bans SMS and email logins
The SFC requires phishing-resistant authentication such as passkeys built on public key cryptography, hardware keys or strong device-based factors, giving most platforms up to 12 months to comply, while large brokers must switch immediately.Hong Kong regulator orders new anti-phishing measures for crypto platforms
The mandate focuses on login and device binding only; other OTP uses such as confirming specific transactions can remain, provided they sit on top of a stronger login layer.Hong Kong gives crypto platforms one year to ditch one-time passwords or cover user losses
2. Why It Matters For Platforms And Users
The change is driven by a sharp rise in credential theft. Hong Kong recorded 15,877 cybersecurity incidents in 2025, up 27 percent year on year, with phishing behind 57 percent of cases.Hong Kong bans SMS and email logins
Under the new rules, weak login controls are treated as a consumer protection failure. Senior management can be held directly liable for losses if platforms do not implement strong authentication and monitoring, shifting more risk from users to custodial operators.Hong Kong gives crypto platforms one year to ditch one-time passwords or cover user losses
For everyday users of Hong Kong licensed platforms, this likely means more prompts to set up passkeys, hardware keys or device-based login, and eventual removal of OTP-only sign in, especially on mobile.
Expect Hong Kong exchanges to emphasize security-grade login methods, and treat OTP-only access on regulated platforms as a short-term phase-out rather than a stable setup.
3. What To Watch Next
The full cutoff for OTP logins is set around July 8, 2027, after which OTP-based logins and new device bindings must be replaced or platforms risk enforcement and liability.Hong Kong gives crypto platforms one year to ditch one-time passwords or cover user losses
Regulators in other hubs such as Singapore, the United Kingdom and the European Union face similar phishing pressures, and the SFC move raises the question of whether they will adopt comparable passkey or hardware-key mandates for crypto access.Hong Kong bans SMS and email logins
On the industry side, watch how quickly major centralized platforms roll out passkey support, device binding safeguards and real-time alerts for logins and account changes, which may become a competitive differentiator in security-conscious markets.
Conclusion
Hong Kong is turning strong, phishing-resistant authentication from a best practice into a regulatory requirement for licensed crypto platforms and brokers. That raises the security bar for custodial services, shifts more responsibility onto operators and sets a precedent other jurisdictions could copy. For users, the near-term impact is mainly changing how they log in, but over time it could reduce some of the most common routes into large centralized account thefts.
CoinsKid.Com