Hong Kong SFC ends SMS-only exchange logins

TLDR

Hong Kongs Securities and Futures Commission is forcing licensed crypto platforms to move beyond SMS-only logins within a year, making stronger, phishing-resistant authentication a regulatory requirement.

1. The SFCs new circular orders licensed exchanges to phase out SMS and email one-time passwords as standalone login methods or accept liability for phishing-related losses.
2. Platforms must roll out multi-factor, phishing-resistant logins like passkeys, hardware keys, or authenticator apps, with tighter monitoring and alerts for suspicious account activity.
3. Over the next year, Hong Kong users should expect new login flows and other regions may copy this model, raising the security baseline across regulated crypto venues.

Deep Dive

1. What The SFC Changed

Hong Kongs SFC has issued an official circular telling licensed virtual asset trading platforms and online brokers to stop using SMS- and email-based one-time passwords as the only factor for logins and new device binding within 12 months, or be liable for client losses from account compromises. The circular treats weak authentication as a consumer-protection failure, tying platform design directly to responsibility for theft and fraud. This follows large phishing campaigns where attackers impersonated brokers and regulators via text and email, capturing both credentials and OTPs and draining client accounts, prompting the SFC to deem OTP-only logins insufficiently secure, as described in the SFCs official circular.

2. Impact On Exchanges And Users

Licensed Hong Kong crypto platforms now have a one-year migration window to implement phishing-resistant authentication for logins and new device registration, while existing device bindings do not need to be redone. Acceptable methods include public-key based passkeys, hardware security keys, and app-based authenticators, where private keys stay on user devices and cannot be intercepted via SMS or email. The SFC also requires better real-time monitoring, rapid suspension of suspicious accounts, and immediate alerts for logins and high-risk changes such as new device bindings or password/passkey updates, which will change the day-to-day experience for users.

3. What To Watch Next

The deadline around July 2027 will be the real test of compliance, as platforms that lag risk regulatory penalties and being held financially responsible for large-scale fraud losses. Senior managers in operations and IT are explicitly accountable, signaling that security failures can become supervisory issues, not just technical bugs. Other Asia-Pacific regulators already tightening crypto rules may view Hong Kongs model as a template, so similar multi-factor requirements could spread, gradually standardizing stronger login security across major regulated exchanges.

Confidence: high because the policy is documented in the SFC circular and reinforced by recent Hong Kong phishing warnings.

Conclusion

Hong Kong is using its crypto licensing regime to push exchanges beyond fragile SMS and email OTP logins, shifting more responsibility for account theft from users to platforms. Over the next year, stronger multi-factor authentication and better fraud monitoring should become standard for licensed Hong Kong venues, and if other regulators follow, users globally may see more secure, but slightly more complex, login flows across regulated crypto markets.