Hong Kong Tightens Cybersecurity Rules for Crypto Platforms

Hong Kong's Securities and Futures Commission (SFC) has instructed licensed brokers and cryptocurrency platforms to phase out one-time password (OTP) login systems within the next 12 months following a rise in phishing-related cybercrime. The move is intended to strengthen digital security standards across the city's regulated financial sector. According to regulators, phishing attacks accounted for a significant share of reported security incidents during the previous year, highlighting weaknesses associated with traditional authentication methods. Cybercriminals increasingly use fake websites, emails and text messages to trick users into revealing login credentials and verification codes. The SFC is encouraging firms to adopt stronger authentication technologies, including passkeys, hardware security keys, biometric verification and cryptographic authentication. These methods are considered more resistant to phishing because authentication credentials cannot easily be intercepted or reused by attackers. The decision aligns Hong Kong with broader global efforts to improve cybersecurity within financial services. Banks, payment providers and cryptocurrency exchanges worldwide are replacing SMS-based verification with more secure alternatives as cyber threats become increasingly sophisticated. Cryptocurrency platforms remain frequent targets for cybercriminals due to the irreversible nature of blockchain transactions. Strong authentication, cold storage, encryption and continuous monitoring are viewed as essential components of modern digital asset security. Industry participants generally support stronger cybersecurity requirements, although firms must invest in infrastructure upgrades, customer education and compliance processes before implementation deadlines. The new requirements reinforce Hong Kong's ambition to become a leading regulated digital asset hub while maintaining high standards of consumer protection and financial stability.