meta_id 3312800

On July 9, 2026, the Securities and Futures Commission (SFC) issued a circular requiring internet brokers and virtual asset trading platform operators (VATPs) to adopt phishing-resistant authentication methods for client login and device binding. The mandate responds to growing phishing attacks involving stolen client credentials, which accounted for 57 percent of security incidents reported to the Hong Kong Computer Emergency Response Team Coordination Centre in 2025. The SFC is requiring internet brokers and VATPs to cease using one-time passwords (OTPs) for client login and device binding, citing associated risks and the availability of stronger alternatives such as passkeys and bound devices. The phishing-resistant authentication measures must be implemented as soon as practicable but no later than 12 months from the circular's issuance, with large internet brokers expected to adopt them immediately. Beyond authentication, the SFC requires firms to implement effective monitoring and surveillance measures to detect suspicious login, trading and withdrawal activities, promptly notify clients of key account events, and respond to hacking incidents in a timely manner. Firms must also regularly alert clients to emerging phishing and cybersecurity risks. Dr Eric Yip, the SFC's Executive Director of Intermediaries, said: "Protecting client accounts from increasingly sophisticated and elusive phishing attacks requires holistic measures combining prevention, detection, response and education." The SFC reminded senior management that they are ultimately responsible for implementing appropriate controls to protect client accounts and assets, and will hold them accountable for any client losses arising from control lapses. The SFC previously encouraged licensed corporations to stop using OTPs in its February 6, 2025 circular on cybersecurity reviews. Internet brokers and VATPs must implement these measures within the 12-month timeframe. The SFC also advised investors to adopt prudent security measures, including strong passwords, secure credentials and devices, and regular account monitoring. REFERENCES: Securities and Futures Commission of Hong Kong. "SFC mandates phishing-resistant authentication methods for internet brokers and VATPs to protect client accounts." July 9, 2026. https://www.sfc.hk/