Hong Kong SFC Requires Internet Brokers & Virtual Asset Trading Platform Operators (VATPs) to 1) Implement Phishing-Resistant Authentication Methods for Client Login & Device Binding within 12 Months (Latest 8/7/27) and to Stop Using 1-Time Passwords (OTPs) for Client Login & Device Binding, 2) Large Internet Brokers are Expected to Implement Immediately and 3) Senior Management are Ultimately Responsible for Appropriate Controls to Protect Client Accounts & Assets and Will be Held Accountable for Client Losses Due to Control Lapses
9th July 2026 | Hong Kong
Hong Kong Securities and Futures Commission (SFC) has issued notice requiring internet brokers & Virtual Asset Trading Platform operators (VATPs) to 1) Implement phishing-resistant authentication methods for client login & device binding within 12 months (latest 8/7/27) and to stop using 1-time passwords OPTs) for client login & device binding, 2) Large internet brokers are expected to implement immediately and 3) Senior management are ultimately responsible for appropriate controls to protect client accounts & assets and will be held accountable for client losses due to control lapses. Announcement (9/7/26): “The Securities and Futures Commission (SFC) today issued a circular requiring internet brokers and virtual asset trading platform operators (VATPs) to adopt phishing-resistant authentication methods for client login and device binding (Notes 1 and 2), amid the growing threat of phishing attacks involving stolen client credentials. As part of its continued efforts to combat phishing attacks and account takeover incidents targeting clients of internet brokers and VATPs (Note 3), the SFC is requiring them to cease using one-time passwords (OTPs) for client login and device binding, given the associated risks and the availability of stronger authentication alternatives (Note 4). Passkeys and bound devices are examples of more robust, phishing-resistant authentication methods. The SFC requires these phishing-resistant authentication measures for login and device binding to be implemented as soon as practicable but no later than 12 months from the issue of its circular. Large internet brokers are expected to adopt them immediately. In addition to robust prevention controls, internet brokers and VATPs should implement effective monitoring and surveillance measures to detect suspicious login, trading and withdrawal activities, promptly notify clients of key account events, and respond to hacking incidents in a timely manner. They should also regularly alert and remind clients of emerging phishing and other cybersecurity risks. The SFC reminds senior management of internet brokers and VATPs that they are ultimately responsible for implementing appropriate controls to protect client accounts and assets. The SFC will hold them accountable for any client losses that arise from lapses in their controls. The SFC also reminds investors to stay vigilant in safeguarding their securities trading accounts and credentials. They should adopt prudent security measures, such as using strong and unique passwords, keeping their credentials and devices secure and up to date, and accessing their accounts only through official websites or mobile applications of their licensed corporations (LCs) and VATPs. They should also monitor their accounts regularly and promptly review account statements, transaction records and notifications for suspicious activities. If they suspect their credentials have been compromised or identify any unauthorised transactions, they should contact their LCs or VATPs immediately, secure their accounts, and report the matter to the relevant authorities.
“ Hong Kong SFC Requires Internet Brokers & Virtual Asset Trading Platform Operators (VATPs) to 1) Implement Phishing-Resistant Authentication Methods for Client Login & Device Binding within 12 Months (Latest 8/7/27) and to Stop Using 1-Time Passwords (OTPs) for Client Login & Device Binding, 2) Large Internet Brokers are Expected to Implement Immediately and 3) Senior Management are Ultimately Responsible for Appropriate Controls to Protect Client Accounts & Assets and Will be Held Accountable for Client Losses Due to Control Lapses “
![](https://www.caproasia.com/wp-content/uploads/2025/08/Air-Charter-Service-728x90-1.png")
Notes:
- Internet brokers refer to licensed corporations which are engaged in internet trading and are licensed for (i) Type 1 regulated activity (dealing in securities); (ii) Type 2 regulated activity (dealing in futures contracts); (iii) Type 3 regulated activity (leveraged foreign exchange trading); and/or (iv) Type 9 regulated activity (asset management) to the extent that they distribute funds under their management through their internet-based trading facilities.
- Device binding is used as one of the authentication methods, where the client binds or registers and links a mobile device/a computer with the internet brokers’/VATPs’ trading system and the mobile device/computer is recognised by its securely enrolled device attributes.
- Phishing attacks accounted for 57% of the security incidents reported to the Hong Kong Computer Emergency Response Team Coordination Centre in 2025.
- Since late 2024, the SFC has been closely monitoring the risks associated with OTPs and the development of alternative authentication methods for client login and device binding. The SFC strongly encouraged licensed corporations to stop using OTPs for these purposes in its Circular to licensed corporations – Cybersecurity review of licensed corporations dated 6 February 2025.
Hong Kong SFC Requires Internet Brokers & Virtual Asset Trading Platform Operators (VATPs) to 1) Implement Phishing-Resistant Authentication Methods for Client Login & Device Binding within 12 Months (Latest 8/7/27) and to Stop Using 1-Time Passwords (OTPs) for Client Login & Device Binding, 2) Large Internet Brokers are Expected to Implement Immediately and 3) Senior Management are Ultimately Responsible for Appropriate Controls to Protect Client Accounts & Assets and Will be Held Accountable for Client Losses Due to Control Lapses
Caproasia Users
- Manage $20 million to $30 billion of assets
- Invest $3 million to $300 million
- Advise institutions, billionaires, UHNWs & HNWs
Caproasia Platforms | 11,000 Investors & Advisors
- Caproasia.com
- Caproasia Access
- Caproasia Events
- The Financial Centre | Find Services
- Membership
- Family Office Circle
- Professional Investor Circle
- Investor Relations Network
Monthly Roundtable & Networking
Family Office Programs
The 2026 Investment Day
- March - Hong Kong
- March - Singapore
- April - Hong Kong
- April - Singapore
- July - Hong Kong
- July - Singapore
- Sept- Hong Kong
- Sept - Singapore
- Oct- Hong Kong
- Nov - Singapore
- Visit: The Investment Day | Register: Click here
Caproasia Summits
- The Institutional Investor Summit
- The Investment / Alternatives Summit
- The Private Wealth Summit
- The Family Office Summit
- The CEO & Entrepreneur Summit
- The Capital Markets Summit
- The ESG / Sustainable Investment Summit
