CryptoSlate
Hong Kong's Securities and Futures Commission has told licensed crypto trading platforms they have one year to retire one-time-password authentication or face direct liability for any resulting user losses.
Under the new rules, the SFC will treat SMS- and email-based OTPs as inadequate protection for retail-facing account access. Platforms must migrate to cryptographic two-factor authentication, typically app-based or hardware-key flows, and are on the hook financially if a user is compromised through any legacy OTP channel during the transition window.
Why it matters
OTP fraud and SIM-swap attacks have been the entry point for the bulk of exchange-side account takeovers over the past three years. By shifting liability onto the platform rather than the user, the SFC is converting a customer-service problem into a balance-sheet one. Exchanges that delay migration are effectively self-insuring against attacks they already know are coming.
Market impact
The compliance clock runs twelve months from the SFC's guidance, which lands alongside Hong Kong's broader licensing push that recently approved four additional platforms for retail crypto trading. Hong Kong-licensed venues now face a forced security capex with a hard deadline, and the liability shift is likely to push more regional platforms to migrate off OTPs even before local regulators require it.
Frequently asked questions
-
Why is the Hong Kong SFC banning one-time passwords?
The regulator has ruled that SMS- and email-based OTPs are inadequate for protecting retail crypto accounts, citing OTP fraud and SIM-swap attacks as the dominant entry point for exchange-side account takeovers.
-
What must Hong Kong crypto platforms replace OTPs with?
Platforms must migrate to cryptographic two-factor authentication, typically app-based authenticators or hardware security keys, within a twelve-month transition window.
-
What happens if a platform misses the OTP deadline?
Licensed platforms that fail to retire OTPs within the one-year window become directly liable for any resulting user losses, rather than offloading the risk onto the affected customer.
-
Does this rule apply to all Hong Kong crypto firms or just licensed ones?
The guidance applies to SFC-licensed crypto trading platforms operating in Hong Kong. Unlicensed offshore venues serving Hong Kong users fall outside the direct mandate but face de facto pressure to align.
-
How does the OTP shift fit with Hong Kong's broader crypto stance?
The two-factor rule lands alongside the SFC's ongoing licensing push, which recently greenlit four additional platforms for retail crypto trading, suggesting Hong Kong is pairing market-opening steps with stricter user-protection floors.
WatcherGuru
Crypto Rank News
TheBlock
WuBlockchain
CoinTelegraph