Recently,the Hong Kong Securities and Futures Commission (SFC) issued new regulatorydirectives requiring significant upgrades to customer authentication systems.The measures require all licensed internet brokers and Virtual Asset TradingPlatform (VATP) operators to stop using One-Time Passwords (OTPs) delivered viaSMS or email for customer login and device binding.Instead,regulated firms must adopt phishing-resistant authentication methods,specifically Passkeys based on the FIDO2/WebAuthn standards or securehardware-based device binding. Most firms have been given 12 months toimplement the new requirements, while large internet brokers are expected tocomply immediately.Which ThatMust ComplyThe new SFCrequirements apply to intermediaries licensed under Hong Kong's Securitiesand Futures Ordinance (SFO) and cover two main categories:Licensed Internet Brokers: Firms providing online trading services under regulated activities including:Type 1 (Dealing in Securities), Type 2 (Dealing in Futures Contracts), Type 3 (Leveraged Foreign Exchange Trading), and Type 9 (Asset Management). Virtual Asset Trading Platforms (VATPs): SFC-licensed operators providing trading and custody services for digital assets.CouldOther Regulators Follow?The SFC'sproactive approach could influence the direction of cybersecurity regulationwell beyond Hong Kong. Financial regulators, including CySEC in Cyprus, theFinancial Conduct Authority (FCA) in the United Kingdom, and the MonetaryAuthority of Singapore (MAS), often monitor developments in other leadingfinancial centres when shaping their own supervisory expectations. If HongKong's transition away from SMS-based OTPs proves successful, it could providea practical model for other regulators seeking to reduce the growing number ofretail account takeover attacks.The move isalso likely to accelerate the adoption of common authentication standardsacross the financial industry. Large international firms operating acrossmultiple jurisdictions face increasing costs when maintaining differentauthentication systems for different markets.More onthis topic, together with additional insights and practical takeaways, can befound in our full analysis on the Finance Magnates Intelligence Portal.This article was written by Sylwester Majewski at www.financemagnates.com.