The Hong Kong Securities and Futures Commission (SFC) just dropped a regulatory bombshell: a flat ban on SMS and email one-time passwords (OTP) for login and device binding across all licensed internet brokers and crypto trading platforms. Why now? Because phishing attacks now account for 57% of all cybersecurity incidents in the region—a 27% spike year-over-year from 2024 to 2025. The SFC isn’t asking; it’s ordering. And it gave operators 12 months to comply, with large brokers forced to switch immediately.
This is not a soft guidance. It’s a hard mandate that shifts the burden of proof from the platform to the user’s device. The technical translation? Bye-bye knowledge-based authentication. Hello possession-based and inherence-based factors—specifically, passkeys (FIDO2/WebAuthn) and biometrics.
Context: Why OTP Failed and What Replaces It
Most market participants underestimate the structural weakness of OTP. It’s a shared-secret model: the same code is generated server-side and sent over an unencrypted SMS or email channel. Attackers intercept via SIM swaps, phishing emails, or malware-laced browser extensions. The SFC’s February 2025 guidance already flagged this risk. Now it’s law.
Passkeys, on the other hand, use public-key cryptography. The private key never leaves the user’s device—biometric or PIN unlocks it. The public key lives on the platform’s server. Even if the server is compromised, the attacker cannot authenticate as the user without the physical device. This is the same cryptographic foundation that underpins hardware wallets and self-custody. The irony? Crypto platforms, which preach self-sovereignty, relied on a compromised authentication method for years.
Core: The On-Chain Evidence Chain and Institutional Compliance Costs
My own experience in 2017, when I manually traced 5,000 lines of Solidity code to catch a reentrancy bug on a DeFi lending protocol, taught me that security audits are not optional—they’re a process. The SFC’s new rule is a similar process mandate, but applied to identity and access management (IAM).
Let’s get quantitative. A typical Hong Kong licensed exchange with 500,000 active users processes around 1.2 million monthly login attempts. Under the current OTP regime, that’s 1.2 million SMS messages per month—roughly $0.06 per SMS in Hong Kong, totaling $72,000 per month in SMS costs alone. Switching to passkeys eliminates that variable cost. However, the upfront integration cost is non-trivial: client-side SDKs, server-side credential management, device recovery workflows. Based on my work designing an institutional compliance dashboard in 2024, a mid-tier exchange can expect 3–4 months of engineering effort and $300,000–$500,000 in total migration cost.
But costs aren’t the only metric. The real risk lies in account recovery. If a user loses their passkey—say, a stolen phone with no backup—they lose access to their account. The SFC’s circular mandates that platforms provide a “reasonable recovery process,” but doesn’t specify details. This is where we see a correlation between compliance and user friction. The data shows that exchanges with strict KYC and multi-factor authentication already see 12–18% higher drop-off rates in new user onboarding. The passkey shift could amplify that.
Contrarian: The Hidden Blind Spots and Correlation ≠ Causation
Every analyst will tell you this is a net positive for security. And they’re right—on the surface. But there’s a nuance the data reveals: the migration itself is a risk. Between now and March 2026, platforms must run dual authentication systems—old OTP for legacy users, new passkeys for migrated ones. This hybrid state is the perfect time for attack: phishers can target users still on OTP while the platform’s attention is split. The SFC’s own 2026 enforcement data is yet to be published, but I’d bet the number of credential-stuffing attacks spikes during transition periods.
More importantly, correlation does not imply causation. Just because phishing attacks are 57% of incidents doesn’t mean OTP is the only vector. Social engineering, API key leaks, and smart contract exploits are equally dangerous. The SFC’s laser focus on authentication may create a false sense of safety elsewhere. Data reveals the truth; narrative obscures it. The narrative says “passkeys fix phishing.” The data says “passkeys fix one type of phishing, but the attack surface is much larger.”
Another blind spot: regulatory arbitrage. If Singapore or the UK doesn’t follow suit, capital and users may flow to jurisdictions with lighter authentication requirements. The SFC is effectively building a walled garden of security. That’s good for users inside, but it raises the barrier to entry for innovation. Volatility is the tax you pay for illiquid assets—and compliance overhead is the tax you pay for regulated markets.
Takeaway: A Signal That Cannot Be Ignored
Over the next 12 months, watch for three things: (1) other regulators—MAS, FCA, perhaps even the SEC—issuing similar directives that cite Hong Kong’s move as a precedent. (2) A wave of investment in RegTech startups specializing in passkey infrastructure and account recovery for crypto platforms. And (3) the user churn numbers of Hong Kong licensed exchanges. If the drop-off exceeds 20%, the compliance cost may outweigh the security benefit.
The SFC just set a new standard. The question isn’t whether you comply—it’s whether you survive the transition. In a bull market where FOMO drives action, the smart money is on those who audit their authentication stack before the regulator audits them.
