Hong Kong SFC Requires Brokers to Strengthen Account Security Against Phishing Risks

Hong Kongs Securities and Futures Commission (SFC) has instructed online brokers and licensed virtual asset trading platforms to introduce stronger customer authentication measures as phishing attacks continue to threaten investor accounts.

Under a circular issued on July 9, the regulator asked licensed firms to gradually move away from one-time passwords (OTP) for customer login and device binding, replacing them with more secure methods such as passkeys and trusted device authentication.

The move applies directly to online brokerage businesses, including forex and CFD brokers operating under Hong Kongs regulatory framework, where protecting client accounts and trading access has become an increasing compliance priority.

Brokers Required to Upgrade Authentication Systems

The SFC said licensed firms should implement the new security measures as soon as possible and complete the transition within 12 months of the circulars publication.

For large-scale online brokers with significant customer bases, the regulator expects the enhanced protection measures to be introduced immediately.

The updated requirements aim to reduce risks associated with stolen passwords, fake login pages, and other phishing techniques that attempt to gain unauthorized access to trading accounts.

For forex brokers, account security is closely linked to trading operations, as compromised accounts may lead to unauthorized transactions, changes in account settings, or improper withdrawal requests.

New Monitoring Requirements for Suspicious Activity

Beyond login protection, the SFC also called on firms to strengthen their internal monitoring systems.

Licensed companies are expected to improve their ability to identify unusual login attempts, suspicious trading behavior, and abnormal withdrawal activity.

The regulator also highlighted the importance of timely communication with customers when major account-related events occur, as well as maintaining effective response procedures after cybersecurity incidents.

In addition, firms should provide customers with regular information about emerging phishing methods and cybersecurity risks.

Management Responsibility for Client Asset Protection

The SFC emphasized that senior management remains responsible for ensuring the security of customer accounts and assets.

The regulator warned that firms may face consequences if inadequate cybersecurity controls contribute to customer losses.

This places greater responsibility on brokers to review their existing security frameworks rather than relying only on traditional password and OTP-based systems.

Phishing Attacks Become a Growing Concern in Hong Kong

The latest requirements follow increasing concerns over online financial fraud.

According to Hong Kongs Computer Emergency Response Team Coordination Centre, phishing attacks accounted for 57% of reported cybersecurity incidents in 2025.

The SFCs latest measures are also aligned with guidance issued in February 2025, which encouraged licensed firms to reduce reliance on OTP-based authentication and adopt stronger security technologies.

For forex and CFD brokers, the changes highlight a broader regulatory trend: cybersecurity controls are becoming an essential part of operational compliance alongside licensing, risk management, and client protection requirements.

About WikiFX

WikiFX is a global forex broker information and verification platform. It provides regulatory information, broker background checks, risk alerts, and user exposure records to help traders assess brokers and identify potential platform risks before making financial decisions.