Briefing

SFC sets a July 2027 date for phishing-resistant broker login

Written by WiT Markets EditorialReview Editorially reviewedLast reviewed

Brokers and regulationDate only. No clock time was recorded.WiT Markets Editorial2 min read

On 9 July 2026 the Securities and Futures Commission issued a circular to internet brokers and SFC-licensed virtual asset service providers. It expects them to use phishing-resistant authentication for client login and for binding a device, and to watch accounts for suspicious login, trading and withdrawal activity.

A login mark with a second check, for authentication that is meant to resist phishing
Editorial illustration. It is not a photograph of an event, and it does not show a price.

Key facts

  • The SFC circular is dated 9 July 2026.
  • Phishing-resistant login and device binding are due no later than 8 July 2027.
  • Large internet brokers are expected to implement those login solutions immediately.

The circular says the SFC does not consider a one-time password, including an email or SMS code, to be a phishing-resistant method for those two steps. Examples it gives of stronger methods are passkeys and devices that are bound to the account with robust verification. Clients who already have a bound device do not have to bind it again. The circular is an expectation for licensed firms. It is not a new statute, and it does not name a broker.

The timetable is in the circular. Robust authentication for login and device binding should be in place as soon as practicable and in any event no later than 8 July 2027, which the SFC describes as within 12 months of the circular. Large internet brokers are expected to implement those solutions immediately. Monitoring, client notification and incident response are also expected immediately, although the SFC says it will take a pragmatic approach where a firm needs time to update systems. A firm that expects to miss the 12-month period is told to notify its case officer.

During that period the SFC reminds firms that one-time passwords remain open to phishing. It expects enhanced checks for irregular logins and unauthorised trading, and immediate suspension or restriction of access when suspicious activity is identified. Investors are reminded to use official websites and applications, to keep credentials to themselves, and to review their statements. This page does not turn that reminder into a claim that any named platform has been compromised.

Why it matters for investors and traders

Clients of Hong Kong internet brokers and licensed virtual-asset firms should see login methods change, and the date for that change is written in the circular. The circular does not say that a one-time password is already forbidden on the day of publication.

Markets discussed: Cryptoassets. These are the subjects of the briefing, not a list of markets that moved.

Uncertainties

  • The circular does not define the size threshold for a large internet broker in the passage used here.
  • A pragmatic approach to system updates is mentioned. The circular does not list which delays the SFC will accept.
  • Passkeys and bound devices are examples. The appendix is not copied onto this page.

What to watch next

  • Keep 8 July 2027 as the latest date for the login change. It is not a date the requirement already started.
  • Treat the immediate expectation for large internet brokers as the SFC’s wording, not as a completed inspection.
  • A firm that tells the SFC it will miss the date is a separate supervisory fact. None is recorded here.

How to read this development

GuidanceHong KongSecurities and Futures Commission

The official document is dated 9 July 2026. This briefing was published on 22 October 2026. A later status would be added as a new entry. The original status stays in the record.

Who is affected

Internet brokers licensed by the SFC, and SFC-licensed virtual asset service providers. No firm is named.

What changes

One-time passwords are not treated as phishing-resistant for client login and device binding. Stronger authentication, monitoring and client alerts are expected.

When it applies

The circular is dated 9 July 2026. The login and device-binding solutions are due as soon as practicable and no later than 8 July 2027. Large internet brokers are expected to implement those solutions immediately.

Status history

  • 9 July 2026. Guidance. Circular sets expectations. Robust authentication for login and device binding is due no later than 8 July 2027.

Markets, research and tools

Markets: Stock marketsCrypto markets

These links are context. They are not a suggestion to trade, and they are not placed as advertisements.

Saved briefingsStored only on this device. Not an account, and not sent to WiT Markets.

Related

Sources and review

Written by: WiT Markets Editorial. Writes and structures WiT Markets pages. Separates a sourced fact from a cell that is Not confirmed.

Review: Editorially reviewed. This is not a qualified specialist review and it is not a legal sign-off.

Last reviewed: . Next review due . The date is an editorial pass. It is not a live check of every third-party fee.

Regulatory and official sources

Methodology. Editorial policy. Corrections. Report an error.

SFC sets a July 2027 date for phishing-resistant broker login | WiT Markets