The Securities and Futures Commission directed licensed virtual asset service providers and internet brokers to adopt phishing-resistant authentication methods, such as passkeys and bound devices, no later than July 8, 2027.