Ordinance
4notify Hong Kong · Government Gazette
OFFICIAL · HKMA · Faster Payment System
Ordinance No
ORD-HK-001
Date
2026-05-27
Status
In force
Category
Banking and payments

Strong customer authentication and FPS: one-time password delivery to Hong Kong retail banking over CSL, 3HK, SmarTone, China Mobile HK and China Unicom HK

The Hong Kong Monetary Authority (HKMA) supervises the retail banking sector and operates the Faster Payment System (FPS), Hong Kong's real-time small-value payment rail. Every login and every FPS transfer must be confirmed by a second factor. 4notify delivers one-time passwords with a P50 below four seconds over the five Hong Kong mobile networks (CSL, 3HK, SmarTone, China Mobile HK, China Unicom HK) via tier-1 direct interconnections — never via grey-route aggregators.

SMSPushEmail
Preamble

Whereas, by virtue of section 8 of the Telecommunications Ordinance (Cap. 106) and the supervisory authority of the Hong Kong Monetary Authority under the Banking Ordinance (Cap. 155), it is hereby ordained that one-time passwords issued in connection with the Faster Payment System and retail electronic banking channels shall be delivered with auditable timing and provenance across the five Hong Kong mobile networks.

Statutory basis
Banking Ordinance (Cap. 155)

Supervisory powers of the HKMA over authorised institutions and the obligation to operate banking channels under prudent risk-based controls.

HKMA Supervisory Policy Manual TM-E-1 — Risk Management of E-Banking

Two-factor authentication is required for high-risk transactions; out-of-band confirmation is the expected control for FPS transfers above the HKMA-set thresholds.

HKMA Practice Note on FPS

Real-time settlement, proxy addressing (FPS ID / mobile / email) and authentication expectations for participating banks.

Implementation
01

OFCA notification + tier-1 carrier contracts

4notify is filed with OFCA as a recognised A2P-SMS provider and holds direct tier-1 routes with CSL, 3HK, SmarTone, China Mobile HK and China Unicom HK.

02

OTP generated inside the bank HSM

The one-time password is generated in the bank's hardware security module; 4notify receives only the hashed reference and the destination MSISDN — never the raw secret.

03

60-second delivery window + channel cascade

SMS is delivered within 60 seconds; if the delivery report fails, push and then email take over. Grey-route delays are eliminated by direct routing.

04

Seven-year signed audit envelope

Every delivery is signed and retained for seven years to satisfy HKMA record-keeping expectations and Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) requirements.

Delivery envelope
json
{
  "event": "bank.fps.otp",
  "bank_id": "HK-XXXX",
  "transaction_id": "FPS-2026-05-27-948210",
  "amount": 4500.00,
  "currency": "HKD",
  "delivery": {
    "channel": "sms",
    "fallback": ["push", "email"],
    "window_seconds": 60,
    "template": "fps_otp_hk_v3"
  },
  "audit_signature": "https://4notify.net/sig/bank/948210"
}
Sample message
SMS

HSBC: your code to confirm an FPS transfer of HKD 4,500.00 to CHAN K.M. is 482193. Valid 5 minutes. Never share this code with anyone.

Compliance checklist
  • OFCA recognised-provider filing on record
  • Tier-1 direct routes active on all five Hong Kong mobile networks
  • OTP P50 ≤ 4 seconds measured every quarter
  • Seven-year signed audit envelope retained
The 4notify difference

4notify is the only A2P provider with simultaneous tier-1 direct routes into CSL, 3HK, SmarTone, China Mobile HK and China Unicom HK plus a seven-year signed audit envelope aligned with HKMA Supervisory Policy Manual TM-E-1.

Frequently asked questions
Does 4notify deliver directly to Hong Kong banks or via an aggregator?

Direct tier-1 interconnections with CSL, 3HK, SmarTone, China Mobile HK and China Unicom HK. We never use grey-route aggregation for authentication traffic.

Do push notifications count as a second factor under the HKMA Supervisory Policy Manual?

Yes — an app-bound push is a recognised possession factor. Because an app cannot guarantee a durable medium, we always pair it with SMS or email as a fallback channel.

Published
4notify Department of Operations
2026-05-27 · ORD-HK-001

Start free

14 days, no card. English-speaking support on weekdays.

Other entries in this edition