Ordinance
4notify Hong Kong · Government Gazette
OFFICIAL · OGCIO · iAM Smart
Ordinance No
ORD-HK-004
Date
2026-05-27
Status
In force
Category
Digital government

iAM Smart, iAM Smart+ digital signature and HKID-bound delivery of one-time passwords to the Hong Kong public

iAM Smart is the all-in-one digital identity platform of the Hong Kong Special Administrative Region Government, operated by the Office of the Government Chief Information Officer (OGCIO) and bound to the holder's Hong Kong Identity Card (HKID). iAM Smart+ adds a legally recognised digital signature. 4notify integrates with the iAM Smart notification gateway and delivers appointment reminders, service-ready notices and one-time passwords with HKID masking at the envelope level.

PushSMSEmail
Preamble

Whereas, by virtue of the Electronic Transactions Ordinance (Cap. 553) and the iAM Smart programme administered by the Office of the Government Chief Information Officer, it is hereby ordained concerning the delivery of service notices and one-time passwords for the iAM Smart and iAM Smart+ digital identity.

Statutory basis
Electronic Transactions Ordinance (Cap. 553)

Legal basis for digital signatures and recognised certification authorities in Hong Kong.

iAM Smart Programme guidance (OGCIO)

Operational rules for iAM Smart, iAM Smart+ and HKID-bound electronic identity.

Registration of Persons Ordinance (Cap. 177)

Statutory basis of the Hong Kong Identity Card; obligation to safeguard the HKID number.

Implementation
01

Integration with the iAM Smart gateway

4notify integrates with the OGCIO notification gateway; quarterly penetration tests are agreed contractually.

02

HKID masking

The delivery envelope carries the HKID only as a hash (SHA-256 + salt). The plaintext HKID stays inside the issuing bureau's system and is never logged by 4notify.

03

Three-channel cascade

Service ready → push (60s) → SMS (2 min) → email (5 min). The citizen's channel preference is read from the iAM Smart profile.

04

One-time password delivery

OTPs for iAM Smart and iAM Smart+ are delivered within a 60-second window; if SMS fails, email takes over via the cascade.

Delivery envelope
json
{
  "event": "gov.service.ready",
  "hkid_hash": "sha256:salt:7f2a9b...",
  "bureau": "ImmD",
  "bureau_name": "Immigration Department · HK Island",
  "channels": ["push", "sms", "email"],
  "cascade_window_min": 5
}
Sample message
PushSubject: Your service is ready

iAM Smart: your Immigration Department certificate is ready for download with digital signature. Expires Friday 18:00. Open the iAM Smart app to continue.

Compliance checklist
  • Integration with the iAM Smart gateway active
  • HKID masking (SHA-256 + salt) mandatory at envelope level
  • Citizen-preference cascade implemented
  • OTP P50 ≤ 4 seconds measured across all five mobile networks
The 4notify difference

4notify is the only A2P provider with native iAM Smart gateway integration, HKID-hash masking at the envelope layer and a service-notice template library aligned with the Electronic Transactions Ordinance (Cap. 553).

Frequently asked questions
Does 4notify ever see the citizen's HKID in plaintext?

No. The delivery envelope carries the HKID only as a salted hash; the issuing bureau retains the plaintext and resolves the hash locally.

Does this support Immigration Department or Transport Department appointments?

Yes — appointment reminders from any bureau integrated with iAM Smart travel through the same envelope, on the channel the citizen has chosen.

Published
4notify Department of Operations
2026-05-27 · ORD-HK-004

Start free

14 days, no card. English-speaking support on weekdays.

Other entries in this edition