2FA is a principle-based requirement for authentication. An internet broker is free to select 2FA (including in-house developed) solutions which best align with its security infrastructure and are suitable for achieving its risk mitigation objectives.

In particular, an internet broker should assess and evaluate, with the assistance of solution providers or technical consultants where needed, the features, limitations and vulnerabilities of each 2FA solution being considered, and put in place compensating controls as appropriate. For example, an internet broker that deploys a short message service (SMS) for transmitting one-time passwords (OTP) should advise its clients against forwarding OTPs received from their mobile devices to other devices.

Given that 2FA solutions may become obsolete and ineffective over time due to technological advances, an internet broker should make reasonable efforts to keep abreast with the latest development and enhance its 2FA solution or implement compensating controls as needed.

No, dual passwords only constitute a single factor in the authentication process, i.e., “what a client knows”. Hence, it does not fulfil the 2FA requirement.

An internet broker may monitor (i) logging into multiple client accounts from the same IP address; and (ii) change of IP address for accessing the same client account from one country to another country in a short period of time.

Our requirement is for internet brokers to notify clients promptly of each system login. But we accept that an internet broker could allow clients to opt-out from notifications of each system login provided that: 

• the internet broker has the capability to identify irregular logins and promptly notify clients of irregular logins;
• the internet broker has provided adequate risk disclosures to clients who have acknowledged that they understand the risks involved in opting-out from notifications of each system login; and
• the clients have not opted out from trade execution notifications.

Yes, DMZ is considered as part of an internal network for the said purpose.

Internet brokers would generally be expected to remind clients who have not changed their passwords for more than 90 calendar days.

Internet brokers may, among other things, implement the following controls:

• account lockout;
• exponential back-off between successive failed login attempts; and
• brute-force attacks detection with appropriate responses.

The above list is not exhaustive and internet brokers can choose to implement any controls they deem appropriate.

Yes, the term “off-line medium”^[1] refers to tape or any other kind of medium, such as remote backup server, which is securely segregated from the production system.