In alignment with enhanced two-factor authentication (2FA) and cybersecurity mandates issued by the Hong Kong Monetary Authority (HKMA), China Construction Bank (Asia) Corporation Limited ("CCB (Asia)") has upgraded its Corporate Online Banking and Personal Online Banking security architecture. By default, CCB (Asia) no longer issues hardware Physical Security Tokens, transitioning to the built-in Mobile Security Token (Mobile Token) and Biometric Authentication (Face ID / Touch ID) integrated within its official mobile banking applications.
Compiled by the Banking Compliance Team at HC Business (86hc.com, Licensed TCSP No. TC006431), this step-by-step visual guide walks corporate directors, CFOs, and individual account holders through: ① Enabling the corporate CIF and Operator permissions on Desktop Online Banking; ② Activating the Mobile Security Token and Biometric Authentication on the mobile app; ③ Generating 6-digit One-Time Security Codes to authorize corporate wire transfers; and ④ Unbinding and migrating tokens when switching smartphones.
I. Why Physical Tokens Are Replaced & Corporate vs. Personal Banking Comparison
Traditional hardware security tokens suffer from cross-border courier delays, battery depletion every 3–5 years, and operational bottlenecks when company directors travel without carrying the physical device. CCB (Asia)'s upgraded Mobile Token embeds cryptographic keys directly within your smartphone, remaining permanently valid without branch renewal. Once the Mobile Token is activated, any previous physical security token is automatically deactivated.
Critical Distinction: Ensure You Download the Correct App! CCB (Asia) operates two separate mobile applications for Corporate vs. Personal accounts:
| Dimension | Corporate Online Banking (Company Account · Primary Focus) | Personal Online Banking (Retail Individual Account) |
|---|---|---|
| Official Mobile App | CCB (Asia) Corporate Mobile Banking App Chinese Title: 建行(亞洲)企業銀行流動應用程式 | CCB (HK & MO) Mobile App Chinese Title: 建行(港澳)手機客戶端 |
| Minimum OS Requirements | iPhone: iOS 15.0+; Android: 9.0+ *Strictly blocked on jailbroken (iOS) or rooted (Android) devices | iPhone: iOS 14.0+; Android: 8.0+ *Blocked on jailbroken or rooted devices |
| Pre-Activation Requirement | Primary User must first enable 2 switches on Desktop Web: ① Corporate-level (CIF) switch; ② Individual Operator permission | No desktop pre-approval required; tap "Activate Mobile Token" directly on the app home screen |
| Identity Verification | Customer No. + Operator ID + Password + 6-digit SMS OTP sent to registered mobile number | HKID Holder: HKID OCR scan + Facial Recognition; Non-HKID Holder: 6-digit SMS OTP |
| Security Cooling Period | Effective for high-risk transactions 6 hours after registration | Effective approx. 6 hours after activation (notified via email & SMS) |
| Device Transfer Protocol | Primary User must first click "Unbind" in Desktop Corporate E-Banking before registering on the new device | Log in on the new phone and tap "Activate Now" → "Reactivate" directly (6-hour cooling applies) |
II. Phase 1 (Desktop Corporate E-Banking): Enabling Corporate (CIF) & Operator Permissions
Before any user (including the Primary User) can log into the CCB (Asia) Corporate Mobile Banking App, the Primary User must log into Desktop Corporate Online Banking to enable both the corporate-level (CIF) master switch and individual operator access:
8 Steps to Enable Corporate Mobile Banking on Desktop Web
- Step 1: The Primary User logs into CCB (Asia) Corporate Online Banking (
https://intl.ccb.com/NCCB/V6/STYA/EN/login_asia.jsp) using Customer Number, Operator Name, and Password; - Step 2: Click "Proceed to Operation Page" on the top right;
- Step 3: Navigate to "Service Management" > "Mobile App Management" and click "Activate Corporate Mobile Banking Service" (this is the corporate-level CIF switch; if already enabled, jump to Step 6);
- Step 4: Enter the Primary User's authentication credentials and click "Submit";
- Step 5: Corporate-level (CIF) Mobile Banking Service is now activated;
- Step 6: Under the "Mobile App Operator Management" list on the same page, locate the operator (including the Primary User) who needs mobile access, and click "Activate" under the "App Status" column;
- Step 7: Enter the Primary User's authentication credentials and click "Submit";
- Step 8: Repeat Steps 6–8 for any additional operators requiring Mobile Token access.
III. Phase 2 (Corporate Mobile App): Registering the Mobile Security Token & Biometric Auth
Download and launch the CCB (Asia) Corporate Mobile Banking App on your smartphone:
- Step 1 (Log In): Log in using your Customer Number, Operator Name, and Password;
- Step 2 (3 Ways to Access Mobile Token Setup):
- Option 1 (Post-Login Prompt): Tap "Activate Now" directly on the pop-up Mobile Token prompt;
- Option 2 (Home Screen Icon): Tap "Mobile Token" on the home screen → tap "Manage Mobile Token Status" → toggle the switch ON;
- Option 3 (Side Menu Security Center): Open the top-left side menu → tap "Security Center" > "Mobile Token Setting" > "Manage Mobile Token Status" → toggle the switch ON;
- Step 3 (Accept T&Cs): Read and accept the Terms and Conditions and tap "Continue";
- Step 4 (SMS OTP Verification): Enter the 6-digit One-Time Password sent via SMS to your registered mobile number and tap "Submit";
- Step 5 (Set 6-Digit PIN): Enter your custom 6-digit Mobile Token Password (PIN) twice and tap "Submit";
- Step 6 (6-Hour Activation Window & Biometric Setup): Your Mobile Token is now registered and will become effective for high-risk transactions after 6 hours. Tap "Activate Biometric Authentication Service" on the completion screen to bind Face ID or Touch ID.
IV. Phase 3 (Transaction Verification): Generating a 6-Digit One-Time Security Code
When initiating transfers or high-risk instructions on Desktop Corporate Online Banking, you can generate a 6-digit One-Time Security Code on your phone without logging into the app:
- Step 1: On the Corporate Mobile App home screen (without logging in), tap "Mobile Token";
- Step 2: Tap "One-Time Security Code";
- Step 3 & 4: Authenticate using Biometric Authentication (Face ID / Touch ID) or enter your 6-digit Mobile Token Password;
- Step 5: A 6-digit One-Time Security Code (e.g.,
226336) is generated on screen; - Step 6: Enter the 6-digit code and your password into Desktop Corporate Online Banking and click "Submit" to complete the transaction.
V. Phase 4 (Switching Smartphones): How to Unbind & Transfer Mobile Token to a New Device
If an operator replaces their smartphone, the Primary User must first unbind the Mobile Token for that user (including the Primary User themselves) in Desktop Corporate Online Banking before activating it on the new handset:
- Critical Rule 1: If the Primary User wishes to change phones, please unbind the service BEFORE discarding or wiping the old device. Otherwise, self-service transfer will be impossible and you must contact your Relationship Manager to submit a paper "Corporate Online Banking Service Amendment Form";
- Critical Rule 2: In Desktop Corporate Online Banking, go to "Service Management" > "Mobile App Management", locate the user, click "Unbind" under "Mobile Token Status", and submit with Primary User verification;
- Critical Rule 3: If the new phone was previously bound to another user's Mobile Token, uninstall and reinstall the CCB (Asia) Corporate Mobile Banking App before registering.
VI. Appendix: CCB (Asia) Personal Online Banking Mobile Token & QR Code Login
For individual account holders using the CCB (HK & MO) Mobile App, tap "Activate Mobile Token" on the app home screen, log in with your Personal Online Banking username and password, verify via HKID scan + Facial Recognition (or 6-digit SMS OTP for non-HKID holders), and set a 6-digit Mobile Token PIN. Once effective after 6 hours, you can also tap the top-right QR Scanner icon to log into Desktop Personal Online Banking via instant QR Code scan:
