In addition, for regular users, consider providing free or subsidised hardware keys (yubikey, Google titan).

While many will raise concern with the UX of having to carry around hardware, in the fintech world I think it's a good tradeoff and raises the bar for the industry (I always shudder when I see "we use industry-standard protection"). :)