{"id":3551,"date":"2026-06-05T18:02:19","date_gmt":"2026-06-05T18:02:19","guid":{"rendered":"https:\/\/idlayr.com\/?p=3551"},"modified":"2026-06-05T18:36:10","modified_gmt":"2026-06-05T18:36:10","slug":"regulators-banning-sms-otp","status":"publish","type":"post","link":"https:\/\/idlayr.com\/it\/blog\/regulators-banning-sms-otp\/","title":{"rendered":"The Global SMS OTP Ban: A Regulator-by-Regulator Guide"},"content":{"rendered":"

Regulators Are Banning SMS OTP \u2014 What You Need to Know<\/h1>\n

 <\/p>\n

A Regulator-by-Regulator Guide<\/b><\/p>\n

 <\/p>\n

How the world’s financial regulators are forcing SMS one-time passwords out of banking \u2014 what each one has actually mandated, the deadlines that matter, and where to find the primary-source documents.<\/span><\/i><\/p>\n

 <\/p>\n

For two decades, the six-digit code texted to your phone was the default second factor in digital banking. That era is ending. SMS one-time passwords (OTPs) travel over a channel the bank does not control, can be intercepted through SIM swap, SS7 exploits, phishing and smishing, and increasingly fail against AI-assisted, adversary-in-the-middle attacks. Regulators have noticed \u2014 and over the last three years they have moved from gentle encouragement to hard deadlines and liability shifts.<\/span><\/p>\n

 <\/p>\n

This is not a single-market story. <\/span>More than 25 regulators worldwide<\/b> have now moved toward phishing-resistant authentication. Below is a market-by-market briefing on the regulators that matter most, what they have actually required (the detail matters \u2014 “banned” and “expanded the options” are very different things), and links to the primary instruments so you can verify each claim yourself.<\/span><\/p>\n

 <\/p>\n

At a glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Market<\/th>\nRegulator<\/th>\nInstrument<\/th>\nKey deadline<\/th>\nIs SMS OTP “banned”?<\/th>\n<\/tr>\n<\/thead>\n
UAE<\/span><\/td>\nCBUAE<\/span><\/td>\nJune 2025 directive<\/span><\/td>\n31 Mar 2026<\/span><\/td>\nYes \u2014 full phase-out for all FIs<\/span><\/td>\n<\/tr>\n
Singapore<\/span><\/td>\nMAS \/ ABS<\/span><\/td>\nJuly 2024 announcement<\/span><\/td>\n~Oct 2024<\/span><\/td>\nRemoved for bank logins (digital-token users)<\/span><\/td>\n<\/tr>\n
Malaysia<\/span><\/td>\nBank Negara Malaysia<\/span><\/td>\nRMiT policy (Nov 2025); 2022 directive<\/span><\/td>\nIn force<\/span><\/td>\nNon-compliant as a standalone 2nd factor<\/span><\/td>\n<\/tr>\n
Philippines<\/span><\/td>\nBSP<\/span><\/td>\nCircular 1213 (AFASA)<\/span><\/td>\n30 Jun 2026<\/span><\/td>\nYes, for high-risk transactions<\/span><\/td>\n<\/tr>\n
India<\/span><\/td>\nRBI<\/span><\/td>\nAuthentication Directions, 2025<\/span><\/td>\n1 Apr 2026<\/span><\/td>\nNo \u2014 2FA mandated, OTP still permitted<\/span><\/td>\n<\/tr>\n
UE<\/span><\/td>\nEBA \/ PSD2 \u2192 PSD3<\/span><\/td>\nRTS on SCA; PSD3\/PSR<\/span><\/td>\n~2027\u20132028 (PSD3)<\/span><\/td>\nNo \u2014 restricted, not banned<\/span><\/td>\n<\/tr>\n
United States<\/span><\/td>\nNIST (+ FINRA, USPTO, FCC)<\/span><\/td>\nSP 800-63B-4<\/span><\/td>\nJuly 2025<\/span><\/td>\nNo \u2014 formally “restricted”<\/span><\/td>\n<\/tr>\n
Vietnam<\/span><\/td>\nState Bank of Vietnam<\/span><\/td>\nDecision 2345\/Q\u0110-NHNN<\/span><\/td>\n1 Jul 2024<\/span><\/td>\nBiometric required above thresholds<\/span><\/td>\n<\/tr>\n
Saudi Arabia<\/span><\/td>\nSAMA<\/span><\/td>\nCyber Security Framework<\/span><\/td>\nOngoing<\/span><\/td>\nMoving beyond OTP to FIDO2 \/ device-bound<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

United Arab Emirates \u2014 the hardest line<\/h2>\n

The Central Bank of the UAE (CBUAE) issued a directive in June 2025 requiring all licensed financial institutions \u2014 banks, finance companies, exchange houses, insurers and payment service providers \u2014 to eliminate SMS- and email-based OTPs by 31 March 2026, replacing them with app-based and biometric authentication. Critically, the directive also shifts liability: institutions are now responsible for fraud linked to OTP authentication.<\/span><\/p>\n

 <\/p>\n

The transition has been visible to consumers. Banks began moving customers to in-app approval from July 2025, and several of the largest banks switched off SMS OTP for online card payments from 6 January 2026. This is the clearest “ban” of any major market.<\/span><\/p>\n

 <\/p>\n

Primary source: Central Bank of the UAE \u2014 <\/span><\/i>centralbank.ae<\/span><\/i><\/a>. Reporting detail: <\/span><\/i>Gulf News<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

 <\/p>\n

Singapore \u2014 OTP removed from the login<\/h2>\n

On 9 July 2024, the Monetary Authority of Singapore (MAS) and the Association of Banks in Singapore (ABS) announced that major retail banks would progressively stop using OTPs for bank-account login for customers who have activated a digital token. The digital token authenticates the login directly, removing the code that scammers phish for. Note the scope: this targets the login step for digital-token users \u2014 decisive, but narrower than a blanket statutory ban.<\/span><\/p>\n

 <\/p>\n

Primary source: MAS media release \u2014 <\/span><\/i>Banks in Singapore to Strengthen Resilience Against Phishing Scams<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

 <\/p>\n

Malaysia \u2014 among the earliest movers<\/h2>\n

Bank Negara Malaysia (BNM) was one of the first central banks anywhere to publicly direct banks off SMS OTP, instructing financial institutions in September 2022 to migrate to more secure authentication for high-risk activities \u2014 account opening, fund transfers, payments and changes to account settings. That direction hardened with BNM’s updated Risk Management in Technology (RMiT) policy, issued 28 November 2025, under which SMS OTP is no longer compliant as a standalone second factor, device binding defaults to one device per account, and MFA must be interception-resistant.<\/span><\/p>\n

 <\/p>\n

Primary source: Bank Negara Malaysia \u2014 Policy Document on Risk Management in Technology (RMiT) \u2014 <\/span><\/i>bnm.gov.my<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

 <\/p>\n

Philippines \u2014 a firm 2026 deadline<\/h2>\n

The Bangko Sentral ng Pilipinas (BSP) issued Circular No. 1213 in June 2025 to implement Section 6 of the Anti-Financial Account Scamming Act (AFASA). It requires supervised institutions to transition away from interceptable authentication mechanisms \u2014 explicitly SMS and email OTPs \u2014 for high-risk transactions and critical account changes by 30 June 2026. OTPs retain a single permitted use: confirming ownership of a registered mobile number, never authorising a transaction. In January 2026, the BSP publicly confirmed it is not extending the deadline, and under AFASA, institutions without adequate controls bear liability for customer losses.<\/span><\/p>\n

 <\/p>\n

Primary source: Bangko Sentral ng Pilipinas \u2014 Circular No. 1213 \u2014 <\/span><\/i>bsp.gov.ph<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

 <\/p>\n

India \u2014 mandate 2FA, but OTP stays<\/h2>\n

India is the market most often mischaracterised. On 25 September 2025, the Reserve Bank of India issued the Reserve Bank of India (Authentication Mechanisms for Digital Payment Transactions) Directions, 2025, to be complied with by 1 April 2026 (cross-border card-not-present transactions by 1 October 2026). The Directions require two-factor authentication for all domestic digital payments, with at least one factor dynamically generated per transaction, and they open the door to device-bound passkeys, biometrics and tokens.<\/span><\/p>\n

 <\/p>\n

What the RBI did <\/span>non<\/span><\/i> do is ban SMS OTP. The framework states plainly that it “does not call for discontinuation of SMS based OTP” \u2014 it expands the menu of acceptable factors rather than removing the old one. The direction of travel is clear; the instrument is principle-based, not prohibitive.<\/span><\/p>\n

 <\/p>\n

Primary source: RBI Press Release 2025-2026\/1165 \u2014 <\/span><\/i>rbidocs.rbi.org.in<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

 <\/p>\n

European Union \u2014 restricted, and tightening<\/h2>\n

Under PSD2’s Strong Customer Authentication (SCA) regime and the EBA’s Regulatory Technical Standards, SMS OTP is not outright banned: it can serve as a possession element where it meets requirements such as dynamic linking. In practice, regulators and the market increasingly treat plain SMS OTP as insufficient. The proposed PSD3 and the Payment Services Regulation (PSR) will tighten SCA further, reduce exemption thresholds and give explicit weight to phishing-resistant methods, with implementation generally expected around 2027\u20132028.<\/span><\/p>\n

 <\/p>\n

Primary sources: European Banking Authority \u2014 RTS on SCA \u2014 <\/span><\/i>eba.europa.eu<\/span><\/i><\/a>; European Commission PSD3\/PSR proposals \u2014 <\/span><\/i>finance.ec.europa.eu<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

 <\/p>\n

United States \u2014 “restricted,” not retired<\/h2>\n

There is no single US banking mandate, but the centre of gravity has shifted. In July 2025, NIST published SP 800-63B-4, which for the first time formally classifies SMS\/PSTN OTP as a “restricted” authenticator \u2014 still permitted, but only with conditions and risk mitigations, and with a clear expectation that organisations at AAL2 migrate away. Around it, federal practice is moving: the US Patent and Trademark Office discontinued SMS authentication on 1 May 2025, FINRA has been phasing SMS OTP out of its own systems, and the FCC has tightened SIM-swap and port-out protections.<\/span><\/p>\n

 <\/p>\n

Primary source: NIST SP 800-63B-4, Digital Identity Guidelines \u2014 <\/span><\/i>pages.nist.gov\/800-63-4<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

 <\/p>\n

Vietnam \u2014 biometrics on top, by value<\/h2>\n

The State Bank of Vietnam issued Decision No. 2345\/Q\u0110-NHNN (18 December 2023), in force from 1 July 2024, requiring biometric authentication for individual transfers at or above 10 million VND (or above 20 million VND cumulative per day) and for first-time or new-device transactions, verified against the national population database. The SBV has reported a roughly 50% drop in fraudulent transactions since rollout. SMS OTP persists for lower-value flows, but the high-risk tier now demands biometrics.<\/span><\/p>\n

 <\/p>\n

Primary source: State Bank of Vietnam \u2014 <\/span><\/i>sbv.gov.vn<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

 <\/p>\n

Saudi Arabia \u2014 the framework approach<\/h2>\n

The Saudi Central Bank (SAMA) has advanced authentication expectations through its Cyber Security Framework, increasingly steering institutions beyond OTP toward FIDO2 and device-bound credentials. Saudi Arabia is frequently cited as a model of specificity and measurable outcomes in authentication regulation.<\/span><\/p>\n

 <\/p>\n

Further reading: Ideem, <\/span><\/i>SAMA Authentication Requirements<\/span><\/i><\/a>; primary framework: SAMA \u2014 <\/span><\/i>sama.gov.sa<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

 <\/p>\n

The common thread<\/h2>\n

Read across these markets and a single pattern emerges. The “ban” markets (UAE, Philippines), the “remove it from the risky flows” markets (Singapore, Malaysia, Vietnam), and the “raise the bar without banning” markets (India, EU, US) are all doing the same thing for the same reason: <\/span>moving the proof of identity off a shared secret sent over a channel the bank doesn’t control, and onto something cryptographic, device-bound, and hard to intercept.<\/b> No major regulator anywhere is moving back toward SMS OTP.<\/span><\/p>\n

 <\/p>\n

For any institution operating across borders, the practical conclusion is that an SMS-OTP exit is no longer a question of if but of which deadline hits first. The replacement needs to satisfy a possession factor that regulators recognise, survive SIM swap and porting, and work without adding checkout friction \u2014 which is precisely where network-verified, device-bound mobile trust comes in.<\/span><\/p>\n

 <\/p>\n

Primary sources<\/h2>\n