No. 07Week of September 23, 2026This week’s briefing
Tradecraft

DispatchNews

Inside BSP Circular 1213, the Philippines’ OTP rule

From June 25, 2026, banks and e-money issuers in the Philippines can no longer rely on SMS or email one-time passcodes for high-risk transactions.

By Published 1 min read

For Compliance Product & payments

The short answer

Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.

If you read nothing else

  1. Applies to high-risk transactions, not every login.
  2. Covers both SMS and email one-time passcodes.
  3. Effective June 25, 2026.

What the circular changes

Banks and other institutions supervised by the Bangko Sentral ng Pilipinas can no longer use one-time passcodes sent by SMS or email to authenticate high-risk transactions. The rule took effect on June 25, 2026.[1][2]

Why SMS and email together

Regulators increasingly treat both channels as the same weakness. Codes sent by text or email can be phished, intercepted, or handed over by a customer who has been convinced they are talking to their bank.

Where it fits

The Philippines joins Singapore, Malaysia and the UAE in moving banks off SMS codes. Tradecraft tracks each of them in the SMS OTP regulation tracker.

Sources

  1. GMA News No more SMS, email OTPs for high-risk financial transactions starting June 25
  2. Fintech News Philippines BSP SMS OTP phase-out

Changelog

  • : Published.

Cite this

Tradecraft. “Inside BSP Circular 1213, the Philippines’ OTP rule.” Tradecraft, June 26, 2026. https://glide-tradecraft.pages.dev/dispatches/philippines-bsp-circular-1213/