Checklist
NIST 800-63B-4 restricted-authenticator file
The four conditions for keeping SMS or voice codes, and the evidence to keep for each.
Desk 01For CISOs
The CISO desk
The decisions, deadlines and board questions behind moving customers off phishable authentication.
For CISOs and security leaders.
What matters now
NIST SP 800-63-4 keeps SMS and voice codes as “restricted” authenticators: allowed, but only with a risk assessment, user notice, an alternative and a migration plan.
Field guide: Preparing for NIST SP 800-63-4: a working plan for banks and agenciesThe UAE completed a regulator-ordered phase-out of SMS and email OTP on March 31, 2026, about nine months after it began.
Dispatch: The UAE’s SMS OTP phase-out is done. What US banks can take from itSynced passkeys are accepted at AAL2, which gives US organizations a standards-backed phishing-resistant option.
Explainer: Are synced passkeys phishing-resistant?
Your reading path
Start at the top. Each step builds on the last.
Start here · Field guide
Moving a bank off SMS OTP: the field guide
The whole program on one page: flows, replacements, owners.
Then · Explainer
SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks
What “restricted” means, in plain language.
Then · Dispatch
The UAE’s SMS OTP phase-out is done. What US banks can take from it
A finished, regulator-mandated migration to learn from.
Then · Buyer’s guide
SMS OTP alternatives: a buyer’s guide
How to evaluate the options before procurement.
Then · Field guide
Preparing for NIST SP 800-63-4: a working plan for banks and agencies
The evidence pack for examiners and auditors.
Checklists for this desk
Checklist
SMS OTP flow inventory
Every place your organization still sends a code, ranked by where fraud cashes out.
Rules that apply
Markets most relevant to this desk. Every row links to its primary source.
| Market | Regulator | Measure | Timing | Status | Primary source |
|---|---|---|---|---|---|
| UAE | Central Bank of the UAE | SMS and email OTP phase-out | Jul 2025 – Mar 2026 | Complete | UAE banks cancel OTPs, switching to in-app verification (The Paypers) |
| Singapore | MAS and the Association of Banks in Singapore | OTP login phase-out for customers with digital tokens | From Jul 2024 | In force | Banks in Singapore to strengthen resilience against phishing scams (MAS) |
| European Union | Council and Parliament | PSR / PSD3 fraud and SCA package | Deal Nov 27, 2025 | Pending | Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU) |
| United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | Guidance | SP 800-63B-4: Authentication and Authenticator Management (NIST) |
Quick answers
How should a bank move customers off SMS one-time passcodes?
Inventory every flow that sends a code, write the risk assessment NIST SP 800-63B-4 asks for, fix account recovery and new-payee setup first, then move customers to phishing-resistant or device-bound methods such as passkeys and in-app approval. Keep SMS only as a restricted fallback, with a dated plan to remove it.
What do organizations need to do to prepare for NIST SP 800-63-4?
Map every authenticator you use to NIST’s assurance levels, identify the restricted ones (SMS and voice codes), and for each restricted authenticator document a risk assessment, user notice, a non-restricted alternative and a migration plan. Add a phishing-resistant option such as passkeys, which Revision 4 accepts at AAL2.
What counts as phishing-resistant MFA?
Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.
What is the best alternative to SMS OTP?
There is no single best alternative for every flow. Passkeys are the most widely standardized phishing-resistant option and are accepted by NIST at AAL2. In-app approval on a registered device is what UAE and Singapore banks moved customers to. Carrier network checks are useful risk signals, and SIM-based cryptographic methods are emerging. Most organizations combine two or more.
Buyer’s guides and vendor briefs
Approaches, evaluation criteria and pre-pilot questions. No rankings; owner interest disclosed.
Buyer’s guide
SMS OTP alternatives: a buyer’s guide
There is no single best alternative for every flow. Passkeys are the most widely standardized phishing-resistant option and are accepted by NIST at AAL2. In-app approval on a registered device is what UAE and Singapore banks moved customers to. Carrier network checks are useful risk signals, and SIM-based cryptographic methods are emerging. Most organizations combine two or more.
Buyer’s guide
Phishing-resistant MFA: a buyer’s guide
Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.
Owner-affiliated vendor brief
Evaluating Glide Identity: what each desk should ask before a pilot
The CISOs question set, then the pilot plan and who owns each step. No scores or recommendations.