Checklist
NIST 800-63B-4 restricted-authenticator file
The four conditions for keeping SMS or voice codes, and the evidence to keep for each.
Desk 05For Compliance
The compliance desk
Every rule that restricts SMS codes, the dates that matter, and the evidence regulators and auditors expect.
For compliance and regulatory teams.
What matters now
The Philippines’ BSP Circular 1213 bars SMS and email OTP for high-risk transactions from June 25, 2026.
Dispatch: Inside BSP Circular 1213, the Philippines’ OTP ruleIndia’s RBI Authentication Directions 2025 took effect on April 1, 2026.
Regulations: SMS OTP regulations trackerThe EU reached a provisional deal on the PSR and PSD3 fraud package on November 27, 2025; it is not yet in force.
Regulations: SMS OTP regulations tracker
Your reading path
Start at the top. Each step builds on the last.
Start here · Regulations
SMS OTP regulations tracker
Start here: every market, with dates and primary sources.
Then · Field guide
Preparing for NIST SP 800-63-4: a working plan for banks and agencies
The four conditions for keeping SMS codes, with evidence.
Then · Explainer
The FCC’s SIM-swap rules: what carriers now have to do
What US carriers must do, and what the order doesn’t cover.
Then · Dispatch
Inside BSP Circular 1213, the Philippines’ OTP rule
The most recent market to restrict SMS and email OTP.
Then · Dispatch
What the UK’s APP fraud reimbursement rules changed for fraud teams
How reimbursement rules changed fraud incentives.
Checklists for this desk
Rules that apply
Markets most relevant to this desk. Every row links to its primary source.
| Market | Regulator | Measure | Timing | Status | Primary source |
|---|---|---|---|---|---|
| UAE | Central Bank of the UAE | SMS and email OTP phase-out | Jul 2025 – Mar 2026 | Complete | UAE banks cancel OTPs, switching to in-app verification (The Paypers) |
| Philippines | Bangko Sentral ng Pilipinas | Circular 1213: no SMS or email OTP for high-risk transactions | From Jun 25, 2026 | In force | No more SMS, email OTPs for high-risk financial transactions (GMA News) |
| India | Reserve Bank of India | Authentication Directions 2025 | From Apr 1, 2026 | In force | RBI mandates 2FA and new security rules for digital payments (Regulation Asia) |
| Singapore | MAS and the Association of Banks in Singapore | OTP login phase-out for customers with digital tokens | From Jul 2024 | In force | Banks in Singapore to strengthen resilience against phishing scams (MAS) |
| Malaysia | Bank Negara Malaysia | Banks directed off SMS OTP | 2022 – 2024 | In force | Malaysian banks stop using SMS for two-factor authentication (Commsrisk) |
| European Union | Council and Parliament | PSR / PSD3 fraud and SCA package | Deal Nov 27, 2025 | Pending | Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU) |
| United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | Guidance | SP 800-63B-4: Authentication and Authenticator Management (NIST) |
Quick answers
How should a bank move customers off SMS one-time passcodes?
Inventory every flow that sends a code, write the risk assessment NIST SP 800-63B-4 asks for, fix account recovery and new-payee setup first, then move customers to phishing-resistant or device-bound methods such as passkeys and in-app approval. Keep SMS only as a restricted fallback, with a dated plan to remove it.
What do organizations need to do to prepare for NIST SP 800-63-4?
Map every authenticator you use to NIST’s assurance levels, identify the restricted ones (SMS and voice codes), and for each restricted authenticator document a risk assessment, user notice, a non-restricted alternative and a migration plan. Add a phishing-resistant option such as passkeys, which Revision 4 accepts at AAL2.
Is SMS OTP still allowed under NIST SP 800-63-4?
NIST SP 800-63-4 does not ban SMS one-time passcodes. It classifies SMS and voice codes as “restricted” authenticators: still allowed, but only if the organization assesses the risk, tells users about it, offers at least one non-restricted alternative, and keeps a plan to migrate away.
Buyer’s guides and vendor briefs
Approaches, evaluation criteria and pre-pilot questions. No rankings; owner interest disclosed.
Buyer’s guide
SMS OTP alternatives: a buyer’s guide
There is no single best alternative for every flow. Passkeys are the most widely standardized phishing-resistant option and are accepted by NIST at AAL2. In-app approval on a registered device is what UAE and Singapore banks moved customers to. Carrier network checks are useful risk signals, and SIM-based cryptographic methods are emerging. Most organizations combine two or more.
Owner-affiliated vendor brief
Evaluating Glide Identity: what each desk should ask before a pilot
The Compliance question set, then the pilot plan and who owns each step. No scores or recommendations.