RegulationsTracker
SMS OTP: who is phasing it out
Every regulator that has restricted or phased out SMS one-time passcodes for banking, with dates, status and the primary source for each.
The short answer
Which countries are moving banks off SMS OTP?
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in force April 2026, open the door to alternatives.
| Market | Regulator | Measure | Timing | Status | Primary source |
|---|---|---|---|---|---|
| UAE | Central Bank of the UAE | SMS and email OTP phase-out | Jul 2025 – Mar 2026 | Complete | UAE banks cancel OTPs, switching to in-app verification (The Paypers) |
| Philippines | Bangko Sentral ng Pilipinas | Circular 1213: no SMS or email OTP for high-risk transactions | From Jun 25, 2026 | In force | No more SMS, email OTPs for high-risk financial transactions (GMA News) |
| India | Reserve Bank of India | Authentication Directions 2025 | From Apr 1, 2026 | In force | RBI mandates 2FA and new security rules for digital payments (Regulation Asia) |
| Singapore | MAS and the Association of Banks in Singapore | OTP login phase-out for customers with digital tokens | From Jul 2024 | In force | Banks in Singapore to strengthen resilience against phishing scams (MAS) |
| Malaysia | Bank Negara Malaysia | Banks directed off SMS OTP | 2022 – 2024 | In force | Malaysian banks stop using SMS for two-factor authentication (Commsrisk) |
| European Union | Council and Parliament | PSR / PSD3 fraud and SCA package | Deal Nov 27, 2025 | Pending | Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU) |
| United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | Guidance | SP 800-63B-4: Authentication and Authenticator Management (NIST) |
Market by market
UAE Complete
Central Bank of the UAE · Jul 2025 – Mar 2026. SMS and email OTP phase-out. Our coverage: The UAE’s SMS OTP phase-out is done. What US banks can take from it
Primary source: UAE banks cancel OTPs, switching to in-app verification (The Paypers)
Philippines In force
Bangko Sentral ng Pilipinas · From Jun 25, 2026. Circular 1213: no SMS or email OTP for high-risk transactions. Our coverage: Inside BSP Circular 1213, the Philippines’ OTP rule
Primary source: No more SMS, email OTPs for high-risk financial transactions (GMA News)
India In force
Reserve Bank of India · From Apr 1, 2026. Authentication Directions 2025.
Primary source: RBI mandates 2FA and new security rules for digital payments (Regulation Asia)
Singapore In force
MAS and the Association of Banks in Singapore · From Jul 2024. OTP login phase-out for customers with digital tokens. Our coverage: Singapore banks to phase out OTPs for customers with digital tokens
Primary source: Banks in Singapore to strengthen resilience against phishing scams (MAS)
Malaysia In force
Bank Negara Malaysia · 2022 – 2024. Banks directed off SMS OTP.
Primary source: Malaysian banks stop using SMS for two-factor authentication (Commsrisk)
European Union Pending
Council and Parliament · Deal Nov 27, 2025. PSR / PSD3 fraud and SCA package.
Primary source: Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU)
United States Guidance
NIST · Final 2025. SP 800-63B-4: SMS OTP is a "restricted" authenticator. Our coverage: SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks
Primary source: SP 800-63B-4: Authentication and Authenticator Management (NIST)
Questions readers ask
Which countries are moving banks off SMS OTP?
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in force April 2026, open the door to alternatives.
Has the United States banned SMS OTP?
No. NIST SP 800-63B-4 classifies SMS codes as a restricted authenticator: allowed, with conditions. No US banking regulator has ordered a phase-out.
Has the EU banned SMS OTP?
Not as of the last verification. Council and Parliament reached a provisional deal on the PSR and PSD3 fraud and strong customer authentication package on November 27, 2025; it is listed as pending.
Methodology
Tradecraft lists a jurisdiction when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for authenticating financial transactions or logins. Status is checked against the primary document or regulator statement. Dates are effective dates unless noted.
Spotted a missing market or an outdated status? Email [CORRECTIONS EMAIL] with the primary source.
Who uses this tracker
Desks CISOs Fraud & risk IAM engineers Security engineers Compliance Product & payments
Cite this
Tradecraft. “SMS OTP: who is phasing it out.” Tradecraft, September 24, 2026. https://glide-tradecraft.pages.dev/regulations/