{
 "slug": "sms-otp-regulation",
 "title": "SMS OTP: who is phasing it out",
 "section": "policy",
 "topic": "apac-gulf",
 "description": "Every regulator that has restricted or phased out SMS one-time passcodes for banking, with dates, status and the primary source for each.",
 "question": "Which countries are moving banks off SMS OTP?",
 "shortAnswer": "Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in force April 2026, open the door to alternatives.",
 "verified": "2026-09-24",
 "version": "1.0",
 "methodology": "Tradecraft lists a jurisdiction when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for authenticating financial transactions or logins. Status is checked against the primary document or regulator statement. Dates are effective dates unless noted.",
 "columns": [
  "market",
  "regulator",
  "measure",
  "timing",
  "status"
 ],
 "rows": [
  {
   "market": "UAE",
   "regulator": "Central Bank of the UAE",
   "measure": "SMS and email OTP phase-out",
   "timing": "Jul 2025 – Mar 2026",
   "status": "Complete",
   "source": {
    "title": "UAE banks cancel OTPs, switching to in-app verification (The Paypers)",
    "url": "https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification"
   }
  },
  {
   "market": "Philippines",
   "regulator": "Bangko Sentral ng Pilipinas",
   "measure": "Circular 1213: no SMS or email OTP for high-risk transactions",
   "timing": "From Jun 25, 2026",
   "status": "In force",
   "source": {
    "title": "No more SMS, email OTPs for high-risk financial transactions (GMA News)",
    "url": "https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/"
   }
  },
  {
   "market": "India",
   "regulator": "Reserve Bank of India",
   "measure": "Authentication Directions 2025",
   "timing": "From Apr 1, 2026",
   "status": "In force",
   "source": {
    "title": "RBI mandates 2FA and new security rules for digital payments (Regulation Asia)",
    "url": "https://www.regulationasia.com/articles/rbi-mandates-2fa-and-new-security-rules-for-digital-payments"
   }
  },
  {
   "market": "Singapore",
   "regulator": "MAS and the Association of Banks in Singapore",
   "measure": "OTP login phase-out for customers with digital tokens",
   "timing": "From Jul 2024",
   "status": "In force",
   "source": {
    "title": "Banks in Singapore to strengthen resilience against phishing scams (MAS)",
    "url": "https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams"
   }
  },
  {
   "market": "Malaysia",
   "regulator": "Bank Negara Malaysia",
   "measure": "Banks directed off SMS OTP",
   "timing": "2022 – 2024",
   "status": "In force",
   "source": {
    "title": "Malaysian banks stop using SMS for two-factor authentication (Commsrisk)",
    "url": "https://commsrisk.com/malaysian-banks-stop-using-sms-for-two-factor-authentication/"
   }
  },
  {
   "market": "European Union",
   "regulator": "Council and Parliament",
   "measure": "PSR / PSD3 fraud and SCA package",
   "timing": "Deal Nov 27, 2025",
   "status": "Pending",
   "source": {
    "title": "Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU)",
    "url": "https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/"
   }
  },
  {
   "market": "United States",
   "regulator": "NIST",
   "measure": "SP 800-63B-4: SMS OTP is a \"restricted\" authenticator",
   "timing": "Final 2025",
   "status": "Guidance",
   "source": {
    "title": "SP 800-63B-4: Authentication and Authenticator Management (NIST)",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
   }
  }
 ]
}