Question Regulation
Did the UAE ban SMS OTP for banking?
Yes, in effect. The Central Bank of the UAE directed licensed financial institutions to phase out one-time passcodes sent by SMS and email, starting in July 2025 with a deadline of March 31, 2026. Banks moved customers to verification inside their own mobile apps on devices the bank had registered.
Did the UAE ban SMS OTP for banking? Yes, in effect. The Central Bank of the UAE directed licensed financial institutions to phase out one-time passcodes sent by SMS and email, starting in July 2025 with a deadline of March 31, 2026. Banks moved customers to verification inside their own mobile apps on devices the bank had registered. Source: https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/ (Cleartext, verified 2026-09-23)
What the UAE required #
The Central Bank of the UAE told licensed financial institutions to stop relying on one-time passcodes sent by SMS or email to authenticate customers. The phase-out began in July 2025, with a deadline of March 31, 2026.[1][2]
What replaced the codes #
Banks moved customers to verification inside their own mobile apps: the customer confirms a login or payment in the app on a device the bank has already registered, instead of typing a code from a text message.[1]
Why it matters outside the Gulf #
Most regulators describe outcomes and leave the method to banks. Here the regulator named the method to retire and set a date.[3]
- A defined deadline forced the migration to the top of bank roadmaps.
- Email went with SMS, because both can be phished or intercepted.
- The replacement was already in customers’ hands: moving approval into the bank’s own app avoided a new device or login habit.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
The UAE is a finished case study: a named method, a fixed date and a replacement customers already had. The timeline was months, not years.
Fintechs & payment firms
If you serve UAE customers through a partner bank, expect the partner to require app-based or other non-code verification for your flows too.
Developers & identity teams
In-app approval needs a device-registration step you trust. The strength of the whole scheme depends on how that registration is protected.
Follow-up questions #
- Did the UAE rule include email codes?
- Yes. SMS and email one-time passcodes were phased out together.
People also ask #
Which countries are banning SMS OTP for banking?
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.
Full answerIs email OTP safer than SMS OTP?
Not meaningfully. Email codes avoid SIM swaps but can be phished, relayed by OTP bots and stolen through a compromised mailbox, just like SMS codes. Regulators treat them as the same class of risk: the UAE and Philippine rules retire SMS and email codes together.
Full answerHas any US regulator banned SMS OTP?
No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “Did the UAE ban SMS OTP for banking?” Last verified 2026-09-23 (rev. 1). https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/
Markdown link
[Did the UAE ban SMS OTP for banking?](https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/) (Cleartext, verified 2026-09-23)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |