# Did the UAE ban SMS OTP for banking?

> **Short answer:** Yes, in effect. The Central Bank of the UAE directed licensed financial institutions to phase out one-time passcodes sent by SMS and email, starting in July 2025 with a deadline of March 31, 2026. Banks moved customers to verification inside their own mobile apps on devices the bank had registered.

- URL: https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/
- Last verified: 2026-09-23 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## What the UAE required

The Central Bank of the UAE told licensed financial institutions to stop relying on one-time passcodes sent by SMS or email to authenticate customers. The phase-out began in July 2025, with a deadline of March 31, 2026.[^1][^2]

## What replaced the codes

Banks moved customers to verification inside their own mobile apps: the customer confirms a login or payment in the app on a device the bank has already registered, instead of typing a code from a text message.[^1]

## Why it matters outside the Gulf

Most regulators describe outcomes and leave the method to banks. Here the regulator named the method to retire and set a date.[^3]

- **A defined deadline** forced the migration to the top of bank roadmaps.
- **Email went with SMS,** because both can be phished or intercepted.
- **The replacement was already in customers’ hands:** moving approval into the bank’s own app avoided a new device or login habit.

## What this means for you

### Banks & credit unions

The UAE is a finished case study: a named method, a fixed date and a replacement customers already had. The timeline was months, not years.

### Fintechs & payment firms

If you serve UAE customers through a partner bank, expect the partner to require app-based or other non-code verification for your flows too.

### Developers & identity teams

In-app approval needs a device-registration step you trust. The strength of the whole scheme depends on how that registration is protected.

## Follow-up questions

**Did the UAE rule include email codes?**

Yes. SMS and email one-time passcodes were phased out together.


## Sources

[^1]: UAE banks cancel OTPs, switching to in-app verification. The Paypers. https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification (secondary)
[^2]: UAE central bank tells FIs to drop SMS OTP authentication. BankInfoSecurity. https://www.bankinfosecurity.com/uae-central-bank-tells-fis-to-drop-sms-otp-authentication-a-28589 (secondary)
[^3]: Countries phasing out SMS OTPs for online banking security. Gulf News. https://gulfnews.com/business/banking/countries-phasing-out-sms-otps-for-online-banking-security-1.500209725 (secondary)

## Related questions

- [Which countries are banning SMS OTP for banking?](https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/)
- [Is email OTP safer than SMS OTP?](https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/)
- [Has any US regulator banned SMS OTP?](https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/)

## Cite

Cleartext. “Did the UAE ban SMS OTP for banking?” Last verified 2026-09-23 (rev. 1). https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/

## Changelog

- 2026-09-23: First published.