Question Regulation
Do US banks have to follow NIST SP 800-63?
Not directly. NIST SP 800-63 is written for US federal agencies, and no banking regulator has adopted it as a rule for banks. In practice examiners, auditors and security teams use it as the benchmark for authentication strength, while the FFIEC’s 2021 guidance asks banks to match controls to risk rather than prescribing methods.
Do US banks have to follow NIST SP 800-63? Not directly. NIST SP 800-63 is written for US federal agencies, and no banking regulator has adopted it as a rule for banks. In practice examiners, auditors and security teams use it as the benchmark for authentication strength, while the FFIEC’s 2021 guidance asks banks to match controls to risk rather than prescribing methods. Source: https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/ (Cleartext, verified 2026-09-24)
Who the guidelines bind #
The Digital Identity Guidelines set requirements for US federal agencies that authenticate people to government systems.[1] Banks are supervised by banking regulators, and the Federal Financial Institutions Examination Council (FFIEC) coordinates the examination standards those regulators use.[2]
What the FFIEC expects instead #
The FFIEC’s August 2021 guidance, Authentication and Access to Financial Institution Services and Systems, is written in terms of risk, not methods.[2] It asks institutions to assess the threats to each customer and employee access path and to apply controls that match. It does not name SMS codes, passkeys or any other technology as required or forbidden.
Why NIST still matters to banks #
When an examiner, auditor or board asks how strong a login is, NIST’s authentication assurance levels are the common yardstick. NIST also moves first: its classification of SMS codes as restricted is the most-cited US reference point in arguments about retiring them.[1] See is SMS OTP still allowed under NIST 800-63-4?.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Expect to be asked how your authentication compares with NIST even though you aren’t bound by it. Mapping each login and step-up flow to an assurance level (AAL1–AAL3) gives examiners a common vocabulary.
Fintechs & payment firms
If you partner with a bank, its vendor-risk team will likely use NIST terms in due diligence. Having your own mapping ready shortens that process.
Developers & identity teams
Use NIST’s assurance levels as the design target for each flow. They translate into concrete requirements, such as which authenticator types are acceptable at AAL2.
Follow-up questions #
- What does the FFIEC 2021 guidance replace?
- It superseded the FFIEC’s 2005 guidance on authentication in internet banking and its 2011 supplement.
People also ask #
Is SMS OTP still allowed under NIST SP 800-63-4?
Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.
Full answerHas any US regulator banned SMS OTP?
No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.
Full answerWhat does “restricted authenticator” mean in NIST SP 800-63B-4?
A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes. An organization that uses one takes on four obligations: offer a non-restricted alternative, tell users the risks, assess the risk of continuing, and keep a migration plan in case a future revision removes it.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “Do US banks have to follow NIST SP 800-63?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/
Markdown link
[Do US banks have to follow NIST SP 800-63?](https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |