Question Regulation
Has any US regulator banned SMS OTP?
No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.
Has any US regulator banned SMS OTP? No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines. Source: https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/ (Cleartext, verified 2026-09-24)
The three US levers #
| Body | What it did | Binding on banks? |
|---|---|---|
| NIST | Classified SMS and voice OTP as restricted authenticators in SP 800-63B-4[1] | No; written for federal agencies |
| FCC | Required wireless carriers to authenticate customers before SIM changes and port-outs (FCC 23-95)[2] | No; applies to carriers |
| FFIEC | Issued authentication guidance framed around risk, not named methods (2021)[3] | Supervisory guidance |
Where bans have happened #
Regulators outside the US have been direct. The Central Bank of the UAE set a deadline of March 31, 2026 for banks to stop using SMS and email codes,[4] and the Philippines barred them for high-risk transactions from June 25, 2026.[5] The full list, with sources, is in which countries are banning SMS OTP and the regulation tracker.
What would change this answer #
A rule from a US banking regulator that names SMS codes, or a future NIST revision that removes them from the permitted list. Cleartext re-verifies this answer whenever either body publishes new authentication guidance.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
- [1]SP 800-63B-4: Authentication and Authenticator Management
- [2]Protecting Consumers from SIM Swap and Port-Out Fraud
- [3]Authentication and Access to Financial Institution Services and Systems
- [4]UAE banks cancel OTPs, switching to in-app verification
- [5]No more SMS, email OTPs for high-risk financial transactions starting June 25
What this means for you #
Banks & credit unions
The absence of a ban is not a safe harbor. NIST’s conditions, examiner expectations and fraud losses create pressure without a rule; plan the migration on your own timeline rather than a regulator’s.
Fintechs & payment firms
If you operate in the UAE, the Philippines, Singapore or Malaysia as well as the US, design for the strictest market. A single authentication stack is cheaper than one per jurisdiction.
Developers & identity teams
Build SMS so it can be switched off per flow and per market with configuration, not a release. Regulators abroad have given banks months, not years.
Follow-up questions #
- Will the US follow the UAE and ban SMS codes?
- No US regulator has signaled a ban. US banking regulators rarely name a technology, so pressure is more likely to come through guidance, examinations and fraud-liability rules than a direct prohibition.
People also ask #
Which countries are banning SMS OTP for banking?
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.
Full answerIs SMS OTP still allowed under NIST SP 800-63-4?
Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.
Full answerWhat does the FCC SIM swap rule require?
The FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records. It regulates carriers, not how banks or apps use SMS codes.
Full answerDo US banks have to follow NIST SP 800-63?
Not directly. NIST SP 800-63 is written for US federal agencies, and no banking regulator has adopted it as a rule for banks. In practice examiners, auditors and security teams use it as the benchmark for authentication strength, while the FFIEC’s 2021 guidance asks banks to match controls to risk rather than prescribing methods.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “Has any US regulator banned SMS OTP?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/
Markdown link
[Has any US regulator banned SMS OTP?](https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |