# Has any US regulator banned SMS OTP?

> **Short answer:** No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.

- URL: https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## The three US levers

| Body | What it did | Binding on banks? |
|---|---|---|
| NIST | Classified SMS and voice OTP as restricted authenticators in SP 800-63B-4[^1] | No; written for federal agencies |
| FCC | Required wireless carriers to authenticate customers before SIM changes and port-outs (FCC 23-95)[^2] | No; applies to carriers |
| FFIEC | Issued authentication guidance framed around risk, not named methods (2021)[^3] | Supervisory guidance |
Table: US federal actions that bear on SMS one-time passcodes.

## Where bans have happened

Regulators outside the US have been direct. The Central Bank of the UAE set a deadline of March 31, 2026 for banks to stop using SMS and email codes,[^4] and the Philippines barred them for high-risk transactions from June 25, 2026.[^5] The full list, with sources, is in [which countries are banning SMS OTP](https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/) and the [regulation tracker](https://glide-cleartext.pages.dev/regulations/).

## What would change this answer

A rule from a US banking regulator that names SMS codes, or a future NIST revision that removes them from the permitted list. Cleartext re-verifies this answer whenever either body publishes new authentication guidance.

## What this means for you

### Banks & credit unions

The absence of a ban is not a safe harbor. NIST’s conditions, examiner expectations and fraud losses create pressure without a rule; plan the migration on your own timeline rather than a regulator’s.

### Fintechs & payment firms

If you operate in the UAE, the Philippines, Singapore or Malaysia as well as the US, design for the strictest market. A single authentication stack is cheaper than one per jurisdiction.

### Developers & identity teams

Build SMS so it can be switched off per flow and per market with configuration, not a release. Regulators abroad have given banks months, not years.

## Follow-up questions

**Will the US follow the UAE and ban SMS codes?**

No US regulator has signaled a ban. US banking regulators rarely name a technology, so pressure is more likely to come through guidance, examinations and fraud-liability rules than a direct prohibition.


## Sources

[^1]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html
[^2]: Protecting Consumers from SIM Swap and Port-Out Fraud. Federal Register, 2023-12-08. https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud
[^3]: Authentication and Access to Financial Institution Services and Systems. FFIEC, 2021-08-11. https://www.ffiec.gov/news/press-releases/2021/pr-08-11
[^4]: UAE banks cancel OTPs, switching to in-app verification. The Paypers. https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification (secondary)
[^5]: No more SMS, email OTPs for high-risk financial transactions starting June 25. GMA News. https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/ (secondary)

## Related questions

- [Which countries are banning SMS OTP for banking?](https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/)
- [Is SMS OTP still allowed under NIST SP 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/)
- [What does the FCC SIM swap rule require?](https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/)
- [Do US banks have to follow NIST SP 800-63?](https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/)

## Cite

Cleartext. “Has any US regulator banned SMS OTP?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/

## Changelog

- 2026-09-24: First published.