Domain
Regulation questions
What NIST, the FCC, the FFIEC and central banks require, with dates and the primary document for each.
Questions #
- Did the UAE ban SMS OTP for banking?
Yes, in effect.
- Do US banks have to follow NIST SP 800-63?
Not directly.
- Has any US regulator banned SMS OTP?
No.
- Is SMS OTP still allowed under NIST SP 800-63-4?
Yes, with conditions.
- What does “restricted authenticator” mean in NIST SP 800-63B-4?
A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes.
- What does the FCC SIM swap rule require?
The FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records.
- What is BSP Circular 1213?
BSP Circular No.
- Which countries are banning SMS OTP for banking?
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022.
Comparisons and checklists #
ComparisonNumber verification vs silent network authenticationComparisonSMS OTP vs authenticator appsComparisonSMS OTP vs email OTPComparisonSMS OTP vs passkeysComparisonSynced vs device-bound passkeysChecklistHow to harden account recovery against SIM swapChecklistHow to migrate a bank off SMS OTPChecklistHow to respond to a SIM swap