Question Regulation
What does “restricted authenticator” mean in NIST SP 800-63B-4?
A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes. An organization that uses one takes on four obligations: offer a non-restricted alternative, tell users the risks, assess the risk of continuing, and keep a migration plan in case a future revision removes it.
What does “restricted authenticator” mean in NIST SP 800-63B-4? A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes. An organization that uses one takes on four obligations: offer a non-restricted alternative, tell users the risks, assess the risk of continuing, and keep a migration plan in case a future revision removes it. Source: https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/ (Cleartext, verified 2026-09-24)
The four obligations #
An organization that keeps offering SMS or voice codes takes on four obligations under SP 800-63B-4:[1]
- Offer an alternative that isn’t restricted, so no user is left with SMS as their only option.
- Tell users the risks of the restricted option in plain language.
- Assess the risk to users and to the organization of continuing to allow it.
- Keep a migration plan in case the authenticator is removed in a future revision.
How to evidence each one #
| Obligation | Evidence an auditor can check |
|---|---|
| Offer an alternative | Enrollment screens that show a non-restricted option; the share of users enrolled in it |
| Tell users the risks | The user-facing copy and where in the flow it appears |
| Assess the risk | A dated document with an owner and a review cadence |
| Keep a migration plan | Retirement dates per flow and the metric that triggers each one |
Why NIST chose conditions over a ban #
SMS reaches almost every phone, which is why it became the default second factor. Removing it outright would strand users who have nothing else. The restricted category keeps that reach while making the organization own the risk and the exit plan.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Treat the four obligations as audit evidence, not intentions. Each one should map to an artifact an examiner can see: an enrollment screen, a piece of user-facing copy, a dated document and a roadmap.
Fintechs & payment firms
The cheapest way to meet the conditions is at design time: build enrollment so users choose between SMS and a passkey, with the risk notice shown next to SMS.
Developers & identity teams
Store the authenticator type on every credential and log which type completed each sign-in. You can’t write a migration plan without knowing how many users depend on the restricted method.
Follow-up questions #
- Is the restricted category new in Revision 4?
- No. NIST introduced it in Revision 3 of SP 800-63B in 2017. Revision 4 keeps SMS and voice codes in it.
People also ask #
Is SMS OTP still allowed under NIST SP 800-63-4?
Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.
Full answerDo US banks have to follow NIST SP 800-63?
Not directly. NIST SP 800-63 is written for US federal agencies, and no banking regulator has adopted it as a rule for banks. In practice examiners, auditors and security teams use it as the benchmark for authentication strength, while the FFIEC’s 2021 guidance asks banks to match controls to risk rather than prescribing methods.
Full answerHas any US regulator banned SMS OTP?
No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “What does “restricted authenticator” mean in NIST SP 800-63B-4?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/
Markdown link
[What does “restricted authenticator” mean in NIST SP 800-63B-4?](https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |