Question Regulation
What is BSP Circular 1213?
BSP Circular No. 1213 is a Bangko Sentral ng Pilipinas rule that bars banks and other supervised financial institutions in the Philippines from using SMS or email one-time passcodes to authenticate high-risk transactions, effective June 25, 2026. It applies to transactions classed as high-risk, not to every login.
What is BSP Circular 1213? BSP Circular No. 1213 is a Bangko Sentral ng Pilipinas rule that bars banks and other supervised financial institutions in the Philippines from using SMS or email one-time passcodes to authenticate high-risk transactions, effective June 25, 2026. It applies to transactions classed as high-risk, not to every login. Source: https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/ (Cleartext, verified 2026-06-26)
What the circular changes #
Banks and other institutions supervised by the Bangko Sentral ng Pilipinas can no longer use one-time passcodes sent by SMS or email to authenticate high-risk transactions. The rule took effect on June 25, 2026.[1][2]
Why SMS and email together #
Codes sent by text or email can be phished, intercepted, or handed over by a customer who has been convinced they are talking to their bank. The circular treats both channels as the same weakness.
Where it fits #
The Philippines joins Singapore, Malaysia and the UAE in moving banks off SMS codes. All of them are in the SMS OTP regulation tracker.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Start from the circular’s definition of high-risk transactions and map every flow against it. Anything in scope needs a non-code authenticator.
Fintechs & payment firms
E-money issuers supervised by the BSP are in scope too. Check whether your wallet top-ups, transfers and cash-outs count as high-risk.
Developers & identity teams
Tag every transaction type with a risk class in code, so authentication requirements can follow the circular’s definitions and change when they do.
Follow-up questions #
- Does Circular 1213 ban SMS codes for logins?
- The reporting we cite describes the ban as applying to high-risk transactions. Check the circular’s definitions for whether a given login or action is in scope.
People also ask #
Which countries are banning SMS OTP for banking?
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.
Full answerDid the UAE ban SMS OTP for banking?
Yes, in effect. The Central Bank of the UAE directed licensed financial institutions to phase out one-time passcodes sent by SMS and email, starting in July 2025 with a deadline of March 31, 2026. Banks moved customers to verification inside their own mobile apps on devices the bank had registered.
Full answerIs email OTP safer than SMS OTP?
Not meaningfully. Email codes avoid SIM swaps but can be phished, relayed by OTP bots and stolen through a compromised mailbox, just like SMS codes. Regulators treat them as the same class of risk: the UAE and Philippine rules retire SMS and email codes together.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “What is BSP Circular 1213?” Last verified 2026-06-26 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/
Markdown link
[What is BSP Circular 1213?](https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/) (Cleartext, verified 2026-06-26)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |