# What is BSP Circular 1213?

> **Short answer:** BSP Circular No. 1213 is a Bangko Sentral ng Pilipinas rule that bars banks and other supervised financial institutions in the Philippines from using SMS or email one-time passcodes to authenticate high-risk transactions, effective June 25, 2026. It applies to transactions classed as high-risk, not to every login.

- URL: https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/
- Last verified: 2026-06-26 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## What the circular changes

Banks and other institutions supervised by the Bangko Sentral ng Pilipinas can no longer use one-time passcodes sent by SMS or email to authenticate high-risk transactions. The rule took effect on June 25, 2026.[^1][^2]

## Why SMS and email together

Codes sent by text or email can be phished, intercepted, or handed over by a customer who has been convinced they are talking to their bank. The circular treats both channels as the same weakness.

## Where it fits

The Philippines joins Singapore, Malaysia and the UAE in moving banks off SMS codes. All of them are in the [SMS OTP regulation tracker](https://glide-cleartext.pages.dev/regulations/).

## What this means for you

### Banks & credit unions

Start from the circular’s definition of high-risk transactions and map every flow against it. Anything in scope needs a non-code authenticator.

### Fintechs & payment firms

E-money issuers supervised by the BSP are in scope too. Check whether your wallet top-ups, transfers and cash-outs count as high-risk.

### Developers & identity teams

Tag every transaction type with a risk class in code, so authentication requirements can follow the circular’s definitions and change when they do.

## Follow-up questions

**Does Circular 1213 ban SMS codes for logins?**

The reporting we cite describes the ban as applying to high-risk transactions. Check the circular’s definitions for whether a given login or action is in scope.


## Sources

[^1]: No more SMS, email OTPs for high-risk financial transactions starting June 25. GMA News. https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/ (secondary)
[^2]: BSP SMS OTP phase-out. Fintech News Philippines. https://fintechnews.ph/71973/security/bsp-philippines-sms-otp-phaseout/ (secondary)

## Related questions

- [Which countries are banning SMS OTP for banking?](https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/)
- [Did the UAE ban SMS OTP for banking?](https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/)
- [Is email OTP safer than SMS OTP?](https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/)

## Cite

Cleartext. “What is BSP Circular 1213?” Last verified 2026-06-26 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/

## Changelog

- 2026-06-26: First published.