Cleartext

Sample content: drafted with AI assistance from the cited sources and awaiting editorial verification. How verification works

Question Regulation

Which countries are banning SMS OTP for banking?

Verified by [VERIFIER NAME]Rev. 27 sources

Short answer

53 words

Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.

Which countries are banning SMS OTP for banking?

Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.

Source: https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/ (Cleartext, verified 2026-09-24)
MarkdownCite

The list #

SMS OTP restrictions by jurisdiction, verified 2026-09-24. Sources in the tracker.
MarketRegulatorMeasureTimingStatus
UAECentral Bank of the UAESMS and email OTP phase-outJul 2025 – Mar 2026Complete
PhilippinesBangko Sentral ng PilipinasCircular 1213: no SMS or email OTP for high-risk transactionsFrom Jun 25, 2026In force
IndiaReserve Bank of IndiaAuthentication Directions 2025From Apr 1, 2026In force
SingaporeMAS and the Association of Banks in SingaporeOTP login phase-out for customers with digital tokensFrom Jul 2024In force
MalaysiaBank Negara MalaysiaBanks directed off SMS OTP2022 – 2024In force
European UnionCouncil and ParliamentPSR / PSD3 fraud and SCA packageDeal Nov 27, 2025Pending
United StatesNISTSP 800-63B-4: SMS OTP is a "restricted" authenticatorFinal 2025Guidance

The same data, with CSV and JSON downloads and a status key, is in the SMS OTP regulation tracker.

How the rules differ in scope #

  • UAE: SMS and email one-time passcodes phased out between July 2025 and March 31, 2026; banks moved customers to in-app verification.[1]
  • Philippines: BSP Circular 1213 bars SMS and email codes for high-risk transactions from June 25, 2026.[2]
  • Singapore: OTP logins phased out for customers who have a digital token activated on their phone, from July 2024.[4]
  • Malaysia: Bank Negara Malaysia directed banks off SMS codes from 2022.[5]
  • India: the RBI’s Authentication Directions 2025 set new rules for authenticating digital payments from April 1, 2026.[3]
  • EU: a provisional deal on the payment services package, reached November 27, 2025, is pending.[6]
  • US: NIST classifies SMS codes as restricted; there is no ban.[7]

How we decide what counts #

A jurisdiction is listed when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for financial transactions or logins. Several entries currently rest on press reports rather than the regulator’s own document; those are marked “secondary” in the tracker and are the first to be re-checked.

Evidence #

Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.

  1. [1]UAE banks cancel OTPs, switching to in-app verificationThe Paypers Secondary
  2. [2]No more SMS, email OTPs for high-risk financial transactions starting June 25GMA News Secondary
  3. [3]RBI mandates 2FA and new security rules for digital paymentsRegulation Asia Secondary
  4. [4]Banks in Singapore to strengthen resilience against phishing scamsMonetary Authority of Singapore, 2024-07-09 Primary
  5. [5]Malaysian banks stop using SMS for two-factor authenticationCommsrisk Secondary
  6. [6]Payment services: Council and Parliament agree to step up the fight against fraud and increase transparencyCouncil of the EU, 2025-11-27 Primary
  7. [7]SP 800-63B-4: Authentication and Authenticator ManagementNIST Primary

What this means for you #

Banks & credit unions

Read the scope of each rule, not just the headline. Singapore’s applies to logins by customers with a digital token; the Philippines’ to high-risk transactions; the UAE’s to SMS and email codes across the board.

Fintechs & payment firms

If you operate in several of these markets, plan one authentication stack that satisfies the strictest scope rather than a patchwork of exceptions.

Developers & identity teams

Make the retirement of SMS configurable by market and by transaction type. Every rule so far has drawn the line differently.

Follow-up questions #

What did Singapore announce?
In July 2024, MAS and the Association of Banks in Singapore said major retail banks would phase out one-time passcodes for account logins by customers who have activated a digital token on their phone.
Is the EU banning SMS OTP?
Not as of this answer’s verification date. Council and Parliament agreed a payment-services fraud package on November 27, 2025; it is pending and does not itself name SMS codes as banned in the sources we cite.

People also ask #

Did the UAE ban SMS OTP for banking?

Yes, in effect. The Central Bank of the UAE directed licensed financial institutions to phase out one-time passcodes sent by SMS and email, starting in July 2025 with a deadline of March 31, 2026. Banks moved customers to verification inside their own mobile apps on devices the bank had registered.

Full answer
What is BSP Circular 1213?

BSP Circular No. 1213 is a Bangko Sentral ng Pilipinas rule that bars banks and other supervised financial institutions in the Philippines from using SMS or email one-time passcodes to authenticate high-risk transactions, effective June 25, 2026. It applies to transactions classed as high-risk, not to every login.

Full answer
Has any US regulator banned SMS OTP?

No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.

Full answer
Is email OTP safer than SMS OTP?

Not meaningfully. Email codes avoid SIM swaps but can be phished, relayed by OTP bots and stolen through a compromised mailbox, just like SMS codes. Regulators treat them as the same class of risk: the UAE and Philippine rules retire SMS and email codes together.

Full answer

Decide and act #

ComparisonSMS OTP vs email OTPComparisonSMS OTP vs passkeysChecklistHow to migrate a bank off SMS OTPChecklistHow to harden account recovery against SIM swap

Cite this answer #

Answers change. Include the verification date when you quote this page.

Plain text

Cleartext. “Which countries are banning SMS OTP for banking?” Last verified 2026-09-24 (rev. 2). https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/

Markdown link

[Which countries are banning SMS OTP for banking?](https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/) (Cleartext, verified 2026-09-24)

Changelog #

DateRevisionChange
Rev. 2Added BSP Circular 1213 (in force since June 25, 2026).
Rev. 1First published.
TopicsSMS one-time passcodesCentral Bank of the UAEBangko Sentral ng PilipinasMonetary Authority of SingaporeBank Negara MalaysiaReserve Bank of IndiaEU PSD3 and Payment Services RegulationNIST SP 800-63-4