# Which countries are banning SMS OTP for banking? > **Short answer:** Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban. - URL: https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/ - Last verified: 2026-09-24 by [VERIFIER NAME] (revision 2) - Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/) ## The list | Market | Regulator | Measure | Timing | Status | |---|---|---|---|---| | UAE | Central Bank of the UAE | SMS and email OTP phase-out | Jul 2025 – Mar 2026 | Complete | | Philippines | Bangko Sentral ng Pilipinas | Circular 1213: no SMS or email OTP for high-risk transactions | From Jun 25, 2026 | In force | | India | Reserve Bank of India | Authentication Directions 2025 | From Apr 1, 2026 | In force | | Singapore | MAS and the Association of Banks in Singapore | OTP login phase-out for customers with digital tokens | From Jul 2024 | In force | | Malaysia | Bank Negara Malaysia | Banks directed off SMS OTP | 2022 – 2024 | In force | | European Union | Council and Parliament | PSR / PSD3 fraud and SCA package | Deal Nov 27, 2025 | Pending | | United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | Guidance | Table: SMS OTP restrictions by jurisdiction, verified 2026-09-24. Sources in the [tracker](https://glide-cleartext.pages.dev/regulations/). The same data, with CSV and JSON downloads and a status key, is in the [SMS OTP regulation tracker](https://glide-cleartext.pages.dev/regulations/). ## How the rules differ in scope - **UAE:** SMS and email one-time passcodes phased out between July 2025 and March 31, 2026; banks moved customers to in-app verification.[^1] - **Philippines:** BSP Circular 1213 bars SMS and email codes for high-risk transactions from June 25, 2026.[^2] - **Singapore:** OTP logins phased out for customers who have a digital token activated on their phone, from July 2024.[^4] - **Malaysia:** Bank Negara Malaysia directed banks off SMS codes from 2022.[^5] - **India:** the RBI’s Authentication Directions 2025 set new rules for authenticating digital payments from April 1, 2026.[^3] - **EU:** a provisional deal on the payment services package, reached November 27, 2025, is pending.[^6] - **US:** NIST classifies SMS codes as restricted; there is no ban.[^7] ## How we decide what counts A jurisdiction is listed when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for financial transactions or logins. Several entries currently rest on press reports rather than the regulator’s own document; those are marked “secondary” in the tracker and are the first to be re-checked. ## What this means for you ### Banks & credit unions Read the scope of each rule, not just the headline. Singapore’s applies to logins by customers with a digital token; the Philippines’ to high-risk transactions; the UAE’s to SMS and email codes across the board. ### Fintechs & payment firms If you operate in several of these markets, plan one authentication stack that satisfies the strictest scope rather than a patchwork of exceptions. ### Developers & identity teams Make the retirement of SMS configurable by market and by transaction type. Every rule so far has drawn the line differently. ## Follow-up questions **What did Singapore announce?** In July 2024, MAS and the Association of Banks in Singapore said major retail banks would phase out one-time passcodes for account logins by customers who have activated a digital token on their phone. **Is the EU banning SMS OTP?** Not as of this answer’s verification date. Council and Parliament agreed a payment-services fraud package on November 27, 2025; it is pending and does not itself name SMS codes as banned in the sources we cite. ## Sources [^1]: UAE banks cancel OTPs, switching to in-app verification. The Paypers. https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification (secondary) [^2]: No more SMS, email OTPs for high-risk financial transactions starting June 25. GMA News. https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/ (secondary) [^3]: RBI mandates 2FA and new security rules for digital payments. Regulation Asia. https://www.regulationasia.com/articles/rbi-mandates-2fa-and-new-security-rules-for-digital-payments (secondary) [^4]: Banks in Singapore to strengthen resilience against phishing scams. Monetary Authority of Singapore, 2024-07-09. https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams [^5]: Malaysian banks stop using SMS for two-factor authentication. Commsrisk. https://commsrisk.com/malaysian-banks-stop-using-sms-for-two-factor-authentication/ (secondary) [^6]: Payment services: Council and Parliament agree to step up the fight against fraud and increase transparency. Council of the EU, 2025-11-27. https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/ [^7]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html ## Related questions - [Did the UAE ban SMS OTP for banking?](https://glide-cleartext.pages.dev/q/did-the-uae-ban-sms-otp-for-banking/) - [What is BSP Circular 1213?](https://glide-cleartext.pages.dev/q/what-is-bsp-circular-1213/) - [Has any US regulator banned SMS OTP?](https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/) - [Is email OTP safer than SMS OTP?](https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/) ## Cite Cleartext. “Which countries are banning SMS OTP for banking?” Last verified 2026-09-24 (rev. 2). https://glide-cleartext.pages.dev/q/which-countries-are-banning-sms-otp/ ## Changelog - 2026-09-24: Added BSP Circular 1213 (in force since June 25, 2026). - 2026-09-22: First published.