Reference data
SMS OTP restrictions by jurisdiction
Every regulator or standards body that has restricted or phased out SMS one-time passcodes for banking, with timing, status and the source for each entry.
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India’s RBI Authentication Directions 2025, in force from April 2026, open the door to alternatives. The EU has a pending fraud package, and the US has issued guidance, not a ban.
The tracker #
| Market | Regulator | Measure | Timing | Status | Source |
|---|---|---|---|---|---|
| UAE | Central Bank of the UAE | SMS and email OTP phase-out Answer | Jul 2025 – Mar 2026 | Complete | UAE banks cancel OTPs, switching to in-app verification (The Paypers) Secondary |
| Philippines | Bangko Sentral ng Pilipinas | Circular 1213: no SMS or email OTP for high-risk transactions Answer | From Jun 25, 2026 | In force | No more SMS, email OTPs for high-risk financial transactions (GMA News) Secondary |
| India | Reserve Bank of India | Authentication Directions 2025 | From Apr 1, 2026 | In force | RBI mandates 2FA and new security rules for digital payments (Regulation Asia) Secondary |
| Singapore | MAS and the Association of Banks in Singapore | OTP login phase-out for customers with digital tokens | From Jul 2024 | In force | Banks in Singapore to strengthen resilience against phishing scams (MAS) Primary |
| Malaysia | Bank Negara Malaysia | Banks directed off SMS OTP | 2022 – 2024 | In force | Malaysian banks stop using SMS for two-factor authentication (Commsrisk) Secondary |
| European Union | Council and Parliament | PSR / PSD3 fraud and SCA package | Deal Nov 27, 2025 | Pending | Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU) Primary |
| United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator Answer | Final 2025 | Guidance | SP 800-63B-4: Authentication and Authenticator Management (NIST) Primary |
Status key #
- Complete
- The phase-out deadline has passed.
- In force
- The rule applies now, in whole or part.
- Pending
- Agreed or proposed, not yet in force.
- Guidance
- A standard or guideline, not a binding ban.
Methodology #
Cleartext lists a jurisdiction when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for authenticating financial transactions or logins. Status is checked against the primary document or the regulator's statement where one is public; entries that currently rest on secondary reporting are marked. Timing shows effective dates unless noted.
Download #
License: CC BY 4.0 [OWNER: confirm license]. Credit “Cleartext” and link to this page.
Cite this dataset #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “SMS OTP restrictions by jurisdiction” Last verified 2026-09-24 (rev. 2). https://glide-cleartext.pages.dev/regulations/
Markdown link
[SMS OTP restrictions by jurisdiction](https://glide-cleartext.pages.dev/regulations/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 2 | Added BSP Circular 1213 (Philippines) as in force. | |
| Rev. 1 | First published. |