{
 "title": "SMS OTP restrictions by jurisdiction",
 "url": "https://glide-cleartext.pages.dev/regulations/",
 "verified": "2026-09-24",
 "version": "1.0",
 "license": "https://creativecommons.org/licenses/by/4.0/",
 "methodology": "Cleartext lists a jurisdiction when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for authenticating financial transactions or logins. Status is checked against the primary document or the regulator's statement where one is public; entries that currently rest on secondary reporting are marked. Timing shows effective dates unless noted.",
 "rows": [
  {
   "market": "UAE",
   "regulator": "Central Bank of the UAE",
   "measure": "SMS and email OTP phase-out",
   "timing": "Jul 2025 – Mar 2026",
   "status": "Complete",
   "source": {
    "title": "UAE banks cancel OTPs, switching to in-app verification (The Paypers)",
    "url": "https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification"
   },
   "code": "AE",
   "topic": "cbuae",
   "question": "did-the-uae-ban-sms-otp-for-banking",
   "sourceType": "secondary"
  },
  {
   "market": "Philippines",
   "regulator": "Bangko Sentral ng Pilipinas",
   "measure": "Circular 1213: no SMS or email OTP for high-risk transactions",
   "timing": "From Jun 25, 2026",
   "status": "In force",
   "source": {
    "title": "No more SMS, email OTPs for high-risk financial transactions (GMA News)",
    "url": "https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/"
   },
   "code": "PH",
   "topic": "bsp",
   "question": "what-is-bsp-circular-1213",
   "sourceType": "secondary"
  },
  {
   "market": "India",
   "regulator": "Reserve Bank of India",
   "measure": "Authentication Directions 2025",
   "timing": "From Apr 1, 2026",
   "status": "In force",
   "source": {
    "title": "RBI mandates 2FA and new security rules for digital payments (Regulation Asia)",
    "url": "https://www.regulationasia.com/articles/rbi-mandates-2fa-and-new-security-rules-for-digital-payments"
   },
   "code": "IN",
   "topic": "rbi",
   "sourceType": "secondary"
  },
  {
   "market": "Singapore",
   "regulator": "MAS and the Association of Banks in Singapore",
   "measure": "OTP login phase-out for customers with digital tokens",
   "timing": "From Jul 2024",
   "status": "In force",
   "source": {
    "title": "Banks in Singapore to strengthen resilience against phishing scams (MAS)",
    "url": "https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams"
   },
   "code": "SG",
   "topic": "mas",
   "sourceType": "primary"
  },
  {
   "market": "Malaysia",
   "regulator": "Bank Negara Malaysia",
   "measure": "Banks directed off SMS OTP",
   "timing": "2022 – 2024",
   "status": "In force",
   "source": {
    "title": "Malaysian banks stop using SMS for two-factor authentication (Commsrisk)",
    "url": "https://commsrisk.com/malaysian-banks-stop-using-sms-for-two-factor-authentication/"
   },
   "code": "MY",
   "topic": "bnm",
   "sourceType": "secondary"
  },
  {
   "market": "European Union",
   "regulator": "Council and Parliament",
   "measure": "PSR / PSD3 fraud and SCA package",
   "timing": "Deal Nov 27, 2025",
   "status": "Pending",
   "source": {
    "title": "Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU)",
    "url": "https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/"
   },
   "code": "EU",
   "topic": "eu-payments-package",
   "sourceType": "primary"
  },
  {
   "market": "United States",
   "regulator": "NIST",
   "measure": "SP 800-63B-4: SMS OTP is a \"restricted\" authenticator",
   "timing": "Final 2025",
   "status": "Guidance",
   "source": {
    "title": "SP 800-63B-4: Authentication and Authenticator Management (NIST)",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
   },
   "code": "US",
   "topic": "nist-sp-800-63-4",
   "question": "is-sms-otp-still-allowed-under-nist-800-63-4",
   "sourceType": "primary"
  }
 ]
}