Topic Standard
NIST SP 800-63-4
Revision 4 of NIST's Digital Identity Guidelines, covering identity proofing (63A), authentication (63B) and federation (63C). Binding on US federal agencies; widely used as a benchmark elsewhere.
Also called: NIST 800-63, 800-63B, Digital Identity Guidelines, AAL2, AAL3
- Publisher
- NIST, US Department of Commerce
- Status
- Final, 2025
- Volumes
- 63A proofing, 63B authentication, 63C federation
- Official site
- pages.nist.gov
Questions (6) #
- Are synced passkeys phishing-resistant?Identity
Yes.
- Do US banks have to follow NIST SP 800-63?Regulation
Not directly.
- Has any US regulator banned SMS OTP?Regulation
No.
- Is SMS OTP still allowed under NIST SP 800-63-4?Regulation
Yes, with conditions.
- What does “restricted authenticator” mean in NIST SP 800-63B-4?Regulation
A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes.
- Which countries are banning SMS OTP for banking?Regulation
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022.
Comparisons (2) #
Checklists (1) #
In the regulation tracker #
- United States: SP 800-63B-4: SMS OTP is a "restricted" authenticator (Guidance)
Glossary #
- Authentication assurance level (AAL)
- NIST SP 800-63B's three-step scale for how strongly a login proves the user controls their authenticators. AAL1 is the lowest, AAL2 is the level most consumer and banking logins target, and AAL3, the highest, calls for a phishing-resistant authenticator with a non-exportable key, such as a hardware security key.
- Restricted authenticator
- NIST SP 800-63B's label for an authenticator that is still permitted but carries extra risk, such as SMS or voice one-time passcodes. Using one obliges the organization to offer an alternative, warn users, assess the risk and plan a migration.