{"meta":{"title":"SMS OTP regulation status board","description":"Every regulator that has restricted or phased out SMS one-time passcodes for banking, with dates, status and the primary source for each.","source":"Telemetry editorial research; see sourceUrl per row","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":7,"verified":"2026-09-24","version":"1.0"},"data":[{"market":"UAE","slug":"uae","regulator":"Central Bank of the UAE","measure":"SMS and email OTP phase-out","timing":"Jul 2025 – Mar 2026","status":"Complete","sourceTitle":"UAE banks cancel OTPs, switching to in-app verification (The Paypers)","sourceUrl":"https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification","url":"https://glide-telemetry.pages.dev/regulations/uae/"},{"market":"Philippines","slug":"philippines","regulator":"Bangko Sentral ng Pilipinas","measure":"Circular 1213: no SMS or email OTP for high-risk transactions","timing":"From Jun 25, 2026","status":"In force","sourceTitle":"No more SMS, email OTPs for high-risk financial transactions (GMA News)","sourceUrl":"https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/","url":"https://glide-telemetry.pages.dev/regulations/philippines/"},{"market":"India","slug":"india","regulator":"Reserve Bank of India","measure":"Authentication Directions 2025","timing":"From Apr 1, 2026","status":"In force","sourceTitle":"RBI mandates 2FA and new security rules for digital payments (Regulation Asia)","sourceUrl":"https://www.regulationasia.com/articles/rbi-mandates-2fa-and-new-security-rules-for-digital-payments","url":"https://glide-telemetry.pages.dev/regulations/india/"},{"market":"Singapore","slug":"singapore","regulator":"MAS and the Association of Banks in Singapore","measure":"OTP login phase-out for customers with digital tokens","timing":"From Jul 2024","status":"In force","sourceTitle":"Banks in Singapore to strengthen resilience against phishing scams (MAS)","sourceUrl":"https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams","url":"https://glide-telemetry.pages.dev/regulations/singapore/"},{"market":"Malaysia","slug":"malaysia","regulator":"Bank Negara Malaysia","measure":"Banks directed off SMS OTP","timing":"2022 – 2024","status":"In force","sourceTitle":"Malaysian banks stop using SMS for two-factor authentication (Commsrisk)","sourceUrl":"https://commsrisk.com/malaysian-banks-stop-using-sms-for-two-factor-authentication/","url":"https://glide-telemetry.pages.dev/regulations/malaysia/"},{"market":"European Union","slug":"european-union","regulator":"Council and Parliament","measure":"PSR / PSD3 fraud and SCA package","timing":"Deal Nov 27, 2025","status":"Pending","sourceTitle":"Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU)","sourceUrl":"https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/","url":"https://glide-telemetry.pages.dev/regulations/european-union/"},{"market":"United States","slug":"united-states","regulator":"NIST","measure":"SP 800-63B-4: SMS OTP is a \"restricted\" authenticator","timing":"Final 2025","status":"Guidance","sourceTitle":"SP 800-63B-4: Authentication and Authenticator Management (NIST)","sourceUrl":"https://pages.nist.gov/800-63-4/sp800-63b.html","url":"https://glide-telemetry.pages.dev/regulations/united-states/"}]}