Briefing / Flash / Policy
Inside BSP Circular 1213, the Philippines’ OTP rule
From June 25, 2026, banks and e-money issuers in the Philippines can no longer rely on SMS or email one-time passcodes for high-risk transactions.
[EDITORIAL: sample briefing drafted with AI assistance. Verify every claim against its sources before launch.]
BLUF Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.
Moderate confidence
Based on press reporting of the circular; the BSP document itself is not linked.
Key points
- Applies to high-risk transactions, not every login.
- Covers both SMS and email one-time passcodes.
- Effective June 25, 2026.
What the circular changes
Banks and other institutions supervised by the Bangko Sentral ng Pilipinas can no longer use one-time passcodes sent by SMS or email to authenticate high-risk transactions. The rule took effect on June 25, 2026.[1][2]
Why SMS and email together
Regulators increasingly treat both channels as the same weakness. Codes sent by text or email can be phished, intercepted, or handed over by a customer who has been convinced they are talking to their bank.
Where it fits
The Philippines joins Singapore, Malaysia and the UAE in moving banks off SMS codes. Telemetry tracks each of them in the SMS OTP regulation board.
Sources
- No more SMS, email OTPs for high-risk financial transactions starting June 25 GMA News
- BSP SMS OTP phase-out Fintech News Philippines
Changelog
- Published.