Briefing / Assessment / Policy
The UAE’s SMS OTP phase-out is done. What US banks can take from it
The Central Bank of the UAE gave banks nine months to stop sending one-time passcodes by text and email. The deadline has passed; the playbook is worth studying.
[EDITORIAL: sample briefing drafted with AI assistance. Verify every claim against its sources before launch.]
BLUF The Central Bank of the UAE directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026. Banks moved customers to in-app verification in their own mobile apps.
Moderate confidence
Based on trade and regional press reporting; the Central Bank of the UAE's own notice is not linked.
Key points
- The phase-out ran from July 2025 to March 31, 2026.
- Banks replaced SMS and email codes mainly with in-app verification.
- It is one of the first complete, regulator-mandated removals of SMS OTP for banking.
What did the UAE require?
The Central Bank of the UAE told licensed financial institutions to stop relying on one-time passcodes sent by SMS or email to authenticate customers. The phase-out began in July 2025, with a deadline of March 31, 2026.[1][2]
What replaced the codes?
Banks moved customers to verification inside their own mobile apps: the customer confirms a login or payment in the app on a device the bank has already registered, instead of typing a code from a text message.[1]
Why it matters outside the Gulf
The UAE rule is unusually direct. Most regulators describe outcomes and leave the method to banks. Here the regulator named the method to retire and set a date. That gives US banks a finished case study rather than a forecast:
- The timeline was months, not years. A defined deadline forced the migration work to the top of the roadmap.
- Email went with SMS. Regulators treated both as the same class of risk, because both can be phished or intercepted.
- The replacement was already in customers’ hands. Moving approval into the bank’s own app avoided a new device or a new login habit.
What US banks should watch
No US regulator has ordered a similar phase-out. The closest signals are NIST classifying SMS codes as restricted and the FCC’s rules on SIM-swap fraud. Telemetry tracks every jurisdiction that has moved in its SMS OTP regulation board.
Sources
Changelog
- Published.