Regulations / SMS OTP
SMS OTP regulation status board
Every regulator that has restricted or phased out SMS one-time passcodes for banking, with dates, status and the primary source for each.
Answer Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in force April 2026, open the door to alternatives.
- Complete
- 1markets
- In force
- 4markets
- Pending
- 1markets
- Guidance
- 1markets
BStatus board
| Market | Status | Measure | Timing | Regulator | Primary or best available source |
|---|---|---|---|---|---|
| UAE | Complete | SMS and email OTP phase-out | Jul 2025 – Mar 2026 | Central Bank of the UAE | UAE banks cancel OTPs, switching to in-app verification (The Paypers) |
| Philippines | In force | Circular 1213: no SMS or email OTP for high-risk transactions | From Jun 25, 2026 | Bangko Sentral ng Pilipinas | No more SMS, email OTPs for high-risk financial transactions (GMA News) |
| India | In force | Authentication Directions 2025 | From Apr 1, 2026 | Reserve Bank of India | RBI mandates 2FA and new security rules for digital payments (Regulation Asia) |
| Singapore | In force | OTP login phase-out for customers with digital tokens | From Jul 2024 | MAS and the Association of Banks in Singapore | Banks in Singapore to strengthen resilience against phishing scams (MAS) |
| Malaysia | In force | Banks directed off SMS OTP | 2022 – 2024 | Bank Negara Malaysia | Malaysian banks stop using SMS for two-factor authentication (Commsrisk) |
| European Union | Pending | PSR / PSD3 fraud and SCA package | Deal Nov 27, 2025 | Council and Parliament | Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU) |
| United States | Guidance | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | NIST | SP 800-63B-4: Authentication and Authenticator Management (NIST) |
SStatus definitions
- Complete
- The phase-out deadline has passed and the measure is fully in effect.
- In force
- The rule or directive is in effect, or its effective date has passed.
- Pending
- Agreed or proposed but not yet in effect.
- Guidance
- A standard or guideline, not a binding rule for the private sector.
MMethodology
Telemetry lists a jurisdiction when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for authenticating financial transactions or logins. Status is checked against the primary document or regulator statement. Dates are effective dates unless noted.
See the site-wide methodology.
Cite this
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in force April 2026, open the door to alternatives. Source: Telemetry SMS OTP regulation board, version 1.0, verified 2026-09-24. https://glide-telemetry.pages.dev/regulations/