Central Bank of the UAE: coverage, rules and key facts

The UAE's central bank. It directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026.

Coverage

Analysis · APAC & Gulf

The UAE’s SMS OTP phase-out is done. What US banks can take from it

The Central Bank of the UAE gave banks nine months to stop sending one-time passcodes by text and email. The deadline has passed; the playbook is worth studying.

[Editor Name] · Sep 23, 2026

Explainer · Authentication & MFA

SMS one-time passcodes are “restricted” under NIST’s new guidelines. Here’s what that means for US banks

Revision 4 keeps SMS codes on the permitted list, with strings attached, and adds synced passkeys as a phishing-resistant alternative. The strings read like a migration plan.

[Editor Name] · Sep 24, 2026