The short answer
Bangko Sentral ng Pilipinas Circular No. 1213 bars banks and other supervised financial institutions from using SMS or email one-time passcodes to authenticate high-risk transactions, starting June 25, 2026.
Key takeaways
- Applies to high-risk transactions, not every login.
- Covers both SMS and email one-time passcodes.
- Effective June 25, 2026.
What the circular changes
Banks and other institutions supervised by the Bangko Sentral ng Pilipinas can no longer use one-time passcodes sent by SMS or email to authenticate high-risk transactions. The rule took effect on June 25, 2026.[1][2]
Why SMS and email together
Regulators increasingly treat both channels as the same weakness. Codes sent by text or email can be phished, intercepted, or handed over by a customer who has been convinced they are talking to their bank.
Where it fits
The Philippines joins Singapore, Malaysia and the UAE in moving banks off SMS codes. Sigil tracks each of them in the SMS OTP regulation tracker.
Sources
- GMA News. No more SMS, email OTPs for high-risk financial transactions starting June 25.
- Fintech News Philippines. BSP SMS OTP phase-out.
- Published.