The UAE’s SMS OTP phase-out is done. What US banks can take from it

What did the UAE require?

The Central Bank of the UAE told licensed financial institutions to stop relying on one-time passcodes sent by SMS or email to authenticate customers. The phase-out began in July 2025, with a deadline of March 31, 2026.^[1][2]

What replaced the codes?

Banks moved customers to verification inside their own mobile apps: the customer confirms a login or payment in the app on a device the bank has already registered, instead of typing a code from a text message.^[1]

Why it matters outside the Gulf

The UAE rule is unusually direct. Most regulators describe outcomes and leave the method to banks. Here the regulator named the method to retire and set a date. That gives US banks a finished case study rather than a forecast:

• The timeline was months, not years. A defined deadline forced the migration work to the top of the roadmap.
• Email went with SMS. Regulators treated both as the same class of risk, because both can be phished or intercepted.
• The replacement was already in customers’ hands. Moving approval into the bank’s own app avoided a new device or a new login habit.

What US banks should watch

No US regulator has ordered a similar phase-out. The closest signals are NIST classifying SMS codes as restricted and the FCC’s rules on SIM-swap fraud. Sigil tracks every jurisdiction that has moved in its SMS OTP regulation tracker.