{
 "title": "SMS OTP: who is phasing it out",
 "description": "Every regulator that has restricted or phased out SMS one-time passcodes for banking, with dates, status and the primary source for each.",
 "verified": "2026-09-24",
 "version": "1.0",
 "methodology": "Sigil lists a jurisdiction when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for authenticating financial transactions or logins. Status is checked against the primary document or regulator statement. Dates are effective dates unless noted.",
 "rows": [
  {
   "market": "UAE",
   "regulator": "Central Bank of the UAE",
   "measure": "SMS and email OTP phase-out",
   "timing": "Jul 2025 \u2013 Mar 2026",
   "status": "Complete",
   "source": {
    "title": "UAE banks cancel OTPs, switching to in-app verification (The Paypers)",
    "url": "https://thepaypers.com/fraud-and-fincrime/news/uae-banks-cancel-otps-switching-to-in-app-verification"
   }
  },
  {
   "market": "Philippines",
   "regulator": "Bangko Sentral ng Pilipinas",
   "measure": "Circular 1213: no SMS or email OTP for high-risk transactions",
   "timing": "From Jun 25, 2026",
   "status": "In force",
   "source": {
    "title": "No more SMS, email OTPs for high-risk financial transactions (GMA News)",
    "url": "https://www.gmanetwork.com/news/money/economy/992561/no-more-sms-email-otps-for-high-risk-financial-transactions-starting-june-25/story/"
   }
  },
  {
   "market": "India",
   "regulator": "Reserve Bank of India",
   "measure": "Authentication Directions 2025",
   "timing": "From Apr 1, 2026",
   "status": "In force",
   "source": {
    "title": "RBI mandates 2FA and new security rules for digital payments (Regulation Asia)",
    "url": "https://www.regulationasia.com/articles/rbi-mandates-2fa-and-new-security-rules-for-digital-payments"
   }
  },
  {
   "market": "Singapore",
   "regulator": "MAS and the Association of Banks in Singapore",
   "measure": "OTP login phase-out for customers with digital tokens",
   "timing": "From Jul 2024",
   "status": "In force",
   "source": {
    "title": "Banks in Singapore to strengthen resilience against phishing scams (MAS)",
    "url": "https://www.mas.gov.sg/news/media-releases/2024/banks-in-singapore-to-strengthen-resilience-against-phishing-scams"
   }
  },
  {
   "market": "Malaysia",
   "regulator": "Bank Negara Malaysia",
   "measure": "Banks directed off SMS OTP",
   "timing": "2022 \u2013 2024",
   "status": "In force",
   "source": {
    "title": "Malaysian banks stop using SMS for two-factor authentication (Commsrisk)",
    "url": "https://commsrisk.com/malaysian-banks-stop-using-sms-for-two-factor-authentication/"
   }
  },
  {
   "market": "European Union",
   "regulator": "Council and Parliament",
   "measure": "PSR / PSD3 fraud and SCA package",
   "timing": "Deal Nov 27, 2025",
   "status": "Pending",
   "source": {
    "title": "Payment services: Council and Parliament agree to step up the fight against fraud (Council of the EU)",
    "url": "https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/"
   }
  },
  {
   "market": "United States",
   "regulator": "NIST",
   "measure": "SP 800-63B-4: SMS OTP is a \"restricted\" authenticator",
   "timing": "Final 2025",
   "status": "Guidance",
   "source": {
    "title": "SP 800-63B-4: Authentication and Authenticator Management (NIST)",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
   }
  }
 ],
 "license": "https://creativecommons.org/licenses/by/4.0/"
}