Which countries are moving banks off SMS OTP?
Singapore, Malaysia, the UAE and the Philippines have ordered banks off SMS or email codes for some or all transactions since 2022. India's 2025 RBI rules, in force April 2026, open the door to alternatives.
| Market | Regulator | Measure | Timing | Status | Source |
|---|---|---|---|---|---|
| UAE | Central Bank of the UAE | SMS and email OTP phase-out | Jul 2025 – Mar 2026 | Complete | Source |
| Philippines | Bangko Sentral ng Pilipinas | Circular 1213: no SMS or email OTP for high-risk transactions | From Jun 25, 2026 | In force | Source |
| India | Reserve Bank of India | Authentication Directions 2025 | From Apr 1, 2026 | In force | Source |
| Singapore | MAS and the Association of Banks in Singapore | OTP login phase-out for customers with digital tokens | From Jul 2024 | In force | Source |
| Malaysia | Bank Negara Malaysia | Banks directed off SMS OTP | 2022 – 2024 | In force | Source |
| European Union | Council and Parliament | PSR / PSD3 fraud and SCA package | Deal Nov 27, 2025 | Pending | Source |
| United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | Guidance | Source |
Methodology
Sigil lists a jurisdiction when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for authenticating financial transactions or logins. Status is checked against the primary document or regulator statement. Dates are effective dates unless noted.
Embed this tracker
Copy this code to show the live table on your site. Attribution to Sigil is built in.
<iframe src="https://glide-sigil.pages.dev/embed/trackers/sms-otp-regulation/" title="SMS OTP: who is phasing it out" width="100%" height="560" style="border:0"></iframe>