n 23 August 2026 the Central Bank of Egypt (CBE) issued its Regulations Governing the Services of the Digital Financial Identity Platform, the rulebook for opening bank accounts and verifying customers remotely (eKYC). For SMS verification the key line is short: a bank verifying customers through its own app must confirm the mobile number belongs to the customer, and is in their possession, by sending a text message containing a one-time password (OTP). Older CBE wallet rules, still published, say SMS must not deliver the second factor for high-risk actions. This guide sets out what each rule says and how BroadNet suggests Egyptian banks, wallets and fintechs design OTP around them.
This guide summarises public regulatory texts as of 10 October 2026. It is general information, not legal advice — confirm your obligations with the Central Bank of Egypt, the NTRA, the PDPC or your counsel before relying on it.
Key takeaways
- The CBE Board approved the Digital Financial Identity (DFI) regulations on 17 June 2026; a circular dated 23 August 2026 sent them to banks. They apply to all banks in Egypt, licensed entities that may join the platform and CBE-authorised banking agents.
- A bank verifying customers in its own app must check possession of the mobile number "by sending a text message containing a One-Time Password (OTP)", then bind a DFI certificate to the device.
- The platform authenticates with four mechanisms: the device-bound DFI certificate, OTP, a six-digit Global PIN and biometrics.
- It can replace a handwritten signature for non-financial transactions; authenticating financial transactions needs a separate CBE approval.
- The CBE's mobile payment rules (April 2021) require two factors for high-risk wallet actions and say OTPs must not be sent automatically and directly by SMS or email for them. SMS stays the named channel for alerts.
- Per the PDPC, data held by the CBE and entities it supervises is outside the data protection law, except money transfer companies and exchange offices.
What did the Central Bank of Egypt issue in August 2026?
The CBE's release of 23 August 2026 says its Board approved "the regulations governing the services of the Digital Financial Identity (DFI) Platform for identifying bank customers and verifying their identities electronically (eKYC)"; the covering circular records Board approval on 17 June 2026. Governor Hassan Abdalla said the platform lets citizens open accounts and obtain banking products through digital channels without visiting a branch, with electronic acceptance of terms and electronic authentication "as an alternative to handwritten signatures".
The rules cover eKYC (identification, verification and identity updates), electronic authentication of transactions, payment and transfer orders and acceptance of terms, and sharing a customer's DFI between participants. The platform is run inside Egypt by the Digital Financial Identity Company, "Haweya", which reads national ID data through trusted sources such as the Civil Status Organization, plus NFC chip reading and liveness detection. The August circular said the anti-money-laundering unit (EMLCU) would issue the electronic identification procedures; a CBE circular of 28 September 2026 says the EMLCU approved their first edition that month. None of these texts sets a separate compliance deadline.
Where does SMS OTP appear in the DFI regulations?
| Clause (DFI regulations) | What it says | What it means for OTP |
|---|---|---|
| 4, Second, 2.1 | A bank using its own apps must verify the mobile number belongs to the customer and is in their possession by an SMS containing an OTP | SMS OTP is the onboarding possession check — it must reach the number on file first time |
| 4, Second, 2.2 | Then issue the DFI certificate and bind it to the customer's device and apps | Routine logins rely on the bound device; SMS becomes the recovery and re-binding channel |
| 5, item 7.2 | Haweya offers four mechanisms: DFI certificate on the same app and device, OTP, Global PIN, biometrics | OTP is one factor of four, not the whole model |
| 4, First, 7 | Notify the customer that DFI creation is complete through more than one method | Pair an SMS confirmation with an in-app or email notice |
| 4, Fifth, 1 | Monitor repeated failed logins and incorrect authentication attempts in a short period; contact the customer immediately | Log every OTP attempt and alert on bursts of failures |
The surrounding controls are strict too: root and jailbreak detection and certificate pinning in the app, incident notice to the CBE within six hours, 48 hours' notice of planned outages, and — before launch — penetration tests, a SOC 2 Type 1 report (Type 2 within six months) and a privacy impact assessment.
Is SMS OTP enough for payments in Egypt?
Not for every action. The CBE's Mobile Payment Services Regulations (third edition, April 2021) define high-risk activities to include payment orders to several beneficiaries at once, orders exempt from the transfer ceiling and changes to contact details. For those, banks must use two means together and must not grant one-time passwords "automatically and directly" by SMS or email; OTPs from token devices or apps must be at least six characters and valid for no more than 90 seconds. Other transactions are re-authenticated with a PIN of at least six digits, with at most five failed attempts before suspension. SMS still has a defined job: banks must alert wallet users to transactions and high-risk activity by SMS or email unless they opt out, and a payment order cannot be created by SMS, though SMS may confirm one.
The Instant Payment Network (IPN) rules of October 2021 require two factors for every IPN payment: hard binding of the phone (device fingerprint plus number) and a six-digit IPN PIN, with OTPs handled only inside the network's secure library. Banks must notify customers of transactions "through text messages or any other approved method". The CBE's March 2023 card-tokenization rules give an SMS OTP to the phone registered with the bank as one way to verify the cardholder.
| Moment in the journey | Role of SMS in the CBE texts | Source |
|---|---|---|
| eKYC onboarding in the bank's own app | Required: SMS OTP proves possession of the number | DFI regulations 2026, 4-Second-2.1 |
| Opening a wallet for an existing customer | Bank must confirm ownership or possession of the number | Mobile payment rules 2021, 3-3-20 |
| Adding a card to a device wallet | SMS OTP to the registered phone is an example method | Tokenization rules 2023, 3-2-5 |
| High-risk wallet action | Two factors; OTP not sent automatically and directly by SMS or email | Mobile payment rules 2021, 3-4-5-1 |
| IPN payment | Device binding + IPN PIN | IPN rules 2021, 4-7 to 4-9 |
| Transaction alerts | SMS named as the channel | Mobile payment rules 3-6-8; IPN rules 3-1-9 |
SMS proves the number, binds the device and keeps the customer informed; the strongest actions rely on the device plus a PIN or biometric. We compare the UAE, India and the Philippines in Is SMS OTP banned?.
What do NTRA rules mean for OTP messages to Egypt?
The National Telecom Regulatory Authority (NTRA) licenses bulk SMS under its framework for mobile value-added services, which defines "Bulk SMS (One to One)" — the category OTPs fall into. Licensees must show the sending entity's name in every message, preceded by an NTRA-set code; notify the NTRA of each customer's name and sender ID before contracting; ensure the sender is in Egypt; and not route international messages into Egypt without the NTRA's prior written approval. So a bank's OTP needs a registered sender ID naming the bank, sent over a licensed local channel.
BroadNet's Egypt coverage page lists licensed termination with direct binds to Vodafone Egypt, Orange Egypt, e& Egypt and WE, and sender-ID registration in 7–14 business days; the paperwork is in our Egypt A2P SMS guide and sender ID registration in Egypt. On the operator side, e& Egypt runs BroadNet's A2P firewall against grey routes. The NTRA's wallet rules add that each number can open only one wallet and no transaction completes without the customer's PIN, so the phone number is the wallet identity — check for SIM swaps and recycled numbers (Number Verify and SIM Swap APIs).
How does Egypt's data protection law treat OTP traffic?
Law No. 151 of 2020 now has executive regulations, which the Personal Data Protection Centre (PDPC) cites as Executive Regulation No. 816 of 2025. The PDPC lists "personal data held by the Central Bank of Egypt and entities under its supervision and control, except money transfer companies and exchange offices" among the exemptions, so banks follow CBE data rules such as the DFI controls; whether a fintech is inside that carve-out is a question for counsel. Where the law applies, contractual necessity is a lawful basis — the fit for a code the user requested — while marketing needs explicit consent, a free opt-out and possibly an e-marketing licence. Breaches go to the PDPC within 72 hours, and transfers abroad need a PDPC licence or permit, so ask vendors where message logs live (data residency).
How should Egyptian banks and wallets design OTP?
BroadNet's recommendations for meeting these rules:
- Use SMS OTP for the onboarding possession check, then bind the device; keep SMS for recovery and re-binding.
- For high-risk wallet actions, use an in-app or token code plus a second factor, then send an SMS alert.
- Register a dedicated OTP sender ID in your brand name, separate from marketing, on licensed local routes.
- Put the code first. Arabic uses UCS-2, so one SMS holds 70 characters, not 160 (encoding guide); add the autofill line.
- Use short expiry, capped attempts and full logs of sends, delivery receipts and verifications — the DFI rules require monitoring of failed authentication.
- If no delivery receipt arrives in your window, retry once on another route, then offer voice OTP; never resend endlessly.
- Check for SIM swaps before sending to a recently changed number (SIM swap fraud).
- Feed OTP metrics into fraud and incident processes (bank OTP monitoring playbook).
BroadNet's OTP API covers this pattern: SMS with automatic voice fallback when no delivery receipt returns, per-destination sender-ID handling and delivery receipts on every attempt. Egypt list prices start at $0.028 per SMS on e& Egypt (Etisalat Misr), $0.030 on Vodafone Egypt, $0.032 on Orange Egypt and $0.035 on WE (SMS pricing in Egypt); for vendor questions see best SMS provider in Egypt.
BroadNet has run carrier-grade messaging since 2003, with 1,000+ direct operator connections, a 99.99% SLA and SOC 2 Type II. Request test access and an engineer replies within one business day; integration typically takes 2–5 business days, with sender-ID approval running alongside.
Frequently asked questions
What is the CBE Digital Financial Identity platform?
The CBE-approved platform for creating a customer's digital financial identity and verifying customers electronically (eKYC), run inside Egypt by the Digital Financial Identity Company, Haweya. Its rules were issued in a CBE circular dated 23 August 2026.
Do the CBE eKYC rules require SMS OTP?
Yes, in one case: a bank verifying identity in its own apps must confirm possession of the mobile number with an SMS OTP before binding a DFI certificate to the device. OTP is also one of the platform's four authentication mechanisms.
Who must comply with the DFI regulations?
All banks operating in Egypt, licensed entities eligible to join the platform, and CBE-authorised banking agents. The rules are a minimum on top of the CBE's electronic banking, AML/CFT and operational risk rules.
Can the DFI platform authenticate payments?
Banks may use it for non-financial transactions in place of a handwritten signature. Authenticating financial transactions needs an additional CBE approval and compliance with its electronic authentication controls.
Can mobile wallets in Egypt use SMS OTP for transfers?
Not for high-risk actions such as paying several beneficiaries at once: the 2021 mobile payment rules require two factors and bar sending those OTPs automatically and directly by SMS or email. Other transactions use a PIN, and SMS carries the alerts.
Does Egypt's PDPL apply to banks' OTP data?
According to the PDPC, data held by the CBE and entities it supervises is outside the PDPL, except money transfer companies and exchange offices. Those two, and businesses outside CBE supervision, are covered by the law.
Do OTP messages to Egypt need a registered sender ID?
Yes. The NTRA framework requires the sender's name in every message and the sender ID to be notified to the NTRA before a customer is contracted.
Can international routes deliver OTPs to Egypt?
Not without approval: NTRA licensees may not bring international messages into Egypt without the NTRA's prior written approval. Use a provider that terminates through licensed local channels.
We read every text below on 10 October 2026 on the regulator's own website; Arabic-only texts were read in Arabic. See our editorial standards and Egypt SMS regulations.
Sources
- CBE — eKYC regulations news release, 23 August 2026: cbe.org.eg.
- CBE — Digital Financial Identity page, updated 23 August 2026: cbe.org.eg.
- CBE — DFI regulations, English text: cbe.org.eg.
- CBE — Circular of 23 August 2026 on the DFI rules (Arabic): cbe.org.eg.
- CBE — Circular of 28 September 2026 on KYC of banks' customers (Arabic), circulars list: cbe.org.eg.
- CBE — Mobile payment services rules, 3rd edition, April 2021 (Arabic): cbe.org.eg.
- CBE — Instant Payment Network rules, October 2021: cbe.org.eg.
- CBE — Card tokenization circular, 8 March 2023 (Arabic): cbe.org.eg.
- NTRA — Mobile value-added services framework (tra.gov.eg, PDF) and Mobile Wallets regulatory rules (tra.gov.eg), accessed 10 October 2026.
- PDPC — FAQs on Law No. 151 of 2020 and Executive Regulation No. 816 of 2025, accessed 10 October 2026: portal.pdpc.gov.eg.