o — SMS OTP is not banned in the UAE, India or the Philippines. UAE banks were directed by the Central Bank to phase SMS and e-mail one-time passwords out of customer authentication (the phase-out began on 25 July 2025), India's RBI kept SMS OTP as a permitted factor under technology-neutral two-factor rules in force since 1 April 2026, and the Philippines' BSP requires larger banks to limit interceptable OTPs from around 25 June 2026.
This guide summarises public regulatory texts and press reports as of 26 September 2026. It is general information, not legal advice — confirm your obligations with your regulator or counsel.
Key takeaways
- UAE: the phase-out applies to banks authenticating their own customers, and moves approval into the bank's mobile app. The Central Bank notice itself is not published; the dates come from press reports (Gulf News, Khaleej Times, 24 July 2025).
- India: the RBI Authentication Mechanisms Directions, 2025 require two distinct factors for digital payments from 1 April 2026, with at least one dynamic factor for everything except card-present payments. SMS OTP remains allowed.
- Philippines: BSP Circular No. 1213 (signed 30 May 2025) tells BSP-supervised institutions to limit OTPs sent by SMS and e-mail, and requires high-volume institutions to adopt biometrics, passwordless or adaptive authentication within one year of the circular's effective date.
- Non-banks — e-commerce, delivery, travel, SaaS, government-style portals — are not addressed by any of the three instruments. SMS OTP stays a normal way to verify a phone number or log in.
- SMS still has a regulated role in banking: the BSP circular lists SMS as a channel for real-time transaction notifications, and Saudi Arabia's SAMA rulebook requires instant SMS notifications for account transactions.
Is SMS OTP banned in the UAE?
No. What happened in the UAE is a bank-sector change, not a national ban. On 24 July 2025 Gulf News reported that "banks in the UAE will begin phasing out one-time passwords (OTPs) sent via SMS and email, starting Friday, July 25", with customers moving to an "Authentication via App" feature in their bank's smart application. Khaleej Times reported the same day that the move "follows directives from the Central Bank of the UAE and will be implemented in phases". Gulf News described complete discontinuation of SMS and e-mail OTPs as mandated by March 2026.
Two cautions matter for anyone writing policy from this. First, the Central Bank of the UAE (CBUAE) has not published the notice itself; the number and exact wording circulating online come from vendor blogs, so treat them as unconfirmed. Second, every public report is about banks authenticating their own customers' transactions and logins. None of them extends the change to other companies that use SMS codes to verify a phone number, confirm a delivery or sign a user in.
In practice UAE bank customers now approve card payments and sensitive actions inside the bank's app, typically with the phone's biometrics or an app PIN. For the wider regulatory context — sender-ID registration, promotional windows and consent — see our UAE SMS regulations page.
Does RBI ban SMS OTP from April 2026?
No. The Reserve Bank of India (Authentication Mechanisms for Digital Payment Transactions) Directions, 2025 were issued on 25 September 2025 and apply to "all Payment System Providers and Payment System Participants, including banks and non-bank entities", who had to comply by 1 April 2026. The core rule: "All digital payment transactions shall be authenticated by at least two distinct factors of authentication", and for everything other than card-present transactions "at least one of the factors of authentication is dynamically created or proven".
The directions set principles rather than naming a technology. The RBI notes that while no specific factor was mandated, the ecosystem "has primarily adopted SMS-based One Time Password (OTP) as the additional factor" — and nothing in the text prohibits it. What changes is accountability: "If any loss arises out of transactions effected without complying with these directions, the issuer shall compensate the customer for the loss in full." Issuers may also add risk-based checks on location, behaviour or device attributes on top of the two factors.
One more date is live now: card issuers must, by 1 October 2026, put in place a mechanism to validate non-recurring cross-border card-not-present transactions raised by an overseas merchant or acquirer. For Indian messaging rules — DLT registration, headers and templates — see India SMS regulations.
What does BSP Circular No. 1213 require in the Philippines?
BSP Circular No. 1213, Series of 2025 was approved by the Monetary Board on 22 May 2025, signed on 30 May 2025 and published on 10 June 2025. It takes effect 15 calendar days after publication, and BSP-supervised financial institutions (BSFIs) must comply "within one (1) year from its effective date" — which lands around 25 June 2026. The circular gives no calendar date itself; some press reports say 30 June, but the one-year rule points to 25 June.
The key line is a limitation, not a prohibition: BSFIs "should limit the use of authentication mechanisms that can be shared to, or intercepted by, third parties unrelated to the transaction", with OTPs via SMS and e-mail given as the example. Institutions "engaged in complex electronic products and services and handling high aggregate values of online transactions" — an average monthly transaction value of at least PHP 75,000,000 over the last six months — must adopt strong authentication: biometrics (fingerprint, face or voice), behavioural biometrics, passwordless authentication such as FIDO keys or hardware tokens, or adaptive authentication, plus strong device fingerprinting.
The circular also keeps SMS in the picture. OTP messages that are still sent "should be personalized with sufficient transaction details", real-time notifications may go "through secure channels such as mobile apps, messaging apps, email, or SMS", and BSFIs must not send clickable links or QR codes by e-mail, messaging apps or SMS unless the customer prompted them, the link is information-only, or it does not lead to a page asking for credentials. Country context: Philippines SMS regulations.
The three rules side by side
| Market | Regulator and instrument | Key date | Who is in scope | Is SMS OTP still allowed? |
|---|---|---|---|---|
| UAE | Central Bank of the UAE directive to banks (notice not published; reported 24 Jul 2025) | Phase-out from 25 Jul 2025; completion by March 2026 (press reports) | Banks authenticating their own customers | Being replaced by in-app authentication for bank customers; not addressed for non-banks |
| India | RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025 (25 Sep 2025) | Compliance by 1 Apr 2026; cross-border CNP by 1 Oct 2026 | All payment system providers and participants, banks and non-banks | Yes — two distinct factors, one dynamic; SMS OTP is a permitted factor |
| Philippines | BSP Circular No. 1213, Series of 2025 (signed 30 May 2025) | One year from effective date — around 25 Jun 2026 | BSP-supervised financial institutions; strong-authentication duty for high-volume ones | Limited, not banned; SMS remains a notification channel |
| Saudi Arabia | No official SAMA mandate to phase out SMS OTP found (checked 26 Sep 2026) | — | — | Yes; SAMA's rulebook requires instant SMS notifications for account transactions |
Who is in scope — and who is not?
The single most common mistake is assuming a bank-authentication rule applies to every business that sends a code. It does not. The scope is set by who the regulator supervises.
- In scope in the UAE: licensed banks authenticating customer logins and transactions (per press reports).
- In scope in India: every payment system provider and participant — banks, card issuers, wallets and other non-bank payment entities — for digital payment transactions.
- In scope in the Philippines: BSP-supervised financial institutions; the strong-authentication list applies to those above the PHP 75 million monthly threshold.
- Not in scope of any of the three: e-commerce log-ins and account recovery, ride-hailing and delivery confirmations, travel bookings, SaaS sign-ups, marketplaces and gaming — unless the business is itself a regulated payment entity.
- Not in scope: phone-number verification at sign-up, where the purpose is to prove possession of a number rather than to authorise a payment.
What replaces SMS OTP for bank customers?
The replacements share one idea: bind the approval to the customer's device or body, not to a code that can be read aloud to a fraudster or intercepted after a SIM swap.
- In-app approval: a push to the bank's own app, confirmed with biometrics or an app PIN — the route UAE banks took.
- Biometrics and behavioural biometrics: named explicitly in BSP Circular 1213.
- Passwordless and passkeys: FIDO-based keys stored on the device; see our guide from SMS OTP to passkeys.
- Network-based checks: silent network authentication and SIM-swap signals verify the number through the operator; see silent network authentication vs SMS OTP.
- Adaptive (risk-based) authentication: step-up only when device, location or behaviour looks unusual — permitted in India and listed in the Philippines.
Where SMS still belongs in 2026
Removing SMS from bank authentication does not remove SMS from banking. The same regulators keep it as a channel for notifications, and outside payments it remains the most universal way to reach a phone number that has not installed your app.
- Transaction alerts: the BSP circular lists SMS among real-time notification channels, and SAMA requires instant SMS notifications for account transactions.
- Phone-number verification at registration and on number change, ideally paired with a SIM-swap check.
- Log-in and recovery for non-bank apps, where SMS is often the only factor every user can receive.
- India: SMS OTP as one of the two factors, provided the other factor is distinct.
- Fallback: when a push or in-app channel fails, a multichannel verification service can fall back to WhatsApp, voice or SMS where the rules allow.
Checklist for banks and payment companies
- Map every flow that sends a code today — log-in, beneficiary add, card-not-present payment, limit change, device change — and tag which regulator's rule governs it.
- Move high-risk approvals to device-bound methods (in-app push with biometrics, passkeys) and document the second factor for India.
- Personalise any OTP you still send with transaction details (merchant, amount), as BSP expects, and never include a clickable link.
- Add risk signals — SIM-swap, device change, velocity — before trusting any possession factor.
- Keep SMS for real-time transaction alerts and monitor delivery; see our bank OTP delivery monitoring playbook.
- Record your decision per market, with the date checked, so auditors can see why each flow uses the method it does.
Checklist for non-bank apps
- Confirm you are not a regulated payment entity; if you are, the bank checklist applies to your payment flows.
- Keep SMS OTP for sign-up and log-in, and add WhatsApp or voice as fallback channels for reach and cost.
- Check for recent SIM swaps before sensitive account changes.
- Offer passkeys as an option for returning users, keeping SMS for recovery.
- Estimate the fraud exposure of each flow with the OTP security calculator.
BroadNet delivers OTPs to 200+ countries — direct to the operator in 86 — at a 99.99% platform SLA, with SIM-swap and number-intelligence checks and automatic fallback across SMS, WhatsApp and voice. See the OTP API, the multichannel MyOTP verification service, and our banking and finance solutions.
Frequently asked questions
Is SMS OTP banned in the UAE?
No. UAE banks were directed by the Central Bank to phase SMS and e-mail OTPs out of customer authentication, starting 25 July 2025 with completion reported for March 2026, and to use in-app authentication instead. The change applies to banks authenticating their own customers; it is not a national ban on SMS codes for other businesses.
Does the CBUAE rule apply to e-commerce, BNPL or delivery apps?
Public reporting describes the directive as applying to banks. It does not mention e-commerce, delivery or other non-bank apps. A company licensed by the Central Bank for payments should check its own licence obligations with the regulator, because the notice text has not been published.
What replaced SMS OTP for UAE bank customers?
In-app authentication. Customers approve payments and sensitive actions in their bank's mobile app, typically with the phone's biometrics or an app PIN, instead of typing a code received by SMS or e-mail.
Does RBI ban SMS OTP from April 2026?
No. The RBI directions effective 1 April 2026 require at least two distinct authentication factors for digital payments, with at least one dynamic factor except for card-present transactions. They do not mandate or forbid any technology, and SMS OTP remains a permitted factor. Issuers must fully compensate customers for losses from non-compliant transactions.
What is BSP Circular No. 1213?
It is the Bangko Sentral ng Pilipinas circular, signed on 30 May 2025, that updates authentication and fraud-management standards for BSP-supervised financial institutions. It tells them to limit interceptable authentication such as SMS and e-mail OTPs, and requires high-volume institutions to adopt biometrics, passwordless or adaptive authentication within one year of its effective date — around 25 June 2026.
Can SMS OTP still be used to verify a phone number?
Yes. None of the three rules restricts using an SMS code to prove that a user controls a phone number at sign-up or on number change. Pairing that check with a SIM-swap lookup makes it considerably harder to abuse.
Is Saudi Arabia's SAMA banning SMS OTP?
We found no official SAMA mandate to phase out SMS OTP as of 26 September 2026. SAMA's rulebook does require banks to send instant SMS notifications for account transactions. Claims of a SAMA deadline circulating online are speculation until SAMA publishes one.
What should a bank use when the app is unavailable?
That depends on the regulator: the Philippine circular limits rather than bans SMS OTP, and India allows it as one of two distinct factors. Design a documented fallback per market — for example a second device-bound method or an assisted channel — and check it with your regulator before relying on SMS as the fallback.
Sources
- Reserve Bank of India — Authentication Mechanisms for Digital Payment Transactions Directions, 2025, 25 September 2025: rbi.org.in (accessed 26 September 2026).
- Bangko Sentral ng Pilipinas — Circular No. 1213, Series of 2025, signed 30 May 2025: bsp.gov.ph (accessed 26 September 2026).
- Gulf News — "UAE banks to stop sending OTPs via SMS and email from July 25", 24 July 2025: gulfnews.com.
- Khaleej Times — UAE banks to phase out OTPs from July 25, 24 July 2025: khaleejtimes.com.
- Saudi Central Bank (SAMA) Rulebook — Instant SMS notification service: rulebook.sama.gov.sa (accessed 26 September 2026).