Financial institutions to replace SMS and Email OTPs with secure authentication methods

All licensed financial institutions are required to phase out SMS and email one-time passwords by the end of next month, transitioning instead to more secure methods such as in-app approvals, biometric verification and risk-based authentication.

The move is part of a wider 2026 regulatory drive to enhance fraud prevention, strengthen artificial intelligence oversight and boost operational resilience across the banking sector.