• Home
  • News
  • UAE Central Bank Mandates End of SMS, OTP Authentication by 2026
uae

UAE Central Bank Mandates End of SMS, OTP Authentication by 2026

Author: teresa_myers | 10 Jul 2025

The UAE Central Bank has issued guidance to financial institutions to discontinue the use of SMS and email-based OTP authentication by March 2026.

The new compliance framework demands the adoption of secure, risk-based authentication methods. This includes Emirates Face Recognition, along with biometric verification, and mobile-based soft tokens. The secure session management and real-time monitoring of fraud are also now a requirement.

The big question, however, would be whether it could actually be implemented well. OTP inkling is being applied in multiple banks in the use of legacy systems.

The revised crypto tokens and use of biometric (authentication) will trigger a complete redesign of systems and apps. Another challenge that will be a question mark on the process of education of the less tech-savvy customers was also noted during the Emirates NBD and Smart Pass rollout.

This strategy to substitute SMS OTPs with biometrics and in-app authentication has already been implemented by the Emirates NBD, ADIB, and FAB banks. The vast majority of organizations still lag behind, although the number of scam cases in the UAE is extremely high, and this number has grown by 43% since the early years, despite the development of anti-scam measures.

The technologies that eliminate the use of passwords are becoming more popular as fraud incidents increase in the area. The most likely to become common are behavioral biometrics and passkeys guided by FIDO2 standards. They provide continuous authentication that cannot be phished.

The advances in technology are not enough on their own. According to professionals, in today’s world, cooperation is the sole thing that matters. This involves improved teamwork, better coordination, and ensuring awareness among people about what is at stake in languages they comprehend.

The UAE is not the sole and only one in this move. Country like Singapore has also stepped away from SMS codes. This action indicates a global shift toward stronger, more ingenious ways to ensure secure authentication.