The Central Bank of the United Arab Emirates (CBUAE) has issued a sweeping directive requiring all licensed financial institutions to phase out the use of SMS- and email-based one-time passwords (OTPs) for customer authentication by 31 March 2026. This move affects banks, finance companies, exchange houses, insurers, and payment service providers regulated by the CBUAE, marking a significant shift in how customers will access online and mobile services.
Mandatory Transition to Stronger Authentication
According to the supervisory circular, institutions must adopt “robust, risk-based user-authentication technologies,” which can include biometric verification systems such as Emirates Face Recognition, hardware and software tokens, and passkey authentication. These approaches have demonstrated stronger resistance to threats like phishing attacks, SIM swapping, and SS7 protocol exploits that have plagued traditional OTP delivery methods.
The regulator has outlined several additional security requirements beyond simply ending SMS and email OTPs. Licensed firms are required to implement real-time fraud monitoring systems capable of suspending active sessions when suspicious activity is detected. They must also provide customers with tools to manage and review authentication settings independently, increasing transparency and consumer control over account security.
Phased Compliance Timeline and Penalties
While institutions have until the end of March 2026 to complete the migration, the CBUAE expects measurable progress in interim periods and will conduct formal reviews of compliance milestones every six months. Any failure to meet the deadlines or demonstrate adequate risk management may result in administrative penalties. Under the circular, fines can escalate to AED 250,000 for significant breaches of the mandate.
This directive mirrors similar regulatory actions elsewhere in the region. In 2024, Singapore’s financial authorities announced a progressive phase-out of SMS OTPs, citing increased phishing scams and credential theft. Industry observers see the UAE’s decision as part of a broader trend to modernize digital banking security and reduce reliance on outdated verification systems.
Financial institutions are now tasked with preparing their systems for the transition and educating customers about upcoming changes. Clear communication strategies will be necessary to avoid confusion and ensure customers understand how to enroll in and use the new authentication tools effectively.
The CBUAE has emphasized that these measures are essential to keep pace with evolving cyber threats and to protect the integrity of the country’s financial system. As the compliance deadline approaches, both institutions and customers will need to adapt quickly to a security landscape that increasingly favors biometrics and advanced digital credentials over legacy authentication methods.
Source: BankInfoSecurity
–
By the ID Tech Editorial Team
