The Central Bank of the United Arab Emirates (CBUAE) has directed licensed financial institutions to phase out SMS and email-based one-time passwords (OTPs) for digital banking authentication by March 31, 2026. The move will replace OTPs with stronger, phishing-resistant methods such as biometric verification, cryptographic passkeys, and in-app push notifications.
Timeline and rollout
The transition began on July 25, 2025, when banks started introducing new verification methods for online and mobile transactions. Institutions have until the March 2026 deadline to fully comply with the directive, which is designed to improve security and reduce fraud risks in the UAE’s rapidly growing digital banking sector.
The shift follows a rise in fraud incidents that exposed the vulnerabilities of OTP-based authentication. Under the new rules, acceptable verification methods include fingerprint and facial recognition, FIDO2-compliant passkeys, and app-based confirmation prompts. The UAE’s national digital identity system, UAE Pass, and Emirates facial recognition services will support identity verification in the new framework.
Customer communication and global context
“The key is communication,” said a senior UAE bank executive. “We have to explain to customers that what feels like a big change is actually a win-win: stronger protection and less hassle.” Banks are expected to run customer education campaigns over the next 18 months to help users update their mobile banking applications and enable the new authentication features.
This change reflects a wider global trend toward passwordless authentication. Standards bodies such as the FIDO Alliance report that billions of accounts already support passkeys, with adoption accelerating across banking, payments, and other high-security sectors.
UAE residents are advised to update their banking apps well ahead of the March 2026 cutoff to avoid service disruptions. By aligning with global authentication best practices, the CBUAE aims to strengthen consumer protection while streamlining the digital banking experience.
Sources: Jagran Josh, Times of India, Khaleej Times
–
By Cass Kennedy
