Central banks in Singapore, Malaysia, India, the Philippines and the UAE.
The Central Bank of the UAE gave banks nine months to stop sending one-time passcodes by text and email. The deadline has passed; the playbook is worth studying.
From June 25, 2026, banks and e-money issuers in the Philippines can no longer rely on SMS or email one-time passcodes for high-risk transactions.
MAS and the Association of Banks in Singapore say customers who have activated a digital token on their phone will no longer be able to log in with a one-time passcode.