Topic starter
08/06/2026 4:41 pm
TL;DR: Financial regulators in the EU, UAE, and Philippines are tightening strong authentication requirements by limiting SMS OTPs, expanding phishing-resistant MFA guidance, and pushing more resilient customer and workforce controls, according to OneSpan. The direction is clear: identity programmes that still rely on weak second factors will struggle to meet emerging compliance and fraud expectations.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “Mises à jour réglementaires : Authentification forte pour clients et personnel”.
Key questions
Q: What breaks when organisations rely on SMS or email MFA for sensitive access?
A: The control breaks when the second factor can be intercepted, relayed, or socially engineered.
Q: Why do banks need phishing-resistant authentication instead of stronger MFA?
A: Stronger MFA still fails if the second factor can be relayed, intercepted, or approved under pressure.
Q: How can organisations tell whether their MFA programme is actually strong enough?
A: Look for coverage gaps, exception paths, and methods that can be reset, replayed, or coerced through user interaction.
Practitioner guidance
- Replace broad SMS OTP dependence Identify customer and workforce flows that still rely on SMS or email OTP as the primary or only factor, then set a removal timetable for sensitive actions and remote access.
- Prioritise phishing-resistant MFA for high-risk access Use cryptographic or FIDO-based authentication for remote login, privileged access and transaction approval where replay, phishing or interception would create material loss.
- Separate authentication policy by journey risk Define different factor requirements for customers, employees and privileged users so low-risk convenience settings do not leak into high-risk access paths.
Bottom line: Strong customer authentication is tightening across multiple regions, and weak second factors are being pushed toward the edge of acceptable use.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 hours ago by NHI Mgmt Group
08/06/2026 6:26 pm
Phishing-resistant authentication is becoming the regulatory floor, not an advanced option. The article shows a clear shift across banking and critical-sector guidance away from SMS OTP and toward stronger, possession-bound or cryptographic factors. That matters because compliance programmes built around weak fallback factors will increasingly fail policy review even when they still pass technical login checks. Practitioners should treat this as a baseline reset for authentication design.
A question worth separating out:
Q: Should customer and workforce authentication be governed the same way?
A: They should be governed under the same risk framework, but not with identical controls. Customer journeys often need accessibility and channel flexibility, while workforce and privileged access can usually support stronger device-bound methods. The practical goal is consistent policy logic with different factor thresholds by use case.
👉 Read our full editorial: Strong customer authentication rules are tightening across regions
This post was modified 4 hours ago by NHI Mgmt Group