Topic starter
25/06/2026 12:56 am
TL;DR: The CBUAE will end SMS and OTP for UAE financial institutions by March 2026, pushing banks toward phishing-resistant passkeys that reduce fraud, user friction, and operational cost, according to HYPR. The real issue is not the authentication factor itself but the governance shift from legacy, interceptable credentials to device-bound assurance that changes how IAM, CIAM, and step-up controls are designed.
Editorial analysis by NHI Mgmt Group, based on content published by HYPR: “The CBUAE's SMS and OTP Ban is a Golden Opportunity”.
Key questions
Q: How should banks replace SMS OTP for high-risk transactions?
A: Banks should move high-risk actions to step-up authentication that is bound to the transaction, not the login.
Q: Why do SMS OTP codes remain risky even when they are paired with other controls?
A: SMS OTP remains risky because the code is still delivered through an interceptable channel and can be phished, redirected, or abused during SIM swap attacks.
Q: What should IAM teams review before rolling out passkeys at scale?
A: Review federation configuration, enrolment verification, recovery procedures, and the impact on support and help desk workflows.
Practitioner guidance
- Replace SMS OTP with phishing-resistant passkeys Prioritise customer journeys where code interception and SIM swap risk create the largest fraud exposure, then phase out OTP as the primary factor in those paths.
- Redesign transaction step-up around cryptographic assurance Use passkey-based confirmation for sensitive actions so step-up occurs inside the authenticated session instead of relying on a separate delivered code.
- Unify onboarding, login, and recovery into one CIAM control set Treat passkey enrolment, device binding, account recovery, and transaction approval as linked lifecycle stages rather than separate authentication projects.
Bottom line: The article frames the CBUAE ban as a governance reset for banking authentication, not just a compliance task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:03 am
SMS OTP bans expose a governance debt, not a feature gap: The CBUAE mandate shows that organisations have tolerated an authentication pattern whose threat model no longer matches the fraud environment. SMS OTP persists because it is familiar and easy to deploy, not because it offers durable assurance. Practitioners should read this as a signal that policy pressure is forcing long-delayed identity design decisions into the open.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: When is it safe to keep OTP as a fallback for banking customers?
A: It is only defensible as a tightly governed exception for limited recovery or transition use cases, not as the default login factor for sensitive accounts. If OTP remains easy to invoke, it becomes the weakest path in the authentication stack and weakens the overall passkey programme.
👉 Read our full editorial: Passkeys make SMS OTP bans a governance turning point