Topic starter
08/06/2026 4:41 pm
TL;DR: Regulators in the EU, UAE, and Philippines are tightening strong-authentication requirements for digital banking and workforce access, with PSR, UAE banking rules, and ENISA guidance all pushing away from weak methods like SMS OTP and toward phishing-resistant MFA and device-aware controls, according to OneSpan. The shift makes authentication governance a cross-domain IAM issue, not just a banking security concern.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “Regulatory updates: Strong authentication for digital banking and the enterprise workforce”.
Key questions
Q: What should security teams do first when weak authentication is still allowed for high-risk access?
A: Start by inventorying every customer and workforce flow that still relies on SMS OTP, email OTP or static passwords alone.
Q: Why do weak authentication methods create fraud risk in digital banking?
A: Weak methods create fraud risk because they authenticate a session without proving that the person, device, and transaction are still trustworthy.
Q: What are the signs that an MFA programme is not strong enough for regulatory expectations?
A: Look for SMS OTP as the default second factor, shared methods across low- and high-risk flows, no device trust checks, and no separate policy for privileged access.
Practitioner guidance
- Define authentication tiers by risk level Map login, transaction approval, privileged access and workforce remote access to separate assurance requirements instead of one MFA policy.
- Remove SMS OTP from high-risk flows Phase out SMS OTP and email OTP for transaction signing, remote access and privileged operations where interception or replay is realistic.
- Adopt phishing-resistant MFA for privileged access Prioritise FIDO-based methods for admin, privileged and remote workforce sessions so the factor resists phishing and site replay.
Bottom line: Regulators are tightening strong-authentication expectations across banking and workforce access, which makes weak factors increasingly hard to defend for sensitive use cases.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
08/06/2026 6:27 pm
Authentication governance is becoming a cross-domain identity control, not a banking-only control. The article ties together customer banking, workforce access and privileged access under one policy shift. That matters because IAM teams can no longer keep consumer authentication and enterprise MFA in separate governance silos. The practical conclusion is that factor policy, device trust and assurance levels need one operating model across user types.
A question worth separating out:
Q: How should teams compare phishing-resistant MFA with OTP-based MFA?
A: Phishing-resistant MFA binds the credential to the legitimate site or device, while OTP-based MFA still allows code theft, relay and interception. The difference matters most where attackers can control the login surface, because a captured OTP can still authenticate a session that should have been blocked.
👉 Read our full editorial: Strong authentication regulations are shifting digital banking and workforce IAM
This post was modified 1 day ago by NHI Mgmt Group