The UAE has become the first country in the world to formally mandate that banks phase out SMS and email OTP as a primary authentication method. Under Central Bank of the UAE (CBUAE) Notice 3057, licensed banks and financial institutions have until 31 March 2026 to move high-risk authentication to stronger methods — and the shift has direct implications for compliance teams, developers, and any business that touches banking-adjacent authentication flows.
What CBUAE Notice 3057 Actually Requires
The rolling implementation began in July 2025, with the first hard milestone applying to online card payment authentication from January 2026, and the full deadline for broader authentication flows set for 31 March 2026. Institutions in scope are required to replace SMS and email OTP with stronger authentication methods, which the directive names explicitly:
Emirates Face Recognition — the UAE's state biometric identity infrastructure.
FIDO2 cryptographic passkeys — phishing-resistant, device-bound authentication.
Secure in-app push approvals — confirmed with biometric or PIN verification inside the bank's own app.
Behavioral biometrics — continuous risk signals (typing pattern, device handling) used alongside primary authentication.
A small documented exception remains: an estimated 3-5% of customers — those on basic feature phones, certain expat residents without compatible devices, and elderly or accessibility-needs users — may retain SMS OTP as a fallback where no viable alternative exists.
Why the UAE Is Moving First
SMS OTP's core weakness is that it depends on the mobile network's underlying signalling layer, which is vulnerable to SIM-swap fraud and, on compromised Android devices, SMS-interception malware. Under the new directive, banks now carry full liability for reimbursing customers whose funds are lost through SIM-swap or phishing attacks conducted via SMS OTP — a direct financial incentive, on top of the regulatory mandate, to migrate away from it.
Who Is — and Isn't — Affected
In Scope
UAE-licensed banks
Payment service providers regulated by CBUAE
Other CBUAE-licensed financial institutions
Not in Scope
E-commerce platforms and online retailers
Buy-now-pay-later (BNPL) providers outside CBUAE licensing
Ride-hailing and delivery apps
Healthcare booking platforms
Government service portals
Non-bank fintech apps outside CBUAE's regulatory perimeter
This distinction matters: businesses outside banking do not need to abandon SMS OTP. It remains a compliant, effective authentication and verification channel for the vast majority of UAE digital services.
What Banks and Fintechs Should Be Doing Now
1. Audit Every Authentication Touchpoint
Map every flow that currently relies on SMS or email OTP — login, password reset, payment confirmation, high-value transfers — and classify each by risk level and regulatory exposure.
2. Prioritize by Deadline Pressure
Online card payment authentication was the first hard cutoff (January 2026). If that migration isn't complete, it should be the immediate priority, with broader authentication flows following ahead of the March 2026 deadline.
3. Plan the Fallback Population Carefully
The 3-5% of customers who may need to retain SMS OTP as a documented exception still need a clear, auditable process — this isn't a loophole to keep the old system running for everyone by default.
4. Communicate the Change to Customers Early
A sudden authentication method change without warning generates support tickets and trust concerns. Banks moving ahead of schedule — reports suggest Emirates NBD, FAB, and ADCB are among those ahead of the curve as of early 2026 — have generally paired the technical migration with proactive customer communication (often via the very channels, like SMS and WhatsApp, that remain compliant for non-authentication notifications).
What This Means Beyond Banking
Regulatory watchers expect similar moves elsewhere in the region: Saudi Arabia's SAMA is anticipated to consider a comparable directive within roughly 12-24 months, with Bahrain potentially following within about 18 months. Even businesses outside CBUAE's direct scope should treat this as an early signal — regulators are actively re-evaluating SMS OTP's role in high-risk authentication, and building flexibility into your authentication stack now avoids a rushed migration later.
Sample Customer Communication Templates
SMS (non-authentication, permitted): [Bank Name]: We're upgrading how you verify transactions for extra security. From [date], you'll confirm payments using Face ID / passkey instead of SMS codes. Learn more: [link]
WhatsApp: 🔐 A quick update from [Bank Name]: we're moving to stronger, faster verification (no more waiting for SMS codes!). Set up your new secure login here: [link]
Frequently Asked Questions
Does this directive ban SMS OTP everywhere in the UAE?
No. It specifically requires CBUAE-licensed banks and financial institutions to move away from SMS/email OTP as their primary authentication method. E-commerce, delivery, healthcare, and most other sectors are unaffected and can continue using SMS OTP.
What is the exact deadline?
31 March 2026, with an earlier hard cutoff (January 2026) already in effect for online card payment authentication specifically.
Who bears the cost if a customer loses money through SMS OTP fraud after the deadline?
Under the directive, banks bear liability and must reimburse customers whose funds are lost through SIM-swap or phishing attacks conducted via SMS OTP.
Can a bank still use SMS for non-authentication notifications, like balance alerts?
Yes — the directive targets authentication specifically. General notifications and alerts sent via SMS or WhatsApp are unaffected, provided they otherwise comply with standard UAE messaging rules.
Conclusion
CBUAE Notice 3057 marks a genuine first in global banking regulation — a central bank formally mandating the retirement of SMS OTP as primary authentication. For UAE banks and fintechs, the March 2026 deadline is close enough that any institution not already migrating is behind schedule. For everyone else — e-commerce, delivery, healthcare, and general consumer apps — SMS OTP remains a fully compliant and effective tool. Knowing which category your business falls into is the first step to responding correctly rather than over- or under-reacting to the headline.