New central bank AI guidelines take effect, with banks gradually phasing out email and SMS OTPs.
Dubai: More banks in the United Arab Emirates are phasing out SMS- and email-based one-time passwords (OTPs) following new Central Bank of the UAE rules that strengthen digital security and fraud prevention across the financial sector.
By the end of next month, all licensed financial institutions in the United Arab Emirates must phase out SMS and email OTPs, replacing them with in-app approvals, biometric authentication, and risk-based verification systems.
This move is part of a wider 2026 regulatory initiative designed to enhance fraud detection, AI governance, and operational resilience across the banking sector.
App and biometric logins
“As per directives from the Central Bank of the UAE, the use of OTPs via SMS or email is being phased out. Customers can now complete online transactions conveniently by selecting the ‘Authentication via App’ feature in their bank’s mobile application,” a spokesperson from a Dubai bank said.
Under the new system, customers approve transactions directly within their banking apps, typically using fingerprint recognition, facial authentication, or a secure PIN.
The change impacts everyday activities for residents, such as online shopping, fund transfers, and card payments, which have traditionally relied on six-digit codes sent via SMS.
Stopping fraud now a priority
“As the new regulations from the Central Bank of the UAE take effect at the end of March, fraud prevention is a top priority for banks and financial institutions,” said Rob Woods, senior director of fraud and identity at LexisNexis Risk Solutions.
“The rules mandate capabilities such as active call detection and screen-sharing monitoring, while promoting the use of behavioural intelligence to intercept scams in real time,” he added.
Woods noted that while larger banks are generally more advanced in implementing the new measures, “many smaller institutions are only now beginning to address these requirements,” as impersonation fraud continues to rise across the Middle East.
More scams under scrutiny
“Impersonation fraud is surging in the Middle East, with criminals posing as government officials or bank staff, and social media-driven phishing scams increasingly targeting younger users,” Woods said.
“Romance scams also remain a threat, highlighting the urgent need for stronger, technology-driven solutions.”
Regulators and industry leaders point out that SMS-based authentication has been repeatedly exploited in SIM-swap and social engineering attacks, where victims are tricked into sharing OTP codes.
AI governance tightened
Alongside the authentication reforms, the Central Bank of the UAE has issued new guidance on the use of artificial intelligence and machine learning in financial services.
The framework sets accountability standards for banks deploying AI tools in areas such as risk monitoring, fraud detection, and customer profiling, requiring oversight mechanisms and safeguards for automated decision-making.
“The guidance note aims to establish a clear framework for the responsible use of artificial intelligence and machine learning in the financial sector, enhancing consumer protection, reinforcing governance and transparency, and emphasising the importance of human oversight and data protection,” said Khaled Mohamed Balama, Governor of the Central Bank of the UAE.
For residents in the United Arab Emirates, the immediate impact is practical: online transactions will increasingly rely on biometric or in-app approvals instead of SMS codes, as banks work to meet the March 2026 deadline and comply with strengthened digital security measures.
