BSP Circular 1213: The SMS OTP Ban and What It Means for Philippine Business Security
On June 25, 2026, Bangko Sentral ng Pilipinas Circular No. 1213 took full effect, prohibiting the use of SMS-based one-time passwords as an authentication factor for financial services transactions in the Philippines. The circular is primarily directed at banks, e-money issuers, and payment service providers — but its downstream effects reach every Philippine business that touches financial systems or runs cloud infrastructure where MFA is a compliance requirement.
This article explains what the circular actually prohibits, which organisations are directly and indirectly affected, and what compliant alternatives look like for Philippine enterprise environments.
Why the BSP Acted on SMS OTP
SMS OTP has been the default second factor for Philippine digital banking since online banking became mainstream. The problem is that SMS OTP has fundamental security weaknesses that have become impossible to ignore:
SIM swap fraud — A fraudster convinces a mobile carrier to transfer a victim's number to a new SIM, then intercepts OTP messages. This is the most common financial fraud vector in the Philippines. DICT reported a significant rise in SIM swap cases in 2024–2025, accelerating the BSP's decision.
SIM jacking and SS7 attacks — Mobile network protocol vulnerabilities allow interception of SMS messages without physical SIM access. This is a technical attack typically used against high-value targets.
Social engineering — Phishing calls that trick users into reading OTP codes aloud remain highly effective. The OTP arrives legitimately; the user delivers it to the attacker.
The SIM Registration Act (RA 11934) was intended to reduce SIM swap fraud by requiring identity verification for SIM purchases. It has had limited effect — fraudsters adapted by using agents and documentation fraud.
BSP Circular 1213 is the next intervention: remove SMS OTP from the equation entirely for financial transactions, rather than relying on telecoms infrastructure to secure it.
What the Circular Prohibits
Circular 1213 prohibits BSP-supervised financial institutions (BSFIs) from using SMS-delivered OTPs as the sole or primary authentication factor for:
- Account access (online banking login)
- Fund transfers
- Payment transactions
- Account maintenance changes (address, contact number, beneficiary additions)
It does not prohibit SMS for notification purposes (transaction confirmations, alerts) — only for authentication.
The effective date was June 25, 2026 for new customers. Existing customers with SMS OTP configured had a transitional grace period, but BSFIs were required to actively migrate users to compliant alternatives and could not accept new SMS OTP enrolments after that date.
Who Is Directly Affected
Directly regulated:
- Universal and commercial banks
- Thrift banks and rural banks with digital channels
- E-money issuers (GCash, Maya, ShopeePay, etc.)
- Digital banks
- Payment service providers and payment system operators
If your business is in any of these categories, your authentication systems must already be circular-compliant or you are in violation.
Indirectly affected: This is the category most Philippine enterprises fall into. You are affected if:
- Your payroll disbursement uses a banking platform that authenticated employees via SMS OTP
- Your finance team uses online banking platforms for supplier payments
- Your accounting software (Ledgr, Xero, QuickBooks) integrates with banking APIs that relied on SMS OTP for authorisation
- Your e-commerce platform uses a payment gateway that passed SMS OTP to buyers
In all these cases, your workflow depends on a BSFI completing their Circular 1213 compliance — which they now have. But if any part of your payment or banking workflow broke or changed in July 2026, Circular 1213 is likely the reason.
What Counts as a Compliant Alternative
BSP Circular 1213 does not prescribe a single replacement technology. It requires authentication that meets the following criteria:
| Requirement | What it means |
|---|---|
| Not reliant on SMS delivery | No SMS channel at any point in the authentication flow |
| Phishing-resistant | The factor cannot be replicated by tricking the user into revealing it |
| Device-bound or possession-based | The authenticator is tied to a specific device or hardware token |
Compliant alternatives recognised by the BSP:
Time-based OTP (TOTP) authenticator apps — Google Authenticator, Microsoft Authenticator, Authy. The code is generated locally on the device without any SMS transmission. This is the most accessible replacement for most users.
Push authentication — Microsoft Authenticator push notifications, Duo Security, Okta Verify. The user approves a login attempt on their enrolled phone via an app notification. Phishing-resistant because the approval is device-bound.
Hardware security keys — FIDO2/WebAuthn-compliant keys (YubiKey, Feitian). The highest security standard; the key physically must be present and a passphrase typed. Standard for high-value access (treasury systems, financial admin accounts).
Biometric authentication on enrolled devices — Face ID or fingerprint combined with device possession. Compliant when implemented through a banking app that binds the biometric to a specific registered device.
The Microsoft 365 and Azure Angle
For Philippine enterprises running Microsoft 365, Circular 1213 is a useful forcing function to audit your own MFA configuration — even if you are not a BSFI. Microsoft has been pushing organisations away from SMS and voice OTP in Microsoft Entra ID (formerly Azure AD) for the same reasons the BSP cited.
Check your current MFA methods: In the Microsoft Entra ID admin centre → Authentication methods → Policies, you can see which methods are enabled for your tenant. If SMS and voice call OTP are enabled, they can be reached by an attacker who controls a user's phone number.
Recommended configuration for Philippine enterprises:
- Enable Microsoft Authenticator (push + number matching) as the primary MFA method — this is phishing-resistant and satisfies Circular 1213 requirements for BSFIs
- Enable passkeys (FIDO2) for admin accounts and finance team members
- Disable SMS and voice OTP in Entra ID authentication policies once Authenticator enrolment is complete
- Enforce MFA through Conditional Access rather than per-user legacy MFA — this gives you more control over when and how MFA is required
Microsoft Authenticator number matching — introduced in 2024 but not always enabled — is the specific control that prevents MFA fatigue attacks where an attacker spams approval requests hoping the user taps Accept out of frustration. Enable it in the Authenticator settings within your tenant.
Practical Steps for Philippine Businesses
If you run banking or payment operations:
- Confirm your banking platform has migrated to Circular 1213-compliant authentication
- Update any internal procedures that referenced SMS OTP steps
- Train finance staff on the new authentication flow before a payment run
If you run Microsoft 365 or Google Workspace for your team:
- Audit which MFA methods are enabled
- Migrate users to authenticator app-based MFA
- Disable SMS OTP in your identity provider settings
- Apply Conditional Access to enforce compliant MFA on financial and admin applications
If you run a customer-facing platform with authentication:
- If you were using SMS OTP for user login (even outside banking), now is the time to move to TOTP or passkeys
- Libraries like Microsoft MSAL, Auth0, and Supabase all support TOTP and FIDO2 natively
Related Reading
- Setting Up Microsoft Entra ID for Philippine SMEs
- Conditional Access Policies for Philippine M365 Tenants
- Zero-Trust Security for Philippine Businesses
- Microsoft Intune and MDM Setup Philippines
Talk to our Cloud & I.T. team about MFA and identity security
