Fraud rules by market. India first, then APAC and the Gulf.
DeepID was built on India’s rails and rules. The same six controls now appear market by market: binding, factors beyond SMS OTP, risk-based checks, cooling-off, mule detection and liability moving to banks. Every rule carries its date, its status and a link to its source.
Research current to 22 October 2026. A summary of public rules, not legal advice. DeepID supports compliance and never guarantees it.
Six controls, seven markets.
“Mapped” means a rule in force, or issued with a start date, calls for the control in that market. A proposal never marks the map. The modules that support each control are listed beside it.
| Control | India | Singapore | Malaysia | Philippines | Australia | UAE | Saudi Arabia | DeepID modules |
|---|---|---|---|---|---|---|---|---|
| Device and SIM bindingOne customer, one registered device and SIM, re-verified when either changes. | Mapped in India | Not mapped yet in Singapore | Mapped in Malaysia | Not mapped yet in the Philippines | Not mapped yet in Australia | Not mapped yet in the UAE | Not mapped yet in Saudi Arabia | SIM and device binding, Device intelligence |
| Beyond SMS OTPFactors that cannot be phished or intercepted, such as in-app, carrier and biometric checks. | Mapped in India | Mapped in Singapore | Mapped in Malaysia | Mapped in the Philippines | Not mapped yet in Australia | Mapped in the UAE | Not mapped yet in Saudi Arabia | Silent network verification, Liveness and face match |
| Risk-based checksReal-time, risk-based checks at login, new payee and payment, not only at sign-in. | Mapped in India | Mapped in Singapore | Mapped in Malaysia | Not mapped yet in the Philippines | Mapped in Australia | Not mapped yet in the UAE | Mapped in Saudi Arabia | Device intelligence, Behavioural biometrics, Scam signals, Payee and mule graph, One decision, with reasons |
| Cool-off and holdsSlow down new devices and payees, and hold payments that look coerced. | Not mapped yet in India | Mapped in Singapore | Mapped in Malaysia | Mapped in the Philippines | Not mapped yet in Australia | Not mapped yet in the UAE | Not mapped yet in Saudi Arabia | SIM and device binding, One decision, with reasons |
| Mule detectionSpot accounts that receive and pass on stolen money. | Mapped in India | Not mapped yet in Singapore | Mapped in Malaysia | Mapped in the Philippines | Not mapped yet in Australia | Not mapped yet in the UAE | Not mapped yet in Saudi Arabia | Payee and mule graph |
| Bank liabilityLosses shift to the bank or payment firm that missed its duties. | Mapped in India | Mapped in Singapore | Not mapped yet in Malaysia | Not mapped yet in the Philippines | Mapped in Australia | Not mapped yet in the UAE | Not mapped yet in Saudi Arabia | One decision, with reasons |
Scroll sideways for more markets →
India
Mapped: Device and SIM binding, Beyond SMS OTP, Risk-based checks, Mule detection, Bank liability.
Not mapped yet: Cool-off and holds.
Singapore
Mapped: Beyond SMS OTP, Risk-based checks, Cool-off and holds, Bank liability.
Not mapped yet: Device and SIM binding, Mule detection.
Malaysia
Mapped: Device and SIM binding, Beyond SMS OTP, Risk-based checks, Cool-off and holds, Mule detection.
Not mapped yet: Bank liability.
Philippines
Mapped: Beyond SMS OTP, Cool-off and holds, Mule detection.
Not mapped yet: Device and SIM binding, Risk-based checks, Bank liability.
Australia
Mapped: Risk-based checks, Bank liability.
Not mapped yet: Device and SIM binding, Beyond SMS OTP, Cool-off and holds, Mule detection.
UAE
Mapped: Beyond SMS OTP.
Not mapped yet: Device and SIM binding, Risk-based checks, Cool-off and holds, Mule detection, Bank liability.
Saudi Arabia
Mapped: Risk-based checks.
Not mapped yet: Device and SIM binding, Beyond SMS OTP, Cool-off and holds, Mule detection, Bank liability.
- How to read each rule
- What it asks is a plain summary of the duty it places on a bank. How DeepID supports it names the modules behind the bank’s own control; the bank stays responsible for meeting the rule.
- In force
- The rule is in force today.
- Applies later
- Issued, with duties that start on a later date.
- Proposal
- A draft or discussion paper. Not a rule, and not on the control map.
- Guidance or initiative
- Guidance, a code or an initiative a bank is asked to adopt. Not binding law.
- Reported
- Known from news or trade reporting. Checked against the regulator’s own text before launch.
A short rule in a cell means not mapped yet, not that no rule exists. DeepID supports compliance and never guarantees it.
Six more markets, dated and sourced.
Each with its real-time rail, its regulators and the dated rules it has issued, with the status of each rule.
Malaysia
Five anti-scam measures. Announced Sep 2022, in place by Jul 2023.Philippines
Anti-Financial Account Scamming Act (RA 12010). IRR since 25 Jun 2025.Australia
Scams Prevention Framework Act 2025. Act Feb 2025, obligations from 31 Mar 2027.UAE
SMS and email OTP replaced by in-app authentication. From 25 Jul 2025.Saudi Arabia
SAMA Counter-Fraud Framework. Full compliance by 29 Jun 2023.
Rules now arriving.
The dates a bank’s calendar should hold, from the rules above. Deadlines that have passed stay on the list, marked.
- Passed
The reported full phase-out of SMS and email OTP by UAE banks.
Gulf News (New rule: UAE banks to stop sending OTPs via SMS and email from July 25, opens in a new tab), 2025, press reportBeyond SMS OTP
- Passed
RBI’s Authentication Directions came into force.
RBI (Press release: directions on authentication mechanisms for digital payment transactions, opens in a new tab), Sep 2025RBI’s Authentication Directions
- Passed
BSP Circular 1213’s deadline to replace SMS and email OTP for high-risk transactions.
GMA News (No more SMS, email OTPs for high-risk financial transactions, opens in a new tab), 2025, press reportBeyond SMS OTP
- Ahead
DoT’s SIM-binding deadline for messaging apps, as reported. Context for banks, not a bank obligation.
Angel One (DoT extends SIM-binding deadline for WhatsApp, Telegram and Signal till year end, opens in a new tab), 2026, press reportSIM and device binding
- Ahead
RBI’s amendment directions on customer liability apply to digital transactions.
RBI (Press release: amendment directions on the review of the framework of limiting customer liability in digital transactions, effective 1 January 2027, opens in a new tab), Jun 2026RBI’s 2027 liability framework
- Ahead
Most obligations of the Scams Prevention Framework start for banks, telcos and digital platforms.
ACCC (Scams Prevention Framework, opens in a new tab), as of Oct 2026Liability by market
Where the loss now falls.
Real-time rails came first, then the scams that ride them, then rules moving the loss to banks.
- Oct 2024
United Kingdom
Mandatory reimbursement of authorised push-payment scams, shared by sending and receiving firms.
- Dec 2024
Singapore
Shared Responsibility Framework: banks and telcos pay when they miss their duties; 12-hour cooling-off after a new device or token.
MAS and IMDA (Response to consultation on the Shared Responsibility Framework, opens in a new tab), Oct 2024
- Jun 2025
Philippines
AFASA rules: muling and social engineering criminalised; disputed funds can be held.
Malaya Business Insight (Anti-financial scam law’s IRR to take effect June 25: BSP, opens in a new tab), 2025, press report
- Jan 2027
India
Revised customer-liability framework for digital transactions applies.
- Mar 2027
Australia
Scams Prevention Framework obligations: prevent, detect, disrupt, respond and report, with penalties.
Federal Register of Legislation (Scams Prevention Framework Act 2025, as made, opens in a new tab), Feb 2025
See DeepID on a real phone.
We show your fraud, security and engineering leads how DeepID would run your sign-up, login or payment journey, then plan a pilot on your own traffic.