The National Institute of Standards recently issued a ruling on digital authentication that states SMS messaging as a second authentication factor should now be considered insecure. While sending an SMS for OTP is still better than having no additional authentication factors, the NIST ruling suggests that organizations wanting to raise the bar on their security standards consider more secure authentication methods.
You can read the rest of my white paper for Vasco (reg. req.) here.