Behind the 6-digit code: Building HOTP and TOTP from scratch

On a side note, does anyone know why banks still rely on sms 2fa codes instead of TOTP? Is there some regulatory issue that makes it more difficult?

Everybody with a phone has SMS baked in. SMS also has a recovery process if you drop your phone in the toilet. Ultimately, this improved user experience outweighs the security benefit to TOTP for many organizations.

TOTP also doesn't stop the biggest threat that SMS faces: phishing. Saving you from sim-swap attacks is just not a particular huge increase in security posture.

My bank at least offers TOTP as an option, but the huge majority of people are going to enroll with SMS.

My two banks require additional approval via push notification to the phone app. No SMS involved.

(In France.)

Some banks in Switzerland give customers a device that generates TOTP codes.