otp rules change