Moving away from SMS is good. SMS is cleartext, equipment to fake a number and get their messages is maybe hundreds of dollars at this point.

Encrypted push notifications are much better.

PSD2 lets you do basically whatever you want. Fingerprint is enough, or confirm in phone app if making a transfer from a desktop banking UI.

U2F would be nice but with banks being banks that's not going to happen this decade.