According to the announcement post on its website as well as its official Facebook page, this will come into effect on 20 May. You will need to be using the bank’s CIMB Clicks or OCTO apps to use SecureTAC. So if you are a customer of the bank but have been putting off using either, it looks like that won’t be possible for much longer.
On that note, there is an entry that mentions the possibility of customers still getting SMS TAC despite already activating SecureTAC. CIMB says that this is being rolled out in phases, and because of this, some transactions will still require SMS TAC for the time being. This will likely stop being a thing once the mentioned 20 May date rolls around. But until then, if you do lose your phone and have activated SecureTAC on another device, you should contact the bank to deactivate the feature on the lost phone. (Source: CIMB)