Open banking in the GCC has moved from sandbox testing to licensed, live services. Saudi Arabia issued its first open banking licence in March 2026, the UAE is connecting banks to third-party providers through a central platform, and Bahrain has had a framework in place for several years. For banks, payment firms and fintechs in the region, open banking is now an operational matter rather than a future project.
Why the GCC, and why now
The region has the conditions open banking needs: high digital payment use, large expatriate populations with heavy remittance flows, and government programmes pushing digital financial services. In Saudi Arabia, SAMA reported that electronic payments made up 79% of retail payments in 2024. These conditions gave regulators both the demand and the political backing to turn open finance policy into live infrastructure.
Saudi Arabia: licensing begins
In March 2026 the Saudi Central Bank moved open banking from its sandbox to formal licensing and granted the first licence to Lean Technologies, a provider of account data and payment initiation APIs. Licensing an infrastructure provider first suggests SAMA wants banks, companies and developers to build on a regulated connectivity layer rather than on a web of separate bilateral links.
Licensing brings full supervision in place of the lighter oversight of a sandbox. Account information and payment initiation are now regulated services in the Kingdom, and institutions that have been watching from a distance need an active plan.
UAE: open finance at national scale
The UAE has chosen a centralised model. Under the CBUAE's Open Finance Regulation, banks and insurers connect to licensed third-party providers through a single API hub run by Nebras and presented to customers as AlTareq. Banks are joining in stages; ADIB became the first Islamic bank to go live in January 2026. The scope goes beyond payments to insurance and the initiation of other financial services.
The UAE is also working on cross-border links. The CBUAE took part in Project Aperta with the BIS Innovation Hub, Brazil, Hong Kong and the UK's FCA, which built a prototype connecting national open finance networks; the final report was published in May 2026.
Bahrain and the rest of the region
Bahrain was one of the first in the region to set open banking rules, through the Central Bank of Bahrain's rulebook and sandbox, and its experience has informed others. Qatar is developing its approach under QCB's FinTech Strategy, with services tested in the QCB sandbox ahead of a formal regulation. For groups operating in several GCC markets, the key question is whether national frameworks will connect with each other or remain separate.
What institutions should do now
First, APIs must be ready: banks in Saudi Arabia and the UAE now face licensed counterparties with the right to access account data and start payments, and their systems must handle this securely and at scale. Second, compliance teams need to map their obligations under the new regimes, including consent management, data governance and incident reporting, which differ from traditional payments rules. Third, commercial strategy should reflect how open banking shifts value towards whoever owns the customer relationship and distribution. Institutions that delay risk losing their place in their own customers' financial lives.