Open banking in the Gulf Cooperation Council has crossed a threshold that regulators, fintechs, and financial institutions have been working towards for several years. The shift from controlled sandbox experimentation to live commercial licensing is no longer a projection — it is happening now, with concrete regulatory decisions, first-mover licences, and cross-border pilots already on record in 2026. For payments professionals and financial institutions operating across the GCC and MENA, understanding what these milestones mean structurally, and what they demand operationally, is no longer optional preparation. It is immediate business.

The Regional Context: Why Open Banking Landed Here, and Why Now

The GCC presents a set of structural conditions that make open banking not merely viable but strategically necessary. The region's fintech market was valued at USD 10.5 billion in 2025 and is projected to reach USD 29.8 billion by 2032, representing a compound annual growth rate of 16.1% over the forecast period. Underpinning this expansion is a payments ecosystem already operating at scale and velocity: digital transactions in Saudi Arabia alone accounted for 79% of all financial transactions in 2024, according to the Saudi Central Bank, while digital wallets in the UAE currently represent 18% of point-of-sale transactions, a figure expected to reach 33% by 2027. The region's large expatriate workforce, deep trade corridors, and government-led digitalisation programmes have created both the demand signal and the political will required to move open finance frameworks from policy documents into live infrastructure. Real-time transaction values across the region are projected to increase by 289% between 2023 and 2030 — a trajectory that open banking architecture is specifically designed to support.

Saudi Arabia: First Live Licences Signal a Decisive Regulatory Pivot

The most consequential single development of 2026 so far is SAMA's (Saudi Central Bank's) decision to begin issuing formal open banking licences to fintech companies in March, ending the sandbox period and committing to a live regulatory framework. The first institution to secure this licence was Lean Technologies, a GCC-based infrastructure provider known for developer-oriented APIs covering account data access, payment initiation, and embedded finance capabilities. Lean's selection is significant beyond the symbolic: it reflects SAMA's preference for licensing firms that operate at the infrastructure layer, enabling banks, corporates, and fintech developers to build upon a regulated, high-performance connectivity layer rather than constructing fragmented point-to-point integrations.

The transition from sandbox to licence represents a deliberate structural choice by SAMA. The sandbox phase allowed the regulator to assess technical performance, data security standards, and consumer protection mechanisms under controlled conditions. The decision to proceed with commercial licensing signals that those standards were met — and that the regulator is now prepared to hold open banking participants to ongoing supervisory obligations rather than the lighter-touch oversight characteristic of experimental environments. For institutions that have been monitoring the Saudi open banking market from a distance, this is the moment at which a watching brief becomes an active strategic requirement. Account information services and payment initiation services are now live product categories in the Kingdom's regulated financial system, not pilots.

The licensing milestone also connects directly to Saudi Arabia's Vision 2030 framework, which identifies fintech ecosystem development as a component of the Kingdom's ambition to diversify its financial sector and position Riyadh as a regional financial hub. Open banking infrastructure is the connective tissue that makes embedded finance, data-driven lending, and real-time payment products commercially viable at national scale.

UAE: Cross-Border Open Finance Moves from Concept to Live Transaction

In April 2026, Spare — a UAE-based open banking infrastructure company — announced the execution of the first live cross-border open finance payment transaction within the UAE, conducted in partnership with regulated banking institutions in the market. This development moves the cross-border application of open banking from architectural discussion into operational reality. The Spare transaction demonstrated that the underlying technical and regulatory components required for live, account-to-account cross-border payments via open banking rails — including identity verification, bank-level API connectivity, and compliance with both sending and receiving jurisdiction requirements — can be assembled and executed within the UAE's existing framework.

The timing reinforces a broader signal. In May 2026, the Bank for International Settlements published findings from a cross-border proof-of-concept exercise involving the UAE, further validating the country's infrastructure readiness for interoperable open finance payments beyond domestic borders. For the GCC's payments ecosystem, where remittance flows are substantial and multi-jurisdiction transactions are a daily commercial reality rather than an edge case, the emergence of regulated open finance cross-border rails represents a structural change in the competitive landscape of international money movement. API-based payment rails operating under open banking frameworks can reduce friction, cost, and settlement time in corridors that have historically depended on correspondent banking infrastructure.

Bahrain and the Broader GCC Progression

Saudi Arabia and the UAE are not operating in isolation. Bahrain established one of the earliest open banking frameworks in the region through the Central Bank of Bahrain's regulatory sandbox and open banking rulebook, and its experience has informed framework design elsewhere in the Gulf. The progression across the three most active GCC markets — Bahrain establishing early regulatory architecture, Saudi Arabia now issuing live licences, and the UAE executing cross-border transactions — reflects a regional ecosystem developing with meaningful policy coherence rather than fragmentation. This matters for institutions that operate across multiple GCC jurisdictions: interoperability between national open banking frameworks will determine whether the region develops a genuinely connected open finance layer or a collection of domestically effective but regionally siloed systems.

What Institutions Must Address Now

For banks, payment service providers, and fintech operators in the GCC, the 2026 milestones define a clear set of immediate priorities. First, API readiness is no longer a future project — institutions operating in Saudi Arabia and the UAE face live counterparties who hold regulatory permissions to access account data and initiate payments. Technical infrastructure must be capable of supporting these interactions securely and at commercial scale. Second, compliance teams need to map their obligations under emerging open banking supervisory regimes, including data governance, consent management, and incident reporting requirements that differ meaningfully from traditional payments regulation. Third, commercial strategy needs to account for the redistribution of value that open banking enables: firms that control customer data relationships and distribution channels will gain leverage, while institutions that delay integration risk disintermediation from their own customers' financial journeys. The GCC's open banking transition is no longer approaching. For the region's payments professionals, it has already begun.