The GCC Isn't Doing Open Banking. It's Doing Open Finance — And That Changes Everything.

Here is a number that should reframe how you think about financial infrastructure in this region: by mid-2026, Saudi Arabia's Central Bank has already issued a formal licensing framework for open banking service providers — not a consultation paper, not a sandbox, but live regulatory architecture. The UAE's CBUAE has open finance principles embedded into its 2026 financial sector strategy. Bahrain's open banking API framework, the first in the GCC, is now being upgraded into a broader open finance ecosystem. And across the region, the dominant analytical conclusion from institutions ranging from the MENA Fintech Association to White & Case is the same: the GCC is not following the traditional Western open banking playbook. It is skipping it entirely, building directly toward open finance — a model that encompasses not just bank account data and payments, but insurance, investments, pensions, real estate, and government services within a single API-driven consent architecture.

That leap matters enormously, and not just for the obvious reasons. In this piece, I want to explain precisely why this structural choice — to bypass open banking as a waystation and go straight to open finance — is one of the most consequential infrastructure decisions any region has made in financial services this decade, what it means for the payments rails being built right now, and what businesses and regulators operating in this market need to understand before they get left behind.

What Is Happening Globally: The Open Finance Movement Takes Shape

Open banking — the regulatory mandate for banks to share customer-permissioned data with third-party providers via standardised APIs — has been the dominant financial services infrastructure story in Europe and the UK for the better part of a decade. The UK's Open Banking Implementation Entity (OBIE) launched in 2018. The EU's PSD2 directive has been in force since 2019. By any objective measure, open banking in those markets has produced real outcomes: millions of payment initiations, thousands of active third-party providers, a genuine shift in how consumers interact with their financial data.

But open banking was always a limited construct. It covered bank accounts. It covered payment initiation. It did not touch insurance, wealth management, pensions, or government benefit records. And as the UK discovered over several years of OBIE operation, the compliance-first approach — mandating data sharing through a regulated interface without simultaneously building the consent infrastructure, liability frameworks, and commercial models that make the ecosystem work — created friction that slowed adoption far below projections.

Open finance is the corrective. It extends the data-sharing principle across the full financial life of a consumer: every product they hold, across every regulated entity — banks, insurers, investment platforms, pension administrators, tax authorities. The theory is that true financial inclusion and genuine competition require visibility across the whole picture, not just the current account.

Globally, the shift is accelerating. Brazil's Open Finance framework — arguably the world's most ambitious — has enrolled over 40 million users and covers credit, insurance, pensions, and investments. Australia's Consumer Data Right (CDR) is being extended beyond banking into energy and telecommunications. The UK is in active consultation on Smart Data frameworks that will eventually connect financial, utilities, and healthcare records. And across Asia — Singapore, India, Thailand — regulators are building data trust frameworks that treat financial data as one node in a broader citizen data architecture.

The JPMorgan 2026 Payments Outlook identifies this as one of five structural forces reshaping global payments: the expansion of consent-based data sharing from single-sector to multi-sector frameworks, driving what they call "embedded finance at the infrastructure layer." Capco's Payment Trends 2026 report flags the same dynamic: the most advanced markets are no longer asking "should we do open banking" but "how do we govern the full-stack data economy."

Into this global context, the GCC's decision to architect toward open finance from the start — rather than building open banking first and retrofitting — is not a shortcut. It is a considered structural choice, and a strategically sound one.

Why It Matters for Payments and Financial Infrastructure

If you work in payments infrastructure — as I do — the open finance model is not primarily interesting as a regulatory story. It is interesting as a rails story. What open finance does, when built correctly, is create a universal data layer across which payment instruments can be intelligently routed, contextualised, and risk-scored in real time.

Consider what this means at a concrete level. Today, a payment initiation in a typical GCC market involves a relatively linear process: the customer authenticates with their bank, the bank validates the instruction, funds move via the domestic clearing rail. The intelligence available to that payment — about the customer's creditworthiness, their insurance status, their employment verified via payroll data, their investment portfolio as collateral signal — is essentially zero at the point of initiation. The payment rail is dumb. It moves money. It does not understand the customer.

Open finance changes this architecture fundamentally. When a customer's full financial picture — across all providers, in consented real time — is accessible via a governed API layer, payment decisions can be made with vastly more intelligence. Credit underwriting at the point of sale becomes possible without a lengthy application process, because the underwriting engine already has the full financial data picture with consent. Fraud detection improves because the anomaly signal is richer — a payment that looks suspicious in isolation looks very different when the engine can see the customer's normal spending patterns across all their accounts. Dynamic pricing of financial products becomes possible — insurance premiums calculated in real time based on current income and liability data, rather than annual surveys.

For the GCC specifically, this matters because the region's payment infrastructure is genuinely world-class in some dimensions — the UAE's Instant Payment Platform, Saudi Arabia's SARIE and its integration with mada, Bahrain's Fawri+ — but still relatively siloed in the data layer. These are fast rails moving money efficiently between parties who know relatively little about each other. Open finance, built on top of these rails, transforms them from fast pipes into intelligent infrastructure.

There is a second dimension that matters even more for a region with the GCC's demographics: the unbanked and underbanked population. Across MENA, a significant proportion of the working population — migrant workers in particular — remains outside formal financial services despite physically residing in some of the world's most sophisticated financial markets. Open finance creates pathways for alternative credit assessment, for portable identity, for financial products that can be offered based on demonstrated transaction history rather than a credit bureau record that does not exist. This is not an idealistic framing. This is the mechanism by which Brazil achieved the 40-million user enrollment figure cited above. The infrastructure and the inclusion story are the same story.

The MENA/GCC Angle: What the Region Is Actually Building

Let me be specific about what is happening on the ground, because the regulatory picture has materially advanced in 2026 in ways that are not yet fully appreciated by businesses operating in this market.

Saudi Arabia (SAMA): The March 2026 SAMA licensing framework for open banking service providers is a genuine milestone. This is not a sandbox or a pilot. It is a formal, enforceable regulatory architecture that creates a licensed category of Open Banking Service Providers (OBSPs) with defined obligations around consent management, API standards, liability, and data governance. The framework is explicitly designed to be extensible — SAMA's public statements have made clear that it is the first phase of a broader open finance architecture. Businesses operating in the KSA market need to understand that the question is no longer "will this happen" but "are you positioned for it when it fully activates."

UAE: The CBUAE's open finance principles are embedded in the Financial Infrastructure Transformation (FIT) Programme — the same programme that brought the UAE's Instant Payment Platform online. The FIT Programme is explicitly multi-year and multi-phase, and the open finance component is designed to interoperate with the digital dirham (CBDC) infrastructure being developed in parallel. This is not a coincidence. The UAE is architecting an end-to-end digital financial system in which CBDCs, open finance APIs, and instant payment rails are designed to work together as a unified system — not bolted together retrospectively.

Regional leapfrog dynamics: The MENA Fintech Association's 2026 analysis is blunt: the region is not doing open banking as a waystation. The framework being built is open finance from the start, and the rationale is partly pragmatic — the region's banking sector is concentrated enough that the data integration challenge is more tractable than in fragmented markets — and partly strategic. GCC regulators have watched the EU's PSD2 implementation closely and drawn clear lessons about what happens when you build compliance infrastructure without simultaneously building the commercial ecosystem. They are attempting to avoid that failure mode.

Gulf News's 2026 GCC fintech analysis captures the mood accurately: "AI-native hubs, resilient funding, open banking frameworks going live, and a pivot toward profitable growth." The infrastructure and the commercial maturity are arriving together, and that combination is genuinely unusual in global fintech terms.

What Businesses and Regulators Should Act On Now

I have spent significant time advising financial institutions and regulators in this region on payments and digital asset infrastructure. My honest assessment: most incumbent financial institutions in the GCC are not yet positioned for open finance at the infrastructure level, and the window for deliberate preparation is shorter than most of their leadership teams recognise. Here is what I think needs to happen now.

API architecture review — urgently: Open finance is an API-first world. If your core banking system was not designed with API-first principles — and many legacy systems in the region were not — you are not looking at a six-month integration project. You are looking at a multi-year core infrastructure programme. The time to begin that programme is not when the regulator issues the compliance deadline. It is now, before the deadline creates artificial urgency that drives poor architectural decisions. The organisations that are going to win in an open finance ecosystem are the ones who treat the API layer as a product, not a compliance artefact.

Consent management as a competitive asset: One of the underappreciated dynamics of the open banking experience in the UK and EU is that customer consent — the mechanism by which data sharing is authorised — became a competitive differentiator. Institutions that built genuinely excellent consent experiences, that made it easy to understand and control what data is shared with whom, attracted more customers to open finance products. Institutions that treated consent as a compliance checkbox built friction into the experience and saw lower uptake. In the GCC context, where trust in financial institutions is generally high but digital financial literacy varies significantly, investing in consent UX is not just good practice. It is market positioning.

Data partnerships and ecosystem thinking: Open finance is, at its structural core, an ecosystem model. No single institution — however large — will own the full customer relationship in an open finance world. The value creation happens at the intersection of data from multiple providers. This means financial institutions need to be thinking now about their data partnership strategy: which third-party providers do they want to work with, what data do they want to access from other institutions, and what commercial models will govern those relationships. The licensing frameworks being built by SAMA and CBUAE will create the regulatory scaffolding for these partnerships. The strategic architecture needs to be developed before the scaffolding is in place, not after.

For regulators: The liability framework is the piece that most often breaks open finance implementations globally. When customer-consented data is used by a third party and something goes wrong — fraud, data breach, incorrect credit decision — who bears responsibility? The EU's PSD2 experience demonstrated that ambiguous liability allocation creates chilling effects on the entire ecosystem. SAMA's March 2026 framework has begun to address this, but the liability question across the full open finance stack — covering insurance, investments, and pensions, not just bank accounts — remains in development. Getting this right before the ecosystem scales is critical.

Interoperability is the endgame: The GCC's real opportunity is not open finance within individual markets. It is open finance across the Gulf Cooperation Council — a regional consent and data framework that allows a customer's financial identity to travel with them across borders. Given the scale of labour mobility in the region — millions of workers whose financial lives span multiple GCC jurisdictions — a regional open finance framework would be genuinely transformative. The technical building blocks exist. The regulatory will is developing. The missing piece is coordination, and that coordination needs to be driven by industry participants, not waited for from regulators alone.

My Perspective: Why This Moment Is Not to Be Wasted

I have been working in payments infrastructure and digital financial services in this region for long enough to have seen several "this changes everything" moments. The launch of real-time payment rails. The QR code standardisation efforts. The first CBDC pilots. Not all of those moments delivered on their initial promise, and I have tried to maintain appropriate scepticism about the gap between regulatory ambition and market reality.

But the open finance trajectory in the GCC feels different to me, and I want to explain why. The difference is the simultaneity. Previous infrastructure initiatives in this region tended to be sequenced: the regulator built the framework, then waited for industry adoption, then adjusted the framework based on what industry said wasn't working. The result was slow cycles and frustrated potential.

What I am observing in 2026 is something more like parallel construction. SAMA's licensing framework is live. UAE's FIT Programme is progressing. Bahrain's ecosystem is maturing. GCC fintech funding is resilient — not the speculative frenzy of 2021, but the quieter, more durable funding of infrastructure businesses. And critically, the talent and institutional knowledge to build open finance products at scale now exists in the region in a way that it did not five years ago.

The risk is not that this doesn't happen. The risk is that incumbent institutions treat it as a compliance exercise rather than a strategic opportunity, and wake up three years from now in an ecosystem they don't understand, serving customers through third-party intermediaries they didn't choose. I have seen that dynamic play out in the UK. The institutions that moved early — that invested in API infrastructure, consent management, and ecosystem partnerships before the regulatory mandate was absolute — are the ones that are now winning in the open banking era. The ones that waited are playing catch-up in a game where the rules were written by others.

The GCC has a structural advantage that most markets did not: the chance to build open finance infrastructure from scratch, with regulatory clarity arriving earlier in the cycle than it did elsewhere, in markets where smartphone penetration and digital payments adoption are already high. That advantage has a shelf life. I would encourage every financial institution and fintech operating in this market to treat that advantage as the urgent strategic asset it is.

Punit Thakker is a payments infrastructure executive and digital assets strategist based in Dubai. He has advised the CBUAE on digital financial infrastructure and serves as co-founder of Fracxn and Drongo Ventures. He is Executive Director at ASK Group.