Saudi Arabia Just Pulled the Trigger on Open Banking. The Rest of the GCC Has No Excuse Now.

In March 2026, the Saudi Central Bank (SAMA) did something that regulators across the GCC have been promising for years but few have actually delivered: it introduced a formal licensing framework for open banking service providers and immediately began issuing the first licences. Within weeks, the first fintechs were cleared to operate as licensed open banking providers in the Kingdom.

That is not a small bureaucratic update. That is a structural shift in how financial data flows across one of the world's most significant emerging markets. And if you work in payments, financial services, or fintech infrastructure anywhere in the MENA region — or if you are advising a business that does — the implications reach far beyond Saudi Arabia's borders.

I have spent the better part of two decades working on payment rails, regulatory frameworks, and financial infrastructure across MENA, APAC, and Europe. I helped architect QR payment systems, worked alongside central bank advisors, and watched dozens of well-intentioned open banking initiatives stall at the policy stage. What SAMA has done in 2026 is different. It is operationally real. And it is going to accelerate change across the entire region faster than most market participants are prepared for.

What SAMA Actually Did — And Why It Matters

Open banking, for those who need the framing: it is the regulatory and technical mechanism through which banks are required (or encouraged) to share customer financial data — with customer consent — with authorised third-party providers via standardised APIs. When done right, it enables a new generation of financial products: smarter lending decisions, real-time financial aggregation, seamless payment initiation, personalised insurance, and far more.

The United Kingdom's Open Banking Implementation Entity (OBIE) pioneered this model starting in 2018. The EU followed with PSD2. Australia introduced its Consumer Data Right. In every case, the economic impact was significant: new entrants, compressed margins for incumbents, and — critically — better outcomes for consumers and businesses that previously had no portability over their own financial data.

SAMA's 2026 framework does the following:

• Establishes a formal licensing category for Open Banking Service Providers (OBSPs), separate from existing payment and fintech licences
• Mandates API connectivity standards for licensed banks, requiring them to expose customer data and payment initiation capabilities to authorised third parties
• Introduces consumer consent architecture — clear rules on how data may be accessed, stored, used, and revoked
• Begins active licensing — Saudi Central Bank did not just publish rules, it immediately granted the first licences to operating fintechs, signalling genuine regulatory intent rather than consultation theatre

This combination — clear rules, a formal licence category, and immediate execution — is precisely what has been missing from most MENA open banking conversations for the past five years.

The Infrastructure Gap This Fills

To understand why SAMA's move matters structurally, you need to understand the fragmentation that currently defines financial data in the GCC.

Despite having some of the world's highest smartphone penetration, among the most digitally active young populations globally, and governments genuinely committed to financial sector modernisation, the GCC has operated with a fundamental information asymmetry problem. Banks held customer data in proprietary silos. Fintechs had to rely on screen-scraping — a crude, unreliable method of accessing data that banks actively resisted. Credit decisioning remained blunt and conservative because lenders could not access comprehensive financial histories. Consumers could not take their banking relationships with them when they moved providers.

The result was a paradox: technologically sophisticated consumers being served by structurally primitive data infrastructure. A young Saudi professional with five years of impeccable salary credits, on-time bill payments, and savings discipline could walk into a competitor bank and find themselves treated as effectively creditless — because their data sat locked in their primary bank's ledger.

Open banking, done properly, breaks that asymmetry. It makes financial data portable, with consent, in real time. It allows a licensed fintech to pull a verified income and expenditure summary directly from a bank's API — in seconds, with the customer's permission — rather than demanding three months of bank statements and a letter from an employer.

SAMA's licensing framework creates the legal foundation for that infrastructure to exist legally and securely in Saudi Arabia for the first time.

The GCC Angle: What Changes, and When

Saudi Arabia is not operating in isolation. The GCC's financial regulators have watched each other closely for years, and SAMA carries substantial weight as the region's most systematically important central bank.

In the UAE, the Central Bank (CBUAE) has been running its open banking consultation since 2022 and has signalled readiness to formalise a framework — SAMA's execution gives the CBUAE concrete regional precedent to reference and a competitive imperative to match. In Bahrain, the Central Bank of Bahrain (CBB) has operated open banking rules since 2020, but adoption has been limited. Qatar, Kuwait, and Oman are all at varying stages of policy development.

What SAMA's licensing activation does is shift the regional conversation from "when will regulation come?" to "how do we operate within it?" That is a fundamentally different commercial question, and it has immediate consequences:

• Banks must now build API infrastructure — not as a future-state aspiration but as a regulatory compliance requirement. Banks operating in Saudi Arabia that have not already invested in standardised API layers face an urgent technical debt problem.
• Fintechs can now build real products — licenced OBSPs can develop personal financial management tools, alternative credit scoring engines, payment initiation services, and data aggregation platforms on a legally certain foundation. Previously, that certainty did not exist.
• Cross-border payment corridors become more efficient — as GCC states progressively align open banking standards, the infrastructure for seamless regional payment flows and financial product interoperability improves significantly.
• Incumbent banks face margin pressure — every market where open banking has been properly implemented has seen net interest margin compression in retail banking as consumers gain the ability to comparison-shop and switch more easily. Saudi banks need a strategy for the post-open-banking competitive environment now, not in three years.

From a capital flows perspective, SAMA's move is also a signal to international fintech investors that Saudi Arabia is open for regulated business. The Kingdom's Vision 2030 programme has driven extraordinary economic transformation across sectors, but fintech funding flows to the GCC have historically been dominated by the UAE. A credible, operational open banking framework makes Saudi Arabia a much more attractive market for product-market-fit fintech investments seeking regulatory clarity.

What Businesses and Regulators Must Do Now

If you are running a financial services business anywhere in the GCC, the strategic question is no longer whether to prepare for open banking — it is how fast you can move.

For banks: The API build is non-negotiable. The question is whether you are going to treat open banking compliance as a minimum-viable obligation or as a strategic opportunity to launch your own data-enabled products. Banks that move first on permissioned data products — using their own customer data to build superior financial management tools, lending products, and embedded finance offers — will be in a materially stronger position than those who treat API connectivity as a cost centre.

For fintechs: The licensing window is open. Apply early, build your consent management architecture carefully, and invest in security and data governance from day one. Regulators across the GCC are watching how the first wave of licensed OBSPs behaves. Strong early compliance track records will translate into regulatory goodwill as frameworks evolve.

For corporates: Embedded finance is coming to the GCC faster than most corporate treasurers appreciate. The combination of open banking data access and real-time payment rails creates the infrastructure for treasury management, supplier finance, and B2B payment products that do not yet exist at scale in this region but will within three years. Get your CFO and treasury teams educated now.

For regulators outside Saudi Arabia: SAMA has set a regional benchmark. The credibility gap between stated policy intent and regulatory execution is now visible. The CBUAE, CBB, and other GCC central banks face a competitive dynamic: every month of delay is a month in which Saudi Arabia attracts the open banking investment and talent pipeline that might otherwise have distributed more evenly across the region.

My View: The Decade of MENA Financial Infrastructure Has Begun

I am genuinely encouraged by what SAMA has done — not because it is perfect, but because it is real. The framework has specificity. The licensing has commenced. The first OBSPs are authorised. That is execution, and execution is rare in financial regulation anywhere in the world.

The GCC has spent years positioned as a "next big thing" in global fintech — a young, digitally native, high-income population sitting atop a financial system that has underserved them relative to their sophistication and needs. Open banking is the infrastructure layer that converts that potential into actual product innovation and genuine consumer benefit.

What comes next, if regulators and market participants move with intention, is a regional financial ecosystem more integrated, more competitive, and more genuinely useful than anything the GCC has seen before. QR payment interoperability, real-time credit decisioning, cross-border financial portability for the region's vast expatriate population, AI-powered personal finance built on verified transactional data — all of this becomes achievable infrastructure rather than speculative roadmap.

Saudi Arabia has fired the starting gun. I will be watching closely to see who runs, who walks, and who is still tying their shoes when the first wave of licensed open banking products reaches consumers.