Saudi Central Bank announces first fintechs licensed to offer open banking services

The Saudi Central Bank (SAMA) announced it commenced the licensing of two fintech companies to provide open banking services in the Kingdom on 26 March, marking the transition from open banking piloted within SAMA’s regulatory sandbox into a fully-fledged and licensed regulatory regime.

Once licensed, open banking participants will find that the regulatory expectations they face are not entirely unfamiliar as SAMA's sandbox framework was itself notably stringent. It imposed substantive supervisory requirements on firms offering open banking services during the testing phase, including ongoing reporting obligations, cyber security safeguards, and operational resilience standards. However, the transition to full licensing represents a qualitative shift rather than merely a continuation of existing oversight.

Under a live licence, accountability is no longer bounded by the scoped limitations inherent to sandbox participation. Instead, it becomes permanent, enforceable across the full breadth of the firm's operations, and embedded within the wider legislative framework of Saudi law including the Personal Data Protection Law (PDPL) and the Banking Control Law.

Where the sandbox offered SAMA the flexibility to calibrate its supervisory approach iteratively as products were tested and refined, a licensed entity is held to fixed and publicly articulated standards, with the full weight of SAMA's enforcement powers brought to bear in the event of non-compliance. For open banking providers, this means that the compliance infrastructure built during the sandbox phase will need to be materially strengthened, formalised, and institutionalised to meet the demands of a permanent supervisory relationship with SAMA.

SAMA’s open banking rules create a distinct regulatory framework which enables customers to securely share their financial data with regulated entities, within a secure ecosystem that safeguards data privacy while building customer trust in data sharing. The ecosystem sits within SAMA’s Open Banking Programme and the National Fintech Strategy; a critical pillar of Saudi Vision 2030, which aims to position the Kingdom as a global fintech hub.

SAMA said that open banking is expected to have a positive impact across the financial sector by strengthening collaboration between banks and fintechs, enhancing financial infrastructure and enabling the responsible use of customers’ financial data within a secure, consent‑driven framework.

Commenting on the licensing, Marie Chowdhry, a financial regulation and fintech expert at Pinsent Masons said: “SAMA’s decision to move open banking from sandbox testing into a licensed regime represents a significant regulatory inflection point for Saudi Arabia’s fintech ecosystem. While the sandbox enabled innovation in a controlled environment, formal licensing fundamentally changes the compliance, governance and commercial expectations placed on providers.”

Chowdhry said that licensing offers fintechs in the country considerably greater regulatory certainty and market credibility. Under the new framework, firms will now be subject to more stringent operational, capital and governance requirements and will need to respond accordingly, she added. “Firms will need to carefully assess whether their business models, data handling practices and operational resilience frameworks are sufficiently mature to meet supervisory expectations.”