Saudi Arabia's fintech landscape changed significantly on 26 March 2026.

The Saudi Central Bank (SAMA) officially moved open banking from a controlled sandbox initiative into a formally supervised and licensed financial activity. Any company offering Account Information Services (AIS), Payment Initiation Services (PIS), or Confirmation of Availability of Funds (CAF) services now requires a formal SAMA licence. A pilot project, sandbox participation, or bilateral agreement with a bank is no longer sufficient.

This shift transforms open banking from an experimental fintech concept into regulated financial infrastructure. Founders building account aggregation platforms, banks exposing APIs, and international fintech firms entering Saudi Arabia must now design products around licensing, certification, security controls, and compliance requirements from day one.

This guide from LogioLegion explains how the SAMA Open Banking Framework works, the technical architecture required to comply, the certification process, major commercial use cases, and what it costs to build an open banking platform in Saudi Arabia.

As part of our broader work as a custom software development company in Saudi Arabia, we help fintech companies navigate both technical delivery and regulatory readiness.

What SAMA Open Banking Actually Is — and What Changed in March 2026

Saudi Arabia's open banking journey began in December 2020 when SAMA introduced its Open Banking Policy.

In May 2022, the Open Banking Lab launched to allow banks and fintech companies to develop, test, and certify open banking implementations before production deployment. The framework was initially influenced by the UK Open Banking Standard but evolved into a Saudi-specific model with stronger consent controls and stricter security requirements.

The major milestone arrived on 26 March 2026.

Open banking became a formally supervised activity requiring licensing and ongoing regulatory oversight. Any company providing regulated open banking services must now obtain approval from SAMA and comply with the framework's operational, security, governance, and technical requirements.

The framework revolves around three core service categories:

• Account Information Services (AIS)
• Payment Initiation Services (PIS)
• Confirmation of Availability of Funds (CAF)

Together, these services form the foundation for Saudi Arabia's next generation of fintech applications.

For founders, this means open banking is no longer a feature. It is regulated financial infrastructure.

The Three SAMA Open Banking Services — What Each One Requires to Build

Account Information Services (AIS)

AIS allows customers to grant consent for a third-party application to access account information from participating banks.

This includes:

• Account balances
• Transaction history
• Spending patterns
• Income trends
• Merchant categorisation
• Cash flow analytics

The most common AIS use case is account aggregation.

A customer with accounts at Al Rajhi Bank, SNB, Riyad Bank, SAB, and BSF can view all balances and transactions through a single application rather than logging into each bank individually.

From a technical perspective, AIS requires:

• OAuth 2.0 authentication
• Consent lifecycle management
• Token storage and rotation
• FAPI-compliant API security
• Secure data encryption
• Customer consent revocation workflows

AIS forms the foundation of personal finance management platforms, SME financial dashboards, wealth management applications, and credit scoring systems.

Payment Initiation Services (PIS)

PIS allows an authorised third-party application to initiate a payment directly from a customer's bank account.

Instead of routing transactions through traditional card networks, the payment is initiated through the open banking infrastructure.

This creates several advantages:

• Lower payment processing costs
• Faster settlement
• Reduced card dependency
• Improved merchant economics

For Saudi merchants, PIS can significantly reduce payment costs compared with traditional card-based acceptance models.

Building PIS functionality requires:

• Strong customer authentication
• Payment consent validation
• Transaction signing
• Bank API integration
• Real-time payment status monitoring
• Fraud prevention controls

PIS is becoming increasingly important for e-commerce, marketplace platforms, subscription services, and B2B payment systems.

Confirmation of Availability of Funds (CAF)

CAF is the least discussed open banking service but has substantial commercial value.

Instead of retrieving full account information, a third-party application can verify whether sufficient funds exist for a proposed transaction.

This protects customer privacy while still supporting lending and payment decision-making.

CAF is particularly useful for:

• Lending platforms
• Credit scoring systems
• BNPL providers
• Risk management tools
• Payment guarantee systems

CAF enables real-time affordability checks without exposing unnecessary financial data.

For lenders, this can dramatically improve underwriting accuracy while maintaining customer privacy controls.

Open Banking App Development Saudi Arabia SAMA — The Technical Architecture Your App Must Implement

The biggest mistake founders make is assuming open banking integration is simply an API connection.

Under the SAMA Open Banking Framework, the security architecture is often more complex than the business logic itself.

FAPI Security Profile

SAMA requires implementation of the Financial-grade API (FAPI) security profile.

FAPI was designed specifically for highly regulated financial environments and introduces significantly stronger controls than conventional OAuth implementations.

This includes:

• Strong client authentication
• Request signing
• Token binding
• Enhanced authorisation controls
• Protection against replay attacks

For fintech builders, FAPI compliance should be considered a core architectural requirement rather than an optional enhancement.

OAuth 2.0 with PKCE

Authentication is built around OAuth 2.0 combined with Proof Key for Code Exchange (PKCE).

Every customer authorisation flow must support:

• Secure login
• Consent presentation
• Authorisation code exchange
• Access token issuance
• Refresh token issuance
• Scope validation

Access rights must always remain tied directly to the customer consent record.

Mutual TLS (mTLS)

Mutual TLS is mandatory.

Unlike standard HTTPS, both parties authenticate each other through digital certificates.

This means:

• Fintech authenticates bank
• Bank authenticates fintech
• Encrypted communication channel
• Certificate validation
• Certificate lifecycle management

Any open banking platform architecture must incorporate certificate management from the earliest development stages.

Signed Request Objects

Every sensitive API request should be cryptographically signed using the client's private key.

This protects against:

• Payload tampering
• Request manipulation
• Man-in-the-middle attacks
• Unauthorised modifications

Request signing becomes a critical component of certification testing.

Consent Lifecycle Management

Consent management sits at the centre of the entire framework.

The typical lifecycle follows:

1. Consent Granted
2. Consent Active
3. Consent Renewed
4. Consent Revoked

Customers must be able to revoke access at any time through either the bank or the fintech application.

Every API call must validate the current consent status before data access occurs.

Token Rotation

Refresh tokens must rotate after every use.

This prevents stolen refresh tokens from remaining valid indefinitely.

Token rotation is now considered a baseline security requirement rather than an advanced feature.

Rate Limiting and Resilience

Open banking APIs operate under rate-limiting constraints.

Applications must implement:

• Retry mechanisms
• Exponential backoff
• Queue management
• Failure recovery
• Circuit breakers

Production systems must gracefully handle bank-side throttling without degrading customer experience.

SIEM Logging and Monitoring

Every API interaction must be logged.

This includes:

• Requests
• Responses
• Errors
• Consent changes
• Authentication events
• Token lifecycle events

Logs should feed into a Security Information and Event Management (SIEM) platform such as AWS CloudWatch or an equivalent monitoring environment.

OWASP API Security Testing

Before certification, applications should be validated against the OWASP API Security Top 10 (2023).

Testing should include:

• Broken object-level authorisation
• Authentication weaknesses
• Excessive data exposure
• Security misconfiguration
• Resource exhaustion
• Server-side request forgery

These controls form the technical backbone of a compliant SAMA open banking platform.

Getting Through the SAMA Open Banking Lab — Certification Before Licensing

Before production deployment, fintech companies must work through the SAMA Open Banking Lab.

The lab provides a controlled environment where banks and fintech firms can test integrations, validate compliance, and prepare for certification. Every serious open banking platform should be architected with certification requirements in mind from the first sprint rather than attempting compliance retroactively.

The Open Banking Lab provides:

• Standardised testing environments
• API conformance validation
• Security assessment procedures
• Certification frameworks
• Technical onboarding support
• Complaint management and escalation channels

The certification process typically follows a structured sequence:

1. Sandbox onboarding
2. API implementation
3. Security validation
4. Consent workflow testing
5. FAPI compliance assessment
6. Documentation review
7. Certification approval
8. Licensing submission

Many fintech teams underestimate the documentation requirements.

Technical implementation alone is not enough. SAMA expects governance documentation, security policies, risk management frameworks, operational procedures, and incident response plans that demonstrate ongoing regulatory readiness.

Common certification failure points include:

• Weak OAuth implementation
• Improper consent scope validation
• Missing token rotation controls
• Incomplete audit trails
• Insufficient API logging
• Poor mTLS certificate management
• Lack of object-level authorisation checks

The most successful teams treat certification requirements as product requirements rather than compliance requirements.

For founders seeking investment, passing certification also provides a strong signal to investors that the platform can realistically move from sandbox to commercial operation.

The 6 Highest-Value Use Cases for SAMA Open Banking in Saudi Arabia

Personal Finance Management (PFM)

Personal finance management remains one of the strongest use cases for AIS Saudi Arabia implementations.

Most consumers maintain accounts across multiple financial institutions. Open banking allows a single application to aggregate balances, transactions, subscriptions, investments, and spending behaviour into one dashboard.

Features commonly include:

• Multi-bank account aggregation
• Spending categorisation
• Budget tracking
• Subscription monitoring
• Savings recommendations
• Cash flow forecasting

For users, the value comes from visibility. For fintech providers, the value comes from becoming the primary financial interface rather than another banking app.

SME Credit Scoring and Lending

Traditional lending models rely heavily on financial statements, collateral, and historical credit records.

Open banking introduces a richer dataset.

With customer consent, lenders can analyse:

• Revenue consistency
• Cash flow stability
• Supplier payment behaviour
• Payroll patterns
• Seasonal fluctuations

This allows lenders to make more accurate decisions, particularly for SMEs that may not have extensive borrowing histories.

Saudi Arabia's growing SME ecosystem makes this one of the most commercially attractive open banking opportunities in the Kingdom.

BNPL with Bank Data Affordability Assessment

BNPL providers increasingly require better affordability checks.

Open banking data enables real-time assessment of income, expenses, recurring obligations, and spending behaviour before approving financing.

Instead of relying solely on credit bureau data, providers can make decisions using live financial information.

This significantly improves risk management while reducing default rates.

Our dedicated guide to BNPL app development Saudi Arabia explores the architecture and compliance requirements behind these platforms.

Islamic Neobanking Products

Open banking is creating new opportunities within Saudi Arabia's Islamic finance ecosystem.

Financial data obtained through customer consent can be analysed and transformed into Sharia-compliant experiences, helping customers understand whether financial products align with Islamic principles.

Potential applications include:

• Islamic budgeting tools
• Halal spending analysis
• Zakat calculation engines
• Sharia-compliant savings products
• Islamic investment platforms

These products combine open banking infrastructure with Islamic financial frameworks.

Our guide to Islamic fintech app development in Saudi Arabia — SAMA and Sharia guide covers this category in greater detail.

E-commerce Payment Initiation

PIS Saudi Arabia services have the potential to change online payments significantly.

Instead of routing payments through card networks, merchants can initiate bank-to-bank payments directly from customer accounts.

Benefits include:

• Lower transaction costs
• Faster settlement
• Reduced chargeback exposure
• Improved payment efficiency

For high-volume merchants, reducing payment costs by even a small percentage can create substantial annual savings.

As PIS adoption grows, many Saudi e-commerce platforms are expected to incorporate open banking payments alongside Mada and card processing options.

B2B Treasury and Cash Management

Large organisations often maintain relationships with multiple banks simultaneously.

Open banking enables treasury teams to aggregate balances and transaction activity from all participating institutions into a single dashboard.

Common capabilities include:

• Multi-bank visibility
• Cash forecasting
• Liquidity monitoring
• Treasury reporting
• Automated reconciliation
• Centralised cash management

For enterprise finance teams, this reduces operational complexity while improving financial visibility.

AI and Open Banking

Open banking creates a structured financial data layer that can support advanced AI applications.

Once consented transaction data becomes available, machine learning models can identify patterns that would otherwise remain hidden.

Examples include:

• Personalised spending insights
• Financial wellness recommendations
• Fraud detection
• Credit risk forecasting
• SME cash flow prediction
• Automated financial coaching

The emergence of agentic AI systems makes these capabilities even more powerful.

Rather than simply generating reports, modern AI agents can monitor financial activity continuously and provide proactive recommendations based on changing customer behaviour.

Many of these capabilities are powered by the same underlying infrastructure discussed in our guide to the best agentic AI models in 2026.

For fintech founders, the combination of open banking and AI is becoming one of the most compelling product categories in Saudi Arabia's financial technology market.

Compliance Beyond SAMA

Open banking compliance does not exist in isolation.

Most fintech platforms also create operational compliance obligations related to invoicing, taxation, customer communications, and financial reporting.

For example, fintech companies charging subscription fees, onboarding fees, platform commissions, or service charges frequently need ZATCA-compliant invoicing infrastructure alongside their banking integrations.

This becomes particularly important for SaaS fintech products operating within Saudi Arabia.

Our guide to ZATCA-compliant app development for Saudi businesses explains how financial platforms can integrate Fatoorah Phase 2 requirements into their architecture.

A mature Saudi fintech stack typically combines:

• SAMA compliance
• PDPL compliance
• ZATCA compliance
• Cybersecurity controls
• Open banking certification
• Internal governance frameworks

Successful platforms plan for all of these requirements simultaneously rather than treating them as separate projects.

What Does It Cost to Build a SAMA Open Banking App in Saudi Arabia?

The cost of open banking app development in Saudi Arabia depends primarily on which SAMA-regulated services are being implemented.

AIS-only platforms are significantly less complex than platforms that combine AIS, PIS, consent management, certification workflows, and licensing preparation.

Another major factor is regulatory readiness.

Many founders focus exclusively on development timelines and underestimate the time required for sandbox onboarding, certification testing, documentation preparation, and licence submission activities.

SAMA Open Banking Integration for Existing Fintech Platforms

Suitable for companies that already operate a fintech product and want to add account aggregation capabilities.

Typical scope:

• AIS integration
• Account aggregation
• Consent management
• OAuth implementation
• Multi-bank connectivity
• Customer dashboard

Estimated cost:

• SAR 120,000–220,000

Timeline:

• 10–16 weeks

Full AIS + PIS Open Banking Platform

Suitable for fintech startups building open banking as a core product capability.

Typical scope:

• Account aggregation
• Payment initiation
• Consent lifecycle management
• FAPI security implementation
• mTLS infrastructure
• Audit logging
• Sandbox certification support

Estimated cost:

• SAR 250,000–450,000

Timeline:

• 18–28 weeks

Complete Open Banking Fintech Product

Suitable for founders building a full commercial product such as:

• Personal finance management platforms
• SME lending platforms
• Credit scoring engines
• BNPL systems
• Islamic fintech applications
• Multi-bank treasury platforms

Typical scope:

• Full product design
• Mobile apps
• Web dashboard
• Open banking infrastructure
• Compliance architecture
• AI analytics
• Sandbox navigation support
• Licensing preparation

Estimated cost:

• SAR 480,000–900,000+

Timeline:

• 24–40 weeks

Important Timeline Consideration

Many development estimates ignore regulatory preparation.

In practice, SAMA Regulatory Sandbox onboarding, certification planning, governance documentation, and approval workflows can add an additional:

• 6–12 weeks

before core development even begins.

Founders should include this period when planning fundraising milestones, investor commitments, and launch dates.

After reviewing requirements, many teams choose to start with a technical and compliance discovery phase before committing to full implementation.

You can book a free discovery call to assess scope, architecture, licensing considerations, and estimated timelines.

Why LogioLegion for SAMA Open Banking Development in Saudi Arabia

Building fintech products in Saudi Arabia requires more than application development skills.

Teams must understand how financial regulations, security controls, compliance frameworks, and government requirements interact inside a production platform.

At LogioLegion, we specialise in Saudi-focused software products that combine regulatory compliance with modern engineering practices.

Our experience includes published implementation guides covering:

• Open banking
• Islamic fintech
• BNPL platforms
• ZATCA compliance
• Saudi business software architecture

We build fintech platforms using:

• Node.js for OAuth services, API integrations, and event-driven workflows
• Laravel for consent management, audit trails, and compliance engines
• React and Next.js for financial dashboards
• React Native for Arabic-first mobile applications

Our preferred deployment architecture uses AWS Bahrain infrastructure to support PDPL requirements while maintaining low latency across Saudi Arabia.

For fintech platforms handling billing and subscription management, we also design solutions that incorporate guidance from our ZATCA-compliant app development for Saudi businesses framework.

For founders building Sharia-compliant products, our expertise extends into the requirements outlined in our Islamic fintech app development in Saudi Arabia — SAMA and Sharia guide.

We work on fixed-scope engagements, provide complete source-code ownership, and deliver architecture designed around Saudi regulatory requirements from the outset.

Conclusion

Open banking in Saudi Arabia is no longer experimental.

The March 2026 transition to a formal licensing regime means AIS, PIS, and CAF services now operate within a regulated framework governed by SAMA. Building correctly from the beginning—FAPI security profiles, mutual TLS, consent lifecycle management, SIEM logging, sandbox certification, and licensing readiness—can dramatically reduce regulatory friction and accelerate market entry.

Building a SAMA open banking product?

Book a free discovery call with LogioLegion — we scope the full technical architecture and compliance requirements within one session.