Open banking licence

How open banking is licensed

Account information and payment initiation are two of the payment services listed in Article 6 of the Implementing Regulations of the Law of Payments and Payment Services, and each has its own licence type in the capital and fee schedules (Articles 44 and 23). Part 8 of the Regulations (Articles 95 to 100) sets the operating rules. Banks and other payment account providers must give licensed PIS and AIS providers access to customer accounts with the customer's consent (Article 96). A PIS provider must never hold client funds and may not alter a transaction (Article 97), and both must make the disclosures in Article 98.

We found no separate SAMA open banking licensing framework with its own capital or fee schedule. On the official texts, open banking providers are licensed under the payments licence categories, and the process is the one that applies to any payment service provider. Claims in secondary sources of a dedicated open banking capital figure or a fixed six-month process are not confirmed by anything SAMA has published.

Payment initiation or account information

Implementing Regulations of the Law of Payments and Payment Services, Arts 23, 44, 46 and 95 to 100. A provider doing both services applies for the PIS licence, whose SAR 1m capital covers AIS as well.

From framework to licences: the timeline

Source: SAMA news releases and the SAMA Rulebook. As of 11 October 2026, the licences SAMA had announced were all for account information; we did not find an official announcement of a payment initiation licence.

What changed in 2026

Before March 2026, open banking providers in Saudi Arabia worked through SAMA's regulatory sandbox. SAMA's announcement of 26 March 2026 said licensing began after the sandbox phase was complete. A provider that tested in the sandbox now has a licensing path, and the sandbox's own rules say it does not accept business models that an existing licence already covers.

SAMA's announcement named the first two licensees by transliterated Arabic names; press reports identify them as Neotek (New Technology for Software Solutions) and Lean Technologies. SAMA continues to meet open banking companies and banks, with sessions announced in May and September 2026.

What the application needs

• The standard payments file under Appendix A of the Licensing Guidelines: application form, fit and proper forms, feasibility study, three-year business plan with ICAAP, and the bank guarantee
• Evidence of professional indemnity insurance or a comparable guarantee
• Consent, authentication and disclosure design that meets Articles 96 to 98
• Data protection and client confidentiality controls (Article 37), aligned with SAMA's PDPL adherence and data governance requirements
• Information security under SAMA's Cyber Security Framework, and business continuity under its BCM Framework
• A risk-based AML/CTF programme proportionate to the service (Article 36)
• Saudi-national Chief Compliance Officer and AML/CTF Director, both with SAMA's written non-objection

How the application runs

1. Confirm the licence type

   Account information only, or payment initiation (with or without account information). The PIS licence carries the higher capital.

2. Submit the file

   Email the in-principle application to NBFI-LIC@SAMA.GOV.SA under the PSP Licensing Guidelines.

3. Answer questions

   Additional information is due within 30 calendar days of SAMA's request.

4. Decision

   SAMA decides within 90 calendar days of confirming the file is complete, or notifies a revised timeline.

5. Set up and licence

   Incorporate within 180 days of approval in principle, put insurance and staff in place, pay the SAR 20,000 fee and receive the licence. Access to the Open Banking Framework and Lab is requested through eSAMA.

Common questions