Embedded finance is the idea that a customer gets a bank account, a card, a loan or insurance inside the product they are already using, from a ride-hailing app to an accounting package, with a licensed institution behind the scenes. Banking-as-a-service is the supply side of that: a bank or licensed fintech exposing its products through APIs for others to embed. The UAE has become the regional test bed for both, because its licensing regime, its Open Finance platform and its digital banks arrived in the same few years.
This guide covers why the UAE leads, the operating models that are working, what a bank must build to become a BaaS provider, and the risks the Central Bank will hold the licence holder responsible for.
Why the UAE is the regional test bed
Three things came together. The Central Bank’s licensing categories, including Stored Value Facilities, Retail Payment Services and the finance company tiers, gave non-banks clear routes to offer regulated products. The Open Finance framework, live through the AlTareq platform since 2025, standardised consent and data sharing so that embedding a bank product into a third-party app no longer requires a bespoke integration per bank. And the digital banks built API-first from the start: Wio launched Wio Embedded as a product line, and the challenger and incumbent banks that followed treat platform distribution as a channel, not an experiment.
Add a market where the largest consumer brands are platforms (delivery, mobility, telecom, e-commerce) with millions of users and no banking licence, and the demand side is obvious.
Operating models that work
Three models dominate. In the first, a platform embeds a bank’s accounts and cards under the platform’s brand: the driver or merchant gets an account inside the app, the bank holds the deposit and the licence. In the second, a platform embeds credit: instalments at checkout, working-capital advances to merchants against their sales data, or salary advances to gig workers, with a bank or finance company underwriting. In the third, a platform embeds payments and collections: payment acceptance, payouts and wallets, usually through a licensed payment institution with a bank behind it.
The economics differ. Account and card embedding earns interchange and float and builds a deposit base; credit embedding earns margin and requires capital and collections; payments embedding earns fees and requires scale. A bank entering BaaS should decide which it wants rather than offering everything.
What a bank must build to be a BaaS provider
An API product layer: accounts, cards, payments, KYC and lending exposed as versioned REST APIs with sandbox, documentation and a developer portal, built for partners who will integrate without talking to you. A partner onboarding and management capability: due diligence, contracts, configuration of products and limits per partner, and monitoring per partner. White-label journeys for the pieces the partner should not build, such as identity verification and consent, delivered as SDKs or hosted flows. Real-time integration into the core, because partners will not accept batch latency. And reconciliation, settlement and reporting per partner, which is where most BaaS operations break down.
Underneath all of this is the same foundation a modern digital bank needs: an API-first digital banking platform in front of a real-time core, with onboarding, cards and payments as modules. Banks that have that foundation can add BaaS as a channel; banks that do not should build the foundation first.
The risks the licence holder owns
Under CBUAE rules the licensed institution remains responsible for the regulated activity regardless of whose brand is on the screen: know-your-customer and anti-money-laundering, consumer protection and disclosure, data protection and residency, complaints, and operational resilience. The practical consequences are that the bank must do the identity verification and screening itself or control it tightly, must monitor every partner’s transactions as if they were its own, must be able to switch a partner off without stranding customers, and must keep customer data inside its own residency boundary even when the partner is global.
The BaaS programmes that have failed internationally failed on exactly these points. A UAE bank entering the market should treat partner risk management as a core capability from day one.
Where Open Finance fits
Open Finance and BaaS are complementary. Open Finance gives a platform read access to a customer’s existing accounts and the ability to initiate payments from them, with consent, through the central AlTareq hub. BaaS gives the platform the ability to create new accounts, cards and credit for its users. A platform typically starts with Open Finance for data and payments and adds BaaS when it wants to own the account relationship. For a bank, being good at one makes the other easier, because the consent, identity and API foundations are shared.
How Eurisko helps
Eurisko builds the API product layer, partner management tooling and white-label journeys that turn a bank’s digital platform into a BaaS offering, and the integration layer that connects them to the core in real time. We have delivered digital banking and open banking platforms for banks in the UAE and the wider Gulf. If you are planning a BaaS line or a platform partnership, talk to our team.
