Open banking in Kuwait is at the stage where preparation still beats reaction. The Central Bank of Kuwait published a draft regulatory framework in June 2025 and has said the final version will roll out in phases after testing; meanwhile it has launched new clearing infrastructure and watched instant transfers grow at double-digit rates. Kuwaiti banks can read exactly what has already happened in Riyadh, Abu Dhabi and Muscat and build ahead of the rules.
This guide covers what CBK’s draft proposes, what the three Gulf regulators with frameworks in force require, and the engineering foundations a Kuwaiti bank should lay now: consent, Mobile ID authentication, the API layer and real-time access to the core.
Kuwait: a draft framework and the rails arriving around it
The Central Bank of Kuwait (CBK) issued a draft Open Banking Regulatory Framework for public consultation in June 2025, after permitting a first open banking product to be tested in its Wolooj regulatory sandbox. The draft lets local banks share customer data with CBK-licensed Open Banking Service Providers, securely and with explicit customer approval, and covers payment orders as well as account information. CBK has said the final framework will be launched in phases after sufficient testing. As of late 2026 it has not been finalised, so Kuwait remains a market where banks can prepare ahead of the rules rather than react to them.
The surrounding infrastructure is moving faster. In January 2026 CBK launched the Kuwait Automated Clearing House (KACH) for low-value, around-the-clock interbank transfers on ISO 20022 messaging, and the WAMD instant transfer service continues to grow strongly. A bank that treats these as one modernisation programme, rather than three projects, will be ready when the open banking framework becomes binding.
Saudi Arabia: SAMA’s Open Banking Framework
The Saudi Central Bank (SAMA) published its Open Banking Framework in November 2022 as an initiative of the Fintech Strategy under the Financial Sector Development Program. The first release covered Account Information Services (AIS): with the customer’s consent, a licensed third party can read account data from any bank. The second release, issued in September 2024, added Payment Initiation Services (PIS), so a third-party app can start a payment from the customer’s bank account rather than merely display it.
The framework is prescriptive. It bundles use cases, business rules, customer-experience guidelines, API specifications and operational requirements, and SAMA runs an Open Banking Lab, launched in January 2023, where banks and fintechs test and certify their implementations against conformance suites before going live. Banks were required to be ready for AIS in the first quarter of 2023, so by now the question in the Kingdom is depth and reliability of the APIs, not their existence.
UAE: Open Finance and the centralised AlTareq platform
The Central Bank of the UAE took a different architectural route. Its Open Finance Regulation, issued in 2024, goes beyond bank accounts to insurance and other financial data, and instead of asking every institution to publish its own APIs it established a centralised API hub operated by Nebras Open Finance, a company created for that purpose. The programme is branded AlTareq. Banks and insurers connect to the hub once; licensed third-party providers connect to the hub once; the hub standardises everything in between, including the consent journey.
Production deployment started in July 2025 and by late 2025 most Tier 1 banks were onboarded, with Tier 2 banks and insurers following. Commercial Bank of Dubai announced in December 2025 that it was the first bank fully live for customers under the framework, and Islamic and digital banks followed in early 2026. For a bank, the integration is narrower than in Saudi Arabia, because the hub owns the public API surface, but the internal work is identical: your systems must answer in real time, correctly, for every account the hub asks about.
Oman: the CBO framework, in force since June 2025
The Central Bank of Oman issued its Open Banking Regulatory Framework by Circular BM 1219/2025 in June 2025, effective immediately, after publishing API specifications, a technology framework and data security specifications in the preceding two years. The framework requires REST APIs and sorts them into three tiers: Basic APIs (read-only account information and balances) that every bank must expose and may not charge for, Standard APIs covering richer customer data, and Premium APIs covering read-write functionality such as payment initiation and credit assessment, which banks may monetise subject to CBO approval of their pricing model.
The framework sits inside a wider modernisation: the new Banking Law under Royal Decree 2/2025, a dedicated regulatory framework for digital banks, a national eKYC registry run by Mala’a, and a Personal Data Protection Law that became fully enforceable in February 2026. Sohar International, the National Bank of Oman and Bank Nizwa all announced API platforms within weeks of the framework landing, which tells you how the competitive clock is now running in Muscat.
What the four markets have in common
Behind the different rulebooks the engineering problem is the same. A third party asks, with the customer’s consent, for data or an action; your bank must authenticate the customer, verify the consent, serve the request from systems of record in near real time, log everything, and do it at a reliability level the regulator can measure. Every market also leans on the national digital identity (Nafath in Saudi Arabia, UAE Pass, Kuwait Mobile ID, the Mala’a registry in Oman) for strong customer authentication, and every one of them makes the bank, not the fintech, accountable for the data it serves.
Consent is a product, not a checkbox
The consent journey is where open banking is won or lost with customers. It needs to show clearly which accounts, which data, for how long and for whom; it must be revocable from inside your own app, not only from the third party’s; and every grant, use and revocation must be auditable. In the UAE the hub standardises much of this, but the customer still authenticates with you. In Saudi Arabia and Oman the customer-experience guidelines spell out the screens. Build the consent store as a first-class service with its own API, because your call centre, your compliance team and the regulator will all need to query it.
The API layer: gateway, data quality, real-time cores
Most Gulf banks already have an API gateway for their own channels. Open banking stresses it in new ways: third parties generate traffic patterns you do not control, they retry aggressively, and they will surface every inconsistency in your data to your customers inside a competitor’s app. Three investments pay for themselves. First, a canonical data model so that a balance means the same thing on every channel. Second, read replicas or event streams off the core so that account-information calls never queue behind end-of-day batch jobs. Third, observability per third-party provider, so you can prove to the regulator which side a failure sat on.
Payment initiation adds the hard part: idempotency, pre-authorisation holds, limits that match your mobile app, fraud screening on an API call that carries less context than a logged-in session, and reconciliation against the instant payment rail (sarie, Aani, WAMD or Oman’s switch). This is where a digital banking platform with an open banking module ready to configure, rather than a set of bespoke endpoints, shortens the programme by quarters.
From compliance to revenue
The banks that get the most out of open banking treat the mandated APIs as the floor. Oman has written the commercial logic into its rules with Standard and Premium tiers; everywhere else the same logic applies informally. Account aggregation inside your own app, embedded lending for merchants using their transaction history, instant affordability checks, variable recurring payments for subscriptions, and corporate treasury APIs for your business clients are all built on the same consent, identity and data foundations the regulator made you lay. The incremental cost of each is small once the base is right.
How Eurisko helps banks ship open banking
Eurisko has built digital banking channels for banks across Lebanon and the Gulf since 2009, and its Eurisko DXP platform carries open banking as a configurable module: consent management, API products, developer portal, third-party onboarding and the real-time integration layer into the core. Our teams have worked under SAMA, CBUAE, CBK and CBO rules and can start from your framework’s specifications rather than from a blank page. If you are scoping an open banking programme, or fixing one that is live but fragile, talk to our fintech team.
