Saudi Arabia now has two fully launched digital banks and a third licensed, and the first year of results is in. STC Bank and D360 Bank each reached millions of customers quickly because they launched with a user base, instant Nafath onboarding and sarie transfers from day one. For an incumbent in the Kingdom, or a group considering an application, the lessons are concrete.
This guide covers SAMA’s licensing model, what the launched banks did, what the UAE did differently, and the blueprint for building a digital bank: core, channels, onboarding, payments, compliance and team.
Saudi Arabia: three licences and two live banks
The Saudi Central Bank licensed its first two digital banks in 2021 (STC Bank, built on the stc pay wallet with over eight million users, and Saudi Digital Bank, which became D360 Bank) and a third, Vision Bank, in 2022. D360 Bank opened to the public in December 2024 as a Shariah-compliant digital bank; STC Bank completed its transition from wallet to bank and launched fully in January 2025. Both started with instant account opening through Nafath, instant transfers over sarie, cards and a savings proposition, and both reached millions of customers within months because they inherited a user base.
SAMA’s model treats digital banks as full banks with full capital requirements, not as a lighter category, which is why the licensed players are backed by telecom and investment groups rather than startups.
How the UAE differs: challengers and bank-owned brands
The UAE has two kinds of digital bank. Independent licensed challengers: Wio Bank, launched in 2022 with ADQ, e& and First Abu Dhabi Bank behind it, which started with SME accounts and crossed into retail; Zand, which launched in 2022 as a corporate-first digital bank; and ruya, launched in 2024 as an Islamic community digital bank. And bank-owned digital brands: Liv from Emirates NBD and Mashreq Neo, which run on the parent’s licence and reach the parent’s scale.
Wio’s path is the one most studied: SME current accounts first, because incumbents were slow to open them, then retail, then embedded finance for platforms. It reported profitability within two years of launch, which is unusual for a neobank anywhere.
Kuwait and Oman: frameworks first, brands following
The Central Bank of Kuwait issued guidelines for digital banks in 2022, and the market’s first move was a bank-owned brand: Weyay, launched by the National Bank of Kuwait in 2021 for a younger segment, running on NBK’s licence. The Central Bank of Oman issued a dedicated regulatory framework for digital banks in 2025 alongside its open banking rules, and the first applications followed. In both markets the near-term pattern is incumbents launching digital brands rather than independent entrants.
What the successful launches had in common
Four things. A customer base or distribution channel on day one (a wallet, a telecom, a parent bank, a platform), because acquiring customers from zero is the most expensive line in the plan. A narrow first product set that was genuinely better than the incumbent alternative, usually instant onboarding plus one account plus one card. A cloud-native core and a channel platform that let them ship weekly. And a compliance function involved from the first sprint, so that the regulator saw a bank, not an app.
The build blueprint
The core: cloud-native, API-first, real-time posting, multi-currency even if you start with one. The ledger is the one component that is almost impossible to swap later, so choose for the bank you want in year five.
The channel platform: mobile first, with a web channel for SMEs and a back-office console for operations. This layer carries onboarding, products, cards, payments, support and marketing, and it is where most of the differentiation lives. Building it bespoke from scratch is the most common cause of a delayed launch; configuring a proven digital banking platform and customising on top is faster and safer.
Onboarding and KYC: national identity integration (Nafath, UAE Pass, Kuwait Mobile ID, Oman’s eKYC registry), liveness, sanctions and PEP screening, risk-based due diligence and a review queue. Target under five minutes to a funded account, because that is now the benchmark.
Payments: instant rail connectivity (sarie, Aani, WAMD), card issuing through a processor, wallet top-ups and bill payments through the national aggregators. Reconciliation and disputes are the unglamorous half of this and they must be designed, not improvised.
Compliance and risk: transaction monitoring, fraud scoring, limits and controls, regulatory reporting and the audit trail. Build these as services with their own APIs so they are consistent across channels.
The team and the timeline
A realistic timeline from licence to public launch is twelve to eighteen months with a platform approach, and twenty-four or more if every layer is built from scratch. The in-house team should own product, architecture, security, compliance and data from the start; engineering capacity can be scaled with a partner that has shipped bank channels before, provided the bank keeps ownership of the roadmap and the code.
The budget line most often underestimated is not technology but operations: the support, fraud, disputes and compliance teams that have to be in place before the first customer, not after.
For incumbents: respond or launch?
An incumbent has three options: modernise the main brand’s channels so that the gap closes, launch a digital brand on the existing licence for a segment the main brand does not serve well, or do both in sequence. The bank-owned brands in the UAE and Kuwait show that the second option works when the segment is real and the brand is given its own product team. It fails when it is the same bank with a new logo.
How Eurisko helps
Eurisko has built digital banking channels for banks across the Gulf and Lebanon since 2009, and its Eurisko DXP platform covers the channel, onboarding, cards, payments and back-office layers of the blueprint above, in front of any core. If you are planning a digital bank or a digital brand, talk to our fintech team about what can be configured and what should be built.
