Pakistan Open Banking Regulations: SBP Draft Framework Explained

Pakistan’s State Bank has taken its most significant step yet toward open banking. On October 30, 2026, the SBP released draft Open Banking Regulations for public consultation, proposing a framework that would give customers consent-based control over their financial data and enable authorized Third-Party Providers to initiate payments and build services on top of bank-held data. If adopted, the regulations would create the legal foundation for Pakistan’s open banking ecosystem — bringing the country into line with a regulatory model already operating in the UK, the EU, Australia, Brazil and parts of Southeast Asia.

In Brief

The SBP released draft Open Banking Regulations on October 30, 2026, inviting feedback from stakeholders through November 30, 2026
The draft enables secure, consent-based financial data sharing and payment initiation through authorized Third-Party Providers (TPPs)
The framework covers B2B and C2B payment digitization, credit assessment, SME financing access, and tailored financial product development
It builds on findings from the SBP’s first Regulatory Sandbox cohort, which ran from January to June 2026 and included four successful open banking and remittance participants
BankIslami’s aik platform launched Pakistan’s first Shariah-compliant open banking solution earlier in 2026, giving an early preview of what the market can deliver
The draft includes safeguards for data protection, privacy, cybersecurity, fraud prevention and consumer protection

What Open Banking Is and Why It Matters

Open banking is a regulatory framework that requires banks to make customer financial data accessible — with the customer’s explicit consent — to licensed third parties through standardized APIs. Instead of your financial data being locked inside one bank’s systems, you can choose to let a fintech app, a lending platform or a payment service read your transaction history, verify your income, or initiate a payment on your behalf.

The model matters because it breaks the data monopoly that traditional banks hold over their customers’ financial information. In markets where open banking is established, it has enabled faster loan approvals (because lenders can verify income through bank data rather than paperwork), cheaper payment initiation (because merchants can bypass card networks), and new categories of financial products built on transaction data.

The UK’s open banking implementation, for example, has grown to over 11 million regular users as of 2024, according to Open Banking Limited. Brazil’s Pix system, while not purely open banking, demonstrates how regulatory infrastructure can transform payment behavior at national scale. Pakistan’s draft is closer to the UK and EU model — focused on consent-based data sharing and payment initiation through TPPs — but adapted to local market conditions.

What the SBP Draft Covers

According to the SBP’s announcement as reported by ProPakistani on October 30, 2026, the draft regulations aim to:

Enable consent-based data sharing: Customers can authorize Third-Party Providers to access their financial data held by banks, with the ability to revoke that consent
Enable payment initiation: TPPs can initiate B2B and C2B payments on behalf of customers, creating alternatives to card-based payment rails
Facilitate credit assessment: Lenders can use bank data to perform robust credit assessments, potentially reducing the documentation burden for loan applicants
Improve SME financing access: Small and medium enterprises can share their financial data with lenders, making it easier to demonstrate creditworthiness
Support tailored financial products: Banks and fintechs can develop products based on a customer’s actual financial profile rather than generic demographic assumptions

The SBP stated that the draft is aligned with international best practices and informed by the outcomes of its first Regulatory Sandbox cohort on open banking, which concluded in June 2026. The framework includes safeguards for data protection, privacy, cybersecurity, fraud prevention and consumer protection.

The draft regulations are available on the SBP’s website. Feedback can be submitted by November 30, 2026, via email with the subject line “Feedback on Draft Open Banking Regulations,” or by post to the Payment Systems Policy & Oversight Department, 4th Floor, SBP Building, I.I. Chundrigar Road, Karachi.

The Sandbox Foundation

The draft regulations did not appear from nowhere. The SBP launched its first Regulatory Sandbox in August 2025 under its Vision 2028 initiative, focusing on three areas: technology-enabled solutions for inward remittances, open banking, and remote onboarding of merchants. According to ProPakistani’s reporting on September 16, 2026, six participants were shortlisted for the first cohort, with testing conducted between January and June 2026. Four participants successfully demonstrated their solutions:

Digi Khata (SMC Private) Ltd — tested an open banking solution
Swich Retail Private Ltd — tested an open banking solution
Neem Exponential Financial Services (Pvt) Ltd — tested an open banking solution
Taptap Send UK Ltd and United Bank Ltd — tested a technology-enabled inward remittance solution

The SBP clarified that sandbox completion does not constitute regulatory approval, and successful participants must obtain required authorization before commercial launch. But the findings, lessons and regulatory recommendations from this cohort directly informed the draft regulations now under consultation.

Early Market Signals: BankIslami’s aik

Open banking is not entirely theoretical in Pakistan. BankIslami launched aik, a Shariah-compliant open banking platform, earlier in 2026. The platform represents the first concrete implementation of open banking principles in Pakistan’s financial sector, albeit outside a formal regulatory framework. Its existence demonstrates that the market is ready — banks and fintechs are already building the infrastructure that the draft regulations would formalize.

For fintech founders, the aik launch and the sandbox cohort together signal that Pakistan’s open banking ecosystem has moved from concept to early implementation. The draft regulations provide the legal scaffolding to scale these pilots into a national framework.

How Pakistan’s Approach Compares Globally

Pakistan is adopting open banking later than the UK and EU (which implemented the PSD2 directive and open banking standards from 2018 onward), but earlier than most South Asian peers. India has no formal open banking regulation but has built the Account Aggregator framework under RBI guidance, which serves a similar function. Singapore’s MAS implemented an API playbook rather than binding regulations. Bangladesh and Sri Lanka have not yet formalized open banking frameworks.

The SBP’s draft appears to follow a hybrid approach — taking the consent-based data sharing model from the UK and EU, but with implementation timelines and technical standards likely to be phased, similar to how Brazil rolled out its framework incrementally.

Market	Framework	Key Feature	Status
UK	Open Banking Standard	Mandatory API access for CMA9 banks	Live since 2018
EU	PSD2 / PSD3	Regulatory mandate for bank API access	Live since 2018
Brazil	Open Banking regulations	Phased implementation across 4 stages	Live since 2021
India	Account Aggregator	Non-bank financial data sharing framework	Live since 2021
Singapore	MAS API Playbook	Voluntary guidelines	Live since 2016
Pakistan	SBP Draft Open Banking Regulations	Consent-based data sharing + payment initiation	Draft consultation (Oct 2026)

What This Means for Fintech Founders

For fintech founders building in Pakistan, the draft regulations open several possibilities:

New product categories. Open banking APIs enable products that were previously impossible or required manual bank statement uploads. Automated credit scoring based on real-time transaction data, personal finance management apps that aggregate accounts across banks, and instant SME lending platforms all become technically feasible.

Lower customer acquisition costs. If a fintech can verify a customer’s income and transaction history through open banking APIs instead of requiring physical documentation, onboarding friction drops significantly. This is particularly relevant for lending platforms and insurance providers.

Payment initiation without card rails. The B2B and C2B payment initiation component of the draft could enable account-to-account payments that bypass card networks — and their interchange fees. For merchants operating on thin margins, this is financially significant.

Regulatory clarity. Until now, fintechs accessing bank data in Pakistan have operated in a grey zone — using screen scraping, customer-provided credentials, or bilateral agreements with individual banks. The draft regulations would create a formal licensing category for TPPs, providing legal certainty that investors and partners need.

However, founders should note that the draft is a consultation document, not a final rule. Key implementation details — API standards, certification requirements, liability frameworks, phased timelines — will likely be determined after the consultation period closes. Building products that depend on open banking APIs before the final regulations are published carries execution risk.

What This Means for Banks

For Pakistan’s commercial banks, open banking is a double-edged development.

The opportunity is that open banking APIs can turn a bank from a closed system into a platform. Banks that build strong developer ecosystems, offer reliable APIs, and partner effectively with fintechs can capture new revenue streams — API access fees, embedded finance commissions, expanded customer bases through third-party distribution channels.

The risk is that open banking commoditizes the bank-customer relationship. If a customer manages their finances through a third-party app that connects to multiple banks via open banking APIs, the bank’s brand and direct relationship with that customer weakens. Banks that treat open banking as a compliance exercise rather than a strategic opportunity may find themselves reduced to utility providers — holding deposits and executing transactions while fintechs own the customer interface.

For product teams inside Pakistani banks, the draft regulations signal that API investment is no longer optional. Banks that begin building production-grade open banking APIs now — with proper documentation, sandbox environments for developers, and dedicated partnership teams — will be better positioned when the final regulations take effect.

What This Means for the Broader Digital Economy

Open banking does not operate in isolation. Its impact ripples across the broader digital economy:

E-commerce: Account-to-account payment initiation can reduce dependence on cash-on-delivery and card payments, which together account for the majority of Pakistan’s e-commerce transactions
SME lending: The SBP’s simultaneous launch of SMEConnect — a centralized digital platform for SME loan applications starting November 1, 2026 — complements open banking by creating the application infrastructure, while open banking provides the data infrastructure for faster credit decisions
Government payments: Open banking APIs can facilitate tax payments, utility bills and government disbursements with better reconciliation and lower transaction costs
Cross-border payments: While the draft focuses on domestic transactions, open banking infrastructure could eventually support cheaper inbound remittances — relevant given that Pakistan’s freelancers earned a record $197 million in September 2026, as we tracked in our analysis of Pakistan’s IT exports and freelance economy

The connection to Pakistan’s broader startup ecosystem is also worth noting. Several of Pakistan’s most active startup sectors — fintech, lending, payments and B2B commerce — depend on financial data access. Open banking regulation could reduce the infrastructure cost of building these businesses, making the unit economics more attractive for both founders and investors.

Product Builder’s Perspective

From a product-building perspective, the most important question is not what the regulations say today, but what they will enable tomorrow.

Open banking is fundamentally an API infrastructure layer. Like any infrastructure layer, its value comes from what gets built on top of it. The UK took several years after its open banking implementation to see meaningful adoption beyond basic account aggregation. Brazil moved faster because its central bank coupled open banking with Pix, creating immediate consumer-facing use cases.

For Pakistan, the adoption curve will depend on three factors: how quickly the SBP finalizes the regulations after consultation, how quickly banks build production-grade APIs, and how quickly fintechs and developers build products that consumers and SMEs actually want to use. The sandbox cohort and BankIslami’s aik platform suggest the first two factors are moving. The third — product-market fit for open banking use cases — is where the real work lies.

For STEAM educators and program designers, this is also a signal that API literacy, financial data standards, and consent management are becoming core skills for Pakistan’s developer workforce. Training programs that teach these skills — alongside the practical coding and systems thinking we focus on in LearnOSTEAM — will produce graduates who are better prepared for the financial technology jobs that open banking will create.

What to Watch

Consultation feedback. The November 30 deadline is the first checkpoint. The quality and substance of feedback from banks, fintechs and industry bodies will indicate how much consensus exists on key implementation questions.
Final regulation timeline. The SBP has not published a target date for final rules. Based on international precedent, a gap of 6–12 months between consultation close and final publication is typical.
API standard specification. The draft regulations define the legal framework, but the technical API standard — data models, authentication protocols, rate limits, error handling — is what developers will actually work with. Watch for a separate technical specification document.
Bank readiness. Which Pakistani banks begin publishing open banking APIs or developer sandboxes first will indicate which institutions are treating this strategically.
TPP licensing process. The draft introduces a Third-Party Provider category. How the SBP structures licensing requirements — capital, security audits, compliance obligations — will determine how accessible the TPP market is to startups versus incumbents.

How to Submit Feedback

The SBP has invited feedback from financial institutions, fintechs, technology providers, consumer groups, academia and the general public. Comments can be submitted through November 30, 2026:

By email: Send to the SBP with subject line “Feedback on Draft Open Banking Regulations”
By post: Payment Systems Policy & Oversight Department, 4th Floor, SBP Building, I.I. Chundrigar Road, Karachi
Draft regulations: Available on the SBP website at sbp.org.pk

For fintech founders and technology builders, this is an opportunity to shape the regulatory framework before it is finalized. Technical feedback on API standards, security requirements and implementation timelines from the people who will actually build on this infrastructure is more useful than generic industry commentary.

Conclusion

Pakistan’s draft Open Banking Regulations represent the most consequential financial infrastructure reform in years. The framework would give customers control over their financial data, enable a new category of fintech products, and create payment rails that bypass traditional card networks. But a draft is a draft. The distance between consultation and implementation — between a published regulation and a working API that a developer can call in production — is where most open banking frameworks either succeed or stall.

The SBP’s sandbox-first approach, the early market signals from BankIslami’s aik, and the simultaneous rollout of SMEConnect all suggest genuine institutional momentum. Whether that momentum translates into a functioning open banking ecosystem will depend on how quickly the final regulations are published, how seriously banks invest in API infrastructure, and how effectively fintechs build products that solve real problems for Pakistani consumers and businesses.

The consultation window is open. If you build in fintech, payments or financial technology in Pakistan, this is your chance to help shape the rules before they are written.

Sources

ProPakistani: SBP Wants Fintechs to Have More Access to Banking Data — October 30, 2026
ProPakistani: SBP Clarifies Rules for Fintechs After Sandbox Testing — September 16, 2026
ProPakistani: New SBP Website for Business Loans Launched — October 29, 2026
State Bank of Pakistan, draft Open Banking Regulations (available on sbp.org.pk)
Open Banking Limited (UK), open banking adoption statistics (ob.comparison data, 2024)