UAE plays catch-up with open banking regulations

The rollout of open banking in the Middle East’s largest banking markets has thus far been a study in contrasting approaches.

Bahrain, once the region’s banking hub and still home to the 10 of the region’s largest 100 lenders, formally commenced its open banking programme in 2018, publishing a comprehensive framework in October 2020.

The framework, which draws on elements from open banking regulations in jurisdictions including the UK, the US and Australia, outlines detailed requirements and guidelines for banks and fintechs for both account information services (AIS) and payment initiation services (PIS), together with requirements for consumer data protection and application programming interface (API) standards.

Seventeen banks are listed as compliant with the framework by the Central Bank of Bahrain (CBB) at time of writing.

Saudi Arabia has followed a similar regulator-led path, with the publication of a comprehensive open banking framework in November 2022 covering AIS and PIS services. The Saudi Central Bank (SAMA) mandated banks to make their AIS APIs available by the end of the year and PIS APIs by the end of March, although both processes were extended by a few months.

In January, SAMA announced the launch of its Open Banking Lab, enabling banks and third-party players (TPPs) to develop, test and certify their open banking services in line with the open banking framework.

Player-led

In contrast with such regulator-driven approaches, the UAE – the Middle East’s largest banking market by assets – has thus far favoured a strategy which is led instead by market players. While financial free zones in Abu Dhabi and Dubai have issued licence regimes for TPPs for both AIS and PIS services, onshore authorities have so far been content to let market actors drive innovation in open finance with minimal interventions.

“The UAE’s approach to date has been similar to that of Singapore and the US, where authorities have given guidance to corporations and then largely let the market get on with implementation,” says Serena Sebastiani, director of financial services for PwC Middle East.

The lack of a comprehensive open banking framework has not stopped the country’s lenders and TPPs from embracing the opportunities for open banking. Emirates NBD, the country’s second largest lender by assets, launched its API sandbox in 2018 with a view to enhancing open banking collaboration with local fintechs.

“The move towards a more open and collaborative approach is the natural and logical consequence of the digitisation of the banking experience in the past few years,” says Fernando Morillo, group head of retail banking at Mashreq, Dubai’s third largest bank by assets.

“Several players in the market, including ourselves, have been making inroads into open finance. It’s a very dynamic area, and in recent months the regulators have been playing an increasing role.”

Mashreq’s initiatives in the open finance space thus far include the use of its APIs to offer financing services to clients and non-clients using the app of local e-commerce retailer Noon.com, and the integration earlier this year of its NEOBiz Connect API with the platform of Dubai-based business consultancy Virtuzone. The bank declined to share transaction volumes for either collaboration.

Lack of clarity

While such collaborations have developed at a significant pace thus far, the UAE’s light-touch approach has drawn some criticism for a lack of clarity regarding permissible practices and preferred standards compared with its neighbours.

“In Saudi Arabia, the regulatory stance has been crystal clear regarding what’s permitted and what’s not, and in terms of the API specifications to be used,” says Abdulla Almoayed, CEO of Tarabut Gateway, which provides open banking services for lenders in Bahrain and Saudi Arabia, and is also licensed to provide platform services by the Dubai Financial Services Authority, the regulator of free zone the Dubai International Financial Centre.

“In the UAE, by contrast, the regulations stipulate that practices like reverse engineering and screen scraping are not permitted, although we know that there are companies doing this that have yet to be sanctioned,” Mr Almoayed adds.

The lack of clear API specifications meanwhile has resulted in a range of different standards being used by banks and fintechs on an ad hoc basis thus far.

“In the UAE, you have a few dozen fintechs that are scrapping around for connectivity while the regulations on API exposures are unclear. Against this backdrop, players like us are focusing on other markets in the region while we wait for standards and regulations to develop further,” Mr Almoayed says.

Such clarity is now on the horizon. In February, the Central Bank of the UAE announced the launch of its ambitious financial infrastructure transformation (FIT) programme. A card payment platform, instant payments system and a digital currency are among the programme’s first phase priorities, with financial cloud, eKYC and open finance platforms to be established in the second phase. The entire programme is set to be implemented by 2026.

“The open finance framework under the FIT programme is set to be much more extensive than the UAE’s current approach, providing comprehensive regulations and standards, and broadening the scope beyond open banking,” says Ms Sebastiani.

“Following the earlier market-led approach, the central bank’s objective is to help banks and TPPs to optimise the cost of implementation and to help them innovate and achieve satisfactory return on investment.”

Stifling innovation?

Yet some TPPs fear that the establishment of such a platform in the midst of a wider top-down overhaul of the country’s financial infrastructure may come at the expense of innovation in the short term.

“The current assumption is that the central bank is looking to build and maintain portions of the open finance platform stack itself, as part of a unified payments infrastructure, similar to what the US has done with FedNow, which will eventually permit for TPPs such as ourselves to build additional use cases on top of it,” says Mr Almoayed. “While you can make the case that it will reduce complexity, it can also be argued that it stifles innovation.”

And with the full implementation of the FIT programme at least three years away, the UAE risks falling further behind its neighbours, he says.

“In Saudi, banks have already gone live with AIS services, with PIS services set to follow soon. In the UAE by contrast, they’re still at the beginning of the RFP process, with the building out of their platform set to take a while. It may be that they can execute on their plan and build something really phenomenal that leapfrogs what others have done elsewhere, but there’s a long road ahead.