SBP Proposes Open Banking Through Raast

SBP Proposes Open Banking Framework, Allowing Third-Party Access to Customer Data

KARACHI: The State Bank of Pakistan (SBP) has proposed a new open banking framework that would require banks, microfinance banks and electronic money institutions to provide authorised third-party service providers with access to customers' financial data and payment services.

The central bank released its draft Open Banking Regulations 2026 for public consultation on Friday, aiming to encourage digital payments, strengthen competition and improve access to financing while introducing protections for customer information.

Under the proposed framework, financial institutions maintaining customer accounts would be required to provide access through application programming interfaces (APIs). With customer consent, authorised providers would be able to retrieve account balances and transaction histories.

The framework would cover current accounts, savings accounts and other accounts used for payments, allowing customers to view financial information from multiple institutions through a single platform.

The SBP has proposed using Raast as the centralised API hub for sharing customer-authorised data and initiating payments.

Licensed third-party providers would be allowed to facilitate business-to-business payments, consumer payments to merchants and transfers between accounts held by the same customer.

The framework would also permit authorised providers to analyse transaction histories and develop credit scores for individuals and small and medium enterprises (SMEs). These scores could then be shared with regulated financial institutions to support lending decisions.

According to the central bank, using customers' existing financial transaction records could help lenders assess borrowers and improve access to credit.

Customer consent and security safeguards

Under the proposed consent rules, customers would have to explicitly approve data sharing or payment initiation, specifying the purpose, duration and applicable transaction limits.

Banks and third-party providers would be required to offer online dashboards allowing customers to monitor, modify or withdraw their consent at any time.

Third-party providers would be prohibited from collecting or storing customers' banking passwords, personal identification numbers and other authentication credentials.

The draft also requires biometric verification through the National Database and Registration Authority (NADRA), followed by authentication through the customer's bank before access is granted.

Liability, complaints and breach reporting

In cases involving unauthorised payments, banks would generally be required to restore disputed amounts within seven business days after receiving a valid claim, subject to specified exceptions. They could subsequently recover the amount from the third-party provider responsible.

The draft assigns responsibility for data breaches, unauthorised transactions and misuse of customer information to the institution responsible for the failure.

Financial institutions and service providers would also have to provide initial findings on customer disputes within seven working days and resolve complaints within 30 days.

Third-party providers would be required to report security breaches, unauthorised access and unplanned service disruptions lasting more than 30 minutes to the SBP within two hours of detection. A detailed report would follow within 72 hours, while a root-cause analysis would have to be submitted within 15 days.

Data storage and service charges

The proposed regulations require customer information to be stored and processed within Pakistan, subject to permitted cloud outsourcing arrangements.

Information obtained through customer consent would generally have to be deleted or irreversibly anonymised within 30 days after consent expires or is withdrawn, unless legal requirements require its retention.

Regarding charges, the SBP has proposed that Raast Payments Pakistan would not charge third-party providers for payment initiation and data-sharing services. Payment initiation service providers would also be prohibited from charging customers for payments made to businesses.

Authorisation and consultation deadline

New third-party providers would need to obtain SBP authorisation and complete integration and testing before launching their services. Existing eligible regulated institutions could begin offering these services after notifying the central bank at least 30 days in advance.

The SBP said the draft regulations incorporate findings from the first cohort of its regulatory sandbox on open banking.

Banks, fintech companies, consumer organisations and other stakeholders have been invited to submit their feedback by November 30, 2026, before the proposed framework is finalised.