Open banking in Saudi Arabia and Egypt: what “connect your bank” means for your app — and what it does not

“Connect your bank account” is a small button that changes an entire product. With SAMA’s open banking framework in Saudi Arabia, and Egypt’s InstaPay network and instant payments, your app can read account data and initiate transfers with the customer’s consent — without being a bank. This article is for founders and CTOs asking: do we need it, and how do we build it without becoming a regulatory project?

The promise in one sentence

Instead of the customer uploading a statement or typing an IBAN by hand, they grant a time-limited consent and your app reads what it needs and starts the payment directly from the bank.

Three things it changes in the product

1. Onboarding: instant account-ownership verification instead of “wait for a one-riyal transfer”. For an earnings-and-contests platform like Arpahak, that means paying winnings into a verified account with no support tickets.
2. Payment initiation: account-to-account transfer with no card and no card fees. For a fractional real-estate platform like Mashrouk, subscribing to a share becomes one step.
3. Understanding: with consent, reading income and commitments for preliminary financing approval — the feature that makes “know your limit before you fall in love with the apartment” possible in property platforms.

What it does not mean

• You are not a bank: money does not pass through you. Excellent — you do not want it to.
• It is not regulation-free: data access in Saudi Arabia goes through licensed third-party providers (TPPs) or a partnership with one; in Egypt through banks and Central Bank-licensed payment providers. Plan for it in the timeline, not in the last week.
• Consent is not forever: approvals are time-limited and revocable. Design for renewal, and for “the customer disconnected” gracefully.

The architecture we recommend

• A bank abstraction layer: one internal interface (accounts, consents, payments) with one or more providers behind it. Swapping the provider must not touch business logic.
• Consent as an entity: a table of permissions with scope, duration and status; every data read is logged against a specific consent.
• Idempotent payments: a retry never creates two transfers. The same rule we apply to WhatsApp messages applies to riyals, harder.
• Daily reconciliation: what we initiated versus what the bank confirmed — one unexplained difference wakes someone up.

For anyone starting today

Start with one high-value case (account verification or a single transfer), pick a licensed provider, and build the abstraction layer from day one. Open banking does not replace the classic payment gateway yet; but it lets your app know its customer financially like never before — with their permission, and under the regulator’s eye.