finpeel Answers · KSA · updated 2026-08-14
Not merely because it has customer consent. If the fintech itself provides a regulated open-banking Payment Account Information or Payment Initiation service, it must fit SAMA’s authorisation framework; a technology vendor acting only for an authorised participant can be different.
The legal question is who is the open-banking service provider, not who built the API connector. Banks and payment account providers must interact with authorised providers under the relevant rules and standards.
Structure any vendor model so customer contracting, consent, data access and regulated responsibility clearly remain with the authorised entity if the fintech is not licensed itself.
Regulator: Saudi Central Bank (SAMA)
Primary sources: SAMA — Implementing Regulations of the Law of Payments and Payment Services · SAMA — Open Banking
Directional — not legal advice. Verify with the regulator before committing.
Read on finpeel.com · All answers · Check the licensing perimeter