SBP proposes mandatory open banking APIs for banks, MFBs and EMIs

The State Bank of Pakistan has published draft Open Banking Regulations that would require banks, microfinance banks and electronic money institutions to give authorised third-party providers access to customer data and payment initiation, with the customer's consent. The central bank released the draft on 30 October and is accepting comments until 30 November 2026.

The draft states that all such account-holding institutions "shall mandatorily expose" their application programming interfaces to authorised providers, and that participation is mandatory for all of them. Shared data would be limited to account balances and transaction history from current accounts, savings accounts and other accounts used for payments.

Two services are proposed. Payment initiation providers could offer business-to-business payments, consumer-to-business payments and transfers between a business's own accounts, and would not be allowed to hold customers' funds at any time. Account information providers could offer a consolidated view of balances across institutions and credit scoring of individuals and small and medium enterprises, for onward sharing with entities regulated by SBP or the Securities and Exchange Commission of Pakistan.

Providers would connect through a central API hub run on Raast, the state bank's instant payment system, and would have to meet Raast's security and technical standards. New entrants would need SBP authorisation under the 2014 rules for payment system operators and payment service providers: first an in-principle approval, then integration and testing in a sandbox. Existing banks, EMIs and payment firms could offer the services after notifying SBP at least 30 days in advance.

Consent is central to the draft. It would have to be explicit, specific and time-bound, covering scope, duration, purpose and daily and monthly payment limits. Providers could not request or store a customer's banking login, PIN or password. Customers would be able to view, change or revoke their consents on a dashboard, and a revocation would take effect immediately.

The draft also sets out who pays when something goes wrong. An account-holding institution would be liable for unauthorised, failed or late payments unless the provider caused the loss, and on a valid claim would have to credit the customer within seven business days, recovering the money from the provider afterwards where liability rests there. It could withhold that credit only on reasonable grounds to suspect customer negligence. In a dispute, the burden of proof would rest with the institution and the provider, and a record that a credential was used would not by itself prove that the customer authorised the transaction.

Providers would have to report security breaches and outages of more than 30 minutes to SBP within two hours of detection, with a detailed report within 72 hours. Customer data would have to be stored and processed in Pakistan unless held through a cloud provider under SBP's outsourcing framework, and it would have to be deleted or irreversibly anonymised within 30 days of a consent ending, subject to exceptions such as legal records. A lender that declines credit or offers worse terms because of a provider's score would have to tell the customer and name the provider.

On cost, the draft says Raast Payments Pakistan would not charge providers for payment initiation and data sharing. Providers could not charge consumers who initiate consumer-to-business payments, and fees between banks and providers would be agreed between providers and a body representing the institutions.

For the digital asset sector, one clause is worth watching. The credit-scoring provision names entities regulated by SBP or SECP, and does not name the Pakistan Virtual Assets Regulatory Authority. On that wording, it is not clear whether a PVARA-licensed firm could receive such scores. Firms that want clarity on this point can raise it in the consultation.

SBP said the draft was informed by the first cohort of its regulatory sandbox on open banking, and invited comments from financial institutions, fintechs, technology providers, consumer groups, academics and the public. The rules are not yet final. Comments can be sent to psdpolicy@sbp.org.pk with the subject line "Feedback on Draft Open Banking Regulations", or by post to the Payment Systems Policy & Oversight Department, 4th Floor, SBP Building, I.I. Chundrigar Road, Karachi.