SBP proposes open banking rules requiring customer-authorised data sharing

The State Bank of Pakistan has released draft Open Banking Regulations 2026 for public consultation, proposing that banks, microfinance banks and electronic money institutions provide authorised third-party providers access to customer financial data and payment services. The consultation will accept feedback until November 30, 2026.

Under the proposal, institutions holding customer accounts would provide access through application programming interfaces. With customer consent, providers could retrieve balances and transaction histories from current, savings and other accounts used for payments. The draft proposes Raast as a central hub for exchanging authorised data and initiating payments.

Authorised providers could facilitate business-to-business payments, consumer payments to merchants and transfers between accounts held by the same customer. Using transaction histories, providers could prepare credit assessments for individual customers and small-to-medium enterprises, then share them with regulated financial institutions to support lending reviews.

The proposed consent process would require customers to specify the purpose and duration of access and any transaction limits. Banks and providers would offer online dashboards for customers to monitor, modify or withdraw consent. Providers would be barred from collecting or storing banking passwords, personal identification numbers and other authentication credentials. The draft also proposes biometric verification through the National Database and Registration Authority, followed by authentication by the customer’s bank.

The draft sets out proposed consumer protections for disputed payments and service providers’ responsibilities. Banks would generally have to restore disputed amounts within seven business days of a valid claim, subject to specified exceptions. The framework also proposes that customer disputes receive initial findings within seven working days and be resolved within 30 days.

The SBP said the framework draws on findings from the first cohort of its open banking regulatory sandbox and includes provisions covering data protection, privacy, cybersecurity, fraud prevention and consumer protection.