The State Bank of Pakistan formally released its draft Open Banking Regulations on October 30, 2026, establishing an open public consultation window through November 30, 2026, to solicit comprehensive feedback from across the domestic and international financial ecosystem. Issued pursuant to the statutory authorities vested under Section 3 read with Section 70(1) of the Payment Systems and Electronic Fund Transfers Act of 2007, this foundational regulatory blueprint is directly informed by the empirical insights, operational mechanics, and risk-mitigation metrics observed during the inaugural cohort of the central bank’s Open Banking Regulatory Sandbox. The primary macro-economic objective of the framework is to dismantle traditional financial data silos, accelerate the end-to-end digitization of business-to-business and consumer-to-business payment streams, and utilize granular, verified digital transaction histories to power advanced alternative credit scoring models, thereby significantly expanding formal institutional lending access for historically underserved small and medium-sized enterprises.
To operationalize this nationwide digital architecture securely, the national instant payment infrastructure, Raast, is legally designated as the centralized application programming interface highway governing consent-based data exchanges and payment routing. All Account Holding Institutions—defined comprehensively across the regulations to encompass conventional commercial banks, specialized microfinance banks, and licensed electronic money institutions maintaining customer accounts, digital wallets, and corresponding financial records—are under a universal mandate to expose standardized application programming interfaces to authorized third-party providers. The legal scope of permissible data sharing is strictly bounded to account balances and detailed transactional histories across current accounts, savings accounts, and payment-designated wallets, while authorized third-party entities are formally bifurcated into Account Information Service Providers and Payment Initiation Service Providers. Payment Initiation Service Providers are authorized to execute business-to-business supply chain collections across merchants, distributors, and corporate actors, consumer-to-business retail and bill payments, and own-account internal fund transfers, whereas Account Information Service Providers are empowered to aggregate multi-institution balances and develop predictive credit risk profiles for individuals and small and medium-sized enterprises for authorized sharing with financial institutions regulated by the State Bank of Pakistan or the Securities and Exchange Commission of Pakistan.
To eliminate prohibitive infrastructure cost walls and foster rapid market participation, Raast Payments Pakistan is mandated to supply data-sharing and payment-initiation pathways to third-party providers completely free of charge. Furthermore, Payment Initiation Service Providers are strictly prohibited from levying any direct service charges on end-consumers for executing business payments, and pricing structures governing corporate, retail, and merchant segments must be maintained strictly below prevailing market thresholds to incentivize digital migration. User interface and user experience guidelines require platforms to present essential payment parameters upfront, supply instant digital confirmations, permit seamless cancellations or modifications prior to settlement, incorporate intuitive retry and help functions, display clear security credentials, ensure transparent redirection for customer authentication, and prohibit design friction such as excessive scrolling, confusing terminology, redundant re-authentication, disparaging messaging regarding licensed providers, or unsolicited promotional cross-selling. Consumer sovereignty, privacy protection, and informed consent architecture remain paramount throughout the regulatory text, mandating that explicit, time-bound, and purpose-restricted approval must be secured prior to any data access or payment routing. Third-party entities are legally barred from harvesting, receiving, storing, or utilizing banking passwords, personal identification numbers, or primary authentication credentials, and Account Holding Institutions are prohibited from permitting credential sharing while deploying automated surveillance controls to detect and block unauthorized channel access. System access workflows require mandatory multi-layered authentication beginning with biometric identity verification via the National Database and Registration Authority, followed by an automated one-time password dispatched to the customer’s registered mobile number, and concluding with final authorization via mobile or transaction personal identification numbers on the home bank’s secure interface.
The regulatory framework imposes stringent operational, cybersecurity, and data lifecycle protocols, dictating that all customer information must be stored and processed strictly within Pakistan (subject to approved cloud-outsourcing standards) and must be permanently deleted or irreversibly anonymized within thirty days following consent expiration or formal revocation, with explicit exemptions restricted solely to mandatory audit trails or active legal disputes held in segregated, access-controlled environments. Additionally, every director, officer, employee, agent, and contractor of a third-party provider granted system access must furnish a formal written declaration of fidelity and secrecy under board-approved policies, which remains legally binding post-employment. Governance structures dictate that third-party provider boards retain ultimate strategic and compliance accountability, supported by dedicated IT steering committees tasked with monitoring technical execution, enforcing application programming interface security standards, and maintaining comprehensive risk registers, incident logs, and annual independent vulnerability assessments utilizing masked production data. In instances involving unauthorized transactions, execution delays, or non-execution errors, Account Holding Institutions bear baseline customer liability unless faults are directly attributable to third-party provider failures, and upon receipt of a valid compensation claim, banks must credit the customer’s account within seven business days while retaining statutory rights to recover corresponding liabilities from responsible third-party entities. For account information services, liability is apportioned according to provenance failures including access control breaches, inaccurate data delivery, or failure to honor revocation requests. Participating entities must maintain a centralized incident register, issue initial findings within seven working days, achieve full complaint resolution within thirty days, and utilize Raast Payments Pakistan as an alternate dispute resolution forum. Furthermore, strict incident reporting windows require third-party providers to notify the central bank of security breaches, unauthorized intrusions, or unplanned service disruptions exceeding thirty minutes within two hours of initial detection, backed by a detailed report within seventy-two hours and an exhaustive root-cause analysis within fifteen days.
Finally, third-party providers must enforce rigorous anti-money laundering, counter-terrorism financing, and counter-proliferation financing controls, incorporating robust customer due diligence and merchant onboarding requirements such as verifying corporate incorporation documents, director identification, tax registration, and utility records, alongside immediate suspicious activity reporting to Account Holding Institutions, which maintain ultimate regulatory oversight for financial crime mitigation. Prospective market entrants must secure formal central bank in-principle approval under payment system operator and payment service provider rules and successfully clear sandbox integration testing prior to commercial deployment, whereas eligible incumbent financial institutions may commence operations upon providing a thirty-day prior written notice, ensuring a secure, orderly, and transparent transition for Pakistan’s evolving digital financial ecosystem.
Source Intelligence Layer: 1
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
