Open Banking in Pakistan: What the SBP Draft Means

On 30 October 2026 the State Bank of Pakistan (SBP) released its draft Open Banking Regulations for public consultation, with comments due by 30 November 2026 (APP). The rules are still a draft and may change. Even so, they give the clearest picture yet of how open banking in Pakistan is meant to work, and they matter to anyone who builds or runs business software that touches payments, invoices or customer accounts. This article explains the draft in plain terms and looks at what it could mean for apps, ERP and billing systems.

What is open banking, in simple terms?

Open banking lets a customer tell their bank, “share my account information with this app” or “let this app start a payment from my account”. The bank then hands over only what the customer agreed to, through a secure connection called an API (application programming interface), instead of the customer sharing passwords or uploading bank statements.

The app on the other side is called a third-party provider (TPP). Under SBP’s draft, a TPP is a licensed provider that can read account data or start payments once the customer has given clear consent (Dawn).

What SBP’s draft Open Banking Regulations propose

According to reporting on the draft, these are the main points (Profit):

• Banks must open APIs. Banks, microfinance banks and electronic money institutions that hold customer accounts would have to give authorised providers API access to balances and transaction histories, with the customer’s consent. Current, savings and other payment accounts are covered.
• Raast as the central hub. SBP proposes using Raast, the national instant payment system, as the central API hub for exchanging customer-approved data and starting payments.
• Payments, not just data. Licensed providers could start business-to-business (B2B) payments, customer-to-merchant payments and transfers between a customer’s own accounts.
• Credit scoring from real transactions. Providers could analyse transaction histories to build credit scores for individuals and small and medium enterprises (SMEs), which regulated lenders could use when assessing loans.
• No charges from Raast to providers. The draft proposes that Raast would not charge third-party providers for payment initiation and data sharing, and that customers paying businesses would not be charged by the payment initiation provider.

SBP says the draft draws on the results of the first cohort of its Regulatory Sandbox on Open Banking (APP).

The safeguards built into the draft

Most of the draft is about protecting customers, and these rules shape how any connected software has to be designed (Profit; Investify):

Consent with limits

Customers would have to approve each data share or payment explicitly, stating its purpose, how long it lasts and any transaction limits. Banks and providers would have to offer online dashboards where customers can see, change or withdraw consent at any time.

No stored passwords or PINs

Providers would be barred from collecting or storing banking passwords, PINs or other login credentials. Access would follow biometric verification through NADRA and then authentication by the customer’s own bank.

Data stays in Pakistan

Customer data would be stored and processed in Pakistan, unless it is held with a cloud provider under SBP’s Framework on Outsourcing to Cloud Service Providers (Dawn). Data obtained through consent would generally have to be deleted or irreversibly anonymised within 30 days after consent ends, unless the law requires keeping it.

Fast incident reporting

Providers would have to report security breaches, unauthorised access and unplanned outages longer than 30 minutes to SBP within two hours, followed by a detailed report within 72 hours and a root-cause analysis within 15 days.

Clear dispute timelines

For unauthorised payments, banks would generally restore the amount within seven business days of a valid claim. Disputes would need initial findings within seven working days and resolution within 30 days.

What open banking could mean for business software

The draft is aimed at banks and licensed providers, but the effects reach the software that businesses use every day. Here is where we expect the biggest changes, based on what the draft describes.

Payments straight from accounts into ERP and billing

Because the rules focus on B2B and customer-to-business payments, an ERP, distribution or billing system could, in time, start a supplier payment or collect from a customer through a licensed provider, and record it automatically. That would cut down on manual entry and bank-statement matching. If you already use Raast QR at the counter, this is the next layer on top; we covered the counter side in our post on Raast dynamic QR codes for billing and POS.

Faster reconciliation

With a customer’s consent, a provider could pull balances and transaction histories through an API instead of a business exporting statements by hand. Accounting modules that read that data could match receipts to invoices much sooner.

Credit for SMEs based on real records

The draft’s credit-scoring provision could help small businesses that keep clean digital records show lenders a real transaction history. Software that already keeps orderly sales and payment data puts a business in a better position for this.

Privacy by design becomes a requirement

Consent dashboards, no stored credentials, local data storage, deletion within 30 days and two-hour incident reporting are not features you can add later. Any web or mobile app that plans to connect to open banking services will need them built in from the start, along with proper audit logs and monitoring. Pakistan’s wider data rules point the same way, as we noted in our post on the National Data Governance Policy 2026.

What to do now

• Read the draft and follow the consultation. SBP is inviting feedback from financial institutions, fintechs, technology providers, consumer groups and the public until 30 November 2026 (APP).
• Don’t build against the draft as if it were final. Details such as consent screens, authentication steps and integration testing could change before the rules are finalised.
• Get your own data in order. Clean customer, invoice and payment records make any future bank integration far easier.
• Design for consent and security now. Role-based access, encrypted storage, logging and a clear way to remove data are good practice whether or not you ever connect to open banking.

FAQ

What is open banking in Pakistan?

It is a framework proposed by the State Bank of Pakistan in its draft Open Banking Regulations 2026. Banks would share a customer’s account data, or start payments, with licensed third-party providers through secure APIs, but only with the customer’s explicit consent.

Is open banking live in Pakistan yet?

Not under these rules. The regulations were released as a draft for public consultation on 30 October 2026, with feedback due by 30 November 2026, and they could change before they are finalised.

What is an open banking API?

It is a secure connection that lets an authorised app request specific account information or start a payment from a bank, without the customer sharing their password. Under the draft, Raast would act as the central hub for these API exchanges.

What is a third-party provider in banking?

A third-party provider is a licensed company, other than the customer’s bank, that uses open banking to read account data or start payments with the customer’s consent. Under the draft, new providers would need SBP authorisation and integration testing before going live.

Is open banking safe?

The draft includes several safeguards: explicit, time-limited consent, no storing of passwords or PINs, NADRA biometric checks, data kept in Pakistan, deletion after consent ends, and strict incident reporting to SBP.

If you’re planning a web application or an ERP or POS system that may connect to banks in future, we’re happy to talk it through on our contact page.