Pakistan drafts open banking rules that route every API through Raast

Pakistan drafts open banking rules that route every API through Raast

30 October 2026: The State Bank of Pakistan (SBP) has published draft Open Banking Regulations that would require every bank, microfinance bank and e-money institution to open customers' balances and transaction histories, and payment initiation from their accounts, to licensed third-party providers through the API hub of Raast, the central bank's instant payment system. Comments are due by 30 November 2026, and the SBP says the draft draws on the first cohort of its open banking regulatory sandbox.

Not yet independently verified. The draft sets no start date and no transition period for banks and providers. We will add them when the State Bank of Pakistan issues the final regulations. We will update this when it can be confirmed, and remove this note.

Participation is mandatory for account holders

The draft calls banks, microfinance banks and e-money issuers "account holding institutions" and says all of them "shall mandatorily expose" their APIs, so that the data of every individual and business customer is in the system from the start. The data in scope is the account balance and the transaction history of current, savings and other payment accounts.

Third parties come in two kinds. Payment initiation providers may run business-to-business payments along supply chains, consumer payments to merchants and transfers between a business's own accounts. Account information providers may aggregate data from several institutions to show balances in one place or to build credit scores for individuals and SMEs, which they can share with entities regulated by the SBP or the Securities and Exchange Commission of Pakistan.

Licensing through the payment service rules

A new provider applies under the SBP's 2014 rules for payment system operators and payment service providers. The SBP first grants in-principle approval; the provider then integrates with Raast and tests its service in the sandbox. Banks, e-money institutions and existing payment providers that want to offer the same services must notify the SBP at least 30 days before they start, and carry the same duties. If a licence is suspended or revoked, Raast blocks the provider's requests, every consent it holds lapses at once, and it must tell its customers and delete or anonymise their data.

Raast will not charge providers for payment initiation or data sharing. The draft also says providers may not charge consumers who pay merchants this way, and must price below the current market rate for merchants and corporates.

How consent and liability work

Consent must be explicit, specific and time-bound, naming the purpose, the duration and, for payments, daily and monthly limits. The customer starts it in the provider's app, the provider verifies identity through NADRA's biometric check, the bank sends a one-time password, and the customer approves with a PIN in the bank's own app. Providers may never request or store a customer's banking credentials, and banks must block automated access to their customer channels from providers, which rules out screen scraping. Both sides must run a dashboard where a consent can be revoked at any moment, with effect from the instant either side receives it.

For an unauthorised, failed or late payment the bank is liable to the customer unless the loss came from the provider's act or omission, in which case the provider compensates. The burden of proof rests with the bank and the provider, the customer gets a finding within seven business days, and Raast Payments Pakistan settles disputes between bank and provider.

Security, data location and deadlines for providers

A provider must report a breach or an outage longer than 30 minutes within two hours, file a full report within 72 hours and a root cause analysis within 15 days, and commission an independent vulnerability assessment at least once a year. Data must be stored and processed in Pakistan unless held with a cloud provider under the SBP's cloud outsourcing framework, and deleted within 30 days of a consent ending, apart from audit logs and records needed for disputes. Our banking systems software category lists eight products.

Comments go to psdpolicy@sbp.org.pk with the subject "Feedback on Draft Open Banking Regulations", or by post to the Payment Systems Policy and Oversight Department in Karachi.

Related on TrustList:

• CNIL fines Fnac Darty €7m over an app tracker used without consent

Sources

• State Bank of Pakistan: SBP Releases Draft Open Banking Regulations for Public Consultation (press release, PDF), 30 October 2026
• State Bank of Pakistan: Open Banking Regulations 2026 (draft for public consultation, PDF), 30 October 2026
• ProPakistani: SBP Wants Fintechs to Have More Access to Banking Data, 30 October 2026