SAMA licenses Mala'a as Saudi open banking takes shape

This is the kind of regulatory announcement that looks minor on its own and only makes sense as part of a sequence. The Saudi Central Bank, SAMA, has licensed Mala'a Information Technology to provide payment account information services, one of the core services enabled under the Kingdom's open banking framework. That single approval takes the number of licensed payment service providers in Saudi Arabia to 33. On its own it is a routine line item, but read against what the central bank has been doing over the past several months, it is a small marker of a financial system being rewired quite deliberately. The substance of what Mala'a can now do is worth explaining plainly, because open banking is one of those terms that gets used more than it gets understood. The license covers payment account information services, which means Mala'a can allow customers to securely share their banking data with licensed third-party providers, but only after obtaining the customer's explicit consent. That consent requirement is the whole point. Instead of a customer's financial data being locked inside whichever bank holds their account, open banking lets them grant a regulated third party access to it, through secure APIs, to power services the bank itself might not offer. Mala'a already operates in the personal finance space, offering saving and expense tracking tools, so an account information license is the natural regulatory foundation for aggregating a user's accounts into a single view and building products on top of that data. The framework Mala'a now operates within is not loose, requiring adherence to strict standards on API performance, data security, consent management and governance, aligned with international best practice. The timing is what gives the license its meaning, because SAMA only moved open banking out of its regulatory sandbox and into a formal licensing regime in late March 2026. That transition, from a controlled testing environment where selected firms trialed use cases under supervision, to a fully supervised activity requiring a proper license, signaled that the central bank judged the framework mature enough for broader market adoption. Lean Technologies became the first firm to secure a full open banking license under the new regime, and the steady drumbeat of approvals since, Tatbiq Darahem, now Mala'a, and others, is SAMA methodically populating the ecosystem it spent years designing in the sandbox. Each license is a firm graduating from experiment to regulated market participant. The regional and strategic context is where a routine approval reveals its real weight. Open banking is a foundational component of Saudi Arabia's National Fintech Strategy, itself one of the headline outcomes of Vision 2030, and the ambition attached to it is explicit, to position the Kingdom as a global fintech hub. The numbers behind that ambition are already running ahead of target. Saudi Arabia's fintech ecosystem grew to 261 companies by the end of 2025, exceeding the original Vision 2030 goal of 230 firms by 13 percent, expanding 21 percent year on year, while cumulative fintech investment reached about 7.9 billion riyals, roughly 2.1 billion dollars, more than double the initial target. Open banking is the infrastructure layer that makes much of that possible, because letting fintechs access bank data with consent is what allows them to build lending, budgeting, payments and wealth products that can actually compete. In regional terms this puts Saudi Arabia in direct competition with the other Gulf hubs racing to own the same space, with Bahrain having moved early on open banking, the UAE building out its own framework, and all of them chasing the fintech talent and investment that a mature data-sharing regime attracts. Saudi Arabia's advantage is the sheer size of its domestic market and the coordination of a central bank that has sequenced this carefully rather than rushing it. The honest caveat is that licensing companies is the easy, visible part, and the harder test is adoption, whether Saudi consumers actually grant consent and use these services at scale, and whether the banks fully cooperate with the fintechs now entitled to their data rather than treating them as rivals. A framework is only as strong as the real usage flowing through it. But the direction is unambiguous. Each license like Mala'a's is another node switched on in a system SAMA is building toward a genuinely open, competitive and data-driven financial sector, and the pace of approvals suggests the Kingdom intends to get there faster than its neighbors.