The app is the brand. The licence sits somewhere else, sometimes at another company entirely, and it determines what protections a customer actually has. Reviews that skip it are reviewing the interface.
The requirement is changing from producing a report on a schedule to demonstrating that a control was working at every moment. That is a different engineering problem, and it is why compliance is becoming a systems purchase rather than a headcount one.
SAMA moved open banking from sandbox to licensed activity in March 2026, and licences have followed. What has not followed is a single published figure on how many consumers or businesses have actually connected an account.