The open banking compliance platform for banks in Saudi Arabia and the GCC: the whole regulated lifecycle in one on-premise deployment, plugged into the APIs your bank already runs.
APIs with availability SLAs, a FAPI authorization server, consent and journeys, directory trust, core integration, reporting and audit, a developer portal - each its own project, all due together.
The Kingdom is already on release 2. A bespoke build re-opens with every release, and the regulator’s migration window is not optional.
Channel APIs assume a logged-in session and display data. The standard needs headless access, IBANs, ISO amounts and distinct balance types.
Supervision asks for consent history, access records and availability. Reconstructing them across systems is where programmes go wrong.
Everything regulator-facing and TPP-facing is the platform’s. Everything bank-specific is isolated behind one connector to the API layer your channels already use.
From the moment a third party is admitted to the moment a customer withdraws access, the regulated path runs end to end on the platform. Your systems answer one question: what does this customer hold?
Licence, certification, role and certificate chain verified against the national directory. Admission is a maker-checker decision by your staff.
Directory verifiedThe TPP calls the standard’s API over mutual TLS with a signed request. The consent is created in the system of record, awaiting authorisation.
Awaiting authorisationThey approve in the bilingual journey. Every call is then checked against the consent, fetched through the connector and minimised before it leaves.
Authorised · auditedOne tap in the dashboard revokes the consent, kills every derived token and notifies the TPP with a signed event.
RevokedBanks don’t expose the core. They expose the API layer their own channels use - and OBConnect is a client of that layer. It does all the compliance shaping; your APIs only have to answer faithfully.
The connector hub is the platform’s single client of your bank: credentials live once, every call is bounded, and TPP load can never take down core banking.
Audit is a write path, not a log. Every consent transition, every data access and every privileged change is hash-chained on the same transaction as the action itself.
Licensed software in your data centre on Kubernetes. No SaaS, no runtime egress; directory sync and pack updates enter through a controlled, signature-verified channel.
Mutual TLS everywhere a TPP touches, pushed authorization requests, signed request objects, private_key_jwt, PKCE and certificate-bound tokens re-checked at the edge.
Signing and transport keys generated and held in the bank’s HSM through PKCS#11. Nothing about the platform needs the vendor in the room.
No privileged operation runs on one person’s say-so, and no script with a secret can approve one. Every decision is on the audit chain.
Partner and connector code never runs in the same process as consent enforcement or TPP traffic; bundles are signed and verified fail-closed at startup.
Bank staff sign in with their own SSO into four roles. Admit or suspend a TPP, activate a pack, revoke a consent, verify the chain - every change submitted by a maker and approved by a checker.
Branded documentation served from the same signed pack the gateway enforces: base URLs, onboarding runbook, error glossary, published rate limits, change register - and a sandbox behind the same edge.
The regulator’s report set generated from the event backbone, availability and response time measured at the edge, and per-certificate rate limits that keep the SLA yours to meet.
Everything reachable from the outside is the standard’s own surface and the portal. The internal plane is authenticated, off the edge, and on the audit chain.
A typical engagement runs in weeks because nothing regulator-facing is written for you. The only bank-specific work is the mapping to your own APIs, the branding, and your staff.
The compact profile running in your environment, and a gap analysis of your API estate against the standard’s surface.
The mapping connector written as configuration against your APIs, with the conformance kit green before the platform ever sees it.
The journey white-labelled, your staff on the operator console, the developer portal and sandbox opened to licensed third parties.
Conformance runs, the evidence bundle, the regulator’s report set, and a platform your own team operates.
Standards as content. Integration as configuration. Evidence as a product. And engineers who work alongside yours, from first workshop to certification.
Keystone Labs builds Wahid, the configurable back office for banks, and OBConnect, the open banking compliance platform - and delivers both with its own engineers.
A guided walkthrough of the lifecycle, with your API estate in mind. Bring one API your channels use today - we’ll show it mapped and answering the standard.
A week with your architecture, integration and compliance leads: the standard’s surface against your API estate.
The compact profile in your environment, your APIs mapped, the conformance kit green, the journey in your brand.
Sandbox and portal opened to TPPs, the evidence bundle, the report set, and operations handed to your staff.