For digital banks, neobanks and account-holding fintechs under the SAMA Open Banking Framework: the same FAPI edge, consent engine and journey a tier-1 bank runs, on a single node, in weeks.
Standards-compliant APIs with availability SLAs, FAPI-grade authorization, consent journeys, directory trust, reporting and audit - the obligations do not scale down with headcount.
Your engineers are building the product. A compliance platform, a FAPI authorization server and a regulator-shaped journey are three specialisms you should not have to hire for.
Aggregators and lenders want to build against you now. Without a sandbox and a portal, every integration is a bespoke conversation.
Conformance testing and supervisory evidence gate go-live. Getting there late is the one delay the roadmap cannot absorb.
The same platform tier-1 banks deploy, in a compact profile that runs every service on one node - and grows into the full high-availability profile as you do, without a migration.
From the moment a third party is admitted to the moment a customer withdraws access, the regulated path runs end to end on the platform. Your systems answer one question: what does this customer hold?
Licence, certification, role and certificate chain verified against the national directory. Admission is a maker-checker decision by your staff.
Directory verifiedThe TPP calls the standard’s API over mutual TLS with a signed request. The consent is created in the system of record, awaiting authorisation.
Awaiting authorisationThey approve in the bilingual journey. Every call is then checked against the consent, fetched through the connector and minimised before it leaves.
Authorised · auditedOne tap in the dashboard revokes the consent, kills every derived token and notifies the TPP with a signed event.
RevokedBanks don’t expose the core. They expose the API layer their own channels use - and OBConnect is a client of that layer. It does all the compliance shaping; your APIs only have to answer faithfully.
Whatever sits behind your API layer, the connector is a client of it. Most estates integrate through the mapping connector; the SDK is the escape hatch.
Audit is a write path, not a log. Every consent transition, every data access and every privileged change is hash-chained on the same transaction as the action itself.
Licensed software in your data centre on Kubernetes. No SaaS, no runtime egress; directory sync and pack updates enter through a controlled, signature-verified channel.
Mutual TLS everywhere a TPP touches, pushed authorization requests, signed request objects, private_key_jwt, PKCE and certificate-bound tokens re-checked at the edge.
Signing and transport keys generated and held in the bank’s HSM through PKCS#11. Nothing about the platform needs the vendor in the room.
No privileged operation runs on one person’s say-so, and no script with a secret can approve one. Every decision is on the audit chain.
Partner and connector code never runs in the same process as consent enforcement or TPP traffic; bundles are signed and verified fail-closed at startup.
Consent operations, TPP management and the audit trail sit beside the rest of your operations in Wahid, the configurable back office - one identity, one set of controls, one place to work.
OBConnect runs beside whatever you already have. The operator console, developer portal and reporting are its own; integration is the mapping to your APIs and nothing else.
Both are built and delivered by the same team, in the GCC, for the standards the region writes.
Nothing regulator-facing is written for you. Your engineers map the platform to your APIs; ours are alongside from the first workshop to certification.
The compact profile running in your environment, and a gap analysis of your API estate against the standard’s surface.
The mapping connector written as configuration against your APIs, with the conformance kit green before the platform ever sees it.
The journey white-labelled, your staff on the operator console, the developer portal and sandbox opened to licensed third parties.
Conformance runs, the evidence bundle, the regulator’s report set, and a platform your own team operates.
A guided walkthrough of the lifecycle, with your launch plan in mind. Bring the API your app already uses - we’ll show it mapped and answering the standard.
A week with your engineering and compliance leads: the standard’s surface against the APIs you have.
The compact profile in your environment, your APIs mapped, the conformance kit green, the journey in your brand.
Sandbox and portal opened to partners, the evidence bundle, the report set, and operations in your hands.