Compliant with the SAMA Open Banking Framework, in weeks
One on-premise platform runs the whole regulated lifecycle - TPP trust, FAPI authorization, consent, the standard’s APIs, audit and reporting - and plugs into the APIs your bank already has. Built for banks in Saudi Arabia and the GCC.
Compliance is seven projects. Make it one deployment.
Every bank pulled into open banking by its regulator discovers the same thing: “being compliant” is not one project. It is standards-compliant APIs with availability SLAs, a FAPI-grade authorization server, consent management with regulator-shaped journeys, TPP identity checks against the national directory, core integration that must not destabilise the bank, regulatory reporting with an audit trail that survives supervision, and a developer portal so licensed third parties can actually build against you.
OBConnect ships all seven, pre-integrated, as licensed software deployed inside your own data centre. Everything regulator-facing and TPP-facing is the platform’s job. Everything bank-specific is isolated behind one connector to the API layer your channels already use.
Because each national standard is versioned content rather than code, a new release of the framework is a pack you activate, side by side with the old one through the migration window - not a programme you restart.
Everything the framework asks for, out of the box
FAPI-grade gateway
Mutual TLS, FAPI header enforcement, routing by standard version and per-TPP throttling at the edge, before a request reaches anything that matters.
Authorization server
FAPI 1.0 Advanced: pushed authorization requests, signed request objects, private_key_jwt, PKCE and certificate-bound tokens whose lifetime follows the consent.
Consent and journeys
The consent system of record with the Arabic-first, regulator-shaped customer journey and dashboard, white-labelled to your brand.
TPP trust
Licence, certification and role verified against the national directory on every request; admission is a maker-checker decision by your staff.
Reporting and audit
The regulator’s report set generated from the event backbone, SLAs measured at the edge, and a hash-chained audit trail exportable to WORM storage.
Developer portal and sandbox
Branded documentation served from the same signed pack the gateway enforces, an onboarding runbook and a sandbox behind the same edge as production.
Delivered on OBConnect
This solution is OBConnect, our open banking compliance platform. See the full lifecycle, the real consent journey screens, how it integrates with your core APIs, and the evidence it produces for your regulator.
Explore the OBConnect platform →More OBConnect solutions
Consent Management
Issue, authorise, track and revoke open banking consents with an Arabic-first customer journey, a consent dashboard and a tamper-evident audit trail.
Read more →Open Banking Integration
Open banking on the core APIs you already run - T24, Finacle, Flexcube or any API layer - through a declarative mapping connector. The core is never touched.
Read more →Frequently asked questions
What does open banking compliance require of a bank in Saudi Arabia?
Under the SAMA Open Banking Framework a bank must expose standards-compliant account information and payment initiation APIs to licensed third parties with strict availability and response-time obligations, run FAPI-grade authorization, manage customer consent through regulator-shaped journeys and a dashboard, verify third parties against the national directory, report to the regulator in its formats, and keep an audit trail that survives supervision. OBConnect provides all of this as one deployable platform.
How is OBConnect different from building open banking compliance in-house or with an integrator?
A bespoke build is a multi-year programme that re-opens with every release of the standard. OBConnect is the product such a programme should have produced: the regulator-facing and TPP-facing parts are already built, certified against the standard’s conformance suite, and kept current through versioned Standard Packs. The only bank-specific work is mapping the platform to your existing APIs and branding the journey.
Is OBConnect deployed on premises?
Yes. OBConnect is licensed software that runs inside your own data centre on Kubernetes, with a single-node compact profile for proofs of concept. Nothing needs internet access at runtime, customer data never leaves your perimeter, and your staff operate it through their own SSO with maker-checker on every privileged change.
Which standards and countries are covered?
The Saudi Arabian SAMA Open Banking Framework first, with account information services live and payment initiation and confirmation of funds following on the same pack mechanism. Bahrain and UAE packs are planned on the same foundation, covering both the bilateral and hub-mediated market models used across the GCC.
How long does it take to become compliant?
Weeks rather than months. A typical engagement deploys the compact profile and runs a gap analysis of your API estate in the first week, connects the mapping connector and passes the conformance kit in the following two, and brands the journey, opens the portal and hands operations to your staff after that, before conformance testing and go-live.
See open banking compliance as one deployment.
A guided walkthrough of the lifecycle, with your API estate in mind.