Every consent, from request to revocation, on one record
Issue, authorise, track and revoke open banking consents with an Arabic-first customer journey shaped by the SAMA customer-experience guidelines, a consent dashboard your customers control, and a tamper-evident record of every transition.
The consent is the system of record
Open banking lets customers share their banking data with licensed third parties. The bank’s job is to issue, record and honour those consents, and to prove at any time exactly who was allowed to access what, for how long, and on whose authority.
OBConnect makes the consent the system of record. Every state the standard defines - awaiting authorisation, authorised, expired, revoked - and every immutable flag is held in one place, every transition is evented and audited on the same transaction, and the customer is bound to the consent where the record lives, not in a session somebody could overwrite.
Revocation is total: one tap in the dashboard withdraws the consent, kills every derived token at the edge, notifies the third party with a signed event and tells the customer in the standard’s mandated wording.
Consent management the framework recognises
Full lifecycle
Created, awaiting authorisation, authorised, expired and revoked - with the standard’s flags, validity rules and re-authentication windows enforced by the record itself.
Regulator-shaped journey
Review who is asking, choose accounts, confirm - screens that implement the SAMA customer-experience guidelines and ship with the platform.
Arabic-first, white-labelled
Arabic and English co-primary, right-to-left, WCAG 2.2 AA, in your brand. Permission wording comes from the Standard Pack, so a guideline update is a pack update.
Customer dashboard
Every connection the customer allowed, its status, what it can see and when data was last taken - with a way to stop sharing.
Signed notifications
Third parties learn of every state change through signed security events with retries and a polling fallback; customers are told in the mandated wording.
Tamper-evident record
Every transition seals into a hash-chained audit trail on the same transaction as the change, so consent history is evidence rather than reconstruction.
Part of the OBConnect platform
Consent management runs inside OBConnect alongside the FAPI edge, the standard’s APIs, participant trust, reporting and the operator console - so a consent is enforced on every data access, not only recorded.
Explore the OBConnect platform →More OBConnect solutions
Open Banking Compliance
Meet the SAMA Open Banking Framework in weeks. OBConnect runs FAPI, consent, the standard's APIs and reporting on premises, on the core APIs your bank runs.
Read more →Open Banking Integration
Open banking on the core APIs you already run - T24, Finacle, Flexcube or any API layer - through a declarative mapping connector. The core is never touched.
Read more →Frequently asked questions
What is open banking consent management?
Consent management is how a bank issues, records, tracks and revokes the permissions customers give to share their data with licensed third parties under open banking. OBConnect holds each consent as the system of record, drives the customer journey the regulator prescribes, enforces the consent on every data access and keeps a tamper-evident history of every transition.
Does the consent journey follow the SAMA customer-experience guidelines?
Yes. The journey implements the guidelines’ permission display language, grouping, sequencing and confirmation steps, in Arabic and English, right-to-left, to WCAG 2.2 AA. The permission wording and step sequence come from the Standard Pack rather than code, so a customer-experience guideline update is a pack update, not a rebuild.
What happens when a customer revokes a consent?
The consent moves to revoked in the system of record, every access token derived from it is refused at the edge from that moment, the third party is notified with a signed security event, and the customer is told in the standard’s mandated wording. The whole cascade is audited on the chain.
Can our own staff manage consents?
Yes, through the operator console: staff sign in with the bank’s own SSO, and a staff-initiated revocation is a maker-checker change - submitted by one operator, approved by another, executed and sealed on the audit trail.
Can the consent journey be embedded in our mobile app?
The journey ships as a white-labelled web application served by the platform and branded per bank; it is launched from your authentication flow and returns the customer to the third party when they decide. Native mobile SDKs for app-to-app authorisation are on the roadmap.
See consent management done right.
A guided walkthrough of the journey, the dashboard and the record behind them.