Apps and fintech companies in Pakistan could soon read your bank balance and transaction history, but only if you say yes. The State Bank of Pakistan has published draft Open Banking Regulations 2026 and is taking comments until 30 November.
Under the draft, every bank, microfinance bank and e-money wallet provider would have to let approved outside companies see your balance and transactions, or start a payment from your account, once you agree. It is still a proposal, and it has no effective date yet.
How you would say yes, and how you would take it back
You would start in the app of the company asking for access. It must show your bank, your IBAN, how long the access lasts, why it wants the data and, for payments, a transaction limit. The company checks you through NADRA’s biometric system, your bank sends an OTP to your registered mobile number, and you then approve the request inside your own bank’s app with your M-PIN or T-PIN. Your consent has to have an end date, and a new one is needed if the scope or purpose changes.
These companies would not be allowed to ask for or keep your banking login, PIN or password, and banks must detect and block automated access to their channels coming from such a company. You would be able to see every active consent in a dashboard and cancel any of them. A cancellation takes effect the moment either side receives it.
What it could be used for
SBP calls these outside companies Third Party Providers. The central bank expects them to digitise business-to-business and consumer-to-business payments, and to use account history for credit scoring so that small businesses can borrow more easily.
Participation would be compulsory: the regulations require all account holding institutions to open their APIs, so no customer’s bank is left out from the start. The data in scope is limited to balances and transaction history on current accounts, savings accounts and other accounts used for payments. Companies would connect through Raast’s central API hub, which Raast Payments Pakistan will run, although banks and providers may also sign bilateral deals that follow the same security standards for account information.
Who pays when something goes wrong
For payments, your bank would be liable to you for unauthorised or failed transactions unless the provider caused the loss. On a valid claim the bank must credit you within seven business days, and may hold back only if it has written grounds to suspect you were negligent. It can then recover the money from the provider. In a dispute, the bank and the provider carry the burden of proving that consent was valid and the transaction accurate, and a record that a PIN was used does not by itself prove you authorised it.
Providers must report a breach, unauthorised access or an outage longer than 30 minutes to SBP within two hours, then file a detailed report within 72 hours and a root-cause analysis within 15 days. Raast Payments Pakistan would act as the forum for bank-versus-provider disputes.
Send your comments by 30 November
SBP says the draft draws on the first cohort of its open banking regulatory sandbox, and it is asking for views from financial institutions, fintechs, consumer groups, academics and the public. Comments go to [email protected] with the subject line “Feedback on Draft Open Banking Regulations”, or by post to the Payment Systems Policy and Oversight Department at SBP’s Karachi head office.
