SBP Open Banking Rules in Pakistan (Draft): Apps Need Your Consent, 7-Day Refunds, Comments by 30 November 2026
SBP's draft Open Banking Regulations let licensed apps see bank data or start payments only with consent. See your rights and how to comment by 30 November.
The State Bank of Pakistan (SBP) published draft Open Banking Regulations on 30 October 2026 and is taking comments until 30 November 2026. Under the draft, licensed apps could see your bank balance and transaction history, or start a payment from your account, but only with your explicit, time-bound consent that you can cancel at any time.
Open banking means letting an approved outside company, such as a payments or lending app, connect to your bank account through a secure link instead of you handing over passwords. Nothing changes for customers yet, because these are draft rules. We read the SBP press release and the full 17-page draft on 30 October 2026. Below is what the rules would let apps do, how your consent works, who pays if money goes missing, and how to send your own comments.
The draft lets licensed apps see your balance and history, with consent
The draft allows two services. An account information service could read your account balance and transaction history from current, savings and other payment accounts. A payment initiation service could start a payment from your account to a business, for example to pay a bill or a supplier. Both need your consent.
| Service | What it could do | Examples in the draft |
|---|---|---|
| Account information | Read balance and transaction history | Credit scoring for people and SMEs, one view of all your accounts |
| Payment initiation | Start a payment from your account | Consumer to business bill payments, business to business supplier payments, transfers between a business's own accounts |
Every bank and other account-holding institution would have to open its systems to licensed providers, so all customers' data could be part of the system from day one. Providers would connect through Raast, the SBP's instant payment system, which would act as the central hub. Our report on the SBP regulatory sandbox explains how fintechs test such services first.
Your consent must be explicit, time-bound and easy to cancel
The draft says providers must get "explicit, specific and time-bound consent" before reading data or starting payments. The consent must state its scope, duration, purpose, and payment limits including daily and monthly limits. You must get a dashboard to view, change or cancel every consent.
- You start the consent inside the provider's app, which shows what it wants and for how long.
- The provider checks your identity through NADRA biometric verification.
- Your bank confirms the request with a one-time password (OTP) sent to your registered mobile number.
- Your bank registers the consent and shows it on its own consent dashboard, and both send you a notification.
- You can cancel the consent at any time from the dashboard, and the provider must then stop using and delete your data.
A provider would never be allowed to ask for, store or use your bank login, PIN or password. If any app asks for your banking password to "link" your account, treat it as a scam, now and after these rules start. After you cancel, the provider must delete the data it collected within 30 days, apart from records the law requires it to keep.
Your bank must refund an unauthorised payment within 7 business days
Under the draft, if a payment started through a provider is unauthorised, not made or late, your bank is liable to you first. On a valid claim it must credit your account within seven business days, then recover the money from the provider if the provider was at fault.
The bank can hold back that refund only if it has reasonable grounds to suspect your negligence, and it must write down those grounds and tell you. In a dispute, the bank and the provider carry the burden of proof. The draft also says a record that your password or OTP was used is not, on its own, proof that you authorised the payment.
| Protection in the draft | Time limit or rule |
|---|---|
| Refund of an unauthorised payment by your bank | Within 7 business days of a valid claim |
| Interim finding on a disputed payment | Within 7 business days |
| Complaint acknowledgement | Within 1 hour, personal reply within 24 hours |
| Deleting your data after you cancel consent | Within 30 days |
| Fee for paying a business through a provider | No charge to the customer |
These timelines sit alongside the SBP's existing rules for digital fraud refunds, which already apply to banks and wallets today.
Paying a shop or bill through a provider would be free for customers
The draft says providers offering consumer to business payments "shall not charge the customers initiating payments". Raast would not charge providers for payment starts or data sharing. Merchants and businesses could be charged, but below current market prices, and every price must be shown clearly on the provider's website or app.
Ads and product selling inside the payment journey would be banned under the draft's design rules. So would confusing wording, repeated requests and messages that discourage you from using a licensed provider. Those are small details, but they decide whether a service is safe to use on a cheap phone.
How to send comments on the draft by 30 November 2026
The SBP invites comments from banks, fintechs, consumer groups, academics and the general public until 30 November 2026. You can email or post your feedback, and you do not need to be a bank to take part. These steps keep it simple.
- Download the draft from the SBP website, linked in the sources below.
- Note the section number for each point you want to make, for example section 7 on consent.
- Write your comment in plain words and suggest the change you want.
- Email it to psdpolicy@sbp.org.pk with the subject "Feedback on Draft Open Banking Regulations".
- Or post it to the Payment Systems Policy and Oversight Department, 4th Floor, SBP Building, I.I. Chundrigar Road, Karachi, before 30 November 2026.
Common questions
What is open banking in Pakistan?
It is a system where SBP-licensed apps can read your bank data or start payments from your account through secure links, only with your consent. The SBP's rules for it are still a draft.
When will open banking start in Pakistan?
No start date is set. The SBP is taking comments until 30 November 2026 and has not said when final rules will follow.
Can an app take money from my account under open banking?
Only a payment you approve, within the limits you set in your consent. Your bank must confirm the consent with an OTP to your registered mobile number.
Will I have to pay for open banking payments?
Under the draft, customers paying a business through a provider are not charged. Businesses may pay a fee.
How do I comment on the draft?
Email psdpolicy@sbp.org.pk with the subject "Feedback on Draft Open Banking Regulations" by 30 November 2026, or post your comments to the SBP in Karachi.
How we verified this
What we checked, where we read it, and what we could not confirm.
We read the SBP press release of 30 October 2026, "SBP Releases Draft Open Banking Regulations for Public Consultation", and the draft Open Banking Regulations in full, on 30 October 2026. Every rule above is from the draft and can change before the final version. The draft gives no start date, no licence fee and no list of providers, so none is stated here.
About the author
Global Affairs & Political Economy Writer
Muhammad Hatim is a book lover who started writing because he enjoys it. At Pakistan Era he writes about international relations, geopolitics and the global economy, with a particular interest in South Asia and the forces behind current events.
