Direct answer: Pakistan’s Open Banking Regulations 2026 are a draft for public consultation, not final rules. The State Bank of Pakistan (SBP) is accepting comments until November 30, 2026 from banks, fintechs, technology providers, consumer groups, academics and the public.[1] The proposal would let authorized providers access customer-permissioned account data or initiate specified payments through secure APIs, while customers retain consent and revocation controls.[2]
Quick action checklist
- Download and read the official 17-page draft before commenting.[2]
- Decide whether you are responding as a customer, bank, EMI, fintech, merchant, developer or consumer group.
- Focus each comment on one clause, the operational problem it may create, and a specific replacement or safeguard.
- Send comments by November 30, 2026 with the subject “Feedback on Draft Open Banking Regulations.”[1]
- Keep a copy of your submission and the version of the draft you reviewed.
Important: This article explains a consultation draft. It does not mean open banking access is already available to every Pakistani customer, and it is not legal or regulatory advice.
What Pakistan’s draft open banking rules propose
Open banking in this draft means sharing customer-permissioned account data with authorized third-party providers and allowing those providers to initiate approved payments in a standardized, secure way.[2] The proposed framework covers two provider roles:
- AISP — Account Information Service Provider: accesses permitted account information, such as data used for account aggregation or approved financial services.
- PISP — Payment Initiation Service Provider: initiates an authorized payment but does not hold the customer’s funds.[2]
The draft identifies practical use cases including business-to-business payments, consumer-to-business payments, transfers between a business’s own linked accounts, and other use cases approved by SBP.[2] It also describes customer-permissioned transaction data as a possible input for alternative credit assessment and improved financing access for merchants and small and medium enterprises.[1][2]
What this could mean for customers
The proposal does not describe unrestricted access to a person’s bank account. It requires AISPs and PISPs to obtain explicit, specific and time-bound consent before providing account-information or payment-initiation services.[2]
For customers, the main ideas are:
- Permission first: a provider should only access the data or initiate the payment covered by the customer’s consent.[2]
- A defined purpose and duration: consent must be specific and time-bound rather than open-ended.[2]
- Revocation: customers should be able to withdraw consent; revocation would not undo a payment already initiated and authorized before the withdrawal request.[2]
- Clear pricing: pricing details must be displayed on the provider’s website or application.[2]
- Complaint handling: the draft includes complaint intake, status updates, evidence collection, initial findings within seven working days, and a 30-day dispute-resolution timeline.[2]
Before connecting any future open banking app, customers should verify that the provider is authorized by SBP, read exactly which accounts and data are requested, check the consent duration and payment limits, and learn how to revoke access.
What banks, EMIs and fintechs should review
Entities seeking to operate as third-party providers would need authorization under SBP’s Rules for Payment System Operators and Payment Service Providers. The draft says SBP would first grant in-principle approval, after which the applicant would integrate with Raast infrastructure and test the relevant services in a sandbox.[2]
Existing banks, electronic money institutions and authorized payment operators/providers could also offer account-information or payment-initiation services, but the draft requires them to notify the relevant SBP department at least 30 days before starting and subjects them to the same consent, security, conduct and liability obligations.[2]
A practical internal review should cover:
- authorization path and responsible owner;
- API and Raast integration scope;
- consent creation, display, expiry and revocation;
- customer authentication and credential handling;
- incident detection and escalation;
- liability allocation between the account-holding institution and provider;
- data protection, retention and deletion controls;
- customer support, evidence retention and dispute timelines;
- merchant and business onboarding documents;
- clear fee and pricing disclosures.
The draft’s incident timetable is especially important: an incident affecting confidentiality, integrity or availability — including a security breach, unauthorized access or an unplanned outage lasting more than 30 minutes — would need to be reported to SBP within two hours of detection, followed by a detailed report within 72 hours and root-cause analysis within 15 days.[2]
A useful feedback template
Copy this structure into an email or document. Replace the brackets and remove sections that do not apply.
Subject: Feedback on Draft Open Banking Regulations
To: Payment Systems Policy & Oversight Department
State Bank of Pakistan
Respondent name: [Name]
Organization, if applicable: [Organization]
Respondent type: [Customer / bank / EMI / fintech / merchant / developer / consumer group / academic / other]
Contact details: [Email and phone]
1. Clause or section
[Quote the section number and heading.]
2. Issue identified
[Explain the practical, legal, technical, security, competition or consumer-protection issue.]
3. Who may be affected
[Customers, small businesses, banks, fintechs, merchants or another group.]
4. Evidence or example
[Add a real workflow, incident scenario, cost estimate or comparable standard. Do not include unnecessary personal or confidential data.]
5. Recommended change
[Provide replacement wording, a threshold, a timeline or a control that SBP can evaluate.]
6. Expected benefit and possible trade-off
[Explain how the recommendation improves safety, clarity, access, competition or implementation, and note any downside.]
7. Implementation suggestion
[Suggest transition time, testing, reporting or guidance needed.]
Regards,
[Name]
SBP’s press release says comments can be sent by email to psdpolicy@sbp.org.pk using the specified subject line, or by post to the Payment Systems Policy & Oversight Department, 4th Floor, SBP Building, I.I. Chundrigar Road, Karachi.[1] Verify the address against the official press release before sending.
High-value questions to raise during consultation
Generic comments such as “improve security” are difficult to act on. A stronger submission asks a narrow question and proposes a testable answer. Depending on your role, consider:
Consent and customer control
- Is every consent screen clear about the exact data fields, purpose, recipient, duration and payment limits?
- Can a customer view and revoke active permissions without contacting support?
- How quickly must revocation propagate through the provider, bank and connected systems?
Fraud, liability and complaints
- Is responsibility clear when a disputed payment involves both the bank and the third-party provider?
- What evidence must each participant preserve?
- Are the seven-working-day initial finding and 30-day resolution periods practical for complex fraud cases?[2]
Security and outages
- Is the 30-minute outage threshold appropriate for every service type?
- Can organizations reliably meet the two-hour notification deadline outside business hours?[2]
- What minimum testing, independent assessment and recovery evidence should be required before launch?
Competition and access
- Can smaller regulated fintechs meet the integration and compliance requirements without weakening customer protection?
- Are API availability, performance and error handling defined clearly enough to prevent discriminatory access?
- What implementation or testing period is needed after final rules are issued?
Customer communication
- Will users understand the difference between sharing account information and authorizing a payment?
- Are pricing, complaints, revocation and liability explained in plain language?
- What protections are needed for people with limited digital or financial literacy?
What not to assume yet
The document is still a draft. Final wording, implementation dates, technical standards and transition arrangements may change after consultation. Do not market a product as “SBP-approved open banking” merely because it is based on this proposal, and do not request customer banking credentials while waiting for final rules.
Organizations planning a service can use the consultation period to map data flows, permissions, payment actions, incident response and complaint ownership. Production claims and launch dates should wait for final regulatory text and any required authorization.
Frequently asked questions
Is open banking already live for every bank customer in Pakistan?
No. SBP has released draft regulations for consultation. The publication of a draft does not by itself make every proposed service generally available.[1][2]
What is the feedback deadline?
SBP’s official press release sets November 30, 2026 as the deadline for comments.[1]
Who can submit feedback?
SBP invited financial institutions, fintechs, technology providers, consumer groups, academia and the general public to comment.[1]
What is the difference between an AISP and a PISP?
An AISP provides account-information services. A PISP initiates an authorized payment and does not hold the customer’s funds.[2]
Can a customer revoke consent?
The draft provides for revocation of consent. A revocation would not invalidate a transaction already initiated and authorized before the revocation request.[2]
Where should comments be sent?
The official press release lists psdpolicy@sbp.org.pk and asks senders to use the subject “Feedback on Draft Open Banking Regulations.” It also provides a postal submission route.[1]