Back
In June 2025, the Central Bank of Kuwait (CBK) issued a draft Open Banking Regulatory Framework, the centrepiece of its Open Banking Project. It puts Kuwait on a path that Bahrain, Saudi Arabia, and the UAE have already travelled. For Kuwaiti banks, 2026 is the year the framework moves from consultation to implementation.
CBK’s framework makes Open Banking a licensed, consent-based activity under central bank supervision, built on four principles: utility, security, transparency, and adoption. For banks, 2026 brings three practical demands. They will need to expose standardized, secure APIs for account information and payments. They will need to make customer consent a core part of the experience. And they will need to be ready to work with Open Banking Service Providers (OBSPs) that CBK has licensed. Banks that treat this as a product opportunity will keep control of the customer relationship. Those that treat it as paperwork risk new sources of competition.
What is the CBK Open Banking framework?
The framework is CBK’s rulebook for Open Banking in Kuwait. The central bank describes the Open Banking Project as an effort to regulate Open Banking through legislation and through security, technical, and operating standards that follow global best practice. What this means in day-to-day terms is that local banks can share customer data with Open Banking Service Providers that CBK has licensed. The sharing happens securely and only when the customer gives explicit approval, and the same rails let customers start payments directly from their bank accounts.
The draft rests on four guiding principles: utility, transparency, security, and adoption. Together they are meant to keep Open Banking useful, keep data use clear, protect customers without adding friction, and account for how ready the market is and what it costs to take part. A set of supporting documents fills in the detail, covering onboarding and dispute handling, consent management, API design and technical specifications, security standards, operational procedures, customer experience, and how providers can earn revenue. CBK has tied the initiative directly to the New Kuwait 2035 vision and to closer cooperation between banks and fintechs.
What can banks and fintechs actually do under it?
The framework covers the two core functions of Open Banking.
Account information. With consent, a provider can read a customer’s account data and use it to show a single view across banks, track spending, suggest ways to save, and let customers compare products. It can also speed up services that still rely on paperwork today, including loan applications and letters of guarantee.
Payment initiation, sometimes called Pay by Bank. Customers can create payment instructions straight from their bank accounts to pay bills, pay online stores, and send money to other people inside and outside Kuwait. That includes standing orders and payments dated for the future.
Both functions run on consent and pass through CBK-licensed providers, which is what makes them safe to scale.
Who has to be licensed, and where does testing happen?
Only Open Banking Service Providers (OBSP) need a CBK licence. Banks take part as the regulated data holders that expose the APIs.
An OBSP is any company that CBK licenses to provide Open Banking services, meaning it either reads a customer’s account data or initiates payments from a customer’s account, always with the customer’s consent. Two broad groups fall under it. Account information providers include account aggregators and personal finance apps, product-comparison and budgeting tools, and lenders that use bank data to assess credit. Payment initiation providers include checkout and Pay by Bank services, billers, and any app that moves money directly from a bank account. A company does not need to be a bank to register: fintechs are the main audience, though a bank can also act as an OBSP when it consumes another institution’s data. CBK’s framework and its supporting instructions set out the exact OBSP categories, eligibility criteria, and licensing requirements.
Kuwait is not starting from zero. CBK has already cleared a fintech to test open banking inside its regulatory sandbox, Wolooj, and it plans to use what it learns there to shape the final instructions and standards. Some banks are moving too. Kuwait Finance House has launched open banking capabilities of its own, an early sign that the country’s Islamic banking leaders intend to be first rather than last.
What does it mean for banks in 2026?
In its June 2025 announcement, CBK sought industry feedback on the draft and previewed that Open Banking would launch in phases after sufficient testing. That makes 2026 the year banks turn the policy into working infrastructure. There are four things they should plan for:
Build standardized, secure APIs for both account information and payments, to CBK’s technical and security specifications.
Make consent a visible part of the product, with clear consent screens, a place for customers to manage it, and an easy way to withdraw it.
Get ready to onboard and work with licensed OBSPs, along with the dispute and operational procedures that come with it.
Choose a strategy. A bank can become a platform that reaches customers through fintechs and third parties, or it can supply data and little else. CBK’s attention to adoption and to how providers earn revenue suggests it wants banks to build real business models, not simply meet a requirement.
The commercial logic is the one seen in every Open Banking market. Banks that build the most useful, consent-driven services keep the customer relationship and the revenue attached to it. For Kuwait, the upside is practical: faster lending decisions for retail and SME customers, Pay by Bank as a cheaper alternative to cards, and better tools for comparing products and managing money. The risk is handing that relationship to faster-moving providers.
How does Kuwait compare with the rest of the GCC?
Kuwait is a careful follower rather than a first mover. Bahrain published its Open Banking framework in 2020. Saudi Arabia’s SAMA and the UAE’s central bank, through its Nebras platform, are further ahead, with live services and licensing already in place. Kuwait’s approach is consent-based and phased, and it draws on those examples as well as on its own sandbox pilot. For banks that operate across the Gulf, this convergence helps. The capabilities built for Kuwait, namely standardized APIs, consent management, and payment initiation, are broadly the ones the rest of the region already expects.
How should banks prepare now?
Treat Open Banking as a product line, not a project. Build API infrastructure and a consent experience you would be comfortable putting your brand on.
Start with the use cases that pay off soonest: account aggregation and money management, Pay by Bank, and data-driven lending for retail and SME customers.
Partner for speed. The most common cause of delay in Open Banking programs is waiting on internal IT to build the integrations. Working with an experienced open finance provider shortens the path to a compliant, revenue-ready launch.
Engage with the sandbox and the provider ecosystem early, so you are ready when CBK moves from testing to a phased rollout.
Frequently asked questions
-
What is CBK’s Open Banking framework?
It is the Central Bank of Kuwait’s set of rules and standards for Open Banking, issued in draft in June 2025 as part of its Open Banking Project. It lets banks share customer data, with explicit consent, through CBK-licensed Open Banking Service Providers, and it allows payments to be initiated from bank accounts. It rests on four principles: utility, transparency, security, and adoption.
-
When does Open Banking launch in Kuwait?
CBK held a four-week public consultation on the draft in mid-2025. Once the framework is final, CBK has said Open Banking will roll out in phases after sufficient testing, which makes 2026 the practical implementation window for banks.
-
Who needs a licence, and what is an OBSP?
Open Banking Service Providers need a licence from CBK. An OBSP is a company licensed to read customer account data or initiate payments on a customer’s behalf, with consent. That covers account aggregators and personal finance apps, product-comparison tools, lenders that use bank data for credit, and Pay by Bank and checkout providers. Banks take part as the data holders that expose APIs. A fintech is already piloting services in CBK’s Wolooj regulatory sandbox.
-
Who needs a licence?
Open Banking Service Providers need a licence from CBK. Banks take part as the regulated data holders that expose APIs. A fintech is already piloting services in CBK’s Wolooj regulatory sandbox.
-
What services does the framework enable?
Two kinds. Account information services give customers a single view of their accounts, spending insights, product comparison, and faster loan and letter-of-guarantee processing. Payment initiation, or Pay by Bank, lets customers pay bills, online stores, and other people directly from their bank accounts, including standing orders and future-dated payments.
-
How is Kuwait’s approach different from Saudi Arabia’s or the UAE’s?
All three are consent-based and led by the regulator, but Kuwait is earlier in the process and is taking a phased, sandbox-informed approach. Saudi Arabia (SAMA) and the UAE, through the CBUAE’s Nebras platform, already have live services and licensing. Bahrain was the region’s early mover in 2020.
Brankas is an open finance infrastructure provider with live national implementations across APAC and MENA. We help banks and fintechs put Open Banking into practice, from standardized, compliant APIs to consent management, so they can move from regulatory readiness to revenue. For more, read The State of Open Banking in Kuwait.
*Preparing for CBK’s Open Banking rollout? Talk to our team.*