State Bank's open banking draft would oblige every institution holding accounts to share customer data, with consent
The draft would apply to every institution that holds customer accounts, not only to banks that volunteer. Comments close on 30 November.
If the State Bank of Pakistan's draft Open Banking Regulations become rule, no bank could keep a customer's account history to itself once the customer asks to share it. The draft, released for public comment on 30 October, would require every account holding institution to give authorised third party providers access to customer data and payment initiation, provided the customer consents.
Comments are due by 30 November, 31 days after the release. The central bank invites financial institutions, fintechs, technology providers, consumer groups, academics and the public. Feedback goes by email under the subject line "Feedback on Draft Open Banking Regulations", or by post to the Payment Systems Policy and Oversight Department at the State Bank building on I.I. Chundrigar Road, Karachi.
What the draft allows
Approved providers could initiate business to business and consumer to business payments. With consent, they could use account data to assess credit, finance small businesses and build tailored products. Data collected under the rules must be stored and processed inside Pakistan, with one exception: a cloud service provider used under the bank's framework on outsourcing to cloud providers. The draft also sets safeguards on data protection, privacy, cybersecurity, fraud prevention and consumer protection.
It follows the bank's first regulatory sandbox cohort, which tested remittance, open banking and remote merchant onboarding solutions from January to June. Three firms demonstrated open banking solutions: Digi Khata, Swich Retail and Neem Exponential Financial Services. The bank said at the time that finishing sandbox testing is not regulatory approval.
Our reading
The word that matters is "all". Open banking works only if the data is complete. A lender that can see a customer's salary account at one bank but not at another prices the loan on half a picture, so a rule that left large banks free to opt out would leave the system with little to offer.
Consent based access normally replaces the habit of handing a fintech a banking password. The customer approves a named request at their own bank, and the provider receives a limited permission that the bank can log and withdraw. That is safer than shared credentials, but it turns each bank's interface into infrastructure that every dependent app inherits. A slow or unreliable interface at one large bank becomes a failure in every product built on it, so uptime and response standards will matter as much as the consent rules.
Khata apps and small business lenders gain verified cash flow in place of handwritten ledgers. Banks give up some of their hold on customer data and must build and secure the interfaces. The cloud exception is narrow and tied to the bank's existing outsourcing framework.
Three questions are not settled by the State Bank's published statement, and the draft text itself was not available for this story: the technical standards interfaces must meet, whether banks may charge providers for access, and who bears the loss when a provider's breach exposes a customer. Those answers will decide how open the system becomes, and the consultation closes on 30 November.
