RIYADH: Saudi Arabia’s digital payments sector is set to expand after the Saudi Central Bank licensed Malaa Co. for Information Technology to offer payment account information services, raising the number of permitted payment service providers to 33.
The move enables Malaa to allow customers to securely share their banking data with licensed third-party providers after obtaining their consent.
The latest approval from the bank, also known as SAMA, underscores the Kingdom’s push to strengthen its open banking ecosystem and accelerate financial sector reforms under Vision 2030.
Saudi Arabia’s fintech ecosystem grew to 261 companies by the end of 2025, exceeding the original Vision 2030 target of 230 firms by 13 percent. The sector expanded 21 percent year on year, while cumulative fintech investment reached SR7.9 billion ($2.1 billion), more than doubling the initial target.
In its statement, the central bank said the decision “reflects SAMA’s commitment to support the payments sector, increase the efficiency of financial transactions, and promote innovative financial solutions for financial inclusion in Saudi Arabia.”
Malaa’s license for payment account information services positions it to operate within SAMA’s open banking framework, which requires adherence to strict data privacy, consent and API security standards aligned with international best practices.
The central bank also reiterated its advice that consumers and businesses should deal only with financial institutions licensed or authorized by SAMA.
What the license covers
Payment account information services allow licensed third parties to access, with customer consent, data from users’ bank accounts to build products such as budgeting tools, credit assessments and account aggregation dashboards.
According to SAMA’s Open Banking Framework, account information services made up the first version of open banking services rolled out in the Kingdom, with payment initiation services — which enable licensed providers to initiate payments directly from a customer’s account with the customer’s consent — following as the framework’s second release.
