UAE Open Finance API Integration: AlTareq, Nebras and What Fintechs Must Build

UAE Open Finance is the Central Bank of the UAE framework that lets licensed third parties access customer bank and insurance data and initiate payments, with the customer's consent, through standard APIs. It is delivered under the AlTareq brand on a central platform called Nebras, uses the FAPI 2.0 security profile, and covers account information, payment initiation, variable recurring payments and insurance data sharing.

For fintech founders and product teams, Open Finance changes how a UAE app gets financial data and moves money. Instead of screen scraping, manual statement uploads or a separate commercial agreement with every bank, an approved provider connects once to the central platform and reaches participating institutions through one set of standards. This guide explains how the framework works, what services it covers, what security it requires and what a fintech application has to build to use it.

What Is UAE Open Finance?

The Central Bank of the UAE issued its Open Finance regulation in 2024, and the framework has been in effect since 1 August 2024. It covers banks, insurance companies and other licensed financial institutions, and it allows customers to share their data or authorise payments through third-party apps they choose. The aim is to make it easier for customers to compare products, manage money across institutions and pay directly from their accounts.

The framework is often described as open finance rather than open banking because it reaches beyond bank accounts. Insurance data sharing is part of the scope, and the design leaves room for other financial products to follow.

AlTareq is the customer-facing brand for the service, so users see a consistent name and consent experience regardless of which app they use. Nebras is the central infrastructure behind it, operated under the Central Bank's oversight, which hosts the API hub, the trust framework and the directory that identifies participants. Institutions holding customer data connect to Nebras, and approved third-party providers connect to Nebras, so neither side needs a separate technical connection to every other participant.

The Services It Covers

Account information services let an approved provider read data such as account balances, transactions and account details after the customer consents. Personal finance apps, lending platforms checking affordability, accounting tools and business dashboards all use this service.

Payment initiation services let an approved provider start a payment from the customer's bank account on their instruction. This supports account-to-account checkout, bill payments and transfers without card networks in the middle.

Variable recurring payments let a customer give a provider a standing consent to make a series of payments within agreed limits, such as a maximum amount per payment and per period. This suits subscriptions, savings rules and sweeping money between a customer's own accounts.

Insurance data sharing lets a customer share policy and quotation data with an approved provider, which supports comparison, aggregation and advice services in the insurance market.

The compliance timeline set by the Central Bank required participating institutions to reach full compliance by 1 June 2026, after a phased rollout in which Commercial Bank of Dubai became the first bank fully activated in January 2026. For third parties, that means the bank coverage available through the platform has broadened through 2026, but each use case should still be checked against the institutions and services actually live at the time of launch.

Who Can Connect

Open Finance access is not open to any app that wants it. A third party that wants to provide account information or payment initiation services must hold the appropriate licence or approval from the Central Bank and be onboarded into the trust framework on Nebras. Businesses that do not want to hold a licence themselves can work with a licensed provider and build their product on top of that provider's access, subject to the commercial and regulatory arrangement between them.

This decision comes before any development work. It affects timelines, ongoing compliance obligations, capital and governance requirements, and the technical setup, because a directly licensed provider manages its own certificates and platform connection, while a partner-based model integrates with the licensed provider's APIs instead. Founders should take legal and regulatory advice on the route before scoping the build.

Security: FAPI 2.0 and Consent

The UAE framework uses the FAPI 2.0 security profile, an OpenID Foundation standard designed for high-value APIs such as banking. In practice it means OAuth 2.0 with stricter rules: pushed authorisation requests, sender-constrained access tokens using mutual TLS or DPoP, strong client authentication and tight controls on redirect handling. Generic OAuth libraries often need extra configuration or replacement to meet the profile, and the participant certificates issued through the trust framework have to be managed carefully.

Consent sits at the centre of the user journey. The customer chooses the institution, is redirected to authenticate and approve the specific data or payment requested, and returns to the app. The app must store each consent with its scope, status and expiry, honour revocation immediately and show the customer which consents are active. Data received through Open Finance can only be used for the purpose the customer agreed to, so the data model and analytics pipeline need to respect consent boundaries rather than pooling everything into one store.

What a Fintech App Needs to Build

The visible part of an Open Finance product is the consent journey and the features built on the data. Underneath, the application needs a connection layer that handles FAPI 2.0 authentication, certificates, token lifecycle and calls to the platform APIs. It needs a consent service that records every consent, renews or re-requests it when it expires and processes revocations. It needs data normalisation, because transaction descriptions, categories and formats vary between institutions even under common standards, and features such as categorisation, affordability scoring or cash-flow forecasting depend on clean data.

For payments, the application needs a payment state machine that tracks each payment from initiation to authorisation, execution and final status, with clear handling of rejected, pending and failed payments. Reconciliation then matches payment confirmations against orders, invoices or wallet balances. Variable recurring payments add limit tracking, so the app never attempts a payment outside the customer's agreed parameters.

Identity verification often sits alongside Open Finance. Many UAE apps use UAE PASS to verify users before they connect their accounts, which Pixbit explains in its guide on how to integrate UAE PASS. Apps that also take card payments need to keep their card environment separate and meet PCI DSS, covered in Pixbit's guide to PCI DSS compliance in the UAE.

Where Open Finance Creates Product Opportunities

The clearest early use cases in the UAE are lending decisions based on verified transaction data rather than uploaded statements, account-to-account payments for e-commerce and bills, accounting and business tools that pull transactions automatically, savings and wealth apps that see a customer's full position across banks, and insurance comparison services built on shared policy data.

Each of these needs a different balance between data and payments, and each has different licensing and partner implications. A product team that maps its use case to the specific services, the institutions it needs and the access route before writing code avoids most of the expensive rework in this space. Pixbit's fintech software development work covers payment, lending and financial data platforms, and the government API integration services page explains how Pixbit builds and maintains regulated integrations for UAE platforms.

Summary

Frequently Asked Questions

What is UAE Open Finance?

UAE Open Finance is the Central Bank of the UAE framework that allows licensed third parties to access customer financial data and initiate payments through standard APIs, with the customer's consent. It is delivered under the AlTareq brand through the Nebras platform.

What is AlTareq?

AlTareq is the customer-facing brand of the UAE Open Finance service. It gives customers a consistent name and consent experience when they share financial data or authorise payments through third-party apps.

What is Nebras in UAE Open Finance?

Nebras is the central infrastructure for UAE Open Finance. It hosts the API hub, trust framework and participant directory that connect financial institutions with approved third-party providers.

Do I need a licence to use UAE Open Finance APIs?

A business providing account information or payment initiation services needs the appropriate licence or approval from the Central Bank of the UAE. Businesses without a licence can build on the access of a licensed provider through a partnership arrangement.

What security standard does UAE Open Finance use?

UAE Open Finance uses the FAPI 2.0 security profile, which builds on OAuth 2.0 with pushed authorisation requests, sender-constrained access tokens and strong client authentication.

Building on Open Finance

Pixbit builds Open Finance features for UAE fintech products, including the FAPI 2.0 connection layer, consent management, data normalisation and payment state handling, working directly with licensed teams or alongside their licensed partners. Costs sit in a broad AED band that depends on the services and institutions involved, and Pixbit scopes Open Finance integration in a single discovery session.