Financial Services & Fintech current GCC market status and evidence monitor

Executive summary

Evidence

Findings

• SAMA’s lifecycle separates a 60-day application stage, up to 120 days of operational readiness and six to twelve months of testing. These are planning references for a controlled sandbox route, not guaranteed approval times and not permission to conduct unrestricted production activity.
• Saudi open-banking services moved into formal licensing in March 2026. A provider within an established category should use the current licensing route rather than describe sandbox entry as the default path. The product, participant role, data flow and money flow must be classified before engagement.
• Qatar Central Bank permits a defined sandbox test for up to twelve months and expects a test-ready solution, measurable objectives and consumer-protection controls. Scope, participant eligibility, transaction limits, disclosure, complaint, loss, reporting and exit rules belong in the application design.
• The Central Bank of Bahrain reported 15 new applications and seven admissions during 2024. At year-end it reported 30 cumulative successful exits and eight of those companies later holding a full operational licence. These are different cohorts and cannot be divided to claim a future applicant success rate.
• Bahrain’s 48 fintech licensees at 31 December 2024 describe the regulated population, not obtainable customer demand. A market-entry case still needs the correct licence or vendor classification, a named customer, production controls and sustainable transaction economics.
• The CBUAE reported more than 60 fintech companies licensed or receiving in-principle approval during 2025 and 36 fully licensed firms as of January 2026, compared with 18 in 2024. The figures show regulator activity and ecosystem growth, not automatic eligibility or customer acquisition.
• The UAE sandbox framework applies to testing innovations that would constitute licensed financial activities and excludes specified activities including deposit taking, UAE insurance business and principal dealing in financial products. The sandbox is therefore not a universal route for every financial proposition.
• The CBUAE application process has preliminary, evaluation and decision stages. It states that the Bank will endeavour to indicate potential suitability within fifteen working days after receiving a complete information set. That preliminary indication is not admission, exemption, licence, production approval or a time commitment for the later stages.
• Bahrain’s published BHD 100 application fee and 15-calendar-day decision target apply to the sandbox application route after a complete submission. They do not include perimeter advice, entity setup, security, integration, test operation, customer protection, licensing or continuing supervision.
• A technology vendor to a regulated institution may not need the same licence as a customer-facing financial operator, but it still faces buyer due diligence, outsourcing, cloud, cyber, resilience, audit and data controls. The role must be documented feature by feature rather than inferred from the company label “fintech”.
• The Central Bank of Oman expects a locally registered company and a nearly test-ready proposition. Its application asks for fit-and-proper information, existing licences, funding and staffing, a bank or partner route, cloud and security architecture, AML and customer safeguards, measurable test limits, compensation and an exit or deployment route. An existing licensing route disqualifies the model from sandbox treatment.
• Kuwait’s Wolooj sandbox targets innovative products or services built on or associated with electronic payment of funds. The proposed solution must be at an advanced, test-ready stage; applications are continuously open, the maximum published duration is one year with extension at CBK discretion, and there is currently no participation fee. None of these conditions is a licence or a promise that a model can enter unrestricted production.
• Kuwait’s 2023 electronic-payment instructions define five licence types according to the nature and scale of the activity and impose governance, risk, AML/CFT, cybersecurity, business-continuity and customer-protection controls. A payment or e-money proposition already inside that framework should not use sandbox language to avoid the applicable licence category.
• Qatar Financial Centre separates legal presence, the QFC Authority licence and QFCRA authorisation. QFCRA lists thirteen regulated activities, including deposit taking, insurance, dealing, arranging, credit, custody, investment management, advice, fund operation and representative-office activity. An entity licence without the relevant scope of authorisation does not permit the firm to conduct a regulated activity.
• The QFC application route starts with activity assessment and a regulatory business plan. The formal file includes a Q02 application for the firm, Q03 forms for each proposed controlled-function holder, procedure manuals and supporting evidence. An approved firm can remain recorded as “Authorised – not yet commenced Regulated Activities” until agreed post-authorisation items such as staffing, premises and manual updates are completed.
• The DFSA Innovation Testing Licence is a restricted live-testing route, not a lighter company licence. The official pre-application criteria require an innovative financial service, readiness to test with customers and an intention to scale in or from the DIFC after testing. The applicant must also evidence sufficient funding, relevant management experience and understanding of applicable DFSA and DIFC rules.
• The DFSA service publishes a USD 5,000–140,000 fee range because the applicable charge depends on the proposed regulated activity. The formal file includes a regulatory test plan, business-flow diagram and risk, AML and compliance policies. That range excludes incorporation, capital, professional advice, systems, assurance, staffing and the cost of meeting any conditions imposed on the test.
• Saudi payment licensing is category-specific. The current implementing regulations use SAR 10 million of average monthly payment value in the Micro-versus-Major PI distinction, while cross-border service and activity conditions also affect classification. Initial paid-up equity ranges from SAR 500,000 for standalone Payment Account Information Services to SAR 10 million for a Major EMI; continuing capital can be the higher of the initial amount and a transaction- or outstanding-e-money calculation. A forecast volume therefore changes both licence route and funding requirement.
• SAMA separates in-principle approval from final payment-service licensing. The applicant must identify every requested service and provide ownership, governance, senior-position, business, control and financial evidence. A commercial registration, submitted application or in-principle decision is not permission to process live customer payments, and a later change in activity or scale may require a different category or approval.
• The UAE Open Finance licence covers Data Sharing, Service Initiation or both, but it does not by itself permit advice, arranging, mediation or holding customer funds. A provider that later changes its selected option must reapply and obtain approval. The published decision ceiling is sixty working days only after the applicant has met all conditions and requirements; expiry without a decision is an implicit rejection, not approval.
• A UAE Open Finance applicant must hold at least AED 1 million, while aggregate capital funds must remain at the higher of that floor and the Central Bank estimate of wind-down cost. Approved participants must register under the Trust Framework within fourteen days. Capital, approval, Trust Framework registration, technical connection, counterparty acceptance and production readiness are separate receipts.
• A UAE technical service provider does not need an Open Finance licence only where its role remains limited to support and it does not perform regulated Open Finance activity. The licensed provider or deemed licensee cannot transfer its regulatory responsibility, legal basis or liability to that supplier. The broader federal perimeter also captures licensed financial activity conducted or facilitated through DeFi, dApps, platforms or other emerging technology; a software label is not an exemption.
• Oman’s official sandbox application requires a test-ready MVP, fit-and-proper evidence, partner and licensing context, workflow, hosting and cloud design, integration plan, security and assessment evidence, regulatory exemptions, customer protection and compensation, communication and exit plans. It asks for a testing timeline of at least six months. Submission of the CEO-signed file, in-principle approval, live testing, evaluation, successful exit and any production licence remain distinct states.
• Across the GCC, the decisive distinction is whether the entrant is the regulated operator, an outsourced technology supplier, an agent, a processor or an implementation partner. Who contracts, controls funds, makes decisions and faces the customer determines the regulatory and operational burden.
• Digital banking and payments tied to a licensed service, transaction flow, settlement model and customer remedy
• Financial crime and compliance automation connected to an accountable control owner, evidence set and escalation decision
• Decision-chain evidence: Business sponsor and budget owner accountable for customer and economic outcome. Record the named institution, accountable role, current need and dated route into the decision.
• Decision-chain evidence: Legal, compliance, AML, fraud, model-risk and customer-protection owners. Record the named institution, accountable role, current need and dated route into the decision.
• Evidence gate: Regulator-specific licensing or sandbox analysis and an explicit production-authorisation path.
• Evidence gate: Customer due diligence, transaction monitoring, sanctions, fraud, complaints and consumer-redress design.

Method and limits

How this brief was produced

Horizon integrated official sector authorities, multilateral or research sources and the reviewed GCC sector dossier. The brief tracks market structure, commercial signals and evidence gates without inventing a regional market-size number.

Original sources