Banks across the GCC are moving into a new phase of technology investment as regulators expand open finance, payment systems become more connected and artificial intelligence moves closer to day-to-day banking operations.
The first wave of digital transformation concentrated on customer access. Banks introduced mobile applications, remote onboarding and faster payment services while retaining much of the established infrastructure behind them.
That model delivered rapid improvements in customer experience. It also left many institutions managing a growing number of connections between the core banking system, digital channels, payment processors and specialist technology providers. The next phase is likely to focus on simplifying that environment.
“GCC banks have made considerable progress in digitising the customer interface,” said Pavel Shumsky, chief marketing officer at core banking technology provider Velmie. “The next investment cycle will address what happens behind that interface: how products are configured, how external services are connected and how the bank maintains control as the technology estate becomes more distributed.”
Open finance moves into implementation
Open banking and open finance are developing at different speeds across the GCC, but the regional direction is clear.
Saudi Arabia has established an Open Banking Framework covering business rules, technical standards and defined use cases. In March 2026, the Saudi Central Bank began licensing fintech companies to provide open banking services following the completion of the regulatory sandbox phase. Its framework now covers both account information and payment initiation services.
The UAE has adopted a broader open finance model. Central Bank regulations provide for an API Hub, a trust framework and common infrastructure through which authorised providers can access customer data and initiate transactions with consent. The framework extends the principle beyond banking to a wider range of financial products and services.
Bahrain was an early regional mover, introducing an open banking framework with technical standards, security requirements and customer-experience guidelines. Qatar, meanwhile, has placed digital transformation, fintech growth and market infrastructure within its national financial-sector strategy.
These initiatives are creating a more formal basis for banks to work with fintech companies and distribute financial services through external platforms. They also require a more disciplined approach to technology architecture.
An API can provide access to an account or initiate a payment, but the bank still has to authenticate the request, apply customer consent, process the transaction and retain a reliable operational record. As more services are exposed externally, weaknesses in the systems behind the API become harder to contain.
“Open finance is often discussed as a distribution opportunity, which it is,” Shumsky said. “It is also an architecture issue. Banks need a controlled layer between their systems and the external market, otherwise every new partnership introduces another point-to-point connection that must be maintained independently.”
Integration becomes a strategic capability
Banks in the region increasingly operate through a combination of internal systems and specialist providers.
Card processing, identity verification, fraud controls, payment connectivity and customer communications may each be supplied by a different company. The bank remains responsible for the overall service even when much of the transaction passes through external infrastructure. This makes integration a continuing operating capability rather than a one-time implementation task.
A change introduced by a payment processor can affect account posting and reconciliation. A revised compliance workflow may require changes to onboarding, customer servicing and internal approvals. New digital products frequently depend on several providers being coordinated within the same release.
Traditional point-to-point integration can support a limited number of connections. It becomes less effective as the number of products and partners increases.
Banks are therefore placing greater emphasis on middleware and orchestration technology that provides a consistent way to connect external services without repeatedly changing the core system.
Velmie’s banking platform follows this model. Its API middleware sits between customer channels, core systems and third-party providers, allowing new services to be introduced while established systems of record remain stable. The platform can be used as a full banking system or as a modernisation layer over an existing core.
The broader solution includes account and ledger capabilities, a role-based operational back office and digital channels for mobile and web. Velmie also provides integration engineering across payments, cards, KYC and AML providers, followed by maintenance and managed development after launch.
For established GCC banks, the significance lies in the deployment model. Institutions can retain infrastructure that continues to perform effectively while introducing a more adaptable layer for new products and external partnerships.
“A core replacement may be necessary in some cases, but it should not be the automatic starting point,” Shumsky said. “Many institutions can modernise progressively by protecting the financial system of record and moving product delivery, integrations and customer journeys onto a platform designed for more frequent change.”
Regional scale requires controlled variation
GCC banks and fintech companies often view regional expansion as a natural route to growth. The markets share commercial links and a broad policy commitment to financial innovation, but they do not operate as one regulatory or payments environment.
Licensing requirements, domestic payment infrastructure and customer onboarding rules differ between jurisdictions. A product configured for one market cannot always be introduced elsewhere without changes to the underlying workflows and provider connections. Modern banking platforms need to support this variation without creating a separate technology estate for each country.
Velmie’s architecture allows institutions to operate a common platform while adapting onboarding rules, transaction controls, fees and external integrations by market. Its deployment options include public cloud, private cloud and on-premises infrastructure, allowing the technical model to be aligned with the institution’s security and regulatory requirements.
The company maintains a presence in Dubai and positions its systems-integration and digital-channel services for regulated institutions across the Middle East and Africa.
The value of such a model is consistency rather than uniformity. A bank can retain a common product and operating foundation while making the changes required by each regulator, banking partner and payment network.
The next stage of GCC banking technology
The GCC has already established many of the foundations required for further digital growth. Regulators have created open banking and open finance frameworks, banks have invested substantially in digital channels and the region has attracted a broad market of fintech and technology providers.
The next challenge is to convert those individual developments into a more coherent banking architecture.
Institutions will need to connect external services without losing control of the customer relationship or financial record. They will also need to introduce products more frequently while maintaining stable production operations.
This is likely to favour modular platforms, governed integration layers and delivery models in which responsibility continues after the initial launch.
For GCC banks, the technology question is moving beyond whether a service can be made available digitally. The more important test will be whether it can be introduced, operated and extended without adding further complexity to the institution beneath it.
