UAE open finance went live inside a bank app: what actually changed

TLDR: On 17 August 2026, Commercial Bank of Dubai became the first UAE bank to let a customer initiate payments from an account held at a different bank, inside its own app. It is a plumbing change under the Central Bank’s open finance framework, and plumbing is not the same thing as knowing where the money went.

For most of the time I have been building a personal finance app in this country, the only reliable way to get transactions out of a UAE bank and into software was a PDF. Not an API. A PDF, emailed monthly, with merged rows, card reference numbers where merchant names should be, and fee lines described as things like “VAT ADJ”. Every serious feature I wrote had to survive that format first.

So when Gulf News reported on 17 August that Commercial Bank of Dubai had become the first bank in the country to let a customer pay from an account held at a different bank, from inside CBD’s own app, I read it as an infrastructure story rather than a product launch. Vladislavs Mironovs, CBD’s Chief Digital Officer, put it plainly in that piece: “This approval allows us to extend the capabilities of the CBD mobile app beyond our own ecosystem.”

What Commercial Bank of Dubai actually turned on in August 2026

Two things, and they are worth separating. The first is account information: linking an eligible account at another UAE bank and seeing its real-time balance in the CBD app. The second is payment initiation: instructing money out of that external account without opening the other bank’s app at all.

The second one is the harder capability, and it is the reason the Central Bank had to approve CBD as a Third-Party Provider. A bank reading a balance is a viewer. A bank moving money out of a rival’s account on a customer’s instruction is a payment participant.

This did not appear from nowhere. CBD activated open finance in live operation in January 2026 on the Central Bank’s AlTareq initiative, working with two licensed Third-Party Providers, Pay10 and Lean Technologies, over the Nebras API hub. The regulation itself is older still: Circular 7 of 2023, updated by Circular 3 of 2025, which took effect on 10 July 2025.

How open finance differs from the PDF-and-scraping era

The old options were bad in different ways. Manual entry is accurate and unsustainable. Statement PDFs are reliable and stale. Screen-scraping, where a third party holds banking credentials and logs in as the customer, is fast and quietly dangerous, and the UAE regulation explicitly prohibits it along with the commercialisation of customer data.

Open finance replaces all three with a licensed API and a recorded consent. Nobody hands over a password. The bank’s own systems check that a specific, named, licensed participant has permission for a specific scope of data.

Aggregation moves the data. It does not tell anyone what the data means.

What the consent screen is really granting

This is the part worth slowing down on, because a consent screen is a document like any other and deserves to be read as one.

Under the framework, consent has to be explicit, informed and securely recorded. That phrasing carries three practical consequences. Explicit means a scope: which accounts, which data, and whether payment initiation is included or only viewing. Informed means the purpose is stated, not implied. Securely recorded means there is an audit trail on the regulated side, which is what makes revocation meaningful rather than theoretical.

Read the scope before tapping accept, and check whether the grant covers reading balances or also moving money. Those are very different permissions wearing the same button.

What this does not solve

Here is the honest limit. Linking three banks into one app produces one screen with three balances on it. It does not produce a category for the AED 412 that left on Tuesday, it does not tell anyone whether that was groceries or a school deposit, and it does not net out the AED 1,800 a colleague still owes for a shared booking.

At the trading company where I work, the same distinction shows up every month. Pulling every bank feed into one ledger is the easy half. Deciding what each line means, and whether it belongs to this month or was paid in advance for the next six, is the half that takes judgement. Consolidation is not reconciliation. It never was.

The scale explains why the plumbing matters anyway. The Central Bank reported UAE banking-system assets of AED 5.3 trillion at end-2025, up 17.1% year on year, with lending growth led by retail and private corporates. Money that large moves badly through PDFs.

For now, one bank has one feature live. The framework behind it is real, the licensing regime around it hardens further in September 2026, and the direction is clear enough. The statement importer I built exists because there was nothing else to build against. I would happily retire it.