How Gulf banking is organised
Each market has one central bank that also supervises its banks. A few large national banks, many with state shareholders, lead beside Islamic banks, foreign branches and new digital banks. Financial free zones in Dubai, Abu Dhabi and Doha run their own regulators and courts.
- Saudi Arabia has 39 licensed banks: 15 Saudi banks and 24 foreign bank branches (SAMA, 2025).
- Five currencies are pegged to the US dollar and the Kuwaiti dinar to a basket, so policy rates largely move with the US Federal Reserve.
- Conventional and Islamic banks work side by side; Islamic banks hold most banking assets in Saudi Arabia and Kuwait.
- DIFC (DFSA), ADGM (FSRA) and the Qatar Financial Centre (QFC Regulatory Authority) run their own rulebooks, modelled on international practice, beside the onshore regime.
- State entities are major shareholders, depositors and borrowers, and banks finance national programmes such as Saudi Vision 2030.
Payments and open finance
National instant-payment rails now run across the region, most reachable by mobile number and open 24/7. Cash is retreating fast, and open banking is moving from frameworks to licensed providers, with Bahrain an early mover and the UAE building one central hub for its whole market.
- Instant rails arrived fast: Fawri+ (Bahrain, 2015), sarie (Saudi Arabia, 2021), Aani (UAE, 2023), then Fawran (Qatar) and WAMD (Kuwait) in 2024.
- In Saudi Arabia, 85% of retail transactions were non-cash in 2025, up from 79% in 2024.
- Open banking: Bahrain set rules in 2018, the UAE issued its Open Finance Regulation in 2024, and SAMA began licensing providers in 2026.
- Domestic card networks anchor everyday payments: mada (Saudi Arabia), Jaywan (UAE), KNET (Kuwait) and BENEFIT (Bahrain).
- AFAQ, the Gulf payments system, connects banks across the member states for cross-border transfers.
Fintech, digital banks and digital assets
Fintech in the Gulf is policy-led: national strategies, regulatory sandboxes and new licence types for digital banks, BNPL, crowdfunding and open banking. Telecom groups and large banks are building digital banks, and the UAE and Bahrain have set rules for stablecoins and virtual assets.
- Saudi Arabia counted 301 fintech companies in 2025, up from 261 at the end of 2024.
- Saudi digital banks: STC Bank, D360 Bank and Vision Bank are operating, and EZ Bank was licensed in 2025 with SAR 2.5 billion of capital.
- The UAE's Financial Infrastructure Transformation programme delivered Aani, Jaywan, open finance, a digital KYC platform and a digital dirham pilot via mBridge.
- Bahrain issued a stablecoin framework in 2025 for fully reserved tokens backed by the dinar or US dollar; Dubai licenses virtual-asset firms through VARA.
- Qatar (2024) and Oman (2025) issued digital-bank frameworks; Kuwait lets banks run digital units such as Weyay, Tam and SiDi.
Rules a bank must map here
Gulf banks run Basel III capital and liquidity rules, AML/CFT laws aligned to FATF standards, national cyber-security and data-protection regimes, consumer-protection rules and, for Islamic banks, Shariah governance frameworks. Each regulator publishes its own rulebook, and free-zone entities follow another.
- Saudi Arabia: SAMA Cyber Security Framework, SAMA Business Continuity Management Framework, NCA Essential Cybersecurity Controls and the Personal Data Protection Law.
- Saudi Arabia also: the Shariah Governance Framework for local banks, SAMA counter-fraud and consumer-protection rules, and outsourcing rules.
- UAE: Federal Decree-Law No. 6 of 2025 (in force since September 2025, with a one-year transition), plus CBUAE consumer-protection, outsourcing and open finance regulations.
- Bahrain: the CBB Rulebook, with separate volumes for conventional and Islamic banks and a module for open banking.
- Qatar, Kuwait and Oman: QCB data-handling and digital-bank rules, CBK instructions for banks and e-payment firms, and CBO's Islamic Banking Regulatory Framework.
What operations teams wrestle with
Digital adoption is high and customers expect instant service around the clock. That brings social-engineering scams onto instant rails, heavy digital onboarding, legacy cores running beside new APIs, and staffing shaped by nationalisation targets, across markets with different weekends.
- Impersonation and social-engineering scams on instant payments: banks add name checks, new-beneficiary limits and alerts; UAE law now requires fraud detection and customer notification.
- Digital onboarding runs on national identity, such as Nafath in Saudi Arabia and UAE Pass with the UAE's digital KYC platform, so data quality and consent records matter.
- Legacy core systems must reconcile with 24/7 rails and open APIs, so night and weekend operations, uptime and exception queues need clear owners.
- Nationalisation targets (Saudisation, Emiratisation and their peers) shape outsourcing choices, hiring and capability building.
- Weekends differ: Saturday–Sunday in the UAE since 2022, Friday–Saturday elsewhere, so cut-offs, liquidity and cross-border support must line up.
How SMEs get financed
Banks remain the main source, supported by state guarantee schemes, development banks and SME authorities. Fintech platforms add debt crowdfunding, invoice finance and B2B payment terms. In Saudi Arabia, SMEs took 9.4% of bank lending in Q4 2024, up from 8.4% a year earlier.
- Kafalah, Saudi Arabia's SME financing guarantee programme, had supported SAR 107.2 billion of financing since inception by 2024.
- Saudi Arabia's SME Bank and Monsha'at, the SME authority, provide development finance, programmes and support for smaller firms.
- SAMA licenses debt-based crowdfunding platforms and updated their rules in 2024, including disclosure of default rates.
- Elsewhere: Emirates Development Bank, Qatar Development Bank, Bahrain Development Bank and Kuwait's National Fund for SME Development.
- Common hurdles: unaudited accounts, thin cash-flow evidence and limited collateral, so a well-prepared file matters; the lender still decides.
