Open Finance & AlTareq API Integration in Dubai (2026): Screen Scraping Is Now Illegal

Short answer: Open finance in the UAE runs on AlTareq, the national framework operated by Nebras Open Finance LLC under the Central Bank of the UAE. Since Circular 3 of 2025 came into force on 10 July 2025, participation is mandatory for every CBUAE-licensed institution, and Federal Decree-Law No. 6 of 2025 made providing open finance services a licensed financial activity in its own right — with existing licensees given until 16 September 2026 to align. If your Dubai app reads a customer’s bank data by asking for their online banking password, that method is now explicitly prohibited. The compliant route is a consented API connection through the Nebras hub, and it is a build project, not a legal memo.

Key takeaways

Screen scraping is banned by name. The Open Finance Regulation explicitly prohibits data scraping — extracting customer financial data into spreadsheets or databases outside the framework. Every “just ask the client for their bank login” integration in Dubai is now on the wrong side of the rulebook.

Two licence categories, not one. Data Sharing (read: aggregation, dashboards, credit analytics) and Service Initiation (write: payment initiation, automated transfers, embedded lending). Which one you need is decided by one question — does your product move money, or only look at it?

Minimum capital is AED 1,000,000 for a third-party provider, and the CBUAE can require more on a risk-adjusted basis.

Being a bank is not a free pass. Banks, finance companies, insurance companies and payment service providers are deemed licensed — but must still notify the CBUAE in writing and hold a no-objection certificate before switching anything on.

The penalty ceiling is real. Federal Decree-Law No. 6 of 2025 allows administrative fines up to AED 1,000,000,000 for licensed financial institutions, AED 20,000,000 for market infrastructure breaches and AED 5,000,000 for authorised individuals. Unlicensed financial activity is criminalised.

It is already live. ADIB became the first UAE bank licensed as an open finance provider under AlTareq, and Commercial Bank of Dubai switched on live cross-bank payment initiation in its app in December 2025. Pay10 has since gone live with both First Abu Dhabi Bank and CBD for retail customers.

The deadline most Dubai founders read as someone else’s problem

Federal Decree-Law No. (6) of 2025 — the new Central Bank Law — was issued on 8 September 2025 and published in the Official Gazette on 15 September 2025. It gave existing licensees a one-year transition, expiring 16 September 2026, with the CBUAE holding discretion to extend. The law did something quietly significant on the way through: it wrote open finance services into the list of licensed financial activities, alongside payment services using virtual assets, and extended the regulatory perimeter to technology providers that facilitate payments, credit, deposits and investment services.

Read that last clause again if you build software in Dubai. “Technology providers that facilitate financial services” is not a description of a bank. It is a description of an accounting SaaS that pulls bank feeds, a property portal that pre-qualifies mortgage applicants, a B2B portal that checks whether an invoice has actually been paid, and a lending app that scores a customer from their transaction history.

The market backdrop explains the urgency. The UAE fintech market is estimated at USD 52.07 billion in 2026, up from USD 46.67 billion in 2025, and is forecast to reach USD 90.06 billion by 2031 at an 11.58% CAGR — growth that regulators would rather shape early than clean up later. Open finance is the plumbing that growth is being routed through.

What AlTareq actually is

Three names get used interchangeably in Dubai boardrooms and they are not the same thing:

The Open Finance Regulation — Circular 7 of 2023, updated by Circular 3 of 2025, in force since 10 July 2025. The rulebook.
Nebras Open Finance LLC — the CBUAE subsidiary that operates the central API hub and trust framework: participant directory, discovery, onboarding, authentication, and the commercial model (supplemental licensing plus variable usage fees).
AlTareq — the user-facing brand and platform layer: standardised consent management, centralised authentication, and in practice the account-to-account payment initiation experience your customer sees.

The framework supports four functions: data sharing, quote generation, service and transaction initiation, and onboarding to licensed financial institutions. Phase one covers all banks — including branches of foreign banks — and insurance companies, both national and foreign branches. Later phases are to be announced by the Central Bank through official channels.

The data in scope is far wider than current accounts. It covers savings and current accounts, credit cards, personal and auto loans, mortgages, overdrafts, motor, health, life and property insurance, digital payments, and investment and wealth management products. That breadth is why the UAE calls it open finance rather than open banking.

Data Sharing or Service Initiation: which licence does your product need?

This is the single decision that sets your budget, your timeline and your compliance load. Get it right in week one.

Dimension	Data Sharing licence	Service Initiation licence
What it permits	Access, process and aggregate customer financial data with consent	Initiate transactions and instructions on the customer’s behalf
Typical Dubai use case	Accounting bank feeds, multi-bank treasury dashboards, credit and affordability analytics, KYC pre-fill	Account-to-account checkout, automated supplier payouts, standing instructions, embedded lending disbursement
Minimum capital	AED 1,000,000, with risk-adjusted uplift at CBUAE discretion
Money movement	None	Yes — but the licence does not permit holding customer funds
Engineering scope	Consent flow, token lifecycle, read APIs, data minimisation, retention	All of the above plus idempotency, payment status reconciliation, failure and refund handling
Realistic build window	8–14 weeks	14–24 weeks

An open finance licence is deliberately narrow. It does not entitle the holder to perform any other licensed activity, to give advice, to arrange transactions in licensed activities, or to hold customer funds in any form. If your product roadmap quietly assumes a wallet balance, you need a stored value facility licence as well — a different application entirely, which we cover in our e-wallet and CBUAE SVF licence guide.

The rules that break naive architectures

No scraping. Extraction of customer data to spreadsheets or databases outside the framework is prohibited outright.
No re-sharing. A licensed institution cannot pass the data on downstream.
No commercialising customer data. Selling, trading or monetising it is banned — so “we will monetise the transaction data later” is not a business model here.
Consent is the product. Scope, duration and revocation are first-class objects in your data model, not a checkbox on a signup screen.
Retention. Records are generally held for at least five years unless another requirement applies — which interacts directly with your PDPL obligations. See our UAE PDPL checklist before you design the schema.

The workaround everyone in Dubai was using — and why it stops now

Until AlTareq went live, almost every Dubai product that needed bank data did one of three things: asked the customer to upload PDF statements, asked the finance team to email a CSV each month, or asked outright for online banking credentials and scraped the screen. The first two are slow, the third is now explicitly prohibited.

The cost of the slow options is measurable. UAE bookkeeping runs roughly AED 1,500–3,000 per month for basic transaction recording and bank reconciliation, and AED 3,500–6,000 per month once VAT filing, reporting and compliance support are included — a spend heavily weighted toward manual matching. It shows up in error rates too: manual journal mistakes affect around 35% of UAE SMEs, and 34% reported a VAT reconciliation error in the last twelve months, usually because ledger VAT accounts did not match what was filed with the Federal Tax Authority.

Those numbers get worse, not better, as the e-invoicing mandate lands — voluntary from July 2026 and mandatory through 2027 under Ministerial Decisions 243 and 244 of 2025. A ledger fed by a consented, structured API is the difference between a clean reconciliation and a quarter-end scramble. We wrote the invoicing side up separately in our UAE e-invoicing guide.

What an AlTareq integration costs to build in Dubai

Licensing fees, capital and legal counsel sit outside these numbers — this is the software. Aquarius build bands for 2026:

Scope	What you get	AED band
Read-only pilot	One consent journey, account and balance retrieval, token refresh, a single product surface. Proves the flow to your board and the regulator.	45,000–90,000
Production data-sharing product	Full consent lifecycle with revocation, multi-institution aggregation, categorisation, reconciliation into your ledger or ERP, audit logging and five-year retention.	120,000–260,000
Service initiation / A2A payments	Payment initiation, idempotency and duplicate protection, status polling and webhooks, failure and reversal handling, settlement reporting, fraud controls.	200,000–450,000
Embedded platform	Open finance as a feature inside an existing marketplace, portal or lending product, with white-label consent UI and per-tenant isolation.	350,000–800,000+
Annual run cost	Hub usage fees, monitoring, certificate and token rotation, regulatory change tracking, support.	18–25% of build

The payback argument is cleanest on the payments side. Card acceptance in the UAE typically costs a merchant a 1.8–3.5% merchant discount rate on every transaction; account-to-account initiation moves high-value B2B and top-up flows off that percentage entirely. On a Dubai business collecting AED 4 million a year on cards at a 2.5% blended rate, that is AED 100,000 of annual fee — a number that funds the build in its first year if even half the volume shifts. The same logic applies to the national rails we covered in our Aani and Jaywan integration guide; open finance is the consented, data-rich sibling of that story.

How Aquarius approaches it

We start with a two-week scoping sprint that answers exactly one question: which licence category your product needs, and what the smallest compliant version of it looks like. That sprint produces the consent data model, the integration sequence diagrams and a fixed-price build quote. If the answer is that you do not need a licence at all — because you are a deemed-licensed entity that only needs a written notification and a no-objection certificate, or because a partner can front the regulated layer — we say so and the sprint has paid for itself. Build pricing and engagement models are on our pricing page.

Three mistakes we keep seeing

Treating consent as a UI screen. Consent has scope, an expiry, a revocation path and an audit trail. Retrofitting that into a schema designed around a simple boolean is the most expensive rework in this category.
Building the read and the write together. Service initiation roughly doubles the surface area and the failure modes. Ship data sharing, learn the hub’s real behaviour, then add initiation.
Assuming a bank partner covers your licensing. Deemed-licensed status belongs to the institution, not to your app. The written notification and no-objection certificate are still prerequisites before anything goes live.

FAQ

Is screen scraping actually illegal in the UAE now?

The Open Finance Regulation explicitly prohibits data scraping — the extraction of customer financial data to spreadsheets or databases — and bans licensed institutions from re-sharing data or commercialising it. With open finance now a licensed activity under Federal Decree-Law No. 6 of 2025, operating that way also risks being treated as unlicensed financial activity, which is criminalised.

What does an open finance licence cost to obtain?

The published hard requirement is a minimum capital of AED 1,000,000, with the CBUAE able to impose more on a risk-adjusted basis. On top of that sit Nebras hub fees — a supplemental licensing charge plus variable usage — and your own legal, governance and AML build-out. Prepare the regulatory business plan, governance framework, compliance and AML policies, data protection controls, technology documentation and financial projections before you apply.

We are a bank. Do we still need to apply?

Banks, finance companies, insurance companies and payment service providers are deemed licensed for open finance activity, but must notify the CBUAE in writing and obtain a no-objection certificate before commencing. Participation as a data holder is mandatory regardless — phase one covers all banks including foreign branches, and insurance companies.

Is anyone actually live on AlTareq?

Yes. ADIB was the first UAE bank licensed as an open finance provider under AlTareq, initially for data aggregation. Commercial Bank of Dubai went live in December 2025 as the first bank letting customers view balances at other banks and initiate payments from those accounts inside its own app. Pay10 has since announced retail go-lives with both First Abu Dhabi Bank and CBD, and Project Aperta tested trade-finance flows to completion in June 2026.

How long does an integration take?

A read-only pilot is realistically 8–14 weeks of engineering; a production service-initiation build is 14–24 weeks. Licensing runs in parallel and is usually the longer pole — start the regulatory track first, not second.

Where to start

If your Dubai product touches bank data in any form, the honest first step is a scoping call, not a procurement process. Tell us what your product does with financial data today and we will tell you which licence category it lands in, whether you need one at all, and what the smallest compliant build looks like. Talk to Aquarius — we build the consent layer, the hub integration and the reconciliation that sits behind it, and we do it against a fixed price.