Kong · Open banking
Open banking API Saudi Arabia: where Kong fits, and what your own programme decides
Open banking API Saudi Arabia work starts with the Open Banking Framework published by the Saudi Central Bank (SAMA), which sets out use cases, business rules and technical standards for banks and fintechs. Kong is an API gateway platform, the layer that applies access, limits and logging to the APIs a bank or fintech exposes, and Interkey implements and operates it in Saudi Arabia, from Riyadh. Compliance with the framework is decided by your own programme, not by the gateway.
Published 5 min read
In short
- What open banking is, per SAMA: a practice that lets customers of financial institutions share their financial data securely with third-party providers, which offer new financial services and products.
- What Kong is: an API gateway platform. It is the API layer: authentication, limits, routing and logging for each call.
- What it is not: a compliance programme. This page does not say that Kong or Interkey holds any certification, approval or accreditation under the framework.
- What Interkey does: deploys, configures and operates Kong in Saudi Arabia, in Arabic and English, in the residency shape your data allows.
What SAMA's Open Banking Framework is
| Element | What SAMA says it is |
|---|---|
| Open Banking Program | Launched by SAMA under the Fintech Strategy, part of the Financial Sector Development Program under Saudi Vision 2030 |
| Glossary | Definitions of the key terms used in the framework |
| Use cases | An overview of the evaluation framework and prioritisation, with the details of the use cases to be enabled; SAMA's Arabic page names account information services and payment initiation services as possible use cases |
| Business rules | Directives on the requirements that banks and fintechs must meet to provide open banking services |
| Technical standards | Customer experience guidelines, API specifications, implementation requirements and operational guidelines |
| Open Banking Lab | A technical testing environment where banks and fintechs develop, test and certify their open banking services, with a sandbox that simulates a real bank's open banking APIs and conformance suites |
Source: SAMA's Open Banking in Saudi Arabia site, read on 8 November 2026. The site says access to the framework and the lab is by contacting the Open Banking Team. This page describes the framework only as that site does. It is not legal advice, and the framework is the authority.
Where an API layer fits
A bank that publishes open banking APIs, and a fintech that offers its own APIs to apps and partners, both need one layer in front of their services that decides who may call them and how often, and records each call. That is an API gateway, and Interkey implements it with Kong. The API gateway page explains the function.
The framework's technical standards state what your APIs must do, and the gateway is where rules of that kind are applied at runtime. The order of work is: obtain the standards from SAMA, decide with your compliance owner what each requires, then express the access rules as version-controlled gateway configuration. The gateway does not interpret the framework for you.
What Kong names for open banking, and what stays with you
| Area | What Kong says it offers | What stays with your programme |
|---|---|---|
| Client registration | Dynamic Client Registration through the Kong Konnect Developer Portal | Who may register, the onboarding process and the approval of each third party |
| Authentication | Mutual TLS authentication | Certificates, their issue and rotation, and the trust decisions behind them |
| Access and permissions | OAuth 2.0 support for managing access and permissions | The scopes and consent rules your services honour, which live in your own systems behind the gateway |
| Scale | Operation across cloud and on-premises environments | Sizing, where each plane runs and who operates it |
Source: Kong's open banking solutions page, read on 8 November 2026. These are Kong's descriptions of its platform, not a statement that using them satisfies the framework. We confirm the edition each feature needs, and where Konnect-hosted components run, before quoting.
Where the gateway runs
Kong separates the plane that carries traffic from the plane that holds configuration. A self-managed deployment places both on infrastructure you operate in Saudi Arabia; a hybrid one keeps the traffic plane in the Kingdom while the vendor hosts configuration. Which shape is acceptable is for your own risk and compliance teams to decide. Interkey's Kong implementation page compares the options and what each costs to operate.
What to ask any supplier of an open banking API layer
Use this list for a proposal from Interkey or anyone else:
- What exactly is claimed. A supplier should say which framework requirements its product helps you meet, and which it does not touch.
- Configuration as code, with nothing edited by hand on a node.
- Per-consumer limits and logs, so each third party's traffic can be seen and bounded.
- A named operator after go-live: your team or Interkey's managed service.
How Interkey delivers the API layer
-
Inventory and policy.
List the APIs you expose and their consumers. Write the access rules the gateway will enforce, using the framework standards your compliance owner has read.
-
Deploy and configure.
Place each plane as your data classification allows, and express authentication, limits and logging as version-controlled configuration.
-
Test before go-live.
Test your APIs in SAMA's sandbox and conformance suites, where your programme has access. The lab is SAMA's; the testing and its results are your programme's.
-
Operate.
Interkey operates the gateway as a managed service, or hands the configuration and runbooks to your team.
What this page does not claim
A gateway enforces access, limits and routing on traffic. It does not make an unsafe service safe, and it does not replace the bank's own authorisation and consent logic. SAMA's site does not describe Kong or Interkey as certified, approved or accredited under the framework, and this page does not say so. Kong licensing, where the Enterprise edition is needed, is quoted at the vendor's terms beside Interkey's services.
Questions buyers ask
What is the Open Banking Framework in Saudi Arabia?
It is SAMA's set of use cases, business rules and technical standards for banks and fintechs offering open banking services, with an Open Banking Lab for testing. See SAMA's Open Banking site.
RelatedSAMA's Open Banking site
How do we get the framework and the lab?
SAMA's site says to contact the Open Banking Team for access to both. We do not hold or distribute the framework documents.
Is Kong certified or approved for SAMA open banking?
This page makes no such claim, and neither Kong's open banking page nor SAMA's site describes Kong or Interkey that way. Compliance with the framework depends on the bank's or fintech's own programme. Kong is the API layer inside it.
Can the gateway stay inside the Kingdom?
Yes. A self-managed deployment runs both planes on infrastructure you operate in Saudi Arabia. We confirm where any vendor-hosted component runs before agreeing a design.
Does a bank need a gateway to take part?
SAMA's public site does not say so. It describes rules and API standards. A gateway is a common way to apply access and logging rules consistently, and your compliance owner decides what the standards require.
Next
Related pages
Next step
Discuss an open banking API layer
Tell us whether you are a bank or a fintech, which APIs you expose or consume, where data must stay and whether you run Kubernetes. We will propose a deployment shape and the first steps.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia