01
Regulator map
Banks, payment systems, PSP, money services, digital banking and open banking.
Capital-market, insurance and other functions within the perimeter established by law.
Company registration, data, telecom, consumer, tax and sector approvals.
A partnership model is possible, but roles and responsibilities must be transparent.
02
Technology does not define license
First, the customer journey and money flow are drawn. Then the functions of each person, the contract with the client, ownership of funds, calculations, data and territory are qualified.
- Funds
- Who receives, stores, transfers and returns money
- Account
- Who maintains the balance or payment account
- Credit
- Who finances, assumes the risk and collects
- Investment
- Who advises, arranges, manages, deals or holds assets
- Data
- Who receives account data and initiates payment
- Technology
- Vendor, agent, outsourcing or independent regulated provider
03
Payments and Payment Service Providers
The National Payment Systems Law and CBO regulations form the basis for licensing payment services. In the sandbox form, CBO directly refers to the Licensing Policy for Payment Service Providers & Ancillary Payment Service Activities, e-KYC, AML and cyber-resilience instructions.
- Product
- Wallet, acquiring, gateway, transfer, remittance or ancillary service
- Customer funds
- Safeguarding, segregation, settlement and reconciliation
- AML
- CDD/EDD, sanctions, monitoring, STR and transfer data
- Operations
- Complaints, refunds, incidents, outsourcing and business continuity
- Technology
- Architecture, access, cloud, cyber controls and audit trail
04
Banking Law 2025
Royal Decree 2/2025 updated banking legislation and expanded the framework for regulating conventional, Islamic, digital and investment banking activities. Accepting deposits and other banking functions cannot be offered under the guise of a wallet, marketplace or technology platform.
Banking-as-a-Service does not transfer the banking license to fintech. Customer contract, brand, funds, ledger, complaints, AML and outsourcing are distributed in a consistent model.
05
Open banking: AISP and PISP
The Open Banking Regulatory Framework establishes licensing for the Account Information Service and Payment Initiation Service. It is based on Banking Law 2/2025 and National Payment Systems Law 8/2018. The published framework indicates a basic capital amount of OMR 100,000 for an open-banking service provider - the final calculation is confirmed based on the current edition and the selected services.
- AISP
- Access to payment account data with the client’s consent
- PISP
- Initiating a payment without deducting client funds
- Consent
- Explicit, controlled, and provable client permission
- Security
- Strong access, API controls, incidents and third-party risk
- License
- Perimeter, capital, governance and ongoing obligations
06
A digital bank is a bank
The Digital Banks Framework is not PSP-lite registration. The project requires sufficient capital, ownership, governance, management, risk, AML, cyber resilience, operational plan and the ability to fulfill banking obligations.
07
BNPL, lending and money services
If the product finances the customer, takes credit risk, determines the price or collects debt, a separate credit-perimeter analysis is carried out. The CBO also publishes special treatment for BNPL and money services: the name of the product does not exempt the applicable license.
08
Regulatory Sandbox
Sandbox is designed for controlled live testing of innovations in a supervised environment. The application describes the problem, technology, users, partners, data, integration with Omani infrastructure and legal, AML, cyber and operational risks.
- Use case
- Innovation and measurable benefit to the market
- Test plan
- Users, volume, duration, success metrics and exit
- Partner
- Licensed bank/PSP, technology provider and government entity
- Risk
- Financial crime, consumer, technology, data and continuity
- Exit
- Full licensing, partner deployment, extension or termination
Admission to the test is limited by the sandbox parameters and does not allow you to provide a service to the market indefinitely.
09
License package
Products, users, geography, money flow, pricing and projections.
Controllers, UBO, source of capital and group structure.
Board, CEO, compliance, MLRO, risk, finance and internal audit.
AML, safeguarding, conduct, complaints, cyber, cloud and BCP/DR.
10
Ongoing compliance
- Prudential
- Capital, liquidity or safeguarding - by category
- Regulatory reporting
- Periodic returns, notifications and audits
- AML/CFT/CPF
- Risk assessment, CDD, monitoring, sanctions and STR
- Consumer
- Terms, fees, disclosures, complaints and redress
- Technology
- Security, incidents, outsourcing, cloud and resilience
- Change control
- Product, owner, key person and material vendor
11
Launch route
- 01
Draw customer, money and data flow.
- 02
Qualify each function and controller.
- 03
Choose your own license, partner model or sandbox.
- 04
Collect entity, capital, team, manuals and technology evidence.
- 05
Agree on banking, safeguarding, settlement and go-live controls.