Getting into UAE open finance: the Trust Framework
Certificates, roles and certification — what a TPP has to clear before it can make its first production API call in the UAE.
Writing the code is not what gets you into UAE open finance. Before a third-party provider can make a production call, it has to be enrolled in the Trust Framework, hold three kinds of certificate, register under a regulatory role, and pass a conformance certification.
None of that is difficult, exactly. It is just a queue of things that take calendar time rather than engineering time, and it is worth knowing the shape before you plan a launch.
What the Trust Framework is
Four components, and it is worth being precise because “trust framework” is doing a lot of work as a phrase:
| Component | What it holds |
|---|---|
| Trust Anchors | Registry of authorised participants and their access scopes |
| API Portal | Registry of servers, clients and available APIs |
| Keystore | Registry of active cryptographic keys used to validate identity |
| PKI | Issues and manages TLS, signing and encryption certificates |
No consumer data passes through it. The platform facilitates the exchange; the data moves directly between the licensed financial institution and the provider. That is a useful thing to be able to state plainly when someone asks where customer data goes.
Three certificates, not one
Both servers and clients need three separate certificate types: transport (TLS), signing, and encryption.
If your mental model is “we need a client cert for mTLS”, that is one of the three. Signing and encryption certificates are distinct artefacts with their own lifecycle, and they are distinct from the mTLS transport certificate that the security profile requires for sender-constrained tokens.
The rotation cadence is a standing commitment
Certificates expire at 13 months, and participants must rotate at least once every 12 months.
The one-month gap between those numbers is the whole design: you are expected to rotate a month before expiry, so there is a window where old and new are both valid and rotation is not an outage.
Practically this means certificate rotation is a recurring operational task with a deadline, across three certificate types, in two environments. It is not a launch task you complete and forget. Whoever owns it needs it in a calendar, not in someone’s memory, because the failure mode is a hard stop on a date you chose twelve months earlier.
The security profile caps jwks_uri caching at 20
minutes, which sets the other end of the same problem — a rotated key propagates within
twenty minutes, so rotation faster than that will race.
Roles decide which APIs you can call
Applications select a regulatory role, and the role determines API access:
| Role | Scope |
|---|---|
| BDSP | Bank Data Sharing |
| BSIP | Bank Service Initiation |
| ISP | Insurance Services |
| LFI | Licensed Financial Institution |
Data sharing and service initiation are separate roles. A product that reads accounts and initiates payments is asking for two, and the split is worth reflecting in how you scope the first release — shipping read-only first is a materially smaller onboarding.
Certification is a gate, not a badge
Before production operations, a TPP must hold FAPI 2.0 UAE Relying Party Certification. LFIs require an LFI Customer Experience Certification.
Two things follow.
First, it settles the version question. The certification is explicitly FAPI 2.0, which matches the security profile taking FAPI 2.0 as its base. If you have seen the UAE described as FAPI 1.0 Advanced because its profile mentions signed request objects, that inference is wrong — the profile layers signed request objects on top of FAPI 2.0’s PAR.
Second, certification is a scheduled external dependency. You cannot compress it by working harder, and it sits between “our integration works” and “we are live”. Plan it as a date rather than a task.
Enrolment, in order
- Submit documentation and pass KYC/KYB verification.
- Create platform accounts — Sandbox and Production register separately, so nothing carries over automatically.
- Have a legal representative sign the terms via DocuSign.
- Obtain production access after AlTareq validation.
Then register in the directory. LFIs register authorization servers with metadata — name, description, logos, URIs — plus API resources, and only approved endpoints go live. TPPs register applications with discovery metadata, including a Shari’ah compliance flag.
That last field is easy to skim past and is a genuine market difference. It is a first-class attribute of your application registration, not a marketing claim, and it is worth deciding deliberately rather than at the point of filling in a form.
What this means for a plan
The engineering is bounded and knowable. The queue in front of it is not, and it is sequential: KYC/KYB, then enrolment, then certificates, then certification, then production access.
If you are estimating a UAE launch, the honest schedule has two tracks — build, and clear the gates — and the second is the one that decides the date.
Sources
Trust Framework User Documentation, Open Finance UAE, v3, published 11 September 2024. Checked 28 July 2026.
Read this one with care. That documentation space is marked deprecated, and directs readers to the current Open Finance Platform version. The structural points above — the four components, the three certificate types, the roles, the certification gate — are unlikely to have changed, but treat specific figures such as the 13-month certificate lifetime as requiring confirmation against the current documentation before you plan around them.
Related: the security profile covers what you must build; the pricing model covers what calling the API Hub costs.