Bank Growth in the GCC
Share Post :

The Gulf’s Digital Ambition Runs Into an Analog Wall

The numbers are hard to ignore. The GCC’s digital banking market is projected to reach $47.6 billion by 2032, growing at a 20.8% CAGR from 2026.1 Saudi Arabia processed 10.8 billion digital transactions in 2023, a 24% year-on-year jump.1 Dubai has a government-mandated target of 90% cashless transactions by the end of 2026.2 By every macro indicator, the Gulf is sprinting toward a digital financial future.

 

Yet inside the operations of many established GCC banks, a different reality persists. Mainframe systems architected in the 1980s and 1990s continue to run the ledgers. Batch processing cycles still define how quickly accounts are updated. New product launches, whether a trade finance module or an SME lending feature, require months of custom coding and QA cycles that were never designed for a real-time economy.

The tension here isn’t simply about old versus new technology. It’s about what happens when a region’s highest-growth ambitions collide with the operational inertia of institutions built for a different era. And in 2026, that collision is no longer theoretical; it’s reshaping competitive dynamics across the GCC’s financial sector in measurable ways.

The Budget Trap: Spending to Stand Still

The most immediate cost of legacy infrastructure is fiscal. Globally, banks that run legacy cores are spending an average of 40–70% of their IT budgets on maintaining existing systems rather than building new capabilities.3 A 2025 Accenture study placed that figure at nearly 40% of IT spend on legacy platform maintenance alone.4 Looked at another way: for every dollar a legacy-dependent bank spends on technology, less than half goes toward competitive differentiation.

 

Global financial institutions spent $36.7 billion on legacy payment systems in 2022 alone, a figure IDC Financial Insights projects will reach $57 billion by 2028. Every dollar spent on maintenance is a dollar not invested in growth.

 

For GCC institutions, this dynamic is particularly damaging given the pace of regulatory change. The UAE’s Open Finance Regulation (updated by CBUAE Circular 3 of 2025, in force July 2025) mandates data-sharing across banking, insurance, and investment sectors through standardized APIs.5 SAMA’s Open Banking Framework has moved from account information services (2023) to payment initiation services (2024), with the Open Banking Lab actively certifying third-party platforms.6 Compliance with these frameworks requires modern API infrastructure, precisely the kind of capability that legacy monoliths struggle to support without costly workarounds.

The result is what analysts increasingly call a “maintenance trap”: institutions spending large portions of their IT budgets just to keep aging systems compliant, with little left to invest in the features their customers now expect as baseline.

The Innovation Gap: When Weeks Become Months

There is a structural reason why GCC digital banks like STC Bank, D360 Bank, and Vision Bank, all launched or expanded significantly in 2025, are able to move at a fundamentally different pace than incumbents.7 They were built on cloud-native core banking platforms with microservices architectures. They carry no legacy debt.

 

On a modern core, a new product can be launched in days to weeks. On a legacy monolith, the same task can take six months to a year, with extensive testing required at every step.8 This isn’t a minor operational inconvenience, it’s a structural competitive disadvantage in a market where consumer expectations are being set by the fastest players, not the most established.

 

Consider the specific challenge facing Islamic finance, which is central to GCC banking. A legacy Islamic banking software stack typically requires manual Shariah compliance checks at multiple process points, introducing delays that modern digital-native competitors have systematically eliminated through automated rule engines.9 For banks serving corporate clients across syndicated lending, trade finance, and structured Islamic products, that operational drag has real cost implications.

 

The broader picture, according to The Financial Brand’s 2026 Retail Banking Trends Report, is that 62% of banks globally planned to offer real-time payments in 2026, up from 49% in 2024, yet many traditional banks still lag behind neobanks that built on modern infrastructure from day one.10 In the GCC, where government-driven real-time payment rails (SARIE in Saudi Arabia, IPP in the UAE) are already live, legacy banks risk becoming the bottleneck in an otherwise fast payment ecosystem.

The Open Banking Compliance Crunch

The shift to mandatory open banking frameworks across the GCC is revealing a harder problem than most institutions anticipated: API connectivity is not just a front-end engineering challenge, it requires the underlying core to expose clean, real-time data.

Legacy cores often store data in formats and schemas that predate modern API standards. Bridging that gap requires middleware layers, data transformation logic, and dedicated integration teams, all of which add cost, latency, and fragility. The result is that even “API-enabled” legacy banks may technically comply with open banking mandates while delivering a user experience that is measurably slower and less reliable than their fintech competitors.

The UAE’s framework goes further than most. Its Open Finance Regulation introduces “service initiation”, allowing non-banking players to directly trigger financial services (lending, wealth management, pension setup) from within fintech environments.5 This is embedded finance at the regulatory level. For a legacy bank whose core cannot support real-time event triggers, this isn’t just a missed opportunity, it’s an existential displacement risk as third parties begin owning the customer relationship.

Bahrain remains the regional first-mover, having implemented open banking rules since 2018 and extending the framework to corporate accounts in 2024.11 That head start has given Bahraini fintechs a longer runway to build on API-enabled banking data, a direct consequence of regulatory pressure forcing infrastructure modernization earlier than in neighboring markets.

 

 

 

Bridging the Gap: Purpose-Built for GCC Complexity

The infrastructure gap described above is precisely the problem that purpose-built fintech solutions are designed to close not by replacing a bank’s entire core in a single high-risk cutover, but by sitting intelligently between existing systems and the modern payment networks that regulators and clients now demand. FINEXCORE, a banking and financial technology firm serving over 14+ banks across the Middle East, South Asia, and Europe, has built its Payment Messaging System (PMS) specifically around this reality. 

 

Rather than asking banks to undertake wholesale transformation, PMS acts as a multi-network hub that bridges internal loan management systems, such as Finastra’s Fusion Loan IQ, with external payment rails including SWIFT, RTGS, UAEFT, SARIE, BHRTGS, and FTS. It handles message preparation, format transformation (MT101, MT103, MT202, MT202COV), and real-time ACK/NACK tracking through a single orchestration layer, with dynamic rule-based configuration that removes the need for manual intervention at each compliance checkpoint. 

 

For GCC banks navigating the dual pressure of open banking mandates and Islamic finance compliance requirements, this type of modular, integration-first architecture offers a pragmatic middle path: the operational agility of a modern payment infrastructure, without the organizational disruption of a ground-up core replacement.

The Talent Dimension: A Skills’ Crisis in Slow Motion

One aspect of the legacy problem that rarely surfaces in strategy reports deserves direct attention: the workforce. Legacy systems, particularly those built on COBOL, older versions of Oracle FLEXCUBE, or proprietary mainframe architectures, require a shrinking pool of specialists to maintain them. As those professionals retire, the institutional knowledge embedded in decades of custom code walks out the door with them.8

 

New engineering talent in the GCC, a young, digitally fluent workforce where roughly half the population is aged 25 or younger12, has little interest in maintaining 30-year-old infrastructure. This creates a dangerous dependency: banks become increasingly reliant on expensive consultants and dwindling internal specialists to keep critical systems operational, while struggling to attract the cloud, API, and AI engineers who will build the next generation of banking and financial services.

 

This talent gap accelerates the cost problem. When specialized knowledge is scarce, even routine maintenance becomes expensive. When it disappears entirely, banks face a difficult choice: costly emergency modernization or dangerous system fragility.

The Path Forward: Not a Single Answer

Acknowledging the problem is easier than solving it, and it is worth being direct about the complexity here. Full “big bang” core replacement, migrating an entire banking stack to a new platform in a single cutover, carries catastrophic risk. Commonwealth Bank of Australia’s famous core migration took five years (completed in 2012) and cost approximately $1 billion.3 Most GCC institutions cannot absorb that level of risk or disruption.

 

The emerging consensus, reflected in practice among early-moving GCC institutions, points toward three viable approaches:

  • Progressive Modernization: Running modern systems alongside legacy cores, gradually migrating workloads and products. Approximately 40% of global banks are taking this phased approach.13 It reduces single-point failure risk but demands multi-year organizational discipline.

  • API Wrapping: Building modern API and middleware layers around legacy cores to enable open banking compliance and front-end digital experiences without replacing the underlying system, a pragmatic short-term bridge, but one that defers, not resolves, the core problem.

  • Greenfield Digital Subsidiaries: Launching new digital bank entities on modern infrastructure, as several GCC banks have done with neobank subsidiaries, effectively running a two-speed architecture while the legacy core is phased out over time. The risk here is organizational fragmentation and internal cannibalization anxiety.

 

What all three approaches share is a prerequisite: executive-level conviction that the cost of inaction now exceeds the cost and risk of change. Globally, legacy technology remains a top concern for 53% of banking executives, yet only one quarter of respondents in The Financial Brand’s report said they had prioritized back-office infrastructure modernization.10 The GCC is not immune to this gap between stated priority and committed action.

Conclusion: The Window Is Not Infinite

The GCC’s macroeconomic moment is real. Vision 2030, the UAE’s Financial Infrastructure Transformation Programme, open banking mandates, and a young digitally-native population have created conditions for one of the world’s most dynamic financial markets. The region’s institutions have genuine advantages: capital, regulatory support, and government alignment that most global banking markets would envy.

But infrastructure debt does not care about macroeconomic tailwinds. It compounds quietly, consuming budgets, slowing product timelines, widening the gap between incumbent capability and customer expectation, and ultimately handing competitive ground to new entrants who started with none of the baggage. 

The three digital banks licensed in Saudi Arabia, D360 Bank, STC Bank, and Vision Bank, are not a warning shot;  The UAE’s open finance framework is not a future requirement; it is live regulation as of July 2025. The UAE’s open finance framework is not a future requirement; it is live regulation as of July 2025.7

 

For decision-makers inside GCC banks, the practical question is no longer whether to modernize. It is which approach, at what pace, and starting with which systems. Those who can answer that with operational specificity and commit the capital and organizational will to back it will define the region’s next decade of banking. Those who continue to defer will find the competitive gap widens faster than their ability to close it.

FOOTNOTES & SOURCES

  1.  PS Market Research. GCC Digital Banking Market Size and Growth Report, 2032. 2025. Also cited for SAMA transaction data. psmarketresearch.com ↩
  2. Dubai Government Cashless Strategy, October 2024. Cited in: MORS Software, Digital Transformation Trends Reshaping GCC Banking in 2025. December 2025. morssoftware.com ↩
  3. Softjourn. Core Banking Modernization in 5 Steps. March 2026. Also cited for the Commonwealth Bank of Australia case study. softjourn.com ↩
  4. PiTech Solutions. Legacy System Modernization: Avoiding the Pitfalls That Cost Banks Millions. Citing 2025 Accenture study. December 2025. pitechsol.com ↩
  5. Pinsent Masons. Open Finance in the UAE: Laws and Regulations. November 2025. Also cited for service initiation provisions. pinsentmasons.com ↩
  6. ICLG. Fintech Laws and Regulations Report 2025–2026: Saudi Arabia. July 2025. iclg.com ↩
  7. Fimple. GCC Digital Banking in 2026: Why Core Modernization Is Now a Competitive Imperative. February 2026. fimple.co.uk ↩
  8. WAU. The Complete Guide to Core Banking System Modernization in 2025. April 2025. Also cited for legacy talent and skills scarcity. wau.com ↩
  9. Intellect Design. The State of Islamic Digital Banking in the GCC: Core Banking, Sharia Compliant Architecture, and the Future of Islamic Finance. June 2026. intellectdesign.com ↩
  10. The Financial Brand. 2026 Retail Banking Trends and Priorities Report. Cited in: SBS Software, Core Banking Systems: How Legacy Systems Hold Banks Back. March 2026. sbs-software.com ↩
  11. Ripae. What GCC Businesses Need to Know About Open Banking in 2025. 2025. ripae.com ↩
  12. ebankIT. Resilience and Innovation: GCC Banking Sector Outlook for 2025. 2024. ebankit.com ↩
  13. CARITech. The Hidden Cost of Good Enough Banking Infrastructure. April 2026. cari-tech.com ↩ 

 

All statistics and regulatory references cited above are drawn from publicly available industry reports, regulatory circulars, and market research published between 2024 and 2026. Where figures vary across sources, the most conservative estimate has been used. Projections (e.g., market size by 2032) represent analyst consensus estimates and should be treated as indicative rather than guaranteed outcomes.

You cannot copy content of this page