Mashreq Pakistan API integration services (NEO Islamic digital banking)

1. Accounting / ERP transaction sync

Context: A Karachi-based SME runs QuickBooks-style accounting and needs to pull every PKR credit and debit on their NEO Current Account, including biller payments and salary disbursements.

Data & API involved: /v1/mashreq-pk/statement (paginated), /v1/mashreq-pk/balance, narration parser for biller-category mapping.

OpenFinance mapping: Mirrors the ISO 20022 camt.053 bank-statement message under the SBP PRISM+ framework, with our adapter normalising fields to the same schema corporate ERPs already expect.

2. UAE→Pakistan remittance dashboard

Context: A money-transfer operator serving overseas Pakistanis needs to confirm landing of cross-border NEO transfers in near real time and notify senders.

Data & API involved: Webhook on cross_border.transfer.completed, plus /v1/mashreq-pk/transfer/status polling fallback. Includes the zero-fee remittance corridor announced for UAE-based Pakistanis.

OpenFinance mapping: Uses the bank's PISP-style payment-initiation pattern from Mashreq's UAE developer portal, ported to PKR rails.

3. Personal finance manager (PFM) aggregation

Context: A PFM app aggregates Mashreq NEO alongside SadaPay, JazzCash, Easypaisa and NayaPay accounts so users see one net-worth view.

Data & API involved: Account login (OAuth-like), 12-month statement pull, NEO Debit Card MCC tagging, monthly profit-rate accrual on Islamic savings (up to 10% p.a.).

OpenFinance mapping: Account Information Service (AIS) consent model — read-only, scoped, revocable.

4. Corporate bulk-payments & payroll

Context: A corporate uses Mashreq NEO Biz to push monthly payroll to 500+ employees and reconcile against HR records.

Data & API involved: Bulk transfer initiation with daily ceiling up to PKR 10M, IBAN validation pre-check, individual settlement webhooks.

OpenFinance mapping: Modelled on Mashreq's Payment Initiation API and IBAN Validation API already published for corporate clients on developer.mashreq.com.

5. Compliance & regulatory reporting

Context: A regulated entity must file STR/CTR-style reports to the SBP, requiring tagged, immutable transaction history.

Data & API involved: Statement export with cryptographic hash, KYC export, audit-log endpoint, biller-category enrichment.

OpenFinance mapping: Aligned with the SBP Consolidated Customer Onboarding Framework (2025) and the SBP regulatory sandbox themes for Open Banking.

A. Account login & token issuance

POST /api/v1/mashreq-pk/auth/login
Content-Type: application/json
X-Channel: mobile-app

{
  "msisdn": "+923001234567",
  "cnic": "42101-XXXXXXX-X",
  "device_id": "",
  "biometric_flag": true
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rtk_...",
  "expires_in": 1800,
  "scope": ["accounts.read","statements.read","transfers.write"]
}

B. Statement export (PKR, paginated)

POST /api/v1/mashreq-pk/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "iban": "PK36MASH00000123456789",
  "from_date": "2026-01-01",
  "to_date":   "2026-04-28",
  "channel":   ["RAAST","IBFT","CARD","BILLER"],
  "currency":  "PKR",
  "page":      1,
  "page_size": 100,
  "format":    "json"   // or "csv","xlsx","pdf-signed"
}

200 OK
{
  "page": 1, "total_pages": 7,
  "items": [{
    "txn_id": "MBPL-20260315-000341",
    "posted_at": "2026-03-15T09:42:11+05:00",
    "amount": -25000.00, "currency": "PKR",
    "channel": "RAAST",
    "counterparty_iban": "PK24ABPA00000099887766",
    "counterparty_name": "ACME PRIVATE LIMITED",
    "narration": "PAYROLL MAR-2026",
    "category": "salary"
  }]
}

C. Webhook: PRISM+ settlement event

POST https://your-app.example/webhooks/mashreq-pk
X-Mashreq-Signature: t=1714300800,v1=hex(hmac_sha256(secret, body))

{
  "event": "transfer.completed",
  "txn_id": "MBPL-XBORDER-9981",
  "rails": "PRISM+",
  "iso20022_msg": "pacs.008",
  "leg": {"from":"AED","to":"PKR","fx_rate":76.42},
  "amount_pkr": 152840.00,
  "settled_at": "2026-04-28T11:05:33+05:00"
}

# Verify HMAC, ack with 200 within 3s, idempotency on txn_id.

Compliance & privacy

Every Mashreq Pakistan integration we ship is scoped against the regulations that actually apply in-country: the State Bank of Pakistan (SBP) Consolidated Customer Onboarding Framework (2025), SBP PSP&OD Circular No. 02 of 2025, and the PRISM+ real-time fund-transfer system that adopts ISO 20022. Where customer data flows out of Pakistan we additionally honour the SBP Open Banking sandbox guidelines (May 2025 cohort) and, for cross-border UAE legs, the UAE Central Bank's Open Finance regulation. EU-bound integrations layer on PSD2/PSD3 and GDPR consent patterns.

Practically, that means: explicit user consent capture, scoped read-only tokens by default, no harvesting of biometric primitives, retention windows defined per dataset, deletion-on-request endpoints, and signed audit logs for every statement pull. We work only under documented public APIs or explicit customer authorisation — never around access controls.

Data flow / architecture

A typical Mashreq Pakistan integration deployed by our studio looks like this:

The auth adapter mirrors the mobile-app handshake; the gateway normalises fields into ISO 20022-flavoured JSON; storage applies field-level encryption with KMS; and the customer-facing API enforces consent scopes plus rate limits. The whole pipeline is observable with structured logs and a per-tenant audit trail.

Deliverables checklist

• OpenAPI / Swagger specification for every endpoint we ship
• Protocol & auth-flow report (token chain, session refresh, biometric handshake)
• Runnable source code for login, balance, statement and transfer APIs (Python, Node.js or Go)
• Automated integration tests + Postman / Bruno collection
• SBP-aligned compliance guidance (KYC/CNIC handling, retention, deletion)
• Webhook handler reference for PRISM+ settlement events
• Optional hosted gateway with per-call billing for teams that prefer no infrastructure

Engagement models

Source-code delivery from $300 — we hand over runnable API source code plus full documentation; you pay only after delivery upon satisfaction.

Pay-per-call API billing — point your client at our hosted Mashreq Pakistan endpoints and pay only for the calls you make, with no upfront fee. Ideal for variable-volume PFMs and pilot projects.

NDA available on request; source escrow for enterprise engagements.

Key integration capabilities

• Account login, OAuth-style token refresh and biometric session binding
• NEO Islamic / Conventional balance sync
• Transactions, statements and signed-PDF exports in PKR
• RAAST / IBFT transfer initiation up to PKR 10M/day
• Biller catalogue (4,000+) and bill-payment automation
• Cross-border NRP remittance (UAE → Pakistan, zero-fee corridor)
• NEO Debit Card transactions and Ramadan 2026 Umrah-campaign tracking

About our studio

We are an independent technical service studio specialised in app interface integration and authorised API integration. Our engineers come from retail banks, payment gateways, protocol-analysis and cloud infrastructure backgrounds, and we ship end-to-end financial APIs under strict security and compliance constraints. For Mashreq Pakistan specifically, we draw on our knowledge of the broader Mashreq UAE developer portal and on Pakistan's SBP regulatory framework (PRISM+, ISO 20022 adoption, the 2025 Open Banking sandbox).

• Coverage: digital banking, payments, insurtech and cross-border clearing
• Custom Python / Node.js / Go SDKs and integration test harnesses
• Full pipeline: protocol analysis → build → validation → compliance review
• Two engagement models — source-code delivery from $300, or pay-per-call hosted endpoints
• Marketed to overseas clients, familiar with mainstream apps' interface standards across Pakistan, UAE, EU, India and Southeast Asia

Contact

To request a quote or scope a Mashreq Pakistan integration, share your target endpoints (account login, statement, transfer, billers) and any sandbox credentials you already hold. We respond within one business day.

Open the contact page

Engagement workflow

1. Scope confirmation: which Mashreq Pakistan endpoints you need (login, balance, statement, transfer, billers, webhooks).
2. Protocol analysis & API design — typically 2–5 business days, depending on complexity.
3. Build & internal validation against sandbox or authorised real account — 3–8 business days.
4. Documentation, sample clients and automated test cases — 1–2 business days.
5. First delivery in 5–15 business days. SBP or third-party approvals may extend the timeline.

FAQ

What do you need from me to start?

How long until I see a working API?

How is compliance handled?

Does this cover NEO Biz (corporate) too?