D360 Bank

1.1 Identity and operating model

D360 Bank is described by the Public Investment Fund as a Saudi digital banking institution that adheres to Sharia principles, with investors including PIF and Derayah Financial. The available company profile places the bank in Riyadh, founded in 2020, and serving Saudi Arabia through a mobile-first platform rather than a conventional branch network. Its stated product scope spans current and savings accounts, cards, domestic and international transfers, bill payments, personal-finance tools, and digitally delivered services for entrepreneurs and small businesses. The PIF account says the bank was established in 2022, which conflicts with the profile's 2020 founding date and should not be silently reconciled. The evidence therefore supports a Saudi digital-bank identity and operating model, while the exact corporate founding event and date remain a diligence item.[CO001, CO002, CO003, CO004, CO005]

1.2 Leadership, capital, and governance

Public materials identify Taha Abdullah Al-Kuwaiz as chairman and Eze Szafir as chief executive in the bank's customer milestone announcement. They also identify Derayah Financial and PIF-linked shareholders as core backers, with the PIF portfolio page describing local and international expertise but not providing a complete board or executive roster. The June 2026 capital increase is the clearest current financing evidence: 72,916,667 new ordinary shares at SAR 20.57 generated approximately SAR 1.5 billion, with an additional 8,750,000 ESOP shares subject to regulatory approvals. Maaal reports a fully diluted pre-money valuation of SAR 4.5 billion and an implied post-money valuation of SAR 6 billion; Derayah planned SAR 100 million and its stake was expected to fall from 20.4% to 16.35%. These are transaction-implied values, not audited revenue or earnings multiples.[CO006, CO007, CO008, CO009, CO010, CO011]

1.3 Scale milestones and evidence gaps

The strongest public scale signal is the bank's announcement that it exceeded one million customers within four months of official launch and processed more than 51 million transactions across over 100 countries, with transaction volume above SAR 50 billion. Later June 2026 reporting cites three million customers and SAR 3 billion in deposits as of April 2026, but that figure is attributed to a bourse disclosure report and sources familiar with the matter rather than audited bank financial statements. The June capital raise is intended to support lending, consumer finance, SME lending, and API banking. Arab News also reported that former JPMorgan banker Mohammed Nazer was appointed chief financial officer to lead the planned Series A process. No retained source provides audited revenue, net income, net interest margin, capital adequacy, non-performing financing, current headcount, active-user methodology, or complete governance disclosures. The appropriate underwriting stance is therefore growth-positive but evidence-constrained.[CO012, CO013, CO014, CO015, CO016]

1.4 Exhibits

2.1 Market boundary, adjacencies and substitutes

The investable boundary is narrower than all Saudi fintech activity. D360 is positioned as a Sharia-compliant digital bank serving individuals, entrepreneurs and small-to-medium-sized enterprises, so the core market is digitally delivered deposit, payment, transfer, card, financing and related account services for those groups. Broader fintech pools that include investments, insurtech or technology vendors are context, not a direct D360 revenue denominator. Adjacent products include digital wallets and embedded finance, while incumbent mobile-banking applications, branch relationships and cash remain status-quo substitutes. This boundary prevents software implementation spend or unrelated fintech revenue from being counted as bank opportunity merely because it is digital.[CM001, CM002, CM007]

2.2 Sizing lenses, not a synthetic TAM

The retained estimates cannot be averaged or stacked into a defensible TAM/SAM/SOM. PS Market Research estimates the Saudi digital-banking market at USD 108.8 million in 2025 and USD 255.5 million by 2032. Mordor Intelligence measures a broader in-Kingdom fintech service-revenue pool at USD 2.85 billion in 2025, rising to USD 6.08 billion in 2031. Verified Market Research publishes a much larger USD 63.85 billion 2024 fintech value. Mordor itself notes that publisher totals vary with category boundaries and revenue treatment. These are alternative lenses, not corroborating observations; none isolates D360's addressable balances, revenue pool or obtainable share.[CM004, CM005, CM006, CM007, CM008]

2.3 Buyer, user and payer segmentation

D360's stated audience spans three economically distinct groups. In retail, the account holder is generally buyer, user and payer, with convenience, transfers and mobile account access shaping adoption. Entrepreneurs may buy for both personal and business workflows, while an SME's owner or finance lead can choose the institution even when employees use payment or expense functions. The Saudi Times reported an intention to expand SME services, but the retained evidence does not quantify D360's segment mix or SME product economics. Corporate banking is a growing market adjacency in one publisher's forecast, yet it should not be treated as D360's present core without company-specific proof.[CM002, CM012]

2.4 Adoption drivers, constraints and valuation relevance

The demand backdrop is supportive: one market report cites smartphone penetration above 90% and a 70% non-cash transaction rate reached by 2023, while Mordor reports that electronic payments represented 79% of retail transactions in 2024. A young, highly urban population and continuing digital-data coverage reinforce the potential distribution base. Adoption is not frictionless, however. Open-banking consent, personal-data rules and cybersecurity standards raise the compliance threshold, while implementation, integration and maintenance needs add operating cost. For valuation, these category tailwinds cannot substitute for evidence on D360's active users, deposits, retention, acquisition cost, revenue or margin; those private metrics determine whether market growth converts into economic value.[CM009, CM010, CM011, CM013, CM014, CM015, CM016]

2.5 Exhibits

3.1 Competitive landscape and scale

Saudi digital banking is no longer a single-challenger market. Fintech News UAE identifies STC Bank, D360 Bank, Barq, Hala, and Vision Bank as prominent standalone digital-bank or neobank players, while explicitly excluding banking arms of traditional lenders such as NEO and Meem. Its account of STC Bank describes a wallet-to-bank transition with more than 3 million customers, whereas D360 is described as serving more than 1 million customers. The same source positions Barq around international transfers and consumer rewards, Hala around MSMEs and embedded finance, and Vision Bank around licensed mobile banking and savings. This creates overlapping alternatives rather than a clean peer set: STC owns distribution and migration scale, D360 competes on a broad digital-bank experience, and the adjacent players can win specific use cases without matching D360's full-bank scope. D360's own investor description confirms its focus on individuals, entrepreneurs, and SMEs, while independent reporting says it planned to expand lending services to individuals and SMEs. The competitor set therefore spans direct licensed banks, payment-led substitutes, specialist SME platforms, and incumbent-bank digital arms such as NEO and Meem. Existing bank relationships and internally managed finance workflows are also status-quo substitutes, but the assigned evidence does not quantify their scale, switching cost, or economics; those alternatives are kept visible as gaps rather than assigned unsupported performance claims.[CP001, CP002, CP003, CP004, CP005, CP006]

3.2 Capability, distribution, and regulatory posture

The strongest observable competitive axis is distribution, not a proven product feature monopoly. STC Bank inherited a large STC Pay user base: Arab News reports that it began as STC Pay, received approval to transition to a bank, and later received full operational approval. Fintech News UAE reports 15 million STC Pay users were eligible to upgrade and two million migrated within three months, a scale advantage that D360 would need to offset through acquisition, engagement, or superior economics. D360 has meaningful breadth: the company-issued launch material describes accounts, bill pay, transfers, cards, personalized services, and a fully digital operating model, while the independent competitor review also describes individual and business accounts, savings, lending, cards, international transfers, and Banking-as-a-Service infrastructure. Regulatory authorization is becoming table stakes: SAMA approved D360 in December 2024, STC Bank's full launch followed a beta period, and SPA records SAMA's September 2025 non-objection for Vision Bank. Vision Bank's approval also illustrates that digital banks remain subject to capital, liquidity, governance, risk, cybersecurity, and data-protection requirements. Those requirements can raise trust and compliance barriers, but they do not by themselves create a D360-specific moat.[CP007, CP008, CP009, CP010, CP011, CP012]

3.3 Pricing pressure and moat durability

Public pricing evidence is thin, so the competitive conclusion should not be framed as a verified price advantage. D360's launch coverage uses promotional language about competitive exchange rates, no-cost local transfers, and low fees, but does not provide a durable price card or realized customer economics. STC Bank's described product set includes transfers, cards, financing, and savings; Barq emphasizes no annual or international fees, travel benefits, and rewards; and Hala monetizes a business workflow through payment acceptance, POS, payroll, expense controls, and financing. These are different packaging strategies that can support multi-homing and segment-specific substitution. D360's potential advantages are its licensed full-bank scope, Sharia-compliant positioning, app-led onboarding, and a broad consumer-to-SME ambition. The evidence does not show retention cohorts, switching costs, realized interchange or lending spreads, customer acquisition cost, or partner exclusivity. A material adverse signal is therefore not a reported product failure but the speed with which regulators and adjacent providers are adding credible alternatives. D360's moat is best treated as provisional until it demonstrates repeat usage, profitable distribution, and differentiated risk or service capabilities that competitors cannot readily replicate.[CP013, CP014, CP015, CP016]

3.4 Exhibits

The analysis separates documented competitor facts from analyst judgments. Where a source reports a customer count, transaction figure, or regulatory milestone, the value is retained with its period and issuer. Unknown pricing, retention, and realized economics remain explicitly unknown rather than being inferred from promotional claims. The positioning map is an evidence-backed ordinal comparison of disclosed breadth and distribution signals, not a measured market-share chart. It is intended to expose evidence quality as well as competitive position. Investment diligence should therefore focus on active-account cohorts, channel-level acquisition cost, realized fee and spread economics, product-level engagement, and exclusivity or dependency in partner distribution before treating early account growth as durable advantage.[CP002, CP007, CP013]

3.5 Exhibits

4.1 Revenue model and monetization visibility

D360 describes itself as a Sharia-compliant digital banking institution serving individuals, entrepreneurs, and small and medium-sized enterprises. Its public materials support a banking operating model rather than a pure software subscription model: the institution is licensed, supervised by SAMA, and positioned around user-friendly digital banking services. The available evidence does not publish a revenue split between financing income, fees, payments, deposits, or other services, and official pricing evidence is not available in the assigned pool. A company statement about planned SME expansion is a strategic intention, not evidence of realized SME revenue or contribution margin. Consequently, list or account features cannot be converted into revenue, ARR, or gross-margin estimates without contracts, financial statements, and product-level volumes.[CI001, CI002, CI003, CI004, CI005]

4.2 Capital adequacy, funding dependency, and cost structure

The capital picture shows meaningful shareholder backing but not cash availability or runway. Argaam reports that D360 was capitalized at SAR 1.65 billion and that a Series A was planned for the first quarter of 2026. Jawlah reports that shareholders later approved a 38.9% capital increase from SAR 2.1 billion to SAR 2.91 billion through new shares, with approximately SAR 1.49 billion of contemplated subscription proceeds. D360's current official page still states capital of SAR 2.1 billion, so the assigned evidence does not establish whether the approved increase completed. These accounts are not interchangeable with cash on hand, regulatory capital ratios, or operating runway. Public evidence also does not identify staffing, technology, funding, credit-loss, servicing, or branch-equivalent costs. The principal financial dependency is therefore the ability to fund regulated balance-sheet growth while building an SME lending operation before public profitability evidence exists.[CI006, CI007, CI008, CI009, CI010]

4.3 Underwriting verdict and diligence blockers

Sector evidence is supportive but cannot substitute for D360-specific underwriting. S&P coverage summarized by Economy Saudi Arabia expects Saudi bank lending to grow 10% in 2026, while also warning that loan-to-deposit ratios may rise beyond 113%, non-performing loans may reach 1.6%-1.7%, and profitability may face lower-rate pressure. A separate sector report cites Moody's expectations of approximately 8% credit growth and 1.3% NPLs. Those are system-level benchmarks, not D360 outcomes. The banking opportunity is also structurally relevant: the Saudi SME financing share was reported at just over 9% of total loans in 2024, while D360 has said it wants to expand SME services. Yet no assigned source establishes D360's CAC, payback, active-to-registered ratio, net interest margin, loss rate, deposit mix, or capital-adequacy ratio. The financial verdict is track/research-more: capital support and demand are credible, but revenue quality, margin path, and balance-sheet risk cannot yet be underwritten with conviction.[CI011, CI012, CI013, CI014, CI015]

4.4 Exhibits

5.1 Customer product and operating model

D360 Bank delivers banking through a mobile-first product rather than a branch-led workflow. The available evidence describes digital bank accounts, personal financing, savings and domestic or international transfers, while the company app description reproduced by Sensor Tower claims account opening in less than two minutes and promotes avoiding branch visits. This is a concrete customer workflow: onboarding, account control, and routine payments are brought into the app, with Sharia compliance presented as a product requirement rather than an optional feature. The service is intended for individuals, entrepreneurs, and small and medium-sized enterprises, although the public materials do not show separate product-line service levels, eligibility rules, or customer-support performance. Sensor Tower identifies the iOS app as a free Finance-category application with Arabic and English support; its public page reports an 18 October 2026 update, but its engagement metrics are gated. The product therefore appears operational and recently updated, while the public record is insufficient to underwrite reliability, retention, or unit-level usage.[CE001, CE002, CE003, CE004, CE006, CE008, CE013]

5.2 Architecture, dependencies, and maturity

The public architecture is best understood as an app-led banking operating model with regulated-bank infrastructure behind it, not as a disclosed software stack. SAMA's no-objection to commence operations establishes regulatory permission to operate, while PIF's portfolio description points to data-driven strategies, digital innovation, and secure, user-friendly services. Those descriptions do not disclose the core banking vendor, cloud topology, API surface, identity stack, fraud controls, service-level objectives, disaster recovery design, or integration dependencies. The iOS update dated 18 October 2026 is a useful maintenance signal, but one release record does not prove production resilience. Saudi Arabia's broader fintech ecosystem includes a regulator-backed Open Banking Lab, and the World Bank identifies the digital economy and SME strategy within its Saudi advisory coverage; neither point proves that D360 has completed its own integrations or controls. A diligence review should treat the product as live but technically opaque, with the most important unknowns concentrated in platform resilience, security assurance, and operational scaling.[CE005, CE006, CE007, CE008, CE011, CE014, CE016]

5.3 Differentiation, trust, and technical risk

D360's defensible product attributes in the public record are its Saudi banking authorization, Sharia-compliant positioning, local strategic backing, and app-based access. Regulatory permission and the stated financial-inclusion objective are meaningful trust and permissioning assets, but they do not substitute for evidence of security certifications, privacy governance, incident history, uptime, or customer-service quality. PIF describes active ownership and risk governance across its portfolio, but the assigned evidence does not show how those practices operate at D360. The bank also faces a competitive digital-banking market: Arab News reported three licensed digital banks in Saudi Arabia, including D360, STC Bank, and Vision Bank. That context makes execution quality and differentiated customer economics important, yet the assigned evidence provides no verified performance benchmark. No source in this pool establishes a breach, outage, or product failure; that evidence boundary is not proof that none occurred. The central underwriting risk is therefore limited transparency around controls and operating outcomes, not a demonstrated technical incident.[CE005, CE008, CE009, CE010, CE012, CE015]

5.4 Exhibits

6.1 Retail scale first, with SMEs as an expansion segment

Public positioning spans Saudi individuals, entrepreneurs, and small and medium-sized enterprises, but the evidence indicates different levels of maturity across those segments. PIF's portfolio page describes all three as intended clientele, while a D360 executive characterized the product as designed for digitally savvy residents and SMEs. The clearest deployed use case is consumer-facing digital banking and international remittance through the mobile app. By contrast, 2025 reporting described full lending for individuals and SMEs as planned rather than proven in production. Market context is favorable but not company-specific: Saudi SME facilities reached SAR383.2 billion in Q1 2025, and surveyed SME digital-payment acceptance was reported at 99%. These figures indicate addressable demand, not D360 penetration or monetization.[CU003, CU004, CU005, CU008, CU009, CU012]

6.2 Rapid reported acquisition, with denominator ambiguity

Two public snapshots imply rapid account acquisition. Reporting tied to a June 2025 funding story put D360 above 1 million users and stated a target of 4 million account holders before a potential listing. A September 2026 announcement from D360's newly appointed media agency reported more than 3.4 million customers in under eighteen months since operations began in 2024. The later figure is fresher, but neither source defines whether the count means registered, verified, funded, monthly active, or revenue-generating accounts. The snapshots also use different labels, "users," "account holders," and "customers," so they should not be treated as a cohort or retention series. The defensible conclusion is strong reported acquisition, not proven engagement quality.[CU001, CU006, CU007, CU013]

6.3 Use cases are visible; named customer outcomes are not

The Thunes relationship provides concrete workflow evidence: D360 app users were expected to send funds to beneficiaries in Europe, the United States, and the Middle East, with upfront cost transparency and arrival confirmation described by the bank. That supports a real remittance proposition but does not disclose transaction volume, successful-transfer rates, customer satisfaction, or economic outcomes. The assigned evidence contains aggregate account counts and broad segment declarations rather than named retail, entrepreneur, or SME references. Even the strongest proof objects are therefore cohort-level claims, not customer-verified case studies. A nationally sampled financial-inclusion survey can benchmark the wider market, but its household methodology cannot establish D360-specific adoption or customer quality.[CU004, CU014, CU016]

6.4 Acquisition investment is visible, while durability remains unproven

D360 is investing in further customer acquisition: Initiative's appointment covers an integrated media mandate centered on trust, consideration, and growth. Expansion paths also include cross-border payments and the previously announced move into individual and SME lending. However, the reviewed sources do not disclose net or gross revenue retention, churn, renewal behavior, customer tenure, account activity, deposit balances, acquisition cost, payback, or revenue concentration. They also do not identify the share of acquisition attributable to media, partners, referrals, or organic demand. This makes the 3.4 million headline useful as reach evidence but insufficient for underwriting durability. Diligence should reconcile registered, funded, active, and paying accounts by monthly cohort before assigning value to the reported scale.[CU002, CU008, CU015]

6.5 Exhibits

7.1 Ranked risk posture

D360's highest-consequence exposure is the combination of regulated-bank execution and limited public operating disclosure. SAMA's open-banking framework standardizes payment-initiation responsibilities and secure service delivery, while the 2026 licensing transition described by Clyde & Co adds expectations around API performance, data security, consent management, governance, cybersecurity, risk management, and operational resilience. These are not evidence of a D360 breach or failure; they define the control surface on which execution can fail. A second material risk is funding economics: Fitch reported that Saudi-sector funding competition increased, cost of funding rose 30 basis points to 3.5% in 3Q25, and sector net interest margin compressed about 20 basis points in 9M25. D360's SAR 1.5 billion capital increase strengthens loss-absorption capacity, but the public record does not disclose its capital-adequacy ratio, non-performing-financing ratio, deposit concentration, or cash-burn equivalent.[CR001, CR002, CR003, CR004]

7.2 Regulatory, legal, and operational exposure

The regulatory risk is not that licensing is absent: Hala Capital describes D360 as licensed by the Saudi Central Bank, and SAMA's second Open Banking Framework release covers Payment Initiation Services and clarifies stakeholder responsibilities. The risk is continuing compliance as the ecosystem moves from framework guidance toward formal supervision. Clyde & Co reports that firms entering the new open-banking licensing regime must demonstrate governance, risk management, cybersecurity, operational resilience, API interoperability, data management, and customer-protection controls. Ghazzawi & Partners further identifies consent, Personal Data Protection Law obligations, licensing of third-party providers, liability allocation, dispute resolution, breach response, audits, penetration tests, and third-party risk assessments as legal and implementation considerations. ICLG reports that the PDPL applies to local and foreign companies handling residents' data and describes fines, suspension, and possible criminal liability for non-compliance. No retained source confirms a D360-specific enforcement action, outage, breach, lawsuit, or failed deployment; those remain diligence gaps rather than negative findings.[CR005, CR006, CR007, CR008, CR015, CR016]

7.3 Dependency and financial-model risks

D360's capital and shareholder structure are strategic strengths but also create dependency questions. The Sharikat Mubasher report, citing a Derayah Financial disclosure, says shareholders approved a SAR 1.5 billion increase through 72.9 million new shares at SAR 20.57 per share, valuing the bank at SAR 4.5 billion before the increase and SAR 6 billion on completion. PIF identifies itself and Derayah Financial among the investors, while describing D360's target users as individuals, entrepreneurs, and small-to-medium-sized enterprises. This supports a capital-provider and execution-dependency risk register, not a conclusion that support will continue indefinitely. Fitch's sector data shows rising funding competition, a loans/deposits ratio of 108% at end-3Q25, and expected margin pressure into 2026. D360-specific deposits, loan mix, impairments, liquidity, profitability, customer concentration, and partner concentration are not disclosed in the retained evidence and should be obtained before underwriting.[CR009, CR010, CR011, CR012]

7.4 Monitoring, mitigations, and thesis-break triggers

The practical mitigation is evidence-led monitoring rather than assuming that a license or capital raise eliminates risk. Management should provide current capital and liquidity ratios, asset-quality and loss metrics, deposit and customer concentration, incident history, service-level performance, and open-banking control attestations. The monitoring set should also track SAMA releases and licensing requirements, consent and data-protection incidents, material outages, funding costs, net interest margin, and the timing and terms of additional capital. A thesis break would be a confirmed material regulatory action, a repeated customer-data or payment-control failure, a material outage without effective remediation, deterioration in capital or asset quality, or inability to raise/retain funding on acceptable terms. These triggers are proposed diligence criteria, not observed events in the retained sources.[CR013, CR014]

7.5 Exhibits

8.1 Investment case and anti-thesis

D360's investable case rests on a regulated operating position, a strategic shareholder base, and a funding plan aimed at expanding lending and SME coverage. Saudipedia records the February 15, 2022 licensing decision and approximately SAR1.65 billion initial capital, while the Saudi Press Agency records SAMA permission to begin banking operations in December 2024. PIF describes the bank as Sharia-compliant and focused on individuals, entrepreneurs, and SMEs. The anti-thesis is that public disclosure remains too thin to connect user growth or capital raised to sustainable revenue, credit performance, profitability, or risk-adjusted returns. The reported financing valuation therefore remains a market signal, not a verified intrinsic value.[CV001, CV002, CV003]

8.2 Financing and valuation context

The strongest current valuation datapoint is EnterpriseAM's report that a SAR1.5 billion issuance would imply SAR4.5 billion pre-money and SAR6 billion post-money, approximately US$1.6 billion, alongside reported customer and deposit figures. That account attributes the figures to sources familiar with the matter rather than audited financial statements. A separate June 2026 account reports a 38.9% capital increase from SAR2.1 billion to SAR2.91 billion and approximately SAR1.49 billion of subscription proceeds, with an employee share plan still subject to approvals. These are material financing signals, but the pool does not contain cap-table preference terms, revenue, net income, net interest margin, capital ratios, or a public valuation model. Finro's Q1 2026 dataset offers broad fintech context, not a D360-specific comp valuation.[CV007, CV008, CV009, CV010, CV011]

8.3 Scenario discipline and decision

A scenario framework is more defensible than a point estimate because the public record leaves core bank economics unresolved. The bull case requires the reported capital to convert into profitable lending, durable deposits, and controlled credit losses while the bank reaches its stated expansion objectives. The base case assumes strategic capital supports continued growth but that monetization and risk metrics remain unproven, warranting monitoring rather than underwriting at the reported post-money mark. The bear case is a combination of dilution, slower SME monetization, funding or margin pressure, and adverse credit or regulatory outcomes. The recommendation is track/research-more: a buyer should require audited financials, cohort activity, capital and asset-quality metrics, and financing terms before accepting the reported valuation as investable.[CV012, CV013, CV014, CV015]

8.4 Exit readiness and diligence asks

Exit optionality is described, not established. EnterpriseAM reports a potential public listing in three years, while Arab News reports a goal of four million account holders ahead of a potential listing within four years. These aspirational horizons do not constitute a verified exit plan. D360's regulated status and Saudi digital-payment adoption support a credible market backdrop, but they do not establish listing readiness, governance readiness, liquidity, or a realizable return. The immediate diligence path is to obtain the latest audited accounts, a bridge from accounts to active customers and deposits, credit and capital-adequacy data, the Series A share and preference documents, and board-approved projections. Thesis-break triggers should include materially weaker asset quality, inability to raise required capital on acceptable terms, or failure to demonstrate monetization despite continued user growth.[CV016, CV017, CV018, CV019]

8.5 Exhibits