How Tabby Built the Middle East’s Largest BNPL System

Why BNPL Had a Bigger Addressable Market in the Gulf Than Anywhere Else

Most Western BNPL players — Klarna, Affirm, Afterpay — launched into markets where credit cards were already ubiquitous. In that context, BNPL was a convenience layer. A slightly better checkout experience. The economics were tight because they were competing against an existing, deeply entrenched credit infrastructure.

The Gulf was structurally different. Credit card penetration in Saudi Arabia sits around 15%, and across the broader GCC region, it's roughly 10%. In the UAE, the figure is higher — approximately 40% — but that still leaves millions of consumers with high disposable income and almost no access to flexible credit. This wasn't a convenience play. This was infrastructure.

Tabby was founded in 2019 by serial entrepreneur Hosam Arab and technologist Daniil Barkalov. Arab had previously been the CEO of Namshi, one of the region's most successful online fashion retailers, giving him deep insight into Middle Eastern consumer behavior. Barkalov had scaled technology at Careem, the region's ride-hailing leader. Together, they saw an opportunity that wasn't just about payments — it was about building the credit layer the Gulf never had.

The numbers tell a story of compounding network effects: users jumped from 0.4 million in 2020 to 15 million by 2025, partner merchants expanded from 2,000 to over 40,000, and annual transaction volume surged from $300 million to over $10 billion. That's 37x user growth and 33x volume growth in five years. Very few fintech platforms anywhere in the world have matched that trajectory.

The Business Model: How Tabby Actually Makes Money

This is the question that tripped up Western BNPL players. Klarna burned through billions chasing growth. Affirm struggled with credit losses. The BNPL model looked structurally unprofitable.

Tabby makes most of its money from businesses, not from shoppers. It gives people an easy way to pay later — and in return, shops pay Tabby for bringing them more sales. The merchant discount rate (MDR) — typically 4–8% per transaction — is Tabby's primary revenue driver. In markets where credit card interchange fees are already high and alternative credit is scarce, merchants willingly pay this premium because BNPL measurably lifts average order value and conversion.

In Saudi Arabia, Tabby removed all late fees in 2023 to stay Shariah-compliant. This is a critical strategic decision. Rather than relying on penalty revenue (which Western BNPL players often depend on), Tabby's model is almost entirely merchant-funded. This aligns the company with the ethical finance expectations of its core market and removes a regulatory risk vector.

The most recent financial data confirms this model works: Tabby's Saudi subsidiary reported net profit of $55 million on revenue of $378 million for the year ended 31 December 2025, according to accounts audited by Ernst & Young.

The Valuation Staircase: From Seed to $4.5 Billion

The funding trajectory is remarkable for its capital efficiency. Tabby has raised over $1.8 billion in total funding, including equity and debt financing. Key milestones include the Series D in October 2023 that made it MENA's first fintech unicorn, the Series E in February 2025 led by Blue Pool Capital and Hassana Investment Company that doubled its valuation to $3.3 billion, and a secondary share sale in October 2025 that pushed the implied valuation to over $4.5 billion.

The investor roster reads like a who's-who of global and regional capital: Wellington Management, Mubadala, STV, Sequoia Capital India, PayPal Ventures, Blue Pool Capital, Hassana, HSG, and Boyu Capital. HSBC, JP Morgan, and Morgan Stanley are advising the company on a potential Tadawul listing.

The Product Ecosystem: From Single Feature to Financial Super-App

What started as a simple "Pay in 4" checkout widget has evolved into a comprehensive financial services platform. This is the strategic evolution that separates Tabby from every other BNPL player in the region.

The product portfolio can be understood through three strategic layers:

Layer 1 — Core BNPL. The foundational "Pay in 4" product that splits any purchase into four interest-free installments, auto-debited every 14 days. This is the wedge product — high frequency, low friction, zero cost to the consumer. Tabby's services follow Shariah rules, which means no hidden fees or unfair charges.

Layer 2 — Engagement products. Tabby Card turns any Visa-accepting merchant into a Tabby merchant, allowing installment-based spending beyond the online checkout. Tabby Plus introduces a subscription model with higher spending limits and exclusive rewards. Tabby Shop acts as a deal-discovery platform, creating a shopping destination that generates demand rather than just processing it. Tabby Care provides buyer protection, building trust in a market where e-commerce fraud anxiety remains high.

Layer 3 — Financial infrastructure (the Tweeq play). The acquisition of Tweeq, a Saudi digital wallet licensed as an e-money institution by SAMA, enables Tabby to expand its product suite with digital spending accounts, cards, and money management tools. This is the move that transforms Tabby from a BNPL provider into a neo-bank competitor. As Arab described it: the acquisition helps Tabby make its next step toward offering more than just BNPL, getting into the financial needs of everyday consumers.

The Tech Stack: What's Running Under the Hood

Tabby's engineering challenge is non-trivial. They need to perform real-time credit decisions on millions of users across multiple jurisdictions, process billions in transaction volume, integrate with 40,000+ merchant backends, and do it all while maintaining Shariah compliance, data sovereignty, and regulatory alignment with SAMA and CBUAE.

While Tabby hasn't published a detailed systems architecture document, we can reconstruct the technical stack from their public API documentation, developer SDKs, integration guides, job postings, and infrastructure announcements.

Client layer — meeting merchants where they are

Tabby GitHub's GitHub organization (tabby-ai) maintains 12 public repositories, including native SDKs for iOS, Android, Flutter, and React Native, along with dedicated Magento 2 plugins for checkout and payments. The developer ecosystem also supports integration through payment orchestration platforms including Checkout.com, Amazon Payment Services (PayFort), Tap Payments, Network International's N-Genius gateway, and Broadleaf Commerce.

Tabby's API uses region-specific domains, with all API paths and payloads identical across both domains. The environment (test or live) is identified based on the API keys used. Tabby This means merchants integrate once and deploy across Saudi Arabia, UAE, and Kuwait without code changes — only key rotation.

API gateway — the integration backbone

The API structure uses versioned endpoints with the base URL at api.tabby.ai, following a clear versioning strategy. The checkout session endpoint uses v2, while payment operations (capture, refund, close) use v1, suggesting an incremental migration that maintained backward compatibility.

The API authentication is bearer-token based with a dual-key model. Merchants use a public key (pk_test / pk_live) for creating checkout sessions and a secret key (sk_test / sk_live) for retrieving payment status and performing sensitive operations. This separation mirrors Stripe's key architecture and ensures that the public key — which is exposed in frontend code — can't be used to access payment data.

A critical architectural detail: the Payment Contexts API supports idempotency, allowing merchants to safely retry API requests without the risk of duplicate requests. This is essential for a payment platform handling billions in volume — network failures, timeouts, and retries are inevitable at scale, and without idempotency, a retry could create a duplicate charge.

The core payment lifecycle

The payment flow through Tabby's system follows a well-defined sequence, as shown in the first diagram above. Here's a deeper look at each stage:

Step 1 — Payment context creation. The merchant backend sends a POST to /v2/checkout containing the order details, customer information (phone, email, name), shipping address, cart items with categories, and the buyer's order history. Tabby performs a credit assessment on each customer as they go through the sign up and checkout process.

Step 2 — Real-time credit decision. This is where Tabby's AI risk engine evaluates the customer. The system considers the customer's phone number (linked to national identity in KSA/UAE), previous transaction history with Tabby, the order value and category, the merchant's risk profile, and the buyer's historical payment behavior. A successful eligibility check returns a 201 Created response with available_payment_types.

Step 3 — Hosted payment page. The customer is redirected to Tabby's hosted payment page, where they verify via OTP and provide card details for the first installment. This keeps the merchant PCI-DSS compliant — they never touch raw card data.

Step 4 — Webhook confirmation. When integrating Tabby, merchants can subscribe to webhooks for events including payment_captured, enabling real-time order fulfillment. The webhook includes a signature header for payload verification, preventing spoofed callbacks.

Step 5 — Installment auto-debit. The remaining three installments are automatically charged to the customer's card at 14-day intervals. Tabby handles all collection logic, failed payment retries, and — in markets where permitted — late fee assessment.

The AI risk engine — NVIDIA-powered sovereign AI

This is the most strategically significant infrastructure investment Tabby has made. Tabby announced it is deploying NVIDIA HGX systems to develop and test its AI capabilities to better serve customers and merchants.

As Barkalov described it: "AI is now central to how we create exceptional experiences for our customers and a safer payment ecosystem. With NVIDIA's HGX systems, we're investing in faster, more secure capabilities and setting the foundation for sovereign AI in financial services."

The "sovereign AI" framing is deliberate and strategically important. NVIDIA noted that financial services companies need to maintain data sovereignty and regulatory compliance when deploying AI in complex regional markets, and that the HGX systems provide Tabby with secure, high-performance infrastructure for processing data locally. This means Tabby's credit-scoring models, transaction data, and customer behavioral data never leave the GCC — a critical requirement for SAMA and CBUAE regulatory compliance.

Regulatory Architecture: The SAMA Sandbox to Licensing Pipeline

Tabby's regulatory journey is a case study in how to navigate fintech licensing in the GCC. Tabby graduated from the SAMA regulatory sandbox and received its BNPL permit in July 2023. The decision to relocate headquarters from Dubai to Riyadh wasn't cosmetic — it was a prerequisite for the Saudi Exchange listing and signaled commitment to SAMA's regulatory framework.

The Tweeq acquisition in September 2024 added a second regulatory license to Tabby's portfolio: Tweeq was licensed as an e-money institution by SAMA in 2022. This gives Tabby the legal authority to offer spending accounts and digital wallet services — capabilities that a BNPL-only license doesn't cover.

Arab highlighted that the Tweeq acquisition would have a positive effect on risk management, as it further informs Tabby's existing credit underwriting capabilities. Having visibility into a customer's spending account activity fundamentally improves credit-scoring accuracy — you're no longer guessing about a customer's financial health from external signals.

One data point worth flagging for due diligence: EY's auditor's report notes that Tabby's net debt of $689 million has breached the ceiling set by SAMA by $139 million. This regulatory overhang will need resolution before or during the IPO process.

Competitive Positioning: Tabby vs. The Field

The BNPL landscape in the Middle East is likely to be dominated by a small set of regional platforms — Tabby, Tamara, valU, and a few others — that combine BNPL with card and wallet features and consumer finance. The market is consolidating rapidly around licensed, multi-product players.

Tabby's moat is built on four pillars. First, network density — 40,000+ merchants and 15M+ users create a two-sided marketplace that is extraordinarily difficult to replicate. Second, regulatory licensing — the combination of a SAMA BNPL permit and Tweeq's EMI license provides a broader operating authority than any competitor. Third, data advantage — with over $10 billion in annual transaction volume, Tabby's AI risk engine has more behavioral training data than any other BNPL platform in the region. Fourth, brand trust — in a market where Islamic finance principles shape consumer expectations, Tabby's Shariah-compliant, zero-late-fee positioning in Saudi Arabia creates genuine brand differentiation.

Tamara's SAMA license allows it to move beyond small BNPL tickets into broader consumer finance, positioning it as a multi-product lender. This makes Tamara a credible competitor, but Tabby's product breadth, transaction volume, and imminent IPO give it a significant first-mover advantage in the super-app race.

The IPO Thesis: What the Tadawul Listing Means

Tabby's Saudi subsidiary has published its first independently audited annual financial statements, and the company is widely understood to be preparing for a Tadawul listing, with HSBC, JPMorgan and Morgan Stanley advising on a potential flotation.

The IPO timing is strategic. Saudi Arabia eliminated the Qualified Foreign Investor designation effective February 2026, opening the main market to all non-resident foreign investors.This reform broadens Tabby's potential investor base significantly and could drive higher demand for the listing.

If Tabby lists at or near its $4.5 billion implied valuation, it would represent roughly 12x revenue (on the Saudi entity's $378 million alone) and approximately 82x net profit. Those multiples are aggressive by traditional financial services standards but moderate compared to Klarna's IPO pricing. The question for public market investors will be whether Tabby's growth trajectory and expanding product suite justify a technology-company multiple on what is fundamentally a consumer credit business.

Strategic Risks and Open Questions

Credit risk at scale. Tabby's profitability depends on maintaining low default rates as it scales into higher-ticket categories and longer-term payment plans. The SAMA debt-ceiling breach flagged by EY's auditors suggests the company is pushing the envelope on leverage.

Regulatory concentration. Tabby's business is concentrated in two jurisdictions — Saudi Arabia and the UAE — both of which are actively tightening BNPL regulation. BNPL is being treated less as a lightweight checkout feature and more as regulated consumer credit in markets such as Saudi Arabia. Further regulatory tightening could compress margins or restrict growth.

Super-app execution risk. The transition from BNPL pure-play to financial super-app is a different game. Integrating Tweeq, launching spending accounts, and competing with established banks requires capabilities that are adjacent to — but distinct from — what made Tabby successful.

IPO timing sensitivity. The TASI fell by 12.8% in 2025, making it one of the worst-performing emerging-market indices. A weak public market backdrop could force Tabby to delay or reprice its listing.

Conclusion: The Playbook for Building a Category Leader in Emerging Markets

Tabby's trajectory offers a replicable framework for any fintech founder targeting emerging markets. The playbook has five elements: identify a structural gap (not a convenience gap) in financial infrastructure, build a product that aligns with local cultural and religious values, achieve regulatory licensing early and deeply, expand from a wedge product into adjacent financial services, and time your capital-raising to coincide with market momentum.

As Hosam Arab noted: "Customers used to rely on us only for e-commerce or point-of-sale spending. Now, especially in the UAE, they see Tabby as a tool to manage all their spending." That evolution — from payment method to financial operating system — is the real story. The BNPL label is already too small for what Tabby is becoming.

With 4,186 employees as of early 2026, a $4.5 billion valuation, audited profitability, and a Tadawul listing on the horizon, Tabby isn't just the Middle East's largest BNPL system. It's becoming the region's first home-grown consumer finance platform of global consequence.