AI in UAE Financial Services: What Regulators Expect
The main AI-specific documents for UAE financial firms are regulatory guidance rather than binding rules, but they set clear expectations on AI governance, transparency and accountability. Here is what applies to your licence, and what to have in place.
9+ Years of Compliance Expertise
End-to-End Execution
UAE financial regulators have set out their AI expectations through guidance. In November 2021 the Central Bank (CBUAE), the Securities and Commodities Authority (SCA, now the Capital Market Authority), the DFSA and the FSRA jointly issued the Guidelines for Financial Institutions Adopting Enabling Technologies. For AI, they cover governance, accountability of the board and senior management, reliable and explainable models, ongoing monitoring, fair outcomes and transparency to customers. They apply alongside binding regulations, which take precedence. On 11 February 2026 the CBUAE added guidance on consumer protection and the responsible adoption of AI by licensed financial institutions. Binding rules still apply to AI use: data protection law (PDPL, DIFC and ADGM regimes), each regulator's own requirements such as those on outsourcing, and, for virtual asset firms in Dubai, VARA's Technology and Information Rulebook, which includes a binding Algorithm Governance requirement.
Why This Matters
Guidance is not optional in practice. The CBUAE's 2026 note expects a documented AI governance framework proportionate to the firm's size and complexity, an inventory of AI models, and accountability that stays with the institution even when AI is outsourced.
Customer transparency is a core expectation, including clear disclosures in Arabic and English, an explanation of the logic behind AI-assisted decisions, and a way for customers to challenge them.
Adoption is moving fast: a DFSA survey found generative AI use among financial institutions rose 166% between 2024 and 2025.
Which regulator applies depends on your licence and location: the CBUAE and CMA on the mainland, the DFSA in the DIFC, the FSRA in ADGM, and VARA for virtual asset firms in Dubai outside the DIFC.
Firms serving EU clients may also fall under the EU AI Act, which is binding and carries its own penalties.
What's Included
Mapping of which regulators and guidance apply to your licence or licences
Inventory and classification of AI use cases: credit, AML and KYC, advisory, trading, customer service
Documented AI governance framework: ownership, approval, monitoring and escalation, with clear roles across risk, compliance, audit and IT
Policies on human oversight, fairness review and incident handling
Customer-facing disclosures and a process for questions, challenges and redress
Due diligence documentation for AI vendors and outsourced AI services
For virtual asset firms: Algorithm Governance policies, documentation and staff-competency evidence under VARA's Technology and Information Rulebook
Question 1 of 8
Check Your AI Compliance Score
Frequently Asked Questions
The main AI-specific documents for financial firms, such as the CBUAE's guidance and the joint Enabling Technologies Guidelines, are guidance rather than binding regulation. Binding rules still apply to AI use: data protection law, each regulator's requirements on governance and outsourcing, and, for virtual asset firms in Dubai, VARA's Algorithm Governance requirements.
Published on 11 February 2026, it sets out non-binding principles for licensed financial institutions. It expects a documented AI governance framework proportionate to the firm's size and complexity, an inventory of AI models, periodic stress testing for bias, due diligence on third-party AI providers, transparency to customers and human oversight calibrated to risk. Accountability stays with the institution even when AI is outsourced.
Issued on 15 November 2021 by the CBUAE, SCA(CMA), DFSA and FSRA, they set principles for APIs, cloud computing, biometrics, big data and AI, and distributed ledger technology. For AI they address governance, accountability of the board and senior management, reliable and explainable models, monitoring, ethics and customer transparency. They apply to institutions licensed by those authorities, alongside binding regulations, which take precedence.
The CBUAE expects institutions to be transparent about their use of AI, particularly for high-impact decisions, with clear disclosures in Arabic and English, an explanation of the logic behind AI-assisted decisions, and mechanisms for clarification, challenge and redress.
It depends on your licence and location. The CBUAE and the Capital Market Authority supervise mainland firms, the DFSA supervises DIFC firms, the FSRA supervises ADGM firms, and VARA licenses virtual asset firms in Dubai outside the DIFC.
VARA regulates this through the Algorithm Governance section of its mandatory Technology and Information Rulebook. A VASP that conducts VA activities using algorithms, in whole or in part, must have policies and procedures giving its Board and Senior Management robust oversight of their design, testing, performance, deployment and maintenance. It must keep records of the algorithm's logic, the data and assumptions behind its decisions, any potential or actual biases, and its results, and it must have qualified staff to supervise it. Because AI and machine-learning models are algorithms, the requirement applies to them.
It applies if a firm's AI systems are placed on the EU market or affect people in the EU. Assessing the creditworthiness of individuals is classified as high-risk under Annex III, with fraud detection carved out.
Related
Not sure how AI governance expectations apply to your licence?
By submitting this form, I acknowledge that I have read and agree to the Privacy Policy, and I consent to the processing of my personal data.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.