Five Years of UAE Financial Technology Guidelines
Five years ago today, on November 15, 2021, the UAE’s joint financial regulators’ guidelines for adopting enabling technologies took effect. Their central message still matters: a financial institution remains responsible for its technology risks, even when an outside supplier builds or operates the system.
What's changing
This anniversary marks five years since the guidelines took effect, not a new commencement date or a fresh compliance deadline. The Guidelines for Financial Institutions Adopting Enabling Technologies were published jointly on November 15, 2021, after a public consultation that opened on June 1 and closed on June 30 that year. They have remained in force throughout the period.
The framework sets supervisory expectations for using application programming interfaces, big data, artificial intelligence, biometrics, cloud infrastructure and distributed ledger technology. Its focus is not simply whether a tool works. Institutions also need to understand how it affects operations, customers, security and their ability to meet existing regulatory duties.
The core expectations cover the technology lifecycle. Firms need a comprehensive inventory of material applications and risk assessments that examine each system’s operational impact. Boards and senior management need direct oversight, supported by people with suitable technical and risk expertise.
Before launch, systems need rigorous testing. After deployment, they need ongoing monitoring. The guidelines also call for retaining model artifacts, code versions and datasets for at least five years. That makes evidence preservation a continuing responsibility: teams need to be able to explain what they deployed and retain the material needed to examine its operation.
Cybersecurity, privacy and supplier management are equally important. A successful launch does not settle those questions permanently; changes in systems, data or suppliers can alter the risk picture.
The distinction between supervisory guidance and underlying legal duties matters. These guidelines do not create direct penalties of their own. Mandatory obligations covering areas such as outsourcing, data protection and operational resilience remain live. If a technology failure breaches those obligations, regulators can require remediation, issue administrative fines or impose licensing sanctions.
Who is affected
The framework covers financial firms licensed in onshore UAE, the Dubai International Financial Centre or the Abu Dhabi Global Market that deploy the listed enabling technologies. It is a joint UAE financial-sector framework, not an instrument attributed to a single emirate or a general rule for every technology business.
Scope turns on licensing and technology use, rather than whether a firm describes itself as a fintech. An established financial institution adopting a cloud service or biometric authentication system faces the same basic governance questions as a business built around digital delivery.
Institutions can scale controls to a project’s complexity and impact. That flexibility does not remove the core expectations. A smaller firm still needs accountable oversight and an understanding of material risks; a more consequential deployment calls for correspondingly stronger controls.
Responsibility also crosses internal boundaries. Product teams, engineers, risk specialists, compliance staff, procurement teams and senior leadership all have roles. Treating the framework solely as an IT checklist misses its emphasis on institution-wide accountability.
Three things to do this week
1. Reconcile the technology inventory with actual operations. Compare the inventory of material applications with deployed systems, supplier arrangements and projects moving toward production. Look specifically for AI tools, APIs, biometric services, cloud infrastructure, big-data applications and distributed ledgers. For each material application, check that its risk assessment reflects its current use and operational impact, and that oversight responsibilities are clear.
2. Test whether the evidence trail is usable. Select a material system and check its pre-launch testing, monitoring records, model artifacts, code versions and datasets. Confirm that the required material is retained for at least five years and can actually be retrieved. The fifth anniversary does not mean every record can now be deleted: retention needs to be assessed against the relevant material and applicable requirements, not the framework’s birthday.
3. Walk through a supplier failure. Choose a significant third-party technology arrangement and review its transition and exit plan. Check whether the institution has secured rights for regulators to audit vendor systems and whether the proposed exit is workable. For material cloud arrangements, confirm that supervisory engagement formed part of the design process. Outsourcing delivery does not outsource regulatory accountability.
Related context
The UAE’s AI Adoption Guideline in Government Services and AI Ethics Principles and Guidelines provide related context for AI adoption and ethics. They are separate instruments, not substitutes for this financial-sector framework.
Qatar’s Central Bank AI Guidelines offer a regional comparison, but concern a different jurisdiction. For UAE financial institutions, the practical task remains maintaining the oversight, evidence and supplier controls expected under the framework that took effect in 2021.
Note: this article was drafted by AI - OpenAI GPT-6.1