United Arab Emirates - Financial Institutions Guidelines

Overview

The joint "Guidelines for Financial Institutions adopting Enabling Technologies" were published on 15 November 2021 by the Central Bank of the UAE, the Securities and Commodities Authority (SCA), the Dubai Financial Services Authority (DFSA) and the ADGM Financial Services Regulatory Authority (FSRA). The document provides cross-sectoral, principles-based guidance for licensed financial institutions that deploy or plan to deploy enabling technologies such as APIs, Cloud, Biometrics, Big Data/AI and DLT. The Guidelines are non-binding and intended to complement applicable laws and binding rules issued by the Supervisory Authorities, while promoting safe and proportionate adoption of innovation to protect customers and financial stability. They apply to institutions licensed or supervised by any of the Supervisory Authorities and are expected to be applied proportionately according to the size, complexity and materiality of the activities.

Definitions

The Guidelines set out standardised definitions for core terms used throughout the text, including "Application Programming Interface (API)", "API lifecycle", "Artificial Intelligence (AI)", "Big Data Analytics", "Biometrics", "Cloud Computing", "Distributed Ledger Technology (DLT)", "Institution", "Customer", "Credential Service Provider", "Identity Lifecycle" and "Materiality". Materiality is central: Institutions must assess the criticality of a given enabling technology arrangement to determine the required level of controls, monitoring and, where appropriate, supervisory engagement. The document emphasises record-keeping, version control and auditability for material applications, and clarifies that the Guidelines sit alongside but do not override binding regulations issued by each Authority.

Governance and Institutional Framework

The Guidelines emphasise clear board-level and senior management accountability for enabling technologies. Institutions must establish an approved and documented governance framework covering roles, responsibilities, escalation, and decision-making. The Governing Body and Senior Management are expected to ensure appropriate expertise is available — including technical specialists (e.g., AI engineers, cloud architects) and domain experts (e.g., credit risk modellers) — and that staff are trained. The framework should include policies on model development and validation, procurement, vendor due diligence, outsourcing, data governance, information security, and business continuity. Institutions are required to maintain enterprise-wide registries of material applications, maintain design and version documentation, and ensure internal audit and compliance functions can effectively review enabling-technology use. For material Cloud Computing and outsourcing arrangements, institutions should engage the relevant Supervisory Authority early in the design process and comply with any approval/outsourcing rules applicable to their supervisor (see ADGM announcement).

Key Focus Areas

The Guidelines organise guidance into cross-cutting expectations and technology-specific sections. Key focus areas include: risk management (materiality assessments, KRI metrics, scenario analysis); safety, testing and validation (pre-launch validation, back-testing, calibration and periodic revalidation); transparency and documentation (audit trails, model cards, decision-justifications and customer disclosures where consumer impact is material); data protection and privacy (encryption, secure channels, anonymisation where appropriate and compliance with applicable personal data laws); cybersecurity and model security (secure design, access controls, monitoring and incident response); outsourcing and third-party risk (contractual clauses, access for supervisors, sub-contracting disclosure and exit/transition planning); and operational resilience (business continuity, recovery objectives and testing). For Big Data/AI, the Guidelines require auditable models, archival of datasets, versioning and a minimum recommended retention period for core model artifacts; for Biometrics they set out identity-proofing, lifecycle and false-acceptance/rejection monitoring requirements; for APIs they set lifecycle, security and performance management guidance; and for DLT they require comprehensive on-chain/off-chain mapping and recordkeeping to support audit and accounting requirements.

Implementation Framework

Institutions are expected to implement the Guidelines proportionately. Implementation steps include: (1) conducting an inventory and materiality review of enabling-technology applications; (2) establishing or updating governance, policy and procedures; (3) performing risk assessments (including KRI and performance indicators); (4) instituting testing and independent validation regimes for models and applications prior to deployment; (5) embedding continuous monitoring, logging and incident detection; (6) ensuring vendor due diligence and robust contractual protections (including supervisory access and exit clauses); and (7) maintaining documentation and records (design docs, version history, datasets, audit logs). Material Cloud Computing plans should be discussed with the relevant Supervisory Authority prior to implementation and may require formal approval under existing outsourcing rules. The Guidelines provide checklists and concrete examples to support institution-level implementation and supervisory engagement (see the full Guidelines PDF).

Monitoring and Evaluation

On-going monitoring and performance evaluation are central. Institutions must define key performance and risk indicators, implement audit logging and traceability, track model outcomes and drift, report security events, and periodically recalibrate models. Monitoring should detect degradation in accuracy, fairness or security and trigger remediation, retraining or retirement. Internal audit and independent validation functions are expected to periodically review governance, technical controls and vendor arrangements. Regulators retain the right to review and audit material arrangements; institutions should preserve evidence and records to support supervisory reviews and external audits. The Guidelines recommend retention of model artifacts, datasets and version history for a minimum of five years (or as required by the relevant Supervisory Authority).

Penalties, Liability, and Appeals

The Guidelines themselves are non-binding guidance; they do not create new sanctions. However, they explicitly sit alongside binding laws and regulations of the respective Supervisory Authorities. Non-compliance with binding regulatory requirements referenced in the Guidelines (e.g., outsourcing rules, data protection laws, prudential requirements) can lead to supervisory action under the applicable legal frameworks — including remediation directives, administrative fines, license sanctions, restrictions on activities, and other enforcement measures. Institutions are also reminded to document liability allocation in outsourcing contracts and maintain redress mechanisms for customers. Where institutions disagree with supervisory findings or decisions, existing appeals and dispute resolution routes under each Authority’s legal framework apply.

Relationship to Other Instruments

The Guidelines reference statutory bases and existing regulatory instruments: the CBUAE’s enabling powers under Decretal Federal Law No. (14) of 2018, the SCA under Federal Law No. (4) of 2000, the DFSA under DIFC Law No. (1) of 2004, and the FSRA under ADGM Law No. (4) of 2013. They are intended to complement — not replace — existing supervisory rules on outsourcing, AML/KYC, data protection and prudential supervision. The document encourages institutions to apply other relevant regulator-specific guidance (for example, DFSA rules on outsourcing and cloud, and ADGM/FSRA guidance on innovation/virtual assets) when implementing enabling technologies.

International Alignment

The Supervisory Authorities state that the Guidelines were developed with reference to international standards and industry best practice. They reflect global themes found in model-risk guidance (e.g., from the Basel Committee and other international bodies), international data protection principles and recognized cybersecurity practices. The cross-jurisdictional coordination also aligns UAE supervisory expectations across onshore and financial free-zone regulators to reduce fragmentation for firms operating across jurisdictions within the UAE.

Implementation Timeline

Sources and References