AI governance for UAE banks, payment firms and fintechs

A licensed financial firm is the one kind of UAE business that already owns a governance apparatus: a risk function, a compliance function, a board that receives papers and a supervisor that asks questions. The task with artificial intelligence is therefore rarely to invent something new. It is to work out which obligations already in force are engaged when a model does part of the work, and to close the evidence gaps that this creates.

What is different about a licensed firm

Three things change once the entity is licensed. A supervisor can ask you to explain anything you do, at a time of its choosing, and expects documents rather than descriptions. The obligations you already carry around governance, senior management responsibility, outsourcing, operational and technology risk, record-keeping, complaints and fair treatment do not pause because a process involves a model. And a control failure is supervisory as well as commercial.

Which authority that is depends on where the entity is licensed and for what. A mainland bank, an exchange house, a payment firm and a firm in one of the financial free zones do not all answer to the same body. Throughout this article the relevant body is simply the supervisor of the licensed entity, because the useful discipline is the same in every case: take the rulebook you already follow and walk it across each AI-assisted process. Free-zone entities have a further layer, described in the DIFC and ADGM piece.

Credit, onboarding and decisions about people

Any use of a model that affects whether a person gets an account, a limit, a price or a loan is the highest-scrutiny category in the firm. The bar is not technical, and a firm can meet it without a research team.

• Know whether the model decides or informs. An automated rejection and a score presented to an underwriter are different arrangements with different expectations attached. Write down which one each process is, because most firms have never said it out loud.
• Be able to state the reason. If the customer asks why, someone must be able to answer in ordinary language. A firm that cannot do this has a problem in front of the customer, any dispute-resolution route open to them, and the supervisor at the same time.
• Test for disparate outcomes. Models learn from history, and history contains patterns that are not lawful bases for a decision. Testing across the groups that matter, and recording that you tested, is cheaper than defending an outcome you never examined.
• Keep a human route. A named person who can review and overturn, with the authority to do it and a record of when they did.
• Retain the inputs. Reconstructing a decision requires the data and the model version as they were on the day, not as they are now.

Fraud and transaction monitoring

Monitoring is where machine learning has been in production longest, often for years before anyone in the firm used the phrase artificial intelligence. Two points repay attention.

The first is calibration. A model that produces too many alerts is not a safe model, because the team stops reading them, and an unread alert is indistinguishable from no alert. Track the false-positive burden and the time to clear a queue as risk measures rather than operations metrics.

The second is that a blocked transaction or a frozen account is a customer outcome. Firms habitually treat a monitoring model as a back-office control, when it can leave a person without access to their money. Oversight, escalation and the speed of human review belong on the monitoring side too.

Customer-facing assistants

A chatbot on a regulated firm's website is a communication to a customer. Everything the firm knows about clear, fair and not misleading communications applies to it, with the complication that nobody approved the individual sentences.

• Decide what the assistant may discuss, and keep it away from anything amounting to advice or a recommendation unless the firm is permitted to give it.
• Disclose that it is automated, and keep the route to a human short.
• Retain transcripts as you would other customer communications, and make them reachable when a complaint arrives.
• Sample the transcripts. Reading fifty conversations a month tells the firm more than any vendor benchmark.
• Make sure a complaint made to the assistant enters the complaints process rather than dying in the chat window.

Model risk and explaining an outcome

Model risk management is a mature discipline and most mid-market firms do not need the full apparatus, only the spine of it: an inventory of models with an owner for each, proportionate validation before a model goes live, monitoring of performance against expectation once it is, a change process for new versions, and periodic review.

Explainability in practice means something narrower than the research literature suggests. It means the firm can say what the model is for, what data it was built on, what its known limitations are, what the main drivers of a given outcome were, and who checked. Models supplied by a vendor make this harder, which is a reason to demand documentation in the contract rather than to accept less. If the vendor cannot describe the model to you, you cannot describe it to your supervisor.

Generative tools sit awkwardly in this frame, because the firm rarely owns the model and the outputs vary between identical requests. Treat them as a third-party service with an output-review control rather than pretending they validate like a scorecard.

Outsourcing, cloud and the model behind the product

Most AI in a licensed firm arrives as somebody else's service, which puts it inside the outsourcing arrangements the firm already governs. The questions are familiar and the answers are frequently missing.

• Is this arrangement material, and has it been assessed and recorded as such.
• Where is data processed and stored, including for logs, backups and support access.
• Who sits behind the vendor, including the model provider, and how are you told when that changes.
• What are the audit and information rights, and do they reach the sub-processors.
• What is the exit plan, and could the firm serve customers without the service for a period.
• Does the contract permit your content to train a model, and has that been switched off.

The generic version of this exercise is the vendor question set, which a regulated firm should run in addition to its outsourcing assessment rather than instead of it.

A sequence for a licensed firm

• Weeks one and two. Build the inventory, including embedded features in existing systems and tools staff adopted themselves. Tag each entry as customer-affecting or internal, and name an owner.
• Week three. Map each customer-affecting entry to the rulebook obligations already engaged: outsourcing, technology and operational risk, records, complaints, fair treatment, and the conduct standards for communications. Note where evidence exists and where it does not.
• Week four. Close the two or three gaps most awkward to explain, usually a missing decision-reason capability, unreviewed assistant transcripts, or an unassessed third-party arrangement.
• Then quarterly. Put a standing item in front of the board or the risk committee, using the board question set as the agenda, and refresh the inventory at the same cadence.

None of this requires a new framework, committee or hire. It requires the firm to treat its existing obligations as engaged and to produce the documents that show it did.