AI in Banking: GCC Regulatory Framework and Compliance
Banks across the GCC are deploying artificial intelligence across credit scoring, fraud detection, customer service and trading operations. Regulators in each jurisdiction are responding with AI-specific guidance that sits alongside existing financial regulations. This article explains what the rules are, how they apply to common banking use cases and what your compliance team needs to do to stay ahead.
AI Applications in Banking
Before examining the regulatory landscape, it is useful to understand where AI is being deployed across GCC banking operations. The most common applications are:
| Use Case | AI Technique | Regulatory Concern |
|---|---|---|
| Credit scoring | Machine learning models on customer data | Fairness, explainability, bias |
| Fraud detection | Anomaly detection, graph neural networks | False positive ratio, data privacy |
| Chatbots and virtual assistants | Large language models, NLP | Customer disclosure, error liability |
| Algorithmic trading | Reinforcement learning, predictive models | Market manipulation, model risk |
| Anti-money laundering | Pattern recognition, transaction monitoring | Regulatory reporting, auditability |
| Personalised products | Recommendation engines, segmentation | Data protection, consent, targeting |
Each use case triggers different regulatory obligations. A credit-scoring model requires explainability and fairness testing; an AML model requires audit trails and suspicious activity reporting; a chatbot requires transparency that the customer is interacting with an AI, not a human.
Regulatory Requirements by Country
GCC regulators have taken different approaches to AI governance. The table below summarises the current state of play.
| Regulator | AI Framework | Status | Key Requirements |
|---|---|---|---|
| Central Bank of UAE | AI Ethics Guidelines for Financial Services | Published 2022 | Fairness, transparency, accountability, human oversight |
| SAMA (Saudi Arabia) | SAMA AI Governance Framework | Published 2023 | Model risk management, bias testing, third-party AI oversight |
| CBB (Bahrain) | Digital Transformation and AI Strategy | Published 2021 | Risk-based classification, explainability, data governance |
| QCB (Qatar) | FinTech Strategy – AI component | Under development | Expected to follow CBB/SAMA model |
| CBK (Kuwait) | No dedicated AI framework | – | General financial regulations apply |
Central Bank of the UAE AI Guidance
The Central Bank of the UAE (CBUAE) published its AI Ethics Guidelines for Financial Services in 2022. The guidelines apply to all licensed financial institutions operating in the UAE. Key provisions include:
- Human oversight: Every AI system must have a designated human responsible for its outcomes. Automated decisions that materially affect customers must be reviewable by a human.
- Transparency: Customers must be informed when they are interacting with an AI system. For credit decisions, the basis of the decision must be explainable.
- Bias and fairness: AI models must be tested for bias across gender, nationality and demographic groups. Results must be reported to the board.
- Data governance: Training data must be accurate, complete and representative. Data lineage must be documented.
- Third-party risk: AI solutions provided by vendors require the same level of due diligence as any other material outsourcing arrangement.
SAMA AI Governance Framework
In 2023, the Saudi Central Bank (SAMA) released its AI Governance Framework for banks and insurance companies. It is the most prescriptive AI regulation in the GCC. The framework introduces a risk-based classification system:
| Risk Tier | Definition | Examples | Requirements |
|---|---|---|---|
| Tier 1 | High impact on customers or financial stability | Credit scoring, AML, trading algorithms | Independent validation, board approval, quarterly bias audit |
| Tier 2 | Moderate impact | Chatbots, marketing personalisation | Annual validation, disclosure to customers |
| Tier 3 | Low or no impact on customers | Internal process automation, HR screening | Documentation only, self-assessment |
SAMA also requires banks to establish a Model Risk Management (MRM) function for AI models. This function must be independent from the business units that develop and deploy the models. The MRM framework must cover model inventory, validation, ongoing monitoring, issue tracking and retirement.
CBB Digital Transformation and AI Strategy
The Central Bank of Bahrain (CBB) published its Digital Transformation and AI Strategy in 2021. It takes a principles-based approach rather than prescriptive rules. The CBB expects licensed institutions to:
- Adopt a risk-based approach to AI deployment
- Ensure AI decisions are explainable to customers and regulators
- Maintain robust data governance frameworks
- Conduct regular AI model validation
- Report AI incidents to the CBB within 24 hours
The CBB is also a strong proponent of regulatory sandboxes for AI-based fintech products. Several AI-powered credit scoring and robo-advisory products have been tested under the CBB’s sandbox framework before full market launch.
Model Risk Management
Model risk management is a cross-cutting requirement across all GCC AI regulations. It refers to the risk of financial loss, regulatory penalty or reputational damage caused by model errors, misuse or incorrect assumptions. The core MRM components are:
- Model inventory: A central register of every AI model in production, including its purpose, version, owner and risk tier
- Validation: Independent testing of model accuracy, stability, robustness and fairness before deployment
- Ongoing monitoring: Real-time tracking of model performance drift, data drift and concept drift
- Governance: A model risk committee with clear escalation paths for model failures
Explainability and Fairness
Explainability is the most technically challenging requirement for GCC banks. The regulators do not prescribe a specific method, but they expect banks to be able to explain, in plain language, why an AI model made a particular decision. Common approaches include:
- SHAP (SHapley Additive Explanations) – assigns each input feature a contribution score
- LIME (Local Interpretable Model-agnostic Explanations) – creates local surrogate models for individual predictions
- Partial dependence plots – visualise how features affect predictions on average
Fairness testing requires banks to measure their models against metrics such as demographic parity, equal opportunity and equalised odds. Most GCC regulators expect results to be disaggregated by nationality, age and gender in line with local anti-discrimination laws.
Frequently Asked Questions
Which GCC country has the strictest AI banking regulations?
Saudi Arabia. SAMA’s AI Governance Framework is the most prescriptive, with a three-tier risk classification system, independent MRM requirements and mandatory quarterly bias audits for high-risk models.
Do AI regulations apply to all banks in the GCC?
Yes. All licensed financial institutions – including retail banks, Islamic banks, investment banks and financing companies – are subject to their national regulator’s AI requirements.
What happens if a bank’s AI model is found to be biased?
The consequences depend on the jurisdiction and severity. In the UAE, the regulator may require the bank to suspend the model, conduct a root cause analysis and submit a remediation plan. In Saudi Arabia, SAMA can impose financial penalties for non-compliance with the AI Governance Framework.
Can we use AI models developed outside the GCC?
Yes, but they must be validated and tested against local regulatory requirements before deployment. Models trained on non-GCC populations may exhibit bias when applied to GCC customers and must be re-trained or fine-tuned appropriately.
Do these regulations cover generative AI?
Explicitly, yes in the UAE and Saudi Arabia. Both regulators have issued additional guidance on generative AI, covering customer disclosure (the customer must know they are talking to an AI), accuracy standards (hallucination rates must be monitored) and data privacy (training data must not include customer PII).
How often must AI models be re-validated?
For Tier 1 (high-risk) models under SAMA’s framework, re-validation is required quarterly. For moderate-risk models, annual re-validation is the baseline. Continuous monitoring is expected for all models regardless of tier.
Build Your AI Compliance Programme
Bitrixme helps GCC banks and fintechs build AI governance programmes that meet local regulatory requirements. We provide gap analysis, model risk frameworks, explainability tooling and regulatory filing support. Contact our team to discuss your AI compliance needs.
