The Central Bank of the UAE expects licensed institutions that run AI agents to keep its existing standards intact: board-level governance and risk management, controlled outsourcing, fair treatment of consumers, AML/CFT compliance, information security and continuity. AI gets no exemption or separate rulebook. The institution must show each control works when an agent, not a person, does the work.
What does the Central Bank of the UAE expect, in plain words?
The Central Bank of the UAE licenses and supervises banks, finance companies, exchange houses, payment service providers and insurers operating onshore. Its approach to AI runs through its general regulations and standards, supplemented by guidance that UAE financial regulators have issued jointly on adopting enabling technologies, including AI, which stresses governance, accountability, fairness and explainability.
In substance, the expectations that bite on agents are:
- Governance and risk management. The board and senior management own the risks of new technology and approve how it is used.
- Outsourcing. Material reliance on third parties, including technology providers, needs due diligence, contracts, oversight and, where required, notification or approval.
- Consumer protection. Customers must be treated fairly, given clear information in a language they understand, and have complaints resolved properly.
- AML/CFT. Institutions must identify customers, monitor transactions and report suspicious activity, consistent with the FATF Recommendations.
- Information security and continuity. Systems and customer data must be protected and services kept running through disruption.
The full set of UAE rules, including the free zone regimes, is in which UAE rules apply to AI agents in financial services.
Who does it apply to?
Institutions licensed by the Central Bank of the UAE, operating in the onshore market. Firms in the Dubai International Financial Centre are supervised by the DFSA and those in Abu Dhabi Global Market by the FSRA, each with its own rulebook, although groups often have entities in more than one regime.
Data protection sits alongside. Onshore, the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) is the starting point, with sector-specific rules for financial data; see UAE Personal Data Protection Law and AI agents.
What changes when an agent acts in a UAE bank?
Three features of the market shape agent design.
Language. Customers deal with banks in Arabic, English and other languages. An agent that explains fees or terms must give the same, accurate meaning in each. A translation error in a product explanation is a consumer protection problem, not a cosmetic one, so wording in each language should come from approved sources.
Islamic finance. Many institutions offer Islamic products under Sharia governance. An agent explaining a profit rate or restructuring a financing arrangement must stay within approved product terms and wording, and anything that changes the structure of a contract should be held for a person.
Cross-border flows. Remittance and trade activity means agents handling payments meet high AML exposure. An agent can assemble alerts, check names and draft case notes. Decisions to clear, block or report should stay with compliance staff, and payment instructions from external sources, such as emailed invoices, should never be enough to release funds.
Multi-agent designs raise an architecture question with a supervisory edge. If agents call each other directly, each hand-off is harder to see and control. Routing them through a central layer that checks and records each step, as discussed in whether agents should talk directly or through a central layer, makes governance demonstrable.
How does an institution meet these expectations for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Board and senior management oversight | Board-approved policy on agent use and limits on agent authority | Board minutes and approved policy |
| Risk management | Every action checked against role scope, certificate, sources, institution limits and platform guardrails | Filed verdict per action, naming the deciding bound |
| Outsourcing control | Agent platform and model providers assessed, contracted and notified where required | Due diligence, contracts and notifications |
| Fair treatment and clear information | Approved wording per language; customers told they are dealing with an AI agent | Approved content library and disclosure records |
| Complaints | Agent drafts responses; resolution decisions and redress stay with staff | Complaint records showing approver |
| AML/CFT | Agent prepares alerts and checks; staff decide on blocking and reporting | Alert records and filing decisions |
| Information security | Least-privilege agent identities; protected credentials; injection testing | Access reviews and security tests |
| Continuity | Fallback to staff if the agent or its provider fails | Continuity test results |
What will the Central Bank's supervisors ask?
- Which services use agents, and what may each agent do without a person?
- Where are the model providers located, and does customer data leave the UAE?
- How do you make sure the agent's Arabic and English explanations match?
- Who approved the outsourcing of this service, and what does the contract say about audit and data?
- How do you stop an agent releasing a payment based on an emailed instruction?
- What reports on agents reach the board?
What does the Central Bank framework not cover?
It does not govern institutions in the DIFC or ADGM, which answer to the DFSA and FSRA. It does not replace data protection law, which has its own regulators and rules. It does not prescribe technical testing for agents. And it does not regulate the agent vendor directly; the licensed institution remains accountable. For the cross-border picture, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does the Central Bank of the UAE have a specific AI regulation?
Its expectations on AI come mainly through general regulations on governance, outsourcing, consumer protection and AML, plus joint regulatory guidance on enabling technologies. Check for any newer issuances before finalising your approach.
Can a UAE bank use a model hosted abroad?
Possibly, but data location and outsourcing rules may restrict which data can leave the country and require approval. Assess this before choosing a model provider.
Should agents give advice on Islamic products?
They can explain approved product information. Anything that changes contract structure or requires a Sharia judgement should go to a person.