Which UAE rules apply to AI agents in financial services?

It depends on where the firm is licensed. Onshore, the Central Bank of the UAE supervises banks and finance companies, and the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) governs personal data. In the DIFC, the DFSA regulates and the DIFC Data Protection Law applies. In ADGM, the FSRA regulates under ADGM's own framework.

Which regime applies to your agent?

A group with entities in more than one zone will run agents under more than one regime. The agent's design can be shared; the analysis cannot.

The federal data law carves out some categories that have their own legislation, which can include banking and credit data. Onshore banks should confirm which data rules govern each kind of data their agents touch.

What do the rules require, in substance?

Financial regulators across all three zones expect boards and senior management to govern technology risk, firms to remain accountable for outsourced services, customers to be treated fairly, and records to be available to the supervisor. An agent platform and model provider are outsourced services; the licensed firm answers for what the agent does.

Data protection law in each zone requires, in substance, a lawful basis for processing, purpose limitation and minimisation, accuracy and security, respect for people's rights, conditions on transfers outside the jurisdiction, and breach notification. The DIFC and ADGM regimes are modelled closely on international data protection standards and are separately enforced.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where does the line fall, and why?

The reasoning is the same everywhere: the licensed firm is accountable, and actions that are hard to undo need a person. Two UAE-specific points shape it. Cross-border data flows depend on the zone, so an agent whose model runs abroad may be lawful in one entity and not in another. And many UAE firms serve customers across the region and beyond, so the agent may also be subject to the rules of the customer's home market.

• Agent may: answer customer questions in Arabic and English, gather documents for onboarding, screen customers, monitor transactions, reconcile payments.
• Agent may, within limits: process authenticated service requests, reverse small charges, execute confirmed payments to verified beneficiaries below limits.
• Stays with a person: payments to new beneficiaries or above limits, credit refusals, account restrictions, suspected fraud decisions, suspicious transaction reports, and any transfer of data outside approved arrangements.

An illustrative example

Take a wealth manager with a DIFC entity and an onshore affiliate. It deploys one agent to prepare client review packs: portfolio summaries, performance and suitability prompts for relationship managers.

For DIFC clients, the agent's processing falls under the DIFC Data Protection Law and the DFSA's conduct rules; for onshore clients, the federal law and Central Bank expectations apply to the affiliate's activity. The firm finds that its model provider's data centre is outside the UAE and checks transfer conditions under both data regimes separately. Suitability judgements stay with licensed relationship managers in both entities. The agent's packs show which sources each figure came from, so managers can check them before meeting clients.

Which controls meet the rules?

• A regime map: for each agent, the entities, zones and laws that apply.
• Transfer assessments per zone for model providers and platforms.
• Outsourcing records for each regulator.
• Holds on payments, credit refusals and account restrictions.
• Suitability and advice kept with licensed staff.
• Decision records available to each supervisor.

Firms with EU operations face additional resilience rules; see whether DORA applies to AI agents in financial services. For other markets, compare which Nigerian rules apply to AI agents in financial services, ASIC and AI agents in financial services for Australia, and NYDFS and AI agents in New York financial services. The full map is in AI agent regulation, mapped to controls.