The Algorithm Can Score the Risk. Only a Banker Can Own It

Gulf banks are no longer asking whether to use artificial intelligence. They are asking how much of their judgment they can safely hand to it. The answer will decide which institutions come out of this decade stronger, and which ones find out too late that efficiency and trust are not the same thing.

[For more news, click here]

AI Adoption and Risk Management

AI is already widespread in GCC banking. McKinsey’s latest regional survey found that 84% of GCC organisations now use AI in at least one business function, up from 64% in 2023. Only 31%, however, have scaled it across the organisation. In June this year, the first Evident AI Index for banks in the Middle East and Africa put Emirates NBD in first place. First Abu Dhabi Bank came third overall and led the index on leadership and transparency. That is evidence that UAE lenders are competing on AI maturity with global peers.

Across the region, the pattern is the same. In the UAE and Saudi Arabia, banks use AI in onboarding, customer service, collections and internal productivity. In Oman, digital channels handled around 89% of transaction volume by the end of 2025. The Central Bank of Oman’s Governor now describes the sector as entering an “intelligence-first” era. In Bahrain, the central bank has regulated automated financial advice for years and is widening its digital banking framework. The ambition is not in question. The open question is whether governance can keep pace.

Risk management is where AI’s value is clearest. Machine learning can spot fraud patterns across millions of transactions in milliseconds. It can flag early warning signs in a borrower’s cash flows months before a missed payment, and it can test portfolios against scenarios no analyst could model by hand.

The threat is growing just as quickly. A BioCatch survey of UAE banking executives published in April 2026 found that 66% of institutions had seen more fraud attempts and 62% put annual fraud losses above US$5 million. Globally, Entrust reports that deepfakes now account for one in five biometric fraud attempts. Criminals are using AI to clone voices and faces. Banks have no choice but to use AI to catch them.

In credit, the gains are real but narrower than the marketing suggests. AI is excellent at reading structured data: bank statements, payment histories, invoices and shipping records. In trade and corporate finance, we use data like this to check that a client’s trade flows are genuine before we take a facility to lenders. But a model trained on yesterday’s data struggles with what it has never seen. The conflict that disrupted shipping through the Strait of Hormuz this year is one example. No historical dataset could have priced that for a Gulf exporter’s receivables.

Regulation, Security and Accountability

GCC regulators have chosen principles over prohibitions, and I think they are right to.

In February 2026, the Central Bank of the UAE issued its guidance note on AI and machine learning for licensed financial institutions. It sets out five principles: governance and accountability, fairness and non-discrimination, transparency and explainability, effective human oversight, and data management and privacy. It sits alongside the new Central Bank Law, Federal Decree-Law No. 6 of 2025, whose one-year transition period ended in September. Together they make clear that the CBUAE expects AI governance to be part of how a bank is run, not an add-on.

Saudi Arabia has taken a different route but is heading to the same place. SDAIA’s AI Ethics Principles and SAMA’s Cyber Security Framework apply alongside the Personal Data Protection Law, which has been fully enforceable since September 2024. Oman’s data protection regime is now in full effect, and Bahrain’s has been in force since 2019.

My advice to boards is simple: don’t wait for a dedicated AI rulebook. Every AI use case should already map to your existing obligations on model risk, outsourcing, consumer protection and data. If a model affects a customer outcome, you should be able to explain it to the customer, the regulator and your own credit committee in plain language.

Every AI system a bank deploys is also a new way in for attackers. Models can be poisoned or manipulated, and a staff member pasting client data into an unapproved tool can create a data breach without anyone noticing. Bankers I speak with are moving from “Where is the data stored?” to a harder question: “Who and what can see it, and can we prove that afterwards?”

Bias is the quieter risk. A credit model trained on historical lending data will reproduce historical blind spots. In the Gulf that often means thin-file SMEs, young businesses and expatriate entrepreneurs, the very segments the region’s growth plans depend on. Transparency is not a compliance box. It is the only way to find these errors before they turn into exclusion at scale.

Why Human Judgment Still Matters

This is where I hold the firmest view. In corporate lending and complex transactions, AI should inform the decision, but a person must make it.

A mid-market trading company in Dubai or a contractor in Riyadh rarely fits a model neatly. Its creditworthiness depends on the strength of its counterparties, how it is structured, the security package, the relationship’s history, and the character of the people running it. A model can score a borrower. It cannot negotiate a covenant, judge whether a founder is being straight with you, or take responsibility when a deal goes wrong.

That is why the CBUAE’s emphasis on human oversight matters. Accountability cannot be delegated to an algorithm. Someone with a name and a signature has to own every material credit decision. Used well, AI makes that person faster and better informed. Used badly, it gives them something to hide behind.

AI’s opportunity in GCC banking is large. PwC’s Strategy& estimates that generative AI alone could add US$23.5 billion a year to GCC economies by 2030. For banks, that comes from faster onboarding, sharper fraud detection, earlier credit warnings and leaner compliance operations. It also comes from wider access to finance: if AI can safely assess smaller businesses that banks find too costly to underwrite today, it can help close the SME funding gap the region’s diversification plans depend on.

The banks that win will not be the ones that automate the most. They will be the ones that can show regulators, clients and their own boards that their AI is explainable, secure and answerable to people. In Gulf banking, trust has always been the real product. AI does not change that. It raises the stakes.

Contributed by Mr. Sayed Adnan

Sayed is the Chief Business Officer of Graystone Capital, where he leads the firm's business development, deal origination, and strategic partnership functions across all 12 of its active markets. As one of the founding architects of the Graystone platform. With a career grounded in financial advisory, capital markets origination, and cross-border business development across the Gulf Cooperation Council, Southeast Asia, and South Asia, Sayed has built and maintained an institutional network spanning corporates, family offices, government-related entities, banks, and financial institutions. As CBO, Sayed is also the principal custodian of Graystone Capital's client relationships, the individual to whom the firm's most important counterparties turn when they require a capital solution, a strategic introduction, or a trusted perspective on a complex financing situation.

Related Articles

Why Human Oversight Is Becoming the Real Scaling Engine for Gulf Fintech’s AI Agents

Middle East Banks Move Past AI Experiments as IBM Backs MEBIS 2026 in Dubai

Why GCC Enterprises Are Finally Ready to Move AI from Pilot Projects to Real Operations