Small- and medium-sized enterprises (SMEs) are central to economic diversification in the Gulf Cooperation Council (GCC), accounting for 90 % of businesses yet facing a financing gap estimated at US$250bn (Deloitte, 2022). This paper critically aims to examine how Saudi Arabia and the United Arab Emirates (UAE) are integrating artificial intelligence (AI) into conventional and Islamic SME financing, evaluating whether technological adoption is matched by enforceable ethical and regulatory safeguards.
This paper uses a desk-based doctrinal and thematic analysis of regulatory strategies across both countries, including sandboxes, fintech hubs and Shariah governance frameworks. Drawing on existing literature, policy documentation and institutional frameworks, it assesses gaps in data governance, algorithmic accountability and transparency within AI-enabled credit scoring systems for SME finance.
Both Saudi Arabia and the UAE are fostering digitally enabled financial ecosystems underpinned by national strategies such as Vision 2030 and AI Strategy 2031. However, regulatory ambition is not consistently matched by enforceable ethical safeguards. Concerns persist around algorithmic bias, data privacy, opacity and weak oversight, which risk reproducing existing inequalities and undermining consumer trust in both conventional and Islamic finance contexts.
The analysis is conceptual in nature and focused on two GCC jurisdictions, limiting direct generalisability. The findings point to the need for empirical evaluation of AI-driven credit outcomes and bias, and underscore the importance of embedding auditability and explainability into financial systems as preconditions for equitable access.
While AI adoption in SME finance is growing rapidly, limited scholarly attention has been paid to its intersection with Islamic finance principles and GCC regulatory environments. This paper addresses that gap by proposing a governance model that embeds accountability, transparency and Shariah compliance into AI-enabled SME finance, offering implications for policymakers, practitioners and society at large.
Introduction
Small- and medium-sized enterprises (SMEs) are often recognised as propellers of economic growth and job creation (Mushtaq et al., 2022). In the Gulf Cooperation Council (GCC), particularly in its two largest economies, Saudi Arabia and the United Arab Emirates (UAE), SMEs play a crucial role. This opportunity is reinforced by the broader Gulf energy transition agenda, where both Saudi Arabia and the UAE are actively reorienting economic structures towards low-carbon industries and clean technology sectors. The Gulf States possess significant renewable energy potential, especially solar and green hydrogen, supported by sovereign wealth capital and existing infrastructure, positioning them to become exporters of new energy forms in a post-fossil future. However, such transitions demand substantial investment in innovation ecosystems, including technology, human capital and sustainable finance, if diversification goals are to be realised (Al-Sarihi, 2025).
In Saudi Arabia, SMEs represent 99.5% of all enterprises and contribute 28% to the GDP, while in the UAE, SMEs account for 94% of all companies and contribute 52% to the non-oil GDP (Abdullah, 2023). Beyond these economic contribution, SMEs are increasingly viewed as key enablers of economic diversification and sustainability in the Gulf, particularly in light of ongoing energy-transition strategies that seek to reduce reliance on fossil fuels and stimulate private-sector-led innovation (IMF, 2014). Recent policy analysis highlights that the success of these transitions depends heavily on SME participation in clean energy, technology and green finance sectors.
However, SMEs across both Saudi Arabia and the UAE face significant funding gaps, which usually affect their growth potential. Despite the expansion of digital banking and fintech solutions globally, recent industry evidence demonstrates that the SME financing gap remains substantial, particularly in emerging and transition economies. According to Deloitte, only 11% of SMEs in the GCC have access to credit, contributing to an estimated US$250bn in credit gap (Deloitte, 2022). This challenge is particularly acute in Saudi Arabia, where only 8% of bank lending goes to SMEs, compared to 15% in the UAE (Al-Hajri et al., 2024). These figures suggest that technological innovation alone has not resolved long-standing structural barriers to SME finance, underscoring the need to examine the regulatory and governance frameworks shaping digital financial services.
The situation is further complicated by the need for Shariah-compliant financing options, as both countries have substantial Islamic banking sectors, with Islamic banking assets representing 75.3% and 22.9% of total banking assets in Saudi Arabia and the UAE respectively (Islamic Financial Services Board, 2023). While Islamic finance offers alternative, Shariah-compliant financing models that are potentially well-suited to SMEs, Islamic financial institutions often face additional governance, compliance and risk-assessment challenges when extending SME credit, particularly in technology-driven financing environments.
Both Saudi Arabia and the UAE have recognised the importance of leading a digitally enabled economy. The UAE’s AI Strategy 2031 and Saudi Arabia’s Vision 2030 have placed significant emphasis on artificial intelligence (AI) technology and applications. While investment in AI could significantly transform both economies, these technologies offer promising benefits in facilitating SME access to both conventional and Islamic finance. AI is disrupting financial services, improving their effectiveness (Ochuba et al., 2024), and can be harnessed to address SME financial exclusion in developing nations (Adeoye et al., 2024). These developments are particularly relevant in the Gulf context, where SMEs are expected to play a growing role in digitally enabled, low-carbon and innovation-driven sectors.
According to Sanga and Aziakpono (2023), AI and big data analytics are transforming credit scoring methods, enabling banks and FinTech lenders to evaluate SMEs and other borrowers with sparse financial histories using non-traditional data like digital footprint. The ability to process larger volumes of data from disparate, often unstructured data enables SME lenders to gain the upper hand over traditional banks and overcome the credit risks that have hitherto limited SME lending.
This transformation extends to Islamic financial institutions, where AI can help assess Shariah compliance, structure Islamic financial products and evaluate risk-sharing arrangements more effectively. Past studies have suggested the applicability of adopting AI for Shariah compliance assessment in the Islamic finance industry (Leuwol et al., 2024; Katterbauer et al., 2021). While AI offers massive opportunities that can be explored in Saudi Arabia and the UAE for improving how SMEs access both conventional and Islamic finance, these opportunities are not challenges-free. Some ethical concerns have been raised regarding the deployment of AI in financial services. Algorithm bias, discrimination, data privacy, transparency and accountability are some of the critical ethical challenges of AI-enabled financial services (Uzougbo et al., 2024; Agu et al., 2024). In Islamic finance, applying AI while ensuring Shariah compliance is challenging for Islamic banks (Shalhoob, 2025).
To imbue legal analysis with the depth and breadth derived from careful historical, political and economic perspectives, we must integrate firm contextual foundations into our interpretive framework. To enhance our examination of technology and its regulatory reforms, such as analysing regulators’ and lawmakers’ activities and their collaboration with other national agencies in a world where commerce transcends borders facilitated by high-speed technology, we should ` firm contextualisation to our interpretative analysis of these legal reforms (Friedman and Macaulay, 1967: 813; Crowe, 2014). Consequently, the core of this article lies in establishing a nuanced contextual foundation for understanding how regulatory and governance frameworks are adapting to these technological advancements (Xu, 2017).
By exploring how ideas and circumstances are forming within these emerging domains of technology and regulation, we can better interpret the impacts of AI-driven interfaces and understand the mechanisms behind legal and regulatory reforms in response to today’s complicated, and often uncertain, sociopolitical, commercial, spiritual and technological landscape (Moses, 2013). Making sense of these interconnected regulatory and technological dynamics is crucial for understanding why and how laws and regulations are enacted or falter, how they are prioritised in a coordinated way despite diversity in legal frameworks and government policies and how this is manifested within policy debates and regulatory outcomes in the Gulf region.
Motivation and research gap
While existing scholarship has made important contributions to understanding Islamic finance and Shariah-compliant investment performance, prior studies remain largely sector- or product-specific and do not offer an integrated regulatory–technological framework for AI-driven SME financing. For example, Al Rahahleh and Bhatti (2023) provide an empirical comparison of Shariah-compliant and conventional mutual fund performance, focusing on risk–return dynamics rather than technological transformation. Similarly, Al Qahtani and Bhatti (2025) examine strategic trends in Islamic mutual funds in Saudi Arabia, including ethical investments and emerging technological innovations, but do not analyse AI adoption from a regulatory or SME-financing perspective. More broadly, Islamic Finance in the Modern Era offers a comprehensive conceptual overview of contemporary Islamic finance without developing an operational framework for AI governance in financial intermediation.
In particular, existing studies do not sufficiently examine how artificial intelligence is being integrated into SME financing across both conventional and Islamic finance systems, nor how regulatory and Shariah governance frameworks are adapting to manage the ethical, legal and technological risks associated with such integration.
In contrast, the framework proposed in this paper is distinct in three key respects: firstly, it centres explicitly on AI-enabled SME financing rather than capital market instruments; secondly, it integrates Shariah governance, financial regulation and AI risk management into a unified analytical model; and third, it adopts a comparative, jurisdiction-sensitive approach grounded in Saudi Arabia and the UAE, with a contextual note on Indonesia as one of the largest economies within the Organisation of Islamic Cooperation (OIC) and MSMEs account for approximately 99% of businesses its business ecosystem.
Accordingly, the paper is positioned as a thematic and doctrinal analysis rather than a purely conceptual literature review, with a focus on regulatory design, governance mechanisms and practical implications for SME finance. This enables the paper to address a critical gap in the literature concerning how innovation, compliance and financial inclusion can be balanced in AI-driven Islamic finance ecosystems.
Research question and objectives
This paper addresses the following research question: How are Saudi Arabia and the UAE regulating and governing AI-enabled financial services to address SME financing gaps while managing ethical, legal and Shariah-compliance challenges?
To answer this question, the paper pursues three objectives:
to examine the role of AI in transforming SME financing practices in Saudi Arabia and the UAE across both conventional and Islamic finance;
to analyse the legal, regulatory and governance frameworks shaping AI deployment in SME finance; and
to assess whether current regulatory approaches adequately support SME access to finance in the context of digital transformation and economic diversification.
Together, these objectives allow the study to identify regulatory gaps, emerging trends and areas requiring further policy and scholarly attention.
Contribution and novelty
This paper contributes to the literature in three ways. Firstly, it incorporates updated industry and policy data to highlight persistent SME financing gaps despite fintech expansion. Secondly, it offers a comparative legal analysis of AI-enabled SME financing across conventional and Islamic finance frameworks in Saudi Arabia and the UAE. Thirdly, by situating AI regulation within broader socio-political, economic and energy-transition contexts, the paper advances a contextualised understanding of regulatory adaptation in the Gulf region. In doing so, the paper explicitly bridges theory and practice by demonstrating how regulatory choices shape real-world SME access to finance and the ethical deployment of AI technologies.
Methodologically, the paper uses a desk-based doctrinal and thematic analysis of current literature and adopts a comparative approach to examine the opportunities and challenges of AI-enabled financial services within the SME financing context in Saudi Arabia and the UAE.
The strategic role of small- and medium-sized enterprises in Gulf Cooperation Council economic diversification
The economic diversification needs of the GCC nations can be justified from multiple angles. Aside from the fact that their long-aged economic dependence on fossil fuel is harmful for the planet and its people, over-relying on a single sector will hamper sectorial inclusive growth needed to transform the tenacity of the GCC economies. While the GCC economies stand to benefit during the rise of oil prices, their economies tend to suffer greatly when the prices plummet (Vohra, 2017). Therefore, to build resilient economies and global competitiveness, the GCC economies need a diversified economy across their real economies. To achieve the aforementioned, SMEs need to be provided with innovative ecosystems that allow them to thrive.
According to the World Bank (2019), MSMEs in developing nations grapple with an annual unmet funding need of $5.2tn. In the GCC, it is estimated that there is a credit gap of US$250bn (Deloitte, 2022). To propel the growth and impact of SMEs in this region, the countries are in need of tailored regulations that facilitate access to finance for these businesses. While SMEs have the potential to contribute to economic development, their lack of access to adequate capital can inhibit this potential.
For SMEs to overcome the systemic financing barriers, there must be regulatory and political support from governments and policymakers. As Alharbi (2023) demonstrated, to revitalise the SME sector in Saudi, the sector needs to enjoy finance-friendly policies. The SME sector is pivotal in bringing the Saudi economy to the new feats it aspires to achieve. SMEs can contribute to reaching the Saudi Arabia 2030 vision’s economic objectives (Ali et al., 2023). As highlighted in the Saudi Financial Sector Development Program, the financial sector is an important engine in ensuring the functionality of the SME sector. As the financial economy responds to the funding needs of the SME sector, then the SME sector can contribute well to economic growth.
The Saudi Vision 2030 is an aspirational blueprint targeted at charting a new roadmap for the economic development of the Saudi Kingdom (Rathi and Alshami, 2023). The vision was launched in 2016 to forge an economic diversification and social development pathway for the kingdom. SMEs are the economic backbone of economies (Robu, 2013). Thus, Saudi can use them to bolster its economic prosperity.
Small- and medium-sized enterprise financial regulations and support mechanisms in Saudi Arabia
Saudi Arabia has implemented several key regulatory frameworks and initiatives to address SME financing challenges. At the forefront is the establishment of the Small and Medium Enterprise Bank (SME Bank) through Council of Ministers resolution No. 376. This institution plays a pivotal role in advancing Saudi’s vision of expanding SME economic contribution by providing diverse financing options including debt, equity and loan guarantees. The bank aims to increase SME financing to 20% of the total loan portfolio and has already deployed over SAR 30.8bn (US$8.2bn) in SME funding since 2020.
To create a more competitive SME financing landscape, the Saudi Central Bank (SAMA) has implemented strategic regulatory adjustments. A significant reform includes the amendment to Article 8 of the Implementing Regulation of the Finance Companies Control Law, which reduced the minimum paid-up capital requirement for SME-focused finance companies to SAR 50m, compared to SAR 100m–200m for other finance companies.
In the UAE, similar strides of ensuring that SMEs in the country receive the needed institutional support were made. For example, in 2021, Operations 300bn was launched to ensure that the Emirates Development Bank support over 13,000 SMEs in financing. Furthermore, legislatives actions such as the Federal Law No. 2 of 2014 was enacted to bolster the SME ecosystem through regulations aimed at promoting and protecting them. As a result, the National SME Programme was launched and the UAE SME Council was established to engineer strategic plans and policies initiatives that reflect intentional efforts to support and develop the SME ecosystem in the emirates.
The Kafalah program, launched in 2006 by the Saudi Industrial Development Fund (SIDF), represents another cornerstone of Saudi Arabia’s SME financing policy framework (Adeyemi et al., 2015). This government-backed credit-guarantee scheme aims to catalyse SME lending by providing up to 80% government assurance on funding value (IMF, 2018). The program has achieved significant milestones, facilitating billions in loan guarantees, supporting over 23,000 small businesses and contributing to the creation of nearly one million jobs (Kafalah Program News, 2024).
However, AlTally (2023) argues that Saudi’s SME lending ecosystem could be more robust if financial institutions developed independent strategies and frameworks rather than relying predominantly on the Kafalah program. This observation suggests the need for a more diversified approach to SME financing in the kingdom.
Evolution of credit bureaus: Strengthening financial infrastructure in Saudi Arabia and the United Arab Emirates
The development of credit reporting systems represents a critical milestone in financial market infrastructure, originating in the 1860 s USA as a business risk management tool (Shisia et al., 2014). Today, credit bureaus have evolved into essential pillars of modern financial ecosystems, enabling financial institutions to enhance risk management capabilities and make data-driven lending decisions (Kirchner et al., 2012). Within the context of Saudi Arabia and the UAE, credit bureaus play a particularly vital role in addressing information asymmetry challenges that have historically hindered SME financing.
The effectiveness of credit bureau systems depends heavily on robust regulatory oversight. As the World Bank (2022) emphasises, establishing well-defined regulatory frameworks for credit bureau operations is crucial for ensuring their proper functioning and supervision. This regulatory infrastructure encompasses several critical functions, including the standardisation of data collection and reporting practices, protection of data privacy and security, establishment of fair and transparent credit assessment processes and promotion of responsible information sharing among financial institutions.
From a macroprudential perspective, functional credit bureaus serve as strategic tools for optimising capital flow and distribution within the financial system. This is particularly significant for SMEs, which have traditionally faced exclusion from credit facilities due to uncertainty surrounding their creditworthiness. By providing comprehensive credit information, these institutions help bridge the information gap between lenders and SME borrowers. Through this enhanced information flow, credit bureaus facilitate more accurate risk assessment and data-driven lending decisions while reducing information asymmetry and promoting greater financial inclusion for the SME sector.
The development of credit bureau infrastructure in both Saudi Arabia and the UAE represents a critical step towards modernising their respective financial systems and supporting their broader economic diversification goals. These institutions serve as fundamental pillars in creating a more transparent, efficient and inclusive financial ecosystem that can better serve the needs of their growing SME sectors.
Credit information systems and collateral registries: a comparative analysis of the United Arab Emirates and Saudi frameworks
While credit information systems and collateral registries have been around for centuries, they still represent an important component of the financial infrastructure for SME financing in many leading economies. The scope of credit data collection in the UAE through Al Etihad Credit Bureau (AECB) has expanded significantly since its establishment. AECB now collects data from a comprehensive network of sources including banks, financial institutions, telecommunications companies, utility providers, real estate rental firms and insurance companies. A notable development in 2023 was the inclusion of government entities, particularly tax authorities, enhancing the breadth of credit information available. While fintech companies are beginning to contribute data, their integration into the credit reporting ecosystem remains in development.
In Saudi Arabia, The Saudi Credit Bureau (SIMAH) maintains a similarly broad but distinctly structured data collection framework. The bureau receives information from all licensed banks, finance companies and telecom operators, complemented by data from government agencies and utility companies. Insurance providers also contribute to the credit information system, though with varying degrees of comprehensiveness. While fintech companies are part of the reporting framework, their participation is primarily limited to those holding lending licenses, reflecting Saudi Arabia’s measured approach to financial innovation.
Regarding secured transactions frameworks, both countries have made significant strides in recent years. The UAE established the Emirates Movable Collateral Registry (EMCR) under Federal Law No. 4 of 2020, creating a system that shares some similarities with Australia’s Personal Property Securities Register (PPSR) but operates within a more confined scope. The EMCR enables the registration of security interests in various movable assets, including equipment and machinery, inventory, receivables, bank accounts, investment instruments and future assets.
The Australia’s Personal Property Securities Register (PPSR), was established under the Personal Property Securities Act 2009, PPSR is a centralised registry that keeps records of security interests in movable assets. It allows lenders to publicly record their claims, therefore ensuring legal action in the event that the borrower default. This system is importantly relevant in the SME financing ecosystem as it ensures that SMEs who often lack fixed-asset as collateral can alternatively use movable assets to access credit. This helps ensure lender risk and ensure financing availability for SMEs.
Saudi Arabia’s parallel system, the Unified Saudi Registry for Security Rights in Movable Assets (USSR), was launched in 2020 under the Commercial Pledge Law. This registry encompasses a broad range of assets including equipment, inventory, agricultural products, documents of title, receivables, bank accounts and intellectual property rights. The USSR represents Saudi Arabia’s commitment to modernising its financial infrastructure and facilitating secured lending.
While these frameworks mark significant progress in both nations’ financial infrastructure development, they are relatively nascent compared to established systems like Australia’s PPSR. Both registries are designed to enhance SME access to finance by enabling the use of movable assets as collateral, though their integration with existing financial systems and institutional frameworks continues to evolve. The ongoing development of these systems reflects both countries’ commitment to building robust financial infrastructures that support their economic diversification goals.
Data protection and privacy in financial services: Regulatory frameworks of Saudi Arabia and the United Arab Emirates
The digitalisation of financial services, particularly in SME financing, has elevated the importance of data privacy and security regulations. This concern is underscored by the IBM Cost of a Data Breach Report, which reveals a significant 10% increase in the average cost of data breaches to US$4.88m in 2024, with the Middle East region ranking second globally at US$8.7m. These statistics emphasise the critical need for robust data protection frameworks in emerging digital economies like Saudi Arabia and UAE.
Saudi Arabia’s approach to data protection is primarily governed by the Personal Data Protection Law (PDPL), overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA) through its National Data Management Office (NDMO). The law specifically addresses credit data protection in Article 24, emphasising the importance of transparency and informed consent in data collection and usage. Complementing this framework, the Saudi Arabian Monetary Agency’s Financial Consumer Protection Principles and Rules establish additional safeguards, with the sixth principle specifically focusing on data protection and information privacy requirements for financial institutions.
The UAE maintains a multi-layered data protection regime through Federal Decree-Law No. 45 of 2021 and the DIFC Law No. 5 of 2020 for entities within the Dubai International Financial Centre. These regulations align with international standards such as the European General Data Protection Regulation (GDPR), incorporating requirements for Data Protection Officers and comprehensive data protection measures. This regulatory framework reflects the UAE’s commitment to establishing trust in its digital financial ecosystem.
Financial institutions leveraging AI for SME financing must navigate these regulatory requirements while maintaining operational efficiency. This involves implementing transparent data collection policies, securing informed consent and maintaining robust cybersecurity measures to protect against unauthorized access. The regulatory frameworks in both countries emphasize the dual responsibility of financial institutions to innovate while protecting customer data, recognising that trust forms the foundation of successful financial services.
The evolving nature of AI-driven financial services demands continuous adaptation of data protection measures. Financial institutions must balance the opportunities presented by technological advancement with their obligations to protect sensitive SME data, ensuring compliance with jurisdictional regulations while fostering innovation in the financial sector. This balance is crucial for maintaining customer trust and promoting sustainable growth in the digital financial ecosystem.
Addressing algorithmic bias in artificial intelligence-enabled credit assessment
The increasing adoption of AI-based credit evaluation systems has heightened attention on fair lending practices and algorithmic bias (Brotcke, 2022). While machine learning systems have revolutionised loan application assessment processes (Garcia et al., 2024), concerns about inherent biases in credit algorithms present significant challenges for financial institutions and regulators. Research has shown that historical societal biases frequently manifest in algorithmic data sets, potentially perpetuating discriminatory practices (Akter et al., 2021).
The issue gained prominent attention with Apple’s credit card controversy, developed in partnership with Goldman Sachs, which reportedly used algorithms that discriminated against women in credit limit determinations. This case exemplifies a broader challenge: algorithms trained on historical data can inadvertently perpetuate existing discriminatory patterns based on demographic variables. As Hassani (2021) notes, the fundamental dependence of algorithms on historical data sets makes them inherently vulnerable to embedding and amplifying existing societal biases.
In the era of algorithmic decision-making, incorporating unbiased practices into credit assessment has become imperative (Kisten and Khosa, 2024). The implementation of fair credit decision models requires sophisticated frameworks and regulatory compliance measures. This necessitates close collaboration between regulators and financial institutions to ensure thorough auditing of algorithmic data, preventing bias or prejudice against any demographic group.
AI-driven scoring depends on extensive data sets, yet neither country imposes robust standards for data quality, interoperability, privacy, or automated decision-making. These gaps disproportionately affect groups facing structural disadvantage (Center for Financial Inclusion, 2021; Kelly and Mirpourian, 2024) and conflict with maqāṣid principles of justice, welfare and harm prevention (Auda, 2008; Al-Ghazālī and Ḥāmid, 2018; Dar al-Ifta, 2021). The lack of binding explainability and auditability requirements further compounds these risks.
Comparative experiences reinforce this picture. Indonesia’s Innovative Credit Scoring pairs innovation with guardrails but still faces opacity and enforcement constraints (Hiswara Bunjamin and Tandjung, 2025; Wijaya, 2023). Malaysia’s integration of Shariah oversight into fintech, from crowdfunding to P2P lending, shows how systemic Shariah governance can shape responsible innovation (Ismail et al., 2025). These examples illustrate that ambition must be matched with regulatory capacity.
Turner Lee et al. (2019) propose regulatory sandboxes as an effective policy measure for addressing algorithmic bias in financial services. These controlled testing environments allow innovations to undergo regulatory supervision before commercial deployment, enabling early identification and mitigation of potential bias issues. This proactive approach to algorithm testing and validation represents a crucial step towards ensuring equitable access to credit and promoting comprehensive financial inclusion.
The challenge of algorithmic bias underscores the critical importance of regulatory frameworks and institutional oversight in promoting ethical AI-enabled lending practices. As financial institutions continue to embrace AI technologies, establishing robust mechanisms for detecting and eliminating bias becomes essential for maintaining fair and inclusive financial systems.
Evolution of fintech regulation: a comparative analysis of Saudi and the United Arab Emirates regulatory frameworks
The digital transformation of financial services, particularly through fintech innovation, has catalysed unprecedented developments in the GCC financial sectors, with Saudi Arabia and the UAE emerging as regional leaders (Dey et al., 2024). Our examination of this situation is grounded in understanding the contextual realities, values and forces that are strengthening these regulatory environments. Consequently, these nations have developed distinct regulatory approaches to nurture their fintech ecosystems while ensuring market stability and consumer protection.
Saudi Arabia’s regulatory framework centres on the Saudi Central Bank (SAMA)'s initiatives to support the kingdom’s vision of becoming a smart financial hub. SAMA’s regulatory sandbox serves as a crucial testing ground for fintech innovations, enabling companies to validate their business models within the regulatory landscape while protecting consumer interests. The establishment of Fintech Saudi, a collaborative initiative between SAMA and the Capital Market Authority (CMA), further demonstrates the kingdom’s commitment to developing a responsible and vibrant fintech ecosystem.
The UAE has cultivated a more diverse regulatory environment, emerging as the largest fintech hub in the MENA region (Al Suwaidi et al., 2022). The Central Bank of the UAE (CBUAE) has implemented comprehensive regulatory frameworks, including the Retail Payment Services and Card Schemes Regulation, Open Finance Regulations and Sandbox Regulations, creating a robust foundation for fintech innovation (Allen and Schoorl, 2024). This regulatory infrastructure has proven instrumental in positioning the UAE as a regional fintech leader.
A distinctive feature of the UAE’s regulatory approach is its dual financial free zone system. The Financial Services Regulatory Authority (FSRA) oversees fintech operations in the Abu Dhabi Global Market (ADGM), while the Dubai Financial Service Authority (DFSA) regulates the Dubai International Financial Centre (DIFC). This decentralised structure, as Albarrak and Alokley (2021) note, creates a more versatile regulatory climate compared to Saudi Arabia, enabling more nuanced oversight and fostering a supportive ecosystem for fintech growth (Alblooshi, 2022).
The contrasting regulatory approaches of Saudi Arabia and the UAE reflects their contexts. They have unique market conditions and development objectives, while both maintaining a shared commitment to promoting responsible fintech innovation. Their experiences offer valuable insights into the balance between encouraging innovation and maintaining regulatory oversight in emerging fintech markets.
Global best practice
The integration of AI in financial services, particularly for SME financing, presents both opportunities and regulatory challenges that demand careful consideration. While AI can enhance financial institutions’ strategic capabilities (OECD, 2021) and marks a significant shift in the fourth industrial revolution’s impact on finance (Lee et al., 2018), proactive regulation is essential to govern its responsible deployment (Truby et al., 2020). This regulatory foresight is crucial to prevent potential harms while avoiding the risk of over-regulation that could stifle innovation.
In the GCC context, regulatory approaches to AI in financial services remain in early stages of development. Saudi Arabia has established the Saudi Data and Artificial Intelligence Authority (SDAIA) to oversee AI governance, releasing ethical principles in 2023. However, these principles are broadly applicable rather than specific to financial services, and Saudi Arabia currently lacks legally binding AI regulations (White and Case LLP, 2024a). The UAE’s regulatory landscape is more complex due to multiple jurisdictions, though initiatives like the UAE National Strategy for AI 2031 and the creation of the AI and Advanced Technology Council in 2024 demonstrate commitment to AI governance.
The European Union’s AI Act offers valuable guidance for regulating AI in SME financing. The Act classifies AI systems used in lending as high-risk applications, particularly when determining access to financial services and evaluating creditworthiness. This classification mandates stringent requirements focused on key areas including risk management systems, data governance protocols and human oversight mechanisms. These requirements aim to ensure AI deployment in financial services adheres to principles of transparency, fairness, accountability and data privacy.
Research indicates that AI implementation in Saudi financial markets could enhance productivity and customer satisfaction (Al-Baity, 2023), with particular benefits for banking operational efficiency (Mohammed, 2024). However, Crisanto et al. (2024) warn that financial institutions’ AI usage may create unprecedented challenges requiring regulatory intervention. This suggests the need for a balanced regulatory approach that promotes innovation while ensuring adequate safeguards.
The challenge for GCC regulators lies in developing frameworks that encourage AI adoption in SME financing while maintaining robust oversight. This requires careful consideration of international best practices, local market conditions and the specific needs of the SME sector. A well-designed regulatory framework should facilitate technological advancement while protecting stakeholder interests and maintaining financial system stability.
Recommendations
A critical analysis of regulatory frameworks in Saudi Arabia and the UAE shows clear strengths but persistent gaps in using AI-enabled finance to meet SME needs. Both states promote AI as part of diversification, yet regulation remains uneven, fragmented and insufficiently aligned with ethical and Shariah-based principles. Meaningful progress requires coupling innovation with safeguards that reflect social justice, consumer protection and Islamic financial integrity.
SMEs have long been central to diversification, yet access to credit remains limited (Sweidan and Elbargathi, 2023). Even with SME agencies and guarantee schemes, SMEs received only 11% of GCC lending by 2015 (World Bank Group, 2016). This persistent imbalance explains why AI-enabled finance is viewed as a potential corrective to long-standing failures of financial inclusion.
Regulatory sandboxes, fintech hubs and credit bureau reforms demonstrate openness to experimentation. But Saudi Arabia’s reliance on state-backed tools such as Kafalah risks entrenching dependency, while the UAE’s multi-jurisdictional model – spanning federal bodies, ADGM and DIFC – creates inconsistency and regulatory arbitrage (White and Case LLP, 2024b). These reflect opposite governance challenges: Saudi over-centralisation versus UAE fragmentation.
For Saudi Arabia and the UAE, aligning AI systems with AAOIFI and IFSB principles (Islamic Financial Services Board, 2015; Accounting and Auditing Organization for Islamic Financial Institutions (AAOIFI), 2015; Sarea et al., 2013; Anderson, 2010) and drawing on maqāṣid approaches developed by Kamali and Auda (Kamali, 2008; Auda, 2008), can elevate justice, welfare and harm prevention into operational regulatory standards. Doctrines such as istiṣlāḥ and sadd al-dharāʾiʿ provide a jurisprudential basis for pre-emptive restrictions on harmful technologies (Zafar et al., 2025). Embedding these principles would shift Shariah governance beyond contract-focused review towards systemic oversight of algorithmic logic, strengthening public trust and aligning with global responsible-AI trends (Zafar et al., 2025). For example, global benchmarks, such as the EU AI Act (Future of Life Institute, 2025) and OECD AI Principles [Organisation for Economic Co-operation and Development (OECD), 2025] also can add further pressure to reform. However, it is important to note that AI cannot substitute for structural improvements in legal enforcement, judicial expertise or SME digital capability.
A coherent path forward therefore requires Saudi Arabia to reduce its dependence on state-credit schemes, the UAE to harmonise oversight across jurisdictions and the GCC to pursue regional alignment. Integrating maqāṣid al-sharīʿa into regulatory design and strengthening institutional capacity across regulators, Shariah boards and SMEs are central to this agenda.
Results, trends and conclusion
AI-enabled finance presents Saudi Arabia and the UAE with a genuine opportunity to narrow persistent SME credit gaps, but the analysis demonstrates that this potential can be realised only if technological innovation is matched by enforceable legal and ethical safeguards. While regulatory sandboxes, fintech hubs and expanding credit infrastructures signal financial modernisation, the analysis reveals uneven oversight, fragmented data-governance frameworks and Shariah review processes that remain too narrowly contract-centred. This leaves space for algorithmic bias, opacity in automated decision-making and consumer harm that undermine both regulatory objectives and Islamic legal principles.
The analysis indicates that AI-enabled SME financing is already reshaping credit assessment practices by increasing speed, scalability and data-driven risk profiling. At the same time, these developments expose significant regulatory and Shariah-governance gaps, particularly where automated decision-making conflicts with established Islamic principles of fairness, transparency and accountability. These tensions suggest that efficiency gains alone are insufficient as a regulatory metric in Islamic finance contexts.
Grounding AI governance in the maqāṣid al-sharīʿa, justice, welfare and harm prevention, reframes compliance as a set of measurable and enforceable obligations rather than aspirational ethics. This requires algorithmic audit requirements, explainability standards, robust data-protection and interoperability rules and accessible mechanisms for redress. Doctrinal principles such as istiṣlāḥ and sadd al-dharāʾiʿ further support pre-emptive regulatory intervention, including restrictions on opaque or high-risk models and mandatory impact assessments linked to demonstrable social benefit.
Looking ahead, the analysis points to several emerging governance trends. These include a shift from soft guidance to binding obligations, the integration of Shariah oversight across the entire AI life cycle, harmonisation of data-governance expectations and the development of supervisory and audit capacity capable of engaging with complex algorithmic systems. A central regulatory challenge will be sequencing innovation and regulation so that controlled experimentation through sandboxes is paired with escalating obligations as systems scale and risks intensify.
Future research should therefore deepen empirical evaluation of credit outcomes, particularly for SMEs traditionally excluded from formal finance, to assess whether AI-driven models improve access, reduce bias and enhance distributive justice in practice. Further work is also required to refine doctrinal links between Islamic legal principles and concrete AI governance tools, translating normative commitments into auditable regulatory standards. At a regional level, the findings indicate a growing need for GCC-wide harmonisation as cross-border fintech operations expand and AI systems increasingly rely on shared data infrastructures.
Ultimately, the analysis demonstrates that AI can expand SME access to finance only if governed as a public-interest technology rather than a purely efficiency-driven tool. By aligning global best practice in AI governance with Islamic legal principles and translating those principles into enforceable, auditable obligations – Saudi Arabia and the UAE are well positioned to develop an innovative, trustworthy and equitable financial ecosystem. This trajectory illustrates how law, technology and ethical traditions can jointly shape more inclusive and sustainable economic futures.
