The deployment needs a documented division of responsibilities. A score used by a credit officer and a score that automatically determines an application create different control requirements. Both can fall within bank outsourcing and model-management rules.
Executive Summary
The recommended starting point is a bank-controlled scoring service. The bank retains credit policy, approval authority, model acceptance and customer redress. The supplier provides the scoring, documentation, testing support and operational evidence needed to discharge those duties.
The approval sequence matters. Material outsourcing requires CBUAE non-objection before the bank enters the agreement. Offshore sharing of Confidential Data requires its own approval and customer permissions. Since 14 September 2026, qualifying operational changes also require external assurance, advance notification and written CBUAE non-objection before implementation. Calling the service advisory does not remove these tests. (Outsourcing Regulation for Banks, Circular 14/2021, Arts. 6.3 and 8.1; accompanying Standards, §8; Operational Risk Management Regulation, Circular 1/2026, Arts. 12.5 and 13.5.)
The commercial decision is whether the supplier can provide a service the bank can understand, supervise and replace. If it cannot support lawful overseas access, independent validation or effective customer review, the architecture or product scope must change before launch.
Keep lending authority with the bank
The service description should identify who sets lending policy, selects inputs, approves thresholds and decides applications. It should also identify who can change the model, override a result or suspend scoring. Describing the supplier as a technology provider is insufficient if its actual authority extends into lending decisions.
The current banking statute is Federal Decree-Law No. 6 of 2025. Its licensing provisions cover financial activities delivered through technology. CBUAE's official explanation distinguishes purely technical software or infrastructure supplied exclusively for a licensed financial institution's benefit. That supports a technical-supplier route where the vendor remains within that role. It does not establish permission for the vendor to offer, arrange or perform regulated financial activities itself. (Federal Decree-Law No. 6 of 2025, Arts. 60–62; CBUAE legislative FAQs, question 6.)
For advisory scoring, the bank's authorised decision-maker must be able to assess the result and depart from it. The vendor may calculate a score and explain its drivers. The bank should retain affordability assessment, credit terms, approval and rejection, and the handling of customer challenges.
Automation requires a separate functional assessment. A bank can remain accountable for a decision executed by software, but a supplier-controlled decision process creates different outsourcing and licensing concerns. CBUAE generally does not permit outsourcing core banking and key management or control functions, including management of credit risk-taking functions. Requests are considered individually. The contract should therefore preserve bank control over executable lending policy and avoid granting the supplier discretion to decide credit. (Outsourcing Regulation, Arts. 2 and 8.2.)
The consumer-protection analysis below concerns individuals and sole proprietors. Lending to incorporated businesses requires the bank to apply the rules for the relevant customer category.
Classify the outsourcing and sequence the permissions
A continuing scoring service with support ordinarily fits the outsourcing definition: another party continuously performs an activity the bank performs or could perform. A one-off software acquisition may produce a different classification. The bank should assess the actual hosting, maintenance, support and update arrangements. Broader third-party controls can still apply under the 2026 Operational Risk Management Regulation. (Outsourcing Regulation, Arts. 1.9–1.10; Operational Risk Management Regulation, Arts. 1.31 and 13.)
Materiality depends on the consequences of disruption or poor performance. The assessment should address credit-risk controls, customer impact, compliance, data exposure and the bank's ability to continue without the supplier. A small contract value, a pilot label or a human signing off loans does not establish non-materiality. The bank must retain an outsourcing register and the governance required for the arrangement. (Outsourcing Regulation, Arts. 2–3; Outsourcing Standards, §2.3.)
The bank's approval schedule should distinguish four requirements.
- For material outsourcing, obtain CBUAE non-objection before entering the agreement. The submission must include the materiality and risk assessments, due diligence, internal audit and compliance agreement, and evidence of board or board-committee approval. A contractual condition delaying service commencement should not be assumed to cure premature signing. (Outsourcing Regulation, Art. 8.1; Outsourcing Standards, §8.)
- Apply the additional 2026 test for outsourcing whose disruption could significantly affect Critical Operations. Article 13.5 requires CBUAE non-objection. Record how the submission addresses this test alongside the material-outsourcing requirements. (Operational Risk Management Regulation, Art. 13.5.)
- Obtain the separate permissions for offshore Confidential Data before enabling that sharing or access. The data conditions remain relevant even where the bank considers an arrangement non-material. (Outsourcing Regulation, Art. 6.3.)
- Before implementing a change material to Critical Operations, or one that may materially affect customers, follow Article 12.5. It requires testing and approval of the results, recovery arrangements including rollback and a sufficient predefined parallel run when replacing an ICT system, an external expert's independent assurance report, and senior-management review, endorsement and response. The bank must notify CBUAE and provide the report at least 30 calendar days before implementation, then obtain written non-objection. The passage of 30 days does not supply that permission. (Operational Risk Management Regulation, Art. 12.5.)
The fourth requirement can capture an advisory scoring deployment through its customer impact. It is not limited to systems designated as Critical Operations. Later changes to decision thresholds, model behaviour or operational dependencies must be screened against the same trigger. Routine changes still need the bank's ordinary change controls.
The supplier should provide the technical and operational evidence for these assessments. The bank owns the classifications, submissions and decisions to proceed. Neither the supplier agreement nor the bank's permission authorises a separate regulated activity carried on by the supplier.
Map customer information through South Africa
The bank must maintain its required Master System of Record in the UAE, including when it outsources. The 2026 rule permits a foreign financial institution's branch, with CBUAE approval, to maintain an up-to-date UAE copy. For foreign-bank branches, the Outsourcing Regulation also requires updating that copy at least daily. Consumer Protection Standards also require consumer and transaction data to be held and stored in the UAE as prescribed. The architecture must satisfy all applicable requirements. (Outsourcing Regulation, Arts. 6.1–6.2; Operational Risk Management Regulation, Arts. 1.17 and 8.9; Consumer Protection Standards, §6.1.6.3.)
UAE hosting alone does not resolve South African access. Identifiable records viewed by support staff, copied into tickets or exposed through logs should be treated as offshore sharing in the proposed design. The location map must cover inference, training, testing, support, telemetry, backups and subcontractors. Record both storage locations and the countries from which people can access data.
Before sharing Confidential Data outside the UAE, the bank needs CBUAE approval and prior written customer consent. It must also obtain the required written customer acknowledgment concerning possible access in foreign legal proceedings. The bank must establish equivalent safeguarding and effective supervisory access in every relevant jurisdiction. An encryption clause or a general consent statement does not establish those conditions. (Outsourcing Regulation, Arts. 1.6 and 6.3–6.13; Federal Decree-Law No. 6 of 2025, Art. 147.)
For personal banking and credit information governed by legislation protecting and regulating its processing, the federal Personal Data Protection Law contains a specific exclusion. This is a data-category exclusion. Other datasets require their own scope assessment; the entire vendor relationship is not automatically excluded. (Federal Decree-Law No. 45 of 2021, Art. 2(2)(f).)
On the South African side, the Protection of Personal Information Act 4 of 2013, or POPIA, requires a role and territorial assessment. The vendor will ordinarily be an operator when it processes only under the bank's instructions. A foreign bank can itself fall within POPIA where it uses processing means in South Africa beyond mere transit. A supplier determining its own purposes, including reuse for its own model training, may become a responsible party for that processing. (POPIA, ss. 1 and 3.)
The parties need a lawful processing ground, proportionate data collection, appropriate notices, security and retention rules. Their written operator agreement must impose the required safeguards. The bank-vendor contract is not, by itself, the contract with the data subject contemplated by POPIA's contractual-necessity ground. Consent is also not the only possible POPIA ground. (POPIA, ss. 8–24, particularly ss. 11, 20–21.)
Credit reporting presents another potential pre-processing gate. POPIA requires prior authorisation for processing for that purpose, subject to its statutory exceptions, including qualifying sector codes. This can reach a scoring service beyond registered credit bureaux. Where applicable, the responsible party must notify the Information Regulator and observe section 58's standstill. A paid business receiving or investigating credit information, compiling and maintaining it and issuing reports must also assess credit-bureau registration under the National Credit Act. The actual functions determine the result. (POPIA, ss. 57–58; National Credit Act 34 of 2005, s. 43.)
POPIA section 72 addresses transfers by a responsible party in South Africa to a foreign third party. It does not authorise the original export from the UAE. Map outward and onward disclosures separately, identify the responsible party, and establish an available section 72 ground where it applies. A binding agreement can support that ground only if its protections meet the statutory standard, including onward-transfer protection.
The recommended architecture keeps the required UAE records and restricts overseas access to the minimum approved data. If overseas permissions or safeguards cannot be established, move identifiable processing and support into a compliant UAE arrangement. South African staff can then work with code or genuinely non-identifying test material. Tokenisation alone does not establish anonymity. Any proposed credit-bureau feed also needs its own source and subscription permissions before disclosure to the vendor.
Validate the model and make review effective
CBUAE's Model Management Standards apply to models supporting decisions, including advisory scores. Purchasing a model does not remove the bank's responsibility to understand its methodology, assess its limitations and validate its use. Where a third party supplies a methodology, subsequent validation must be performed by an internal or external party independent of that provider. An acquired methodology the bank does not fully understand is not fit for purpose under the Standards. (Model Management Standards, Notice 5052/2022, §§2.4, 4.7 and 10.)
The supplier should provide documentation sufficient to test inputs, calibration, limitations, version history and score behaviour. The bank needs validation against the proposed UAE products, customers and operating conditions. Good performance on a South African development sample does not establish fitness for UAE lending. Testing should examine accuracy, stability, missing data, overrides and unjustified differences in outcomes between relevant customer groups. (Model Management Standards, §§6.2, 6.10, 8.4 and 9; Consumer Protection Standards, §10.1.1.4.)
External calibration has a further constraint. The Standards allow externally calibrated models where the bank cannot collect sufficient internal data. Where the bank is in a position to collect internal data, externally calibrated models are allowed only temporarily over the short term until sufficient data is collected. Immediately after implementation, it must take the necessary steps to collect historical and future internal data to develop a model internally. The procurement plan must address that requirement and the bank's resulting internal-data obligations. A perpetual licence does not settle the model's regulatory suitability. (Model Management Standards, §4.7.5.)
CBUAE's AI guidance issued in February 2026 adds supervisory expectations on fairness, transparency and human oversight. It calls for bias review annually and when models are upgraded, materially changed or newly introduced. It also supports meaningful human review and explanations where AI affects customers. The guidance reserves operation without direct human involvement for low-risk, non-material processes and expects oversight proportionate to consumer risk. These are guidance expectations alongside binding consumer and model-management duties. (Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., §§3, 4, 6–7 and 9.)
The bank must be able to explain a rejected application, subject to the exception for financial-crime compliance risks or legal prohibition. It must preserve responsible financing assessments and an effective complaints process. Customer-facing explanations should identify the material reasons for the decision in understandable terms. The vendor should supply accurate reason information and investigate challenged data or model behaviour; the bank owns the customer response. (Consumer Protection Standards, §§2.1.1.26, 7.1 and 8.1.)
Where POPIA applies, section 71 separately restricts decisions based solely on automated profiling that produce legal consequences or substantially affect the person. Creditworthiness is expressly within its scope. Its exceptions require the specified contractual conditions or an applicable law or code with protective measures. Consent alone is not a general exception. For the protected contractual route requiring safeguards, the person must be able to make representations and receive sufficient information about the underlying logic. (POPIA, s. 71.)
A nominal human approval does not resolve that issue if the person cannot meaningfully assess or change the outcome. For advisory use, the operating procedure should document genuine review and override authority. For automated use, the bank and supplier must establish the applicable legal route, challenge process and information needed for review before enabling the feature. Proprietary-model protection must leave enough access for validation, supervision and required explanations.
Put the controls into the contract and release decision
The agreement needs schedules that operations, risk and compliance teams can use. The following positions implement the regulatory requirements and identify the additional commercial protections recommended for this service.
- Define the permitted products, users, score outputs and decision rights. Reserve credit policy, model acceptance and lending authority to the bank. Identify permitted data purposes and prohibit supplier training or reuse beyond authorised instructions.
- List processing and access locations, approved subcontractors and the permissions each flow needs. Require bank approval before changes affecting those conditions, with equivalent duties throughout the supplier chain.
- Give the bank, its auditors and CBUAE the information, systems, records and access needed for oversight. Supplier confidentiality and security arrangements must accommodate those rights. An audit certificate alone cannot replace required access.
- Require model documentation, reproducible version records, validation assistance, monitoring information and advance change assessment. Prevent unilateral production upgrades. Include tested rollback and bank authority to suspend harmful or non-compliant scoring.
- Set incident escalation, investigation, evidence-preservation and cooperation duties against the actual reporting triggers. Allocate customer and regulator communications to the responsible entity, while preserving each party's statutory duties.
- Define service continuity, an alternative operating route, transition assistance, data export and continuing access to necessary records. Require return or demonstrable deletion at exit, subject to lawful retention. Allocate transition costs, liability and insurance expressly.
These provisions draw on the Outsourcing Regulation, Articles 4–7 and 9–11; Outsourcing Standards, §5; Operational Risk Management Regulation, Articles 8 and 11–15; and Model Management Standards, §§4 and 6–10. Proposed service levels, liability allocation and any source-code escrow must be negotiated for the actual dependency. Those commercial terms do not transfer the bank's regulatory accountability.
Incident deadlines need particular care. POPIA requires an operator to notify the responsible party immediately on the statutory trigger. UAE rules require immediate notification for specified significant data breaches and material outsourcing events. The 2026 Operational Risk Management Regulation separately sets four-hour initial and 24-hour summary reporting for qualifying critical operational events. Its 72-hour rule concerns a different category of high-risk incidents. A general 72-hour supplier notice clause would leave earlier duties unsupported. (POPIA, ss. 21(2) and 22; Consumer Protection Standards, §6.1.2.6; Outsourcing Regulation, Art. 9.4; Operational Risk Management Regulation, Art. 15.)
Exit rights must also be deliverable from South Africa. An assignment, outward licence or release arrangement involving South African intellectual property can require exchange-control approval or an applicable authorised-dealer permission. Confirm the route before promising rights that take effect on default or termination. Data ownership, pre-existing model rights and the bank's continued-use rights should be addressed separately. (Exchange Control Regulations, 1961, regs. 10(1)(c) and 10(4); South African Reserve Bank, Currency and Exchanges Manual for Authorised Dealers, §B.2(A).)
Before signing, the bank should complete the service classification, due diligence and required outsourcing non-objections. Before identifiable data access, the parties should complete the location map, customer permissions, country-law safeguards and applicable South African processing permissions. Before production, the bank should accept independent validation, test customer review and operational fallback, and complete any Article 12.5 implementation process.
The release record should identify each requirement, its owner, the supporting evidence and any unresolved condition. If a condition fails, the response is specific: restrict foreign access, reduce supplier decision authority, change the model or postpone deployment. That gives the bank and supplier a contract they can operate within the approved service scope.
Scope an AI bank-supplier review. Send the service description, proposed bank agreement and data-location map. Licentium can scope the legal review, contractual changes and evidence needed for the proposed deployment.