How financial institutions in United Arab Emirates meet them with Fortanixor — banks, exchange houses, payment providers, microfinance and fintechs supervised by the Central Bank of the UAE.
Regulation refs: CBUAE Consumer Protection Standards (Circular 8/2020); CBUAE Outsourcing Regulation for Banks (Circular 14/2021)
The UAE is the clearest of the seven markets on where data may live. Article 6.1.6.3 of the Consumer Protection Standards states that all Licensed Financial Institutions must hold and store all consumer and transaction data within the UAE as prescribed by the Central Bank, and must keep a secure backup in a separate location for the retention period. There is no risk-assessment escape hatch and no approval route around it, which is a stricter position than SAMA's cloud rule and far more explicit than anything in the Pakistani or Bangladeshi frameworks.
On authentication CBUAE is principle-based rather than prescriptive. Article 6.1.1.7 requires more than one evidence of identity verification wherever a consumer's identity is verified online, and 6.1.1.8 requires institutions to secure digital transaction processing, implement detailed activity monitoring and enhance consumer identification methods in line with the Central Bank's requirements for strengthening digital channels. CBUAE does not name the mechanism, so a passkey is not mandated — but it satisfies 6.1.1.7 in a single gesture, and the per-ceremony event log is the kind of detailed activity monitoring 6.1.1.8 asks for. The Standards also carry an obligation most frameworks leave implicit: under 6.1.1.10, logs of who accessed consumer data and when must be produced to the Central Bank on request. Two further points come from reading the full Standards rather than Article 6 alone: personal data, documents and records must be retained for a minimum of five years under Article 6.1.6.1, and the complaint management function must itself be situated in the UAE under Article 8.1.1.1. And one caution worth stating plainly — Article 5.1.1.10 prohibits marketing loans and other services to individual consumers by telephone, so an AI voice agent belongs on servicing and consented contact here, not on acquisition calling.
Where a consumer's identity verification is conducted online, the institution must apply more than one evidence of identity verification for electronic services. Consumers must also be advised about directed and repeated online fraud attempts on their accounts so they can take additional precautions.
Institutions must secure digital transaction processing and controls, implement detailed activity monitoring, and enhance consumer identification methods in accordance with the Central Bank's requirements for strengthening digital channels.
Two instruments say this. Under the Consumer Protection Standards all Licensed Financial Institutions must hold and store all consumer and transaction data within the UAE, with a secure backup in a separate location. The Outsourcing Regulation goes further for banks: the Master System of Record, which includes all Confidential Data, must be continuously maintained and stored within the UAE, and customers' Confidential Data must not be shared outside the UAE without Central Bank approval and the customer's prior written consent.
Institutions must provide a safe, secure and confidential environment in all of their delivery channels to ensure a high level of confidentiality and privacy of personal data, and remain responsible for data protection and confidentiality where new technologies are used to deliver financial services.
Institutions must operate a data management control framework with policies, procedures, system controls and checks and balances that protect consumer data and identify and resolve information security breaches, backed by monitoring and preventive controls that detect unauthorised or accidental loss, misuse, modification, access, disclosure or destruction. Access to personal data must be limited to authorised business lines and their staff, and logs recording who accessed consumer databases and when must be provided to the Central Bank as and when requested.
Consumer Protection Standards, Article 6.1.1.6, 6.1.1.10 and 6.1.2.2
All personal data, documents, records and files must be securely retained for a minimum of five years, running from termination of the business relationship, closure of the account, or completion of a casual transaction. Separately, the consumer complaint management function must be situated in the UAE and independent of retail operations management.
Consumer Protection Standards, Article 6.1.6.1 and Article 8.1.1.1
| Requirement | Framework reference | How Fortanixor addresses it | Product |
|---|---|---|---|
| More than one evidence of identity verification for online electronic services | Article 6.1.1.7 | A FIDO2 passkey ceremony supplies two independent evidences in one gesture: possession of the device holding the private key, and the biometric or PIN that unlocks it inside the secure element. Neither is a shared secret, so neither can be phished from the consumer or breached from the institution. | FortAuth |
| Secure digital transaction processing, detailed activity monitoring and enhanced consumer identification | Article 6.1.1.8 | Every authentication ceremony is logged with its result and the reason it was challenged, giving a per-transaction record rather than a session-level one, and Secure Payment Confirmation binds amount and payee into the signature so the record shows what was actually authorised. One passkey credential covers the mobile app, web through cross-device QR sign-in, cardless ATM and 3-D Secure, so identification is strengthened uniformly across channels instead of each falling back to something weaker. | FortAuth |
| Master System of Record and all Confidential Data maintained and stored within the UAE, with no sharing offshore without approval and customer consent | Consumer Protection Standards 6.1.6.3; Outsourcing Regulation Article 6.1, 6.3 and 6.4 | All three products deploy on-premise, into in-region cloud, or hybrid, and Fortanixor has an office in the UAE. An in-country deployment keeps authentication data, speech processing and call records inside the UAE, so it does not create the cross-border flow Article 6 restricts — and it avoids Article 6.3's chain of Central Bank approval plus written customer consent, which is a per-customer obligation an offshore service would otherwise impose on the bank. | FortAuthFortVoiceFortAgent |
| Speech processed without leaving the country | Article 6.1.6.3 | FortVoice processes speech in the bank's own region rather than shipping audio to a global endpoint, which matters here because a voice recording of a consumer instructing a payment is both consumer data and transaction data under this article. | FortVoice |
| A safe, secure and confidential environment in all delivery channels | Article 6.1.1.4 | Credentials are origin-bound and device-held, so a spoofed channel cannot complete a sign-in. On the automated channel, FortAgent discloses that the caller is speaking to an AI agent and can hand off to a person at any point. | FortAuthFortAgent |
| Logs of who accessed consumer data and when, producible to the Central Bank on request | Article 6.1.1.10 | Every FortAgent call is transcribed, scored and summarised with a full audit trail, and every authentication ceremony carries its own record — so an access request can be answered with the actual interaction rather than a reconstruction. | FortAgentFortAuth |
| Access to consumer personal data limited to authorised staff | Article 6.1.1.10 | FortAgent handles routine calls under allow-listed tools and policy controls, so fewer interactions require a person to open a consumer record at all, and those that do are reached through the bank's existing access controls after the caller has been verified. | FortAgent |
| Monitoring and preventive controls to detect unauthorised access to personal data | Article 6.1.2.2 | Optional device fingerprinting and VPN or anonymiser detection surface anomalous sign-in attempts, and the per-ceremony log gives the data-protection function a feed it can monitor rather than a periodic report. | FortAuth |
| Personal data, documents and records retained securely for a minimum of five years | Article 6.1.6.1 | Authentication ceremony records and call transcripts, scores and summaries export into the institution's own retention estate, so the five-year clock is served by the systems the institution already controls rather than by a vendor's retention policy. | FortAuthFortAgent |
| Complaint management function situated in the UAE and independent of retail operations | Article 8.1.1.1 and 8.1.1.2 | FortAgent deploys in-country and hands off to a person at any point, so a complaint raised on an automated servicing call reaches the institution's own UAE-situated complaint function with a full transcript attached, rather than being handled offshore or lost between channels. | FortAgent |
Where a requirement belongs to the bank’s own operations, or where the regulator has published no rule to map to, we say so rather than stretch a row to cover it. This is the boundary of the table above, not a gap in it.
Every clause cited on this page was read in the document below, on the regulator’s own site.
This mapping is provided for guidance and must be validated by the bank's compliance function against the current version of each framework.
Fortanixor has an office in the UAE and deploys on-premise, into in-region cloud, or as a hybrid of the two.
Deployment shapes
Runs on
Microsoft AzureGoogle CloudDeployed into your own account and your own region on any of the three, or on-premise where the data must not leave your estate at all.
CBUAE is principle-based here rather than prescriptive. Article 6.1.1.7 requires more than one evidence of identity verification wherever a consumer is verified online, and a FIDO2 passkey ceremony supplies two in one gesture — possession of the device holding the private key, and the biometric or PIN that unlocks it. Article 6.1.1.8 additionally requires enhanced consumer identification methods and detailed activity monitoring for digital channels, which the per-ceremony event log provides. CBUAE does not name passkeys, so this is a mapping rather than a mandate, and it must be validated by your compliance function against the current version of the Standards.
You have to, and two instruments say so. Article 6.1.6.3 of the Consumer Protection Standards requires all consumer and transaction data to be held and stored within the UAE, with a secure backup in a separate location. The Outsourcing Regulation for Banks (Circular 14/2021) is sharper still: Article 6.1 requires the Master System of Record, including all Confidential Data, to be continuously maintained and stored within the UAE, and Article 6.3 forbids sharing customers' Confidential Data outside the UAE without Central Bank approval AND the customer's prior written consent. Fortanixor has an office in the UAE and all three products deploy on-premise, into in-region cloud, or hybrid, so authentication data, speech and call records stay in country. This matters most for voice: a recording of a consumer instructing a payment is both consumer data and transaction data.
It can, and CBUAE leaves the choice to you. Unlike Turkey, where SMS OTP is prohibited once the mobile app is active, the Consumer Protection Standards do not name any specific mechanism — they require more than one evidence of identity and identification methods that are strengthened in line with the Central Bank's digital channels requirements. Institutions here typically enrol passkeys alongside the existing OTP, move sign-in first, then higher-value transactions, and retire the SMS path once enrolment is high enough.
It cites CBUAE's own article numbering, links to the Rulebook, and separates what the product does from what stays with the institution. The downloadable CBUAE mapping covers Article 6.1.1 through 6.1.6 plus the retention and complaint provisions in 6.1.6.1 and 8.1.1.1, and it names what is outside our scope — consent and disclosure processes, the designated data protection function, the backup obligation. It also records two things we deliberately do not claim: there is no AI-disclosure clause anywhere in the 162-page Standards, so FortAgent's disclosure is not presented as satisfying one; and Article 5.1.1.10 prohibits telephone marketing of loans and services to individual consumers, which bounds outbound use of an AI voice agent in this market.
The full control-by-control mapping for FortAuth, FortVoice and FortAgent, as a document your compliance function can review.
