Armin Moradi, the CEO and Founder of Qashio

For centuries, financial institutions relied on one advantage. Whether it was the range of their products, their pricing, or how far their services could reach. Today, those advantages are easy to replicate. Digital infrastructure is widely available, capital moves quickly across borders, and acquiring customers is increasingly automated. What now sets institutions apart is not the breadth of their offerings or the cost of their services. It is the confidence they inspire.

In a world that is increasingly more fragmented, turbulent, and cautious, trust has become one of the few advantages that cannot be replicated. Global investment patterns illustrate this shift. According to the UNCTAD World Investment Report 2025, foreign direct investment (FDI) remains far below its early 2010s peak, reflecting a world that is more risk-aware and geopolitically sensitive. The World Bank’s Global Economic Prospects also highlights uneven growth and rising uncertainty across regions. This means capital is no longer chasing the highest return; instead it is seeking predictability. And institutions that inspire trust are the ones most likely to attract it.

Capital Moves Toward Certainty

The UAE offers a compelling example. The EMIR report, supported by Qashio, Flows of Capital: Mapping the UAE’s Role as a Global Financial Gateway, shows that FDI into the country reached $40 billion, doubling from 2019 levels, and accounting for 40% of gross capital formation compared to a developed economy average of 4.3%. That differential cannot be explained by tax efficiency alone. It reflects regulatory clarity, institutional stability, and operational reliability, all of which underpin trust

The same principle is playing out at the company level.

UAE banks are increasingly pushing for founders and business owners to separate personal and corporate spending. On paper, that is a compliance issue. In reality, it signals a structural shift. Poor accounting discipline creates risk. Blurred financial lines complicate audits, funding discussions, and cross-border expansion. When investors and regulators examine financial behaviour, governance becomes visible immediately, highlighting that trust begins with discipline.

Designing Trust: Transparency, Control, Reliability

As finance becomes more digital, trust is becoming more measurable. It rests on three interlocking foundations: transparency, control, and reliability.

Transparency is now a baseline expectation. Customers want to know what they are paying, when transactions settle, and how fees are calculated. The scale of global financial flows reinforces this demand. The World Bank estimates that remittance flows to low- and middle-income countries reached $685 billion in 2024. That figure exceeds FDI and official development assistance combined for those economies. When volumes are that significant, even marginal opacity in pricing or settlement becomes economically material, making clarity a matter of cost efficiency at the system level rather than a branding exercise.

Control is equally critical. Modern finance teams operate across distributed workforces, multi-entity structures, and global vendor networks. Organisations lose an estimated 5% of revenue annually to fraud. While fraud has multiple sources, weak internal controls and policy bypass increase exposure. Giving customers direct control of their funds, through stronger controls and policies, helps reinforce trust in financial institutions.

The most resilient organisations design policy directly into their payment infrastructure. Approval hierarchies, spend limits, and permission layers are embedded into the system itself. This allows companies to move quickly without sacrificing oversight. The distinction between proactive and reactive governance is not philosophical. It determines speed, cost of capital, and investor confidence.

Reliability completes the triad. Finance is ultimately about certainty. Platforms must perform consistently. Settlements must arrive when expected. Liquidity windows must be predictable. Inconsistent infrastructure creates friction not just for finance teams, but for suppliers and partners across the value chain.

The Economics of “Free”

Digital finance has conditioned customers to expect “free” services: zero-fee accounts, no-cost cards, complimentary transfers. Yet compliance, fraud monitoring, capital provisioning, cybersecurity, and regulatory reporting all carry measurable costs. If a core financial service is offered at no charge, the obvious question becomes: how is it funded?

Revenue may come from interchange, cross-selling, float income, or data monetisation. None of these are inherently problematic. But misalignment between a provider’s revenue model and a customer’s long-term interests can erode confidence over time.

The question “How good can it be if it’s free?” is not rhetorical. It is structural. Sustainable economics enables sustained investment in compliance, uptime, and risk management. Underinvestment may not be visible immediately, but in financial services, weaknesses surface under stress.

From Compliance to Competitive Moat

Trust can no longer be viewed as a soft metric. It is measurable in capital inflows, in regulatory endorsements, in uptime statistics, and in audit outcomes. It influences valuation multiples and partnership decisions.

Institutions that deliberately design for transparency, embed control within infrastructure, and invest consistently in reliability will compound confidence over time. Those that rely primarily on aggressive pricing or superficial features may gain short-term adoption, but long-term retention is built on predictability.

In a more volatile global environment, the question facing financial leaders is shifting. It is no longer simply about how fast a product can scale or how cheaply it can be distributed. It now depends on the system’s ability to remain reliable under pressure.

Stefan Deiss, CEO and Co-Founder, The Hashgraph Group

The Middle East has moved faster on digital identity than almost any other region in the world. The UAE Pass now connects residents to more than 5,000 government and private services. Saudi Arabia’s Absher platform has issued over 28 million unified digital IDs. Dubai has gone fully paperless across 45 government entities.

But these systems were built for a world where the main challenge was convenience: getting citizens online, reducing paperwork, speeding up access to services. The threats they were designed to handle were stolen passwords, forged documents and basic impersonation.

What they were not built for is an environment where artificial intelligence can generate a convincing human face in seconds, clone a voice from a few minutes of audio, and inject a synthetic video feed into a verification check in real time.

What distributed ledger technology actually adds

Most digital identity systems today are centralised. Your credentials sit in a government or enterprise database, and every time your identity needs to be checked, the system queries that database. Sometimes that means scanning your face against a stored biometric template. Sometimes it means pulling up your document records and cross-referencing them. Either way, the process depends on one central store of information being secure, accurate and available.

The model works until it doesn’t. A single database holding millions of identities is a high-value target. An attacker who gets in does not compromise one person. They compromise everyone. And the tools available to attackers are improving fast.

The GCC fraud detection market has reached $1.2 billion. Deepfake attacks on identity systems are surging globally. In May, the Saudi Data and Artificial Intelligence Authority published updated deepfake guidelines that explicitly recommend blockchain-based provenance systems to establish traceable records of original content. The guidelines identify identity impersonation through cloned voices and facial simulations as a major risk, and single out finance, politics and identity verification as sectors requiring priority monitoring.

This is the context in which distributed ledger technology becomes relevant. Decentralised identity flips the conventional model. Instead of credentials sitting in someone else’s database, you hold them yourself, in a digital wallet on your device. When you need to prove something, you present only the specific credential required. The verification is recorded on a distributed ledger, a shared record maintained across a network of independent computers rather than controlled by any single organisation. Nobody owns it, can alter it, and shut it down.

Then there are zero-knowledge proofs. This is a way of proving something is true without revealing the underlying information. You could prove you are over 18 without showing your date of birth. You could prove you hold a valid professional licence without disclosing your name or address. The verifier gets the confirmation they need. You keep everything else private.

There is no single database to breach. The individual controls what information is shared and with whom. And every verification event is recorded permanently, creating an audit trail that regulators, enterprises and individuals can each trust independently.

In Sharjah, decentralised identity infrastructure has been integrated across a smart city ecosystem, making it one of the first urban environments in the world where residents, buildings and services interact through digital credentials rather than centralised databases.

The physical presence problem

There is a further gap that even well-designed digital identity systems do not currently address: physical presence.

Identity verification today confirms who someone claims to be remotely. It checks documents, runs facial recognition, performs biometric matching. What it cannot confirm is that a real human being is actually sitting in front of the screen. A synthetic face, a cloned voice and an injected video feed can sail through remote checks that were designed for an era when faking a human was genuinely difficult. That era is over.

The technology to close this gap exists. Ultra-wideband radar, the same short-range spatial sensing found in consumer devices, can detect physical presence with sub-10-centimetre accuracy. It can pick up vital signs such as breathing and heartbeat as a liveness check. When that presence event is cryptographically bound to a decentralised identity credential and recorded on a distributed ledger, the result is a tamperproof record proving a specific individual was physically present at a given location at a given time, verifiable by any authorised party without exposing personal data.

The applications stretch across sectors. In transport, a traveller approaching a gate at an airport or train station could be verified instantly: identity confirmed, physical presence proven, the event recorded permanently. The same logic applies to stadiums, conferences, concert venues and any gated environment where ticket fraud is a problem.

Why the Middle East is the right place for this conversation

The UAE government has announced its intention to transition 50 per cent of federal sectors and services to agentic AI within two years. When AI agents begin autonomously processing licences, permits, compliance checks and cross-border transactions, the question of who authorised what, and whether a human was genuinely involved at the point of decision, becomes critical. Without a verifiable link between a physical person and a digital action, agentic AI systems become vulnerable to impersonation at a scale that manual fraud teams cannot monitor.

The region also has structural advantages that most other markets do not. Governments in the Gulf are bringing policy, investment and technology deployment together under unified national strategies. Saudi Arabia’s Vision 2030, the UAE’s digital economy strategy targeting 20 per cent of non-oil GDP by 2030, and the broader push toward smart city infrastructure all create an environment where new identity infrastructure can move from concept to deployment far faster than in markets weighed down by legacy systems and fragmented regulation.

What comes next

The digital identity systems the Middle East has built over the past decade are genuine achievements. But they were designed for a world where the person on the other end of a verification check was assumed to be real. That assumption is becoming less reliable every quarter.

The next generation of identity infrastructure needs to do three things. It needs to remove single points of compromise by decentralising how credentials are stored and verified. It needs to give individuals control over their own data through zero-knowledge proofs and selective disclosure. And it needs to prove physical presence at the moment of verification, closing the gap that synthetic media is already exploiting.

About the Author:
Stefan Deiss is Co-Founder and CEO of The Hashgraph Group (THG), a Swiss-based Web3 and AI technology engineering company specialising in enterprise solutions built on the Hedera network.

Stefan brings over two decades of experience in technology and business transformation. He spent 11 years at Orange Business Services before moving to Zurich Insurance Group, and went on to found his own consulting firm in 2013. In 2016, he co-founded The Hashgraph Group, which today operates globally with offices across Switzerland, Abu Dhabi, Hong Kong, and beyond.

Under his leadership, THG has developed a suite of enterprise products including TrackTrace for EU Digital Product Passport compliance, IDTrust for decentralised digital identity, and EcoGuard for sustainability and carbon markets. He is also co-inventor of CITI (Continuous Identity Trust Infrastructure), a patent-pending cryptographic framework that binds physical presence to digital identity.

As geopolitical uncertainty, tighter liquidity and digital disruption converge, the CRO role is evolving from compliance gatekeeper to strategic business leader.

For much of the past decade, GCC banks operated in an environment defined by strong liquidity, rapid credit expansion and relatively stable macroeconomic conditions. Supported by high oil revenues and ambitious national growth agendas, the region’s banking sector became synonymous with resilience, scale and sustained growth.

That resilience has been tested in recent months and, so far, the sector has responded well. Recent banking data published by the Central Bank of the UAE (CBUAE) and the Saudi Central Bank (SAMA) suggests that customer deposits have continued to grow despite heightened regional uncertainty.

Customer deposits increased by 17% year-on-year as of April 2026, and 2% from February to April 2026 in the UAE, while in Saudi Arabia, the growth in deposits was 11% year-on-year as of April 2026 and 2% from February to April 2026 , reinforcing both markets’ positions as regional safe havens for capital. Growth in monetary aggregates and non-resident deposits further suggests that regional and international investors continue to view GCC banking systems as stable, well-capitalized and resilient.

Importantly, there is little evidence so far of the capital flight or systemic liquidity pressures that some observers initially feared. Instead, the data suggests that the UAE and Saudi Arabia continue to play an important role as regional safe havens for capital, supported by strong banking fundamentals, prudent regulation and proactive central bank intervention.

Central banks have also played an important role. Proactive interventions helped preserve liquidity, support credit expansion and provide targeted relief to sectors facing short-term disruption. In the UAE, banks were able to extend working capital facilities and restructure short-term obligations for fundamentally healthy businesses, helping bridge temporary cash-flow pressures while maintaining confidence across the financial system.

As a result, resilience is no longer simply a measure of capital strength. It has become a strategic capability that underpins the sector’s ability to navigate an increasingly complex operating environment.

However, what is clearer than ever before is that the operating environment around banks is changing rapidly—and as a result, so is the role of the CRO.

The recent regional conflict accelerated that realization. Traditional stress-testing models were largely designed around financial shocks such as market volatility, liquidity tightening, and credit deterioration. What many institutions are now confronting is a far broader challenge, where geopolitical tensions, cyber threats, operational resilience, and credit risk can all influence one another simultaneously.
Across the GCC, this has prompted some banks to reassess whether existing business continuity and resilience frameworks are sufficiently equipped for a far more interconnected risk landscape.

This is particularly relevant in a region where regulatory frameworks have prioritized sovereignty, local data residency, and operational control. Recent events have also created an opportunity for institutions to reassess how these strengths can be balanced with greater operational flexibility and diversification, e.g., for digital data storage.

At the same time, a second structural shift is unfolding more quietly beneath the surface.

According to analysis from FTI Consulting, GCC banks originated close to $1 trillion in new lending between 2020 and 2025 across Saudi Arabia, the UAE and Qatar. Much of this growth took place during a prolonged low-interest rate environment and elevated liquidity conditions, meaning many portfolios, particularly across real estate and mortgage lending, have not yet been tested through a full economic stress cycle.

That could create a more complex operating backdrop for the years ahead.
For banks, the longer-term risk is not simply operational disruption. While business continuity and cybersecurity remain critical priorities, credit risk remains equally important. If short-term disruption were to evolve into a prolonged economic slowdown, pressure could emerge across borrower segments and asset classes, particularly in sectors that have benefited from strong credit expansion in recent years. In certain scenarios, a meaningful correction in real estate markets would have implications not only for borrowers but also for portfolio performance and risk provisioning across the banking sector.

This is precisely the type of forward-looking scenario that CROs must now anticipate, rather than simply respond to.

Modern CROs are increasingly expected to balance resilience, growth, operational continuity and profitability simultaneously, while helping institutions navigate a far more dynamic and interconnected operating environment. More importantly, the CRO can no longer afford to be purely backward-looking.

The institutions likely to outperform over the next decade will be those capable of identifying disruption early, adapting faster and embedding risk intelligence directly into strategic decision-making.

That requires a fundamentally different approach to risk management. One built around predictive intelligence, integrated scenario planning, dynamic stress testing and real-time decision-making.

Artificial intelligence and advanced analytics are becoming increasingly important in that transition.

Some leading regional banks are already investing in AI-enabled underwriting, early-warning systems and advanced collections capabilities that allow them to identify stress signals earlier and make more sophisticated portfolio decisions in real time. Others, however, continue to rely on fragmented legacy systems, manual workflows and reactive operating models.

That gap may become increasingly important during periods of disruption. Institutions that can identify emerging stress earlier, underwrite more effectively and anticipate portfolio deterioration before competitors will inevitably benefit from lower risk costs and stronger resilience outcomes.

Because in this new environment, resilience itself is becoming a competitive advantage.

The banks most likely to succeed will not necessarily be the largest or most conservative institutions. They will be the organizations capable of integrating risk more directly into strategic decision-making, modernizing operational infrastructure and responding dynamically to an increasingly volatile external environment.

The broader lesson for the sector is clear.

The GCC banking industry is entering a new era where resilience can no longer be measured purely through capital strength or regulatory compliance. Increasingly, resilience will be defined by adaptability and the ability to proactively anticipate interconnected geopolitical, operational, technological and economic disruption in real time.