Al Masraf has signed a strategic agreement with Moody’s, a global provider of financial intelligence and risk assessment, marking an important step in strengthening the Bank’s risk management and credit capabilities through enhanced data, insights and technology.

The agreement was formalized during a signing ceremony held in Abu Dhabi, bringing together senior leadership from Al Masraf and Moody’s. The collaboration reflects both organizations’ commitment to leveraging advanced intelligence and risk expertise to support informed, data-driven decision-making in an increasingly complex financial environment.

As risks become increasingly interconnected and the financial landscape continues to evolve, access to timely, reliable and actionable intelligence is becoming essential for financial institutions. Through its combination of data, intelligence, risk expertise and technology, Moody’s helps organizations better understand interconnected risks.

The partnership will further support Al Masraf’s continued focus on strengthening its risk management framework, enhancing credit decision-making and building resilient, forward-looking capabilities that support sustainable growth.

Commenting on the occasion, Fuad Mohamed, CEO of Al Masraf, said: “At Al Masraf, we believe that sustainable growth is built on the strength of our ability to understand risk, anticipate change and make informed decisions. Our collaboration with Moody’s represents an important step in advancing our risk and credit capabilities through deeper intelligence, data and technology.”

He continued: “As the financial landscape continues to evolve, partnerships of this nature enable us to strengthen our resilience, enhance decision-making and create greater value for our customers and stakeholders. We look forward to building on this collaboration as we continue to shape a more agile, intelligent and future-ready Al Masraf.”

“We are delighted to partner with Al Masraf on an important step in modernizing its corporate lending operations. By bringing greater automation, efficiency, and insight to the credit journey, Moody’s is helping the bank build a future-ready operating model that enables faster, better-informed lending decisions, strengthens governance, and enhances risk management.” said Wael Jadallah, Managing Director, Head of Asia Pacific and Middle East at Moody’s.

Senior representatives from both organizations attended the signing ceremony.

Representing Al Masraf were Fuad Mohamed, Chief Executive Officer; Moataz Khalil, Chief Wholesale Banking Officer; Safeya Almarzooqi, Chief Credit Officer; Mirel Baila, Acting Chief Operating Officer; Rohit Kumar, Chief Risk Officer; and senior representatives from the Bank’s Wholesale Banking, Credit, Risk, Information Technology, Islamic Banking, Corporate Banking, Project Management and Business Management functions.

Representing Moody’s were Wael Jadallah, Managing Director, Head of Asia Pacific and Middle East; Brendan Gavaghan, Senior Director, Middle East; Raghavendra Katagade, Director, UAE; Blaine Connan, Director, UAE; Ali Abdullah, Director, UAE; and Anand Thirunellai Radhakrishnan, Senior Director, Middle East & Europe.

The agreement underscores Al Masraf’s commitment to continuous innovation and adopting advanced capabilities that strengthen its ability to navigate an evolving risk environment, while supporting the Bank’s broader ambition to deliver sustainable growth and enhanced value to its customers and stakeholders.

With the dirham pegged to the US dollar and UAE investors exposed to global markets, decisions made by the Federal Reserve and the US government can influence local borrowing costs, liquidity, and investment
sentiment. Michael Smirnow, Chief Investment Officer, Arabian Capital Gulf
After the global financial crisis, U.S. authorities tried to stimulate the economy primarily through monetary measures: the Federal Reserve cut interest rates to zero and launched quantitative easing (QE) for the first time, purchasing assets to provide market participants with liquidity. As a result, the Fed’s balance sheet grew to USD 8 trillion by 2021. However, between 2008 and 2020, the U.S. economy did
not experience rapid growth, and inflation regularly remained below the target level. Everything changed in 2020, when the government entered the stimulus fray for the first time in many years. While the Fed’s accommodative monetary policy primarily helped large banks and market participants, at the onset of
the pandemic the U.S. government began distributing money to households and increasing budget expenditure across nearly all areas. Compared with monetary measures, these fiscal stimulus measures proved to be a significantly more powerful tool for stimulating the economy; however, they increased
government debt by the aforementioned 61%. Against this backdrop, we expect the next few years to be shaped primarily by fiscal stimulus, with
government action, rather than the Federal Reserve, becoming the key factor for investors. Indeed, while the private sector ran large deficits before 2008, the deficit now lies with the government, while private-sector indebtedness is declining. In the years following the pandemic, the largest government deficits coincided with the strongest growth in financial markets. This is unsurprising, since a public-sector deficit becomes private-sector income. This dynamic enabled the U.S. economy to remain resilient in 2023-2024 despite the Fed’s record pace of interest-rate increases. Whichever U.S. political party is in power will continue along this path;

Trump is also doing the same through legislation known as the “Big Beautiful Bill.” As long as inflation in the United States remains under control, this race will continue.
The current balance between monetary and fiscal stimulus vividly illustrates this argument. On the one hand, the U.S. Federal Reserve is adopting an increasingly neutral stance and is clearly in no hurry to cut interest rates or introduce new stimulus programmes. On the other hand, the Treasury is entering the fray: as yields on long-term U.S. bonds confidently exceed 5%, the Treasury has launched a program to buy back its long-term debt. In effect, this gives the bond market the same kind of stimulus the Fed previously delivered.

Thus, the balance of power is changing, but the direction remains the same: the United States still needs accommodative monetary conditions. If these are not achieved through monetary measures, they will be achieved through fiscal ones.
(Arabian Gulf Capital (AGC) holds a Category-1 Investment Firm license issued by the Central Bank of Bahrain and provides tailored investment solutions to individual, corporate, and institutional clients.)

As GCC businesses expand into new markets and increasingly complex supply chains, traditional credit assessment is giving way to a more predictive approach. In this interview with Mohamad Jomaa, CEO and Country Manager for GCC and Egypt at Coface, we explore how real-time data, AI and early-warning intelligence are helping CFOs anticipate payment risk, protect working capital and make more confident decisions across customers, suppliers and markets.

What is driving the shift from relationship-based credit decisions to predictive credit intelligence among CFOs in the GCC?

Relationships remain fundamental to business in the GCC and will continue to be. What has changed is the speed at which companies are expanding into new sectors, markets, and supply chains. As organizations grow beyond their traditional networks, finance leaders need additional tools to assess customers, suppliers, and partners they may not know well.

Today’s CFOs are increasingly complementing business relationships with data-driven insights. They need greater visibility not only into credit risk, but also into supply chain dependencies, corporate ownership structures, payment behavior, and potential vulnerabilities across their ecosystem.

Predictive intelligence provides that forward-looking perspective. It helps businesses make faster and more informed decisions, strengthen due diligence processes, identify opportunities, and anticipate risks before they impact cash flow, operations, or growth plans.

What trends are you currently seeing in payment delays and corporate defaults across the UAE and Saudi Arabia?

The overall economic outlook in both the UAE and Saudi Arabia remains positive, supported by ambitious investment programs and continued economic diversification. At the same time, businesses continue to face uneven market conditions across sectors.

Drawing on Coface’s unique experience as a global trade credit insurer, we monitor payment behavior, claims activity, and credit events across millions of companies worldwide. What we are seeing today is not necessarily a significant increase in corporate failures, but rather signs of pressure on working capital in specific industries.

Payment delays have become more common in sectors exposed to longer project cycles, margin pressure, or supply chain disruptions. For finance leaders, the challenge is distinguishing between temporary liquidity constraints and deteriorating credit quality. This is where access to real-time payment data and early warning indicators becomes particularly valuable.

How can better credit intelligence improve cash flow, working capital, and overall financial resilience?

Better intelligence enables businesses to make more informed decisions across the entire customer and supplier lifecycle. By combining financial information, payment behavior, sector analysis, ownership data, Country Risk Assessments, Sector Risk Assessments, and ongoing monitoring, organizations gain a much clearer view of both risk and opportunity.

This has a direct impact on cash flow and working capital. Businesses can identify signs of financial stress earlier, reduce exposure to overdue accounts, prioritize collections efforts, and allocate credit more effectively. Access to real-time information and early warning indicators allows companies to act before issues translate into cash flow challenges.

Increasingly, however, financial resilience is not only about customer risk. It is also about understanding vulnerabilities across the supply chain. A disruption involving a key supplier, contractor, or logistics partner can have a significant impact on operations, costs, and liquidity. Better intelligence provides greater visibility into these critical dependencies, helping organizations identify concentration risks, assess the financial health of strategic partners, and strengthen business continuity planning.

As companies expand into new markets and engage with new customers, suppliers, and partners, they need confidence in who they are doing business with. Access to reliable data on ownership structures, financial health, payment behavior, sector outlooks, and country risk helps organizations make better-informed decisions and reduce uncertainty when entering new commercial relationships.

. What warning signs should finance leaders monitor before extending credit to new customers or entering unfamiliar markets?

Financial statements remain important, but they only tell part of the story. Finance leaders should also evaluate payment behavior, ownership structures, management stability, sector outlooks, supplier concentration, and exposure to geopolitical or regulatory risks.

One of the most valuable early warning indicators is a deterioration in payment behavior. In many cases, companies begin showing signs of financial stress long before it becomes visible in published financial statements.

Similarly, supply chain concentration risks should not be overlooked. A business may appear financially sound while remaining highly dependent on a small number of customers, suppliers, or projects. Understanding these dependencies is an increasingly important component of due diligence.

Effective credit decisions require a broader assessment of the business ecosystem rather than focusing solely on traditional financial metrics.

This is why a combination of company information, payment behavior, Country Risk Assessments, Sector Risk Assessments, and supply chain intelligence is increasingly becoming an essential part of the decision-making process.

How are AI and predictive analytics changing the way organizations assess credit risk and make financing decisions?

Financial statements remain important, but they only tell part of the story. Finance leaders should also evaluate payment behavior, ownership structures, management stability, sector outlooks, supplier concentration, and exposure to geopolitical or regulatory risks.

One of the most valuable early warning indicators is a deterioration in payment behavior. In many cases, companies begin showing signs of financial stress long before it becomes visible in published financial statements.

Similarly, supply chain concentration risks should not be overlooked. A business may appear financially sound while remaining highly dependent on a small number of customers, suppliers, or projects. Understanding these dependencies is an increasingly important component of due diligence.

Effective credit decisions require a broader assessment of the business ecosystem rather than focusing solely on traditional financial metrics.

This is why a combination of company information, payment behavior, Country Risk Assessments, Sector Risk Assessments, and supply chain intelligence is increasingly becoming an essential part of the decision-making process.

What sectors in the GCC are showing the strongest opportunities, and where are the highest risks based on your data?

Our outlook combines insights from Coface’s payment experience data, claims observations, Country Risk Assessments and Sector Risk Assessments. Together, these provide a comprehensive view of the opportunities and vulnerabilities shaping the business environment across the GCC.

We continue to see attractive opportunities in sectors supported by economic diversification strategies, digital transformation, infrastructure investment, logistics development and the energy transition. These areas are benefiting from sustained investment, strong policy support and growing regional demand.

At the same time, businesses operating in sectors facing tighter margins, elevated input costs, project execution challenges or longer payment cycles require closer monitoring. What is important to remember is that risk is rarely uniform across an entire sector. Performance can vary significantly from one company to another depending on its financial strength, competitive positioning, customer base and exposure to broader supply chain dynamics.

Looking ahead, how do you see the role of predictive intelligence evolving within corporate finance over the next three to five years?

Over the next three to five years, predictive intelligence will become an integral component of decision-making across finance, procurement, sales, treasury, compliance, and risk management functions.

We expect companies to move beyond using intelligence solely for credit assessments and begin embedding it throughout the business. This includes supplier selection, customer onboarding, supply chain management, compliance checks, investment decisions, and strategic planning.

The organizations that will be most successful are those that can combine technology, data, and human expertise to obtain a holistic understanding of their business ecosystem.

In an increasingly interconnected world, success will depend not only on knowing who you do business with, but also on understanding the risks and opportunities across the entire value chain. Access to reliable, forward-looking intelligence will therefore become a key competitive advantage, helping companies grow confidently while remaining resilient in a rapidly changing environment.

Standard Chartered today announced the expansion of its institutional Bitcoin (BTC/USD) and Ether (ETH/USD) spot trading in the UAE through ‘Standard Chartered DIFC’[1].

This makes Standard Chartered the first Global Systemically Important Bank (G-SIB) to offer the capability in the market and the only global bank currently offering institutional digital asset spot trading in the region. The move further broadens the bank’s regulated digital asset offering in the UAE by adding execution to its custody offering.

The capability enables eligible institutional clients to access deliverable Bitcoin and Ether spot trading through Standard Chartered’s electronic trading channels. It is integrated into the Bank’s existing platforms, enabling clients to access crypto-asset trading through familiar FX interfaces.

Clients may settle trades with a custodian of their choice, including Standard Chartered’s digital asset custody solution that was launched in September 2024.

Rola Abu Manneh, Chief Executive Officer, UAE, Middle East and Pakistan at Standard Chartered, said: “The UAE has developed a clear digital assets regulatory framework that supports institutional participation and innovation. Extending our Bitcoin and Ether spot trading capability to institutional clients is a significant step in broadening our regulated digital asset proposition in the market. By combining execution with secure custody, governance and the connectivity of a global bank, we are providing clients with a more integrated way to participate in digital asset markets.”

Christopher Parsons, Senior Executive Officer, Standard Chartered DIFC, said: “DIFC provides an established platform for international financial institutions to deploy global capabilities across markets. Extending our institutional digital asset trading capability through the Centre demonstrates the strength of that model, combining Standard Chartered’s global markets expertise and network with a regulated base from which we can serve clients across the region.”

Standard Chartered first introduced institutional Bitcoin and Ether spot trading through its UK branch in July 2025, becoming the first G-SIB to offer deliverable spot crypto-asset trading to institutional clients. The UAE launch extends that established global capability into a market where the Bank has been building its institutional grade digital assets offering.

The latest UAE capability builds on Standard Chartered’s broader digital assets strategy, which spans custody, trading and tokenisation capabilities through its Corporate and Investment Bank, while its ventures ecosystem extends these capabilities through Zodia Markets and Libeara. Together, these capabilities are designed to support institutional clients’ evolving digital asset needs through regulated infrastructure and services.

Dhruva will adopt the Ryan brand across the UAE and Saudi Arabia by the end of 2026, uniting the practice with Ryan’s global identity and international platform.

Dhruva, a leading tax consultancy firm in the Middle East, and Ryan, a leading global tax services and software provider, today announced that Dhruva will transition to the Ryan brand across the United Arab Emirates (UAE) and the Kingdom of Saudi Arabia. The rebranding will be completed by the end of 2026, bringing the practice under Ryan’s global identity and reinforcing its position as part of the world’s leading global-scale specialist in business tax.

The transition marks the next phase of the strategic joint venture announced in 2025 and reflects the continued integration of Dhruva’s regional capabilities with Ryan’s global platform, technology, and international resources. Clients across the Middle East will continue to benefit from the same trusted advisory teams, enhanced by access to Ryan’s worldwide expertise and service capabilities.

“The Middle East has been a strategic growth market for us for many years, and we have built a strong advisory practice founded on deep client relationships, technical excellence, and local market understanding,” said Dinesh Kanabar, Founder, Chairman, and CEO, Dhruva Advisors and Vice Chairman, Ryan.

“The transition to the Ryan brand marks a significant milestone in our journey and reflects the strength of our partnership. By combining our regional expertise with Ryan’s global scale, technology, and international capabilities, we are creating an even stronger platform to support clients across the region as they navigate an increasingly dynamic and evolving tax landscape.”

“The Middle East is one of the most important growth markets for tax advisory services globally, and we are investing in the region with a long-term view,” said Tom Shave, President of Ryan’s European and Asia-Pacific Operations. “Uniting under the Ryan brand strengthens how we serve clients across the UAE, Saudi Arabia, and Europe—bringing seamless access to our global expertise, technology, and international resources through one trusted platform. This transition marks an important milestone in our integration and reinforces our commitment to the region’s future.”

Ryan will continue to invest in its Middle East operations, expanding its team, capabilities, and regional presence across key markets, including Dubai, Abu Dhabi, and Riyadh. The practice provides comprehensive tax advisory services spanning corporate tax, value-added tax (VAT) and indirect tax, transfer pricing, mergers and acquisitions (M&A) tax structuring, research and development (R&D), and cross-border compliance.

“The response from our clients over the past year has been the clearest validation of this partnership,” said Nimish Goel, Leader, Middle East, Dhruva, a Ryan Affiliate. “From the outset, our teams have been integrating Ryan’s global capabilities in technology, specialized expertise, and best practices into the work we already lead in the region. Adopting the Ryan brand is the natural next step. It is the same people and the same trusted relationships, now carrying the name of the largest Firm in the world dedicated exclusively to business taxes.”

The rebranding will be implemented in phases during the second half of 2026, with signage, visual identity, and digital properties transitioning to the Ryan brand across the region.

By Manish Bansal, Associate Partner, Dhruva Advisors, A Ryan Affiliate, Saudi Arabia

For most of the past five years, inter-alia, one of the major topics of tax conversation in Saudi boardrooms has been e-invoicing. Are we on the Fatoora platform? Which wave are we in? Has the ERP been configured or do we go with a third-party e-invoicing solution? Will we make the deadline?

Those were the right questions for the period we have just left. They are not necessarily the right questions for the period we are entering.

On 29 June 2026, the Zakat, Tax and Customs Authority (“ZATCA”), acting on a decision of the Minister of Finance, extended the Cancellation of Fines and Exemption of Financial Penalties initiative for a further six months, running from 1 July to 31 December 2026. It covers excise tax, value added tax, real estate transaction tax, withholding tax and corporate income tax. That much has been widely reported.

Less widely noticed is a condition set out in the accompanying guideline. If the Authority extends the initiative again past December, that further extension will not reach returns that fell due after 30 June 2026.

The Authority has not simply granted more time. It has informed the market, in advance, where the relief eventually stops. Whatever is announced in December, the clean-up window for historical positions is being drawn shut. For a tax administration, that is about as clear a statement as one can give.

What the regulator already sees

The reason this matters now, rather than in some indeterminate future, is that the Authority’s information position has changed fundamentally.

Wave 24 of the e-invoicing Integration Phase closed on 30 June 2026. Announced in September 2025, it captured every taxpayer whose VAT-subject revenues exceeded SAR 375,000 in 2022, 2023 or 2024. That figure is not arbitrary: it is the mandatory VAT registration threshold. In effect, the wave brought the entire registered population into scope.

And the direction has not stopped there. On 24 July 2026 – ZATCA published the criteria for Wave 25, halving the threshold to SAR 187,500 of VAT-subject revenue in 2022, 2023, 2024 or 2025, with integration required by 1 February 2027.

Under the Integration Phase, standard business-to-business invoices are cleared by ZATCA before they reach the buyer, and simplified business-to-consumer invoices are reported within twenty-four hours. Invoices must be issued in a prescribed structured format, carrying a cryptographic stamp and a unique identifier.

The Authority is therefore no longer reliant on what appears in a filed return. It holds the underlying transactional record, in structured form, close to real time, across the whole economy.

This is the shift most finance functions have not yet absorbed. For years, the Saudi assessment process began with an information request. In an environment of structured, near-live data, it begins instead with an anomaly the system has already identified. The taxpayer’s first substantive contact with the process is not a request for documents. It is a proposition to be answered.

Key exposure areas to be mindful of

In our experience, the following key areas could be more visible and exposed to assessment risk in the Kingdom once transactional data can be cross matched against declarations.

The first is permanent establishment risk arising from project delivery. Groups routinely deploy technical staff, secondees and subcontracted specialists into Saudi projects while treating the arrangement as an offshore supply.  Given that most KSA government portals are inter-linked, careful monitoring of in-Kingdom presence is critical, in particular, employees of non-resident companies undertaking fly-in/fly-out assignments in the Kingdom.  It is worth noting that the current tax law has no de minimis threshold for the creation of a permanent establishment.  Accordingly, even a single day of presence in the Kingdom could potentially give rise to a permanent establishment, although in practice, the ZATCA may apply a more facts-based approach when assessing whether a permanent establishment exists.

Second is related-party pricing, and here a change that took effect two years ago is still under-appreciated. Following amendments to the Transfer Pricing By-Laws, the transfer pricing provisions apply to zakat payers as well as taxpayers for financial years beginning on or after 1 January 2024, and Advance Pricing Agreements became available to both. For a Saudi family group with decades of intercompany arrangements built for operational convenience rather than for documentation, this is a material change in obligation, and one that many such groups have not yet worked through.

Lastly, needless to state that VAT audits are likely to get much more sophisticated with real time data and the data analytics and AI tools available.

What the amnesty covers, and what it does not

Many companies are counting on this window. It is worth being precise about what it covers.

The initiative covers late registration, late payment and late filing fines, penalties on the amendment or correction of a VAT return, and other financial fines imposed under Article 45 of the VAT Law, including field detection and e-invoicing violations. To benefit, a taxpayer must register where registration is required, submit the outstanding returns, and either pay the amounts due or obtain ZATCA’s approval for an instalment plan.

Two limits deserve emphasis. The initiative does not extend to penalties relating to tax evasion violations. And it operates on fines for returns falling due up to 30 June 2026.

There is also a point that no guideline states because it does not need to. The initiative waives penalties. It does not validate a technical position. A voluntary disclosure that corrects an arithmetic omission is a straightforward matter. A voluntary disclosure that reveals a contestable tax treatment is a different exercise entirely, because it puts a position on the record that will be read. The analysis must come before the filing, not after it.

Fewer than four months

For most groups, what remains to be done before 31 December is a short list. It is also, notably, not a systems exercise. The e-invoicing platforms are already built and connected. The work now is reviewing the positions those systems have been reporting all along.

Reconcile first. Take VAT/ Tax/ Zakat returns, customs declarations, withholding tax filings and audited financial statements for the open years and reconcile them against one another before ZATCA’s systems do it. Where the numbers do not tie, understand why, and document the reason contemporaneously rather than reconstructing it under assessment.

Then sort. Separate the genuine errors, which the current window is designed to resolve, from the judgement positions, which need to be assessed on their merits and defended with evidence that pre-dates the query.

Finally, treat documentation as a deliverable with a deadline. Substantiation assembled after an assessment notice arrives carries markedly less weight than substantiation prepared when the transaction occurred.

A regulator that publishes wave criteria six months ahead, that notifies taxpayers directly, that issues guidance with worked examples, and that tells the market in advance where relief will end, is behaving like the administration of a mature investment destination. That predictability is an asset for serious businesses, and it is what long-term capital looks for.

But predictability runs in both directions. The Kingdom has been clear about what it expects and when. The businesses that will move through the coming assessment cycle with least disruption are those that use the next few months to answer the questions before they are asked.

Disclaimer: This article is intended for general information only and does not constitute tax, legal, accounting or other professional advice. It reflects the tax rules in force as of the publication date, and the described regulatory landscape continues to develop. Readers should obtain professional advice appropriate to their own facts and circumstances before acting on any matter discussed.

The collaboration broadens Al Ansari Exchange’s portfolio of third-party products and extends access to Dubai’s integrated mobility payment system through the UAE’s largest branch networks. It also reflects the company’s strategy of building a connected physical and digital ecosystem that provides customers with convenient access to a wider range of everyday financial and lifestyle services.

Residents and visitors can now purchase nol Travel Cards from selected Al Ansari Exchange branches, distributed through MDX Technology Solutions ME, the RTA-authorised distributor of nol Travel Cards, providing an additional point of access to one of Dubai’s most widely used mobility payment solutions.

The nol Travel Card enables cashless payments across Dubai’s public transport network, including the Dubai Metro, Dubai Tram, public buses, marine transport and public parking. It is also accepted at more than 14,000 retail outlets across the UAE. Through the nol Pay App, cardholders can access more than 200 lifestyle offers and discounts.

Commenting on the collaboration, Musad Ibrahim Alhammadi, Director of Automated Collection Systems at Corporate Technology Support Services Sector, Roads and Transport Authority (RTA), said: “Expanding the availability of nol Travel Cards through strategic collaborations supports RTA’s efforts to make mobility services more accessible across Dubai. Providing additional distribution channels contributes to wider adoption of digital payment solutions and enhances the travel experience for residents and visitors.”

Ali Al Najjar, Chief Executive Officer of Al Ansari Exchange, added: “As customer expectations continue to evolve, we are expanding the role of Al Ansari Exchange beyond traditional financial transactions by bringing together financial, payment and everyday lifestyle services through both our branch network and digital platforms. Making nol Travel Cards available through our branches complements our broader strategy of creating a seamless customer experience while supporting Dubai’s vision for a smart, digitally connected city.”

Resilience is not only about cash reserves, backup servers or alternative suppliers. It also depends on whether a company’s legal rights and permissions still work when the business is under pressure.

By: Maroun Abou Harb, Associate at BSA LAW

Resilience is discussed as an operational or financial discipline. Businesses test liquidity, back up systems and diversify supply chains. Yet every continuity plan rests on legal infrastructure: licenses, delegated authorities, contracts, data permissions, employment arrangements, security rights and evidence.

That infrastructure can fail when needed most. The replacement supplier cannot be appointed without third-party consent. Customer data cannot lawfully be moved to the backup provider. An insurance claim is compromized by late notification. A guarantee was signed incorrectly. The company owns a platform, but not all of its intellectual property.

The most dangerous legal risk is not the missing clause. It is the right management assumes the business has, but cannot use.

In the UAE, the Central Bank’s 2026 Operational Risk Management Regulation now requires licensed financial institutions to implement a comprehensive operational risk and resilience proecedure. The principle is valuable for every company: identify what must continue, locate the legal points of failure and test them before disruption does.

1. Can the business lawfully act?

Start with corporate authority, check that licenses match actual activities, constitutional documents reflect the ownership and governance structure, and beneficial-owner, shareholder and director records are accurate. Review reserved matters, signing matrices, powers of attorney and banking mandates.

A deal, borrowing or emergency payment can stall because the authorized signatory is unavailable, a power has expired or an approval threshold was misunderstood. Group companies should confirm which entity employs people, owns assets, contracts with customers and receives revenue.

Run this scenario: if the chief executive and chief financial officer were unreachable tomorrow, who could bind the company, access its accounts and appoint an alternative supplier? If the answer is uncertain, the business has a legal single point of failure.

• Which contracts become dangerous under stress?

Most contract reviews examine value and liability. A resilience review asks a different question: what happens when performance is interrupted?

Build a heat map of critical customer and supplier contracts, ranked by operational importance and consequence of failure. For each, test termination and suspension rights, force majeure and change-in-law provisions, service levels, price-adjustment mechanisms, liability caps, indemnities, insurance, governing law and dispute forum, subcontracting, assignment and change-of-control restrictions. Check notice methods and cure periods; a valuable right can disappear if a notice is sent late or to the wrong address.

Then examine optionality, can the company use a replacement supplier, obtain transition assistance, retrieve its data in a usable format and continue using essential intellectual property? Is there a source-code escrow or step-in mechanism where appropriate?

The aim is not to renegotiate every contract. It is to know which five contracts could stop the business and to fix those first.

• Can technology fail without the legal part failing too?

A technical recovery plan is incomplete if the contracts do not support it. Cloud, payment, telecommunications and managed-service arrangements should align promised recovery times with the company’s tolerance for disruption. Audit rights, incident cooperation, subcontractor controls, data-location commitments and exit assistance should be tested.

The incident playbook must allocate legal decisions. Who determines whether regulators, customers, insurers or affected individuals must be notified? Who preserves evidence and engages external advisers? How will legal privilege or professional confidentiality be preserved? A cyber incident moves quickly; ambiguity over decision-making wastes the hours that matter most.

Conduct an exercise with management, technology, legal, communications and finance. Introduce a realistic vendor outage or data breach and follow the contracts: who calls whom, what must be notified, and what can actually be recovered?

• Does the company know what data and technology it is using?

Across the GCC, privacy and cybersecurity regimes increasingly regulate how data is collected, processed, retained, transferred and protected. A company cannot comply, or recover confidently, without knowing where its data goes.

Create a data map covering customers, employees, vendors and website users. Record the purpose and legal basis for processing, storage location, access rights, retention period, cross-border transfers and third-party processors.

The same exercise should include artificial intelligence, by identifying public and embedded AI tools, the information supplied to them, the outputs relied upon and the human review applied. Confidential information, personal data and third-party intellectual property should not enter a tool because an employee can access it. An approved-use policy, procurement review and output-verification process are proportionate safeguards.

• Can the company protect value when conditions deteriorate?

Management should monitor covenant breaches, unpaid taxes, overdue receivables, expiring insurance, threatened claims and counterparties showing signs of insolvency. The legal team should know which rights permit suspension, security enforcement, contract termination or protective court relief, and whether exercising them could create risk.

People and intellectual property also require continuity planning. Confirm that employment and consultancy terms contain appropriate confidentiality, invention-assignment and post-termination protections, tailored to the governing law. Identify key-person dependencies, succession gaps and access held by departing staff. Register intellectual property where appropriate and maintain evidence of creation and ownership.

Business needs also to review insurance as a contract, not a certificate. Map material risks to coverage, exclusions, deductibles, notification deadlines and consent requirements. The policy is only useful if the company knows how to activate it.

In brief, the output should be that for every critical risk, record the business service affected, relevant entity and contract, responsible owner, required action, deadline and escalation threshold.

Report the highest exposures to the board and repeat the exercise after major acquisitions, restructurings, regulatory changes or technology deployments.

A focused review can produce four useful assets:

1. an authority and obligations calendar;
2. a critical-contract heat map;
3. a data and AI inventory; and
4. a tested incident playbook.

No company can remove disruption. It can, however, remove the uncertainty surrounding who may act, what must be done and which rights remain available.

By Joe David, CEO of Nephos Group

“Move to Dubai for tax.”

I hear this constantly. From founders, investors, crypto-native operators – people building real businesses who reduce one of the biggest decisions of their professional lives to a single line on a spreadsheet.

And honestly, it is the wrong way to think about it.

Tax should rarely be the sole reason to relocate. When it is, it is usually where things go wrong. The corporate structure is not set up correctly. The banking relationships are not in place. The founder leaves within 18 months because the deeper rationale was never really there. I have seen this pattern play out dozens of times over the past decade, and it almost always traces back to the same root cause: a decision built on a tax rate rather than a strategy.

The tax-first trap

Dubai’s zero per cent personal income tax rate is real, and it is significant. But leading with tax creates a narrow frame that obscures the fuller picture. Founders who relocate purely for a rate often fail to consider the operational realities of building in a new jurisdiction. They underestimate the compliance infrastructure required to make the move defensible. They overlook the substance requirements that tax authorities in their home countries will scrutinise. When the expected savings do not materialise cleanly, because the structure was an afterthought, disillusionment sets in fast.

This does Dubai a disservice. It reduces a genuinely world-class business environment to a line in a tax planning brochure. The city deserves better than that, and so do the founders making life-altering decisions based on incomplete thinking.

What the successful ones actually optimise for

The founders and investors who get the most out of Dubai are not chasing a tax rate. They are making a broader strategic move.

Jurisdictional access is a major factor. Dubai sits at the crossroads of Europe, Africa and Asia, offering time zone coverage and travel connectivity that few cities can match. For businesses operating across multiple markets, particularly in digital assets, fintech and professional services, that geographic positioning is a genuine competitive edge.

Then there is the capital environment. Dubai has become a magnet for institutional and private capital, with fund structures, family offices and venture vehicles establishing a permanent presence. The banking infrastructure, while still maturing in certain areas, has improved significantly. For crypto-native businesses in particular, the regulatory clarity offered by frameworks like the Virtual Assets Regulatory Authority (VARA) provides something that many Western jurisdictions still cannot: a clear, codified path to operating legally with digital assets.

The business ecosystem itself is another draw. The speed at which you can incorporate, hire, open accounts and begin operating is remarkable compared to legacy jurisdictions. Free zones offer tailored licensing, and the government’s responsiveness to emerging sectors – AI, blockchain, tokenised finance – signals a jurisdiction that is building forward rather than regulating backward.

And then, yes, there is the lifestyle. Climate, safety, connectivity, quality of infrastructure. These are not trivial considerations when you are asking a founding team to commit to a base for the next five to ten years.

Tax is often the outcome of all of this. It is not the strategy itself.

The compliance landscape is shifting

There is another reason the tax-first mindset is increasingly risky. The global compliance environment is tightening rapidly. The Crypto-Asset Reporting Framework (CARF), developed by the OECD, will require automatic exchange of information on crypto transactions between jurisdictions. The EU’s DAC8 directive introduces similar obligations across member states. The days of relocating and assuming your home country’s tax authority will not follow are numbered.

This means that substance, genuine economic activity, real operational presence, defensible corporate structures, matters more than ever. A Dubai relocation that is purely cosmetic will not survive scrutiny. One that is built on genuine strategic foundations, with proper advisory support and compliant structures, will.

The conversation worth having

None of this is an argument against moving to Dubai. Quite the opposite. For the right founder, with the right business, at the right stage, it can be a transformative decision. But that decision needs to be grounded in strategy, not arithmetic.

Before you start calculating your tax savings, ask the harder questions. Does your business model benefit from being in this jurisdiction? Can you build genuine substance here? Are your corporate structures defensible under international reporting frameworks? Do you have the advisory infrastructure to get this right from day one?

That distinction – between tax as a tactic and strategy as a foundation – matters more than most people realise. And it is a conversation worth having before you make any decisions.

By: Avi Pardo, Co-Founder & CBO, LeapXpert

Financial firms globally have similar playbooks for off-channel communications: ban the channel, run a training, and send attestations for signing. Yet, the conversations are still happening on personal phones. Calling that playbook ‘good enough’ only hides how little has changed.

More than 100 organisations have faced charges under the US Securities and Exchange Commission’s off-channel communications initiative, while other regulators have pursued similar failures. Yet the response is still another rule, another warning, another ban.

The missing piece is the psychology behind banning. Until firms understand what drives employees towards off-channel apps, even banned ones, the next record-keeping failure is already on its way.

Why employees find workarounds

These channels are already part of the client relationship. A banker may be chasing a decision, dealing with a concern or replying to a question that has come through on Signal, WeChat or WhatsApp. In that moment, getting back to the client takes priority.

If replying through the approved channel takes too long, creates operational friction, or disrupts the conversation flow, the employee is likely to answer somewhere else. The message gets sent, but the firm may never see the full exchange.

Psychologists have studied this response to bans for decades. Jack Brehm’s work on psychological reactance shows people can push back when they feel their freedom of choice has been restricted. Research into imposed workplace change points to the same response: people who feel pushed into a new way of working may quietly find another route. Someone reads the policy, completes the training and then uses a personal phone when a client needs an answer.

Daniel Wegner’s work on ironic rebound also helps explain why bans can misfire. Tell people often enough to avoid something and it can make it more appealing. The channel remains on the phone, the client is waiting and the approved route takes longer.

Once the conversation moves to a personal phone, the firm may never recover the full exchange. Employers also face legal limits on how far they can inspect a private device.

Governance beats the workaround

Governance should redirect behaviour instead of trying to suppress it. Employees need an approved route that works while the client conversation is happening, or the workaround will keep winning.

Financial firms still need clear rules and a complete record of business conversations. Regulators expect those messages to be kept, whether they were sent by email, text, WhatsApp or another service.

The problem usually shows up during an ordinary working day: between meetings, on a journey or while a client is waiting for an answer. If the approved channel holds things up, few people will pause the conversation to sort out the process. They will reply another way.

Businesses are losing valuable conversation data

Regulatory risk is obvious when messages go missing: a firm cannot supervise what it cannot see or produce records that were never captured.

Client conversations carry information a business would want to know: a concern raised weeks before a relationship starts to slip, pricing pushback that never reaches the CRM or a salesperson handling a difficult exchange in a way others could learn from. Repeated questions may also point to problems with onboarding, service or product design.

Governed communication creates a record the organisation can learn from. Applied responsibly, conversation data can support supervision, client service, dispute resolution, coaching and a clearer view of relationship risk.
That information is already being generated every day. The difference is whether it remains scattered across personal devices or becomes something the organisation can understand and act on.

Bring the conversation back into view

Plenty of companies have the basics in place: a policy, training and an approved tool. What is often missing is a setup that matches how people work and talk to clients.

The existence of a policy says very little about whether it works. ‘Good enough’ governance can leave a business with all the right paperwork while the same behaviour carries on underneath it.

A quick exchange can soon include a shared document, a follow-up question and another colleague joining the conversation. Messages, files, participants and timing all form part of the record, which needs to stay within the firm without someone rebuilding the exchange later.

If senior leaders use the same channels they have banned for everyone else, the policy is a sham. Employees follow what leaders do, rather than what the compliance manual says. Training can help, particularly when people understand the reason behind it. But explanations only go so far if the approved route slows down a live client conversation. Technology can capture the record, but leadership decides whether people take the rules seriously. No system can rescue a policy that senior figures ignore.

Keeping those exchanges within view gives the business more than a record for compliance. It can also pick up concerns, repeated questions and early signs that a client relationship is beginning to change.

More rules have not stopped the conversations. They have pushed them onto personal phones and out of sight. Calling that ‘good enough’ is no longer credible.