For a long time fraud was treated as an operational loss. Banks wrote it off, absorbed it in pricing and dealt with it inside the business. That is changing. Central banks across the Gulf now set specific expectations for how institutions prevent, detect and respond to fraud, and the FATF has made fraud one of its main priorities for the next two years.
Understanding the rules is rarely the hard part. The harder part is turning a notice or a framework into controls that work in practice, metrics that show they work, and evidence that will satisfy a supervisor. This article looks at what regulators now expect and how institutions can close that gap.
Fraud is now a regulatory priority
The FATF's paper on Cyber-Enabled Fraud, published on 24 February 2026, notes that 156 jurisdictions, or 90 percent of those assessed, have identified fraud as a major money laundering risk. The paper describes fraudsters using phishing, AI enabled deepfakes and messaging applications, and professionalized fraud actors using shell companies to hide the proceeds. It highlights measures such as confirmation of payee, tools to suspend or freeze payments, faster information sharing between authorities, and the use of machine learning on transaction data by some FIUs and banks.
At its February 2026 Plenary the FATF committed to focusing on fraud over the next few years. When the United Kingdom took over the FATF Presidency on 1 July 2026, it launched a 2026 to 2028 Roadmap on Combatting Fraud. The Presidency points to the FATF toolkit, including "freezing and seizing assets, suspending fraudulent transactions, and enhancing cross-border intelligence sharing", and to the financial flows around scam compounds and the transnational networks behind them. It also prioritizes risk based supervision and better information sharing between the public and private sectors, across borders and between institutions. The FATF cites an estimate from the Global Anti-Scam Alliance of nearly USD 500 billion lost to scams in 2024 to 2025.
The work is already reaching the standards. At its June 2026 Plenary the FATF approved a public consultation on payment transparency guidance under Recommendation 16, aimed at predicate crimes, in particular fraud. It also approved a Global Overview of Public and Private Sector Partnerships and Data Protection Arrangements, for launch in July 2026, recognizing that information sharing is needed to address money laundering, terrorist financing, fraud and other crimes. Institutions should expect supervisors to ask how they share fraud intelligence with peers and authorities, and how quickly they can act on what they receive.
For institutions, the message is that fraud and money laundering are no longer separate problems. Fraud proceeds have to be moved and laundered, often through mule accounts at other banks. Supervisors and mutual evaluators will look at both sides.
What Gulf central banks require
United Arab Emirates. Federal Decree-Law No. 6 of 2025, the new Central Bank law, was issued on 8 September 2025, with a transition period for compliance to 16 September 2026. According to Norton Rose Fulbright, it requires licensed financial institutions to "implement robust fraud prevention and detection mechanisms to safeguard customers against fraudulent activities" and to notify affected customers "promptly of any security breaches or fraudulent incidents", where the previous laws were silent on fraud prevention. In July 2025 UAE banks began phasing out SMS and email one time passwords in favor of in app authentication, following CBUAE directives. CBUAE Notice 3057 of 2025 has extended expectations to digital impersonation. Crowe's analysis describes deadlines of 31 March 2026 for brand monitoring controls and 30 June 2026 for a first Digital Impersonation Risk Assessment.
Qatar. The QCB Technology Risks regulation for banks (January 2018) contains a notably specific set of fraud requirements. Banks must set up a fraud review group of senior leaders that meets at least once a quarter to review fraud trends and reports to the board of directors. QCB requires "a real-time fraud monitoring system" for financial transactions, with principles such as velocity checks applied to current and previous transactions. Fraud vulnerability assessments must cover all channels, and new products and processes must be analyzed for fraud vulnerabilities before launch. Residual risks must be covered by fraud loss limits, monitored regularly, with a review triggered when losses reach 90 percent of the limit. Internet banking must include features such as two factor authentication, payee registration controls, transaction limits and SMS alerts, and customers must have a dedicated email address and phone number for reporting fraud.
Saudi Arabia. SAMA's Counter-Fraud Framework, issued in October 2022, is a comprehensive program framework. It is organized around governance, prevention, detection and response. Institutions must establish a Counter-Fraud Governance Committee headed by a member of the Executive Committee. The fraud risk assessment must follow a documented methodology and be performed at least annually. The fraud risk appetite must be reviewed at least annually and endorsed by the Board, and key risk indicators "should be forward looking and provide an early indication of increasing fraud risk exposure". Detection scenarios must be calibrated and tested to confirm they work as designed. Authentication "should not solely consist of One Time Passwords (OTPs) sent via SMS". SAMA expects institutions to operate at maturity level 3 or higher, subject to periodic self-assessment and internal audit.
Elsewhere. Regulators outside the region are moving liability toward the party whose controls failed. Singapore's Shared Responsibility Framework, in force since 16 December 2024, requires a cooling off period of at least 12 hours for high risk activity after a new device is activated, real time alerts, real time fraud surveillance and a self service kill switch, with losses allocated first to a financial institution that has not met its duties. In the UK, an independent evaluation for the Payment Systems Regulator found that mandatory reimbursement of authorized push payment scams coincided with in scope losses about 21 percent lower per month.
The detail differs from one country to the next. The direction does not. Supervisors expect a governed program, a current fraud risk assessment, real time controls in digital channels, stronger authentication, clear reporting to senior management and the board, and a defined way of dealing with customers who have been defrauded.
From requirement to control
Institutions that struggle with fraud requirements rarely lack controls. More often they have controls that grew up product by product and channel by channel, with no clear line back to the obligations they are meant to meet. We suggest four steps.
Build a requirements inventory. Start by listing every obligation that applies, from the central bank law and notices to technology risk, consumer protection and AML requirements that touch fraud. Break each one into specific, testable statements. A requirement to "implement robust fraud prevention" means little until it is translated into who does what, in which channel, to what standard. Assign each statement an owner and map it to one or more controls. The same control will often satisfy several requirements, and the inventory makes that visible.
Assess fraud risk by product, channel and typology. The QCB requires vulnerability assessments across all channels, and SAMA requires a documented methodology repeated at least annually. A useful assessment goes beyond a heat map. It identifies the typologies that matter for each product and channel, such as account takeover, authorized push payment scams, card not present fraud, application fraud and insider fraud, and assesses how well current controls address each one. New products and changes to customer journeys should pass through the same lens before launch.
Design controls across the full lifecycle. SAMA's structure of prevent, detect and respond is a practical way to check for gaps.
- Prevent. Strong customer authentication and device binding, cooling off periods and limits for new devices and payees, payee verification, customer due diligence at onboarding, employee and third party screening, and monitoring of impersonation domains, fake apps and social media accounts.
- Detect. Real time transaction monitoring that combines rules, velocity checks and behavioral analytics, monitoring of inbound payments for mule activity, and channels for customers and staff to report suspected fraud quickly.
- Respond. A customer facing kill switch, clear procedures for blocking, recalling and recovering funds, defined timelines for investigating claims and communicating with customers, and root cause analysis after every significant incident. SAMA expects corrective actions to be tracked and escalated where they are delayed.
Align fraud, AML and cyber. SAMA requires fraud, financial crime and cyber capabilities to be aligned. In practice this means sharing data and intelligence between the teams, agreeing who owns mule accounts, and making sure a phishing campaign detected by the security team reaches the fraud team in time to act. The FATF's emphasis on fraud as a source of laundered proceeds makes this alignment more important, not less.
Metrics that mean something
Regulators increasingly expect fraud to be managed against a stated appetite. SAMA requires a Board endorsed fraud risk appetite with management information showing "performance against thresholds and limits". The QCB's fraud loss limits, with a review at 90 percent of the limit, are an appetite expressed in numbers. Both point to the same discipline. Decide in advance how much loss and which outcomes the institution will accept, then measure against those limits.
A small, stable set of metrics usually works better than a long list. We would group them as follows.
- Loss. Gross and net fraud losses after recoveries, by product, channel and typology, and losses relative to transaction volume so that growth does not hide deterioration.
- Detection. The share of fraud detected by the institution's own controls compared with fraud first reported by customers, rule and scenario performance including false positive rates, and the time from alert to decision.
- Response. Time to block an account or payment after a report, recovery rates, the time taken to resolve customer claims, and the number and age of open corrective actions.
- Customer impact. Legitimate transactions declined or delayed, complaints, and the outcomes for customers who report fraud. Controls that stop fraud by stopping legitimate business are not a success.
- Leading indicators. Measures such as attempted account takeovers, new impersonation domains detected or mule accounts identified. SAMA describes key risk indicators as forward looking signals of increasing exposure, and these are what allow management to act before losses rise.
These metrics should go to the forum that owns fraud risk. In Qatar that is the fraud review group, which reports to the board. In Saudi Arabia it is the Counter-Fraud Governance Committee. Trends over several quarters tell the board far more than a single month's figures.
Evidence a supervisor will accept
When a supervisor reviews a fraud program, the question is not whether the institution has policies. It is whether the controls operate as intended and whether management knows how well they work. SAMA's internal audit requirement is framed in exactly those terms, to verify that fraud control design "is adequately implemented and operating as intended".
Good evidence is produced in the ordinary course of running the program, not assembled in the weeks before an inspection. It usually includes the following.
- The requirements inventory, showing each obligation mapped to an owner and a control.
- The fraud risk assessment and its methodology, with the dates it was performed and approved.
- Records of detection scenario design, calibration and testing, including the reasons for threshold changes.
- Minutes and management information from the fraud governance forum and the board, showing that issues were discussed and decisions taken.
- Case files showing investigation, customer communication, root cause and corrective action through to closure.
- Records of notifications to the regulator. SAMA expects immediate notification of new typologies and significant incidents, and the QCB requires notification of incidents such as hacking, fake websites and forged cards.
- Self-assessments, internal audit reports and evidence that findings have been closed.
Testing deserves particular attention. Controls should be tested the way a fraudster would approach them, not only reviewed on paper. The QCB lists seeding and mystery shopping exercises among the techniques banks must use to detect fraud, and SAMA requires detection scenarios to be calibrated and tested to confirm they work as designed. Running test transactions through each channel, attempting to register a new device or payee, or simulating an impersonation attack on customers will show quickly whether controls behave as the policy says they should. The results, and the fixes that follow, are some of the most persuasive evidence an institution can produce.
The strongest evidence shows controls operating over time. A policy approved last month proves little. Twelve months of management information, calibration records and closed corrective actions proves a great deal.
Where programs fall short
Some patterns are worth watching for. The first is treating a regulatory notice as a technology project. Authentication changes and new monitoring tools matter, but a deadline met with a system upgrade and no change to governance, metrics or response will not hold up under review. The second is measuring activity instead of outcomes. The number of alerts reviewed says little about whether fraud is falling. The third is looking only at outbound payments. An institution receiving fraud proceeds into mule accounts is part of the problem, and the QCB already requires banks to share data and documents requested by the police when fraudulent money has been received into their accounts, even if the bank was not the victim. The fourth is running fraud, AML and cyber in separate silos, so that intelligence arrives too late to stop a payment. The last is investigating incidents without fixing their causes, so that the same weakness is exploited again.
Questions for the board
- Do we have a complete inventory of the fraud requirements that apply to us, mapped to owners and controls?
- Has the board approved a fraud risk appetite, and do we see performance against it every quarter?
- Do our metrics show whether fraud losses and customer harm are falling, not just how busy the team is?
- Are our fraud, AML and cyber teams sharing intelligence fast enough to stop a payment?
- Could we show a supervisor twelve months of evidence that our controls operate as intended?
Central bank fraud requirements will keep developing, and the FATF's focus over the next two years will add to them. Institutions that build a program around a clear inventory of obligations, a current risk assessment, a stated appetite and a small set of meaningful metrics will find each new requirement easier to absorb. Kompass helps institutions translate fraud requirements into controls, metrics and evidence that stand up to supervisory review.