Sovereign AI for Gulf banks that answer to SAMA and the CBUAE.
Gulf banks answer to SAMA and the CBUAE long before they answer to a model vendor. Iftah keeps generative and analytical AI inside the bank's own SAMA- and CBUAE-aligned environment — transaction data, KYC records, and customer PII processed where the regulator can supervise them, never shipped to a foreign region. One control plane enforces residency, governance, and audit across every model and cloud.
Built for the Gulf's banking regulators
- In-Kingdom / in-country residency by configuration
- Tamper-evident audit for SAMA & CBUAE review
- Bare-metal for real-time fraud & AML
- Explainability & human-in-the-loop controls
Designed to evidence the regimes your bank answers to.
Iftah does not claim certification — that stays the bank's obligation. In-region deployment, a content-free audit trail, and customer-held keys give your reviewers concrete, exportable evidence for each framework.
SAMA Cyber Security Framework
Access, logging, and incident-response controls designed for review under the SAMA CSF.
Outsourcing & Cloud Rules
In-Kingdom control over outsourced and cloud AI workloads, mapped to platform configuration.
AML / CTF Rules
Auditable, explainable model outputs for monitoring, screening, and SAR workflows.
CBUAE Outsourcing Regulation
Master System of Record and Confidential Data kept inside the UAE with supervisory access.
PDPL (SDAIA / Federal)
In-country processing, data-subject-rights flows, and transfer controls for your DPO's review.
DIFC & ADGM Data Protection
Free-zone-resident processing with reviewable controls for autonomous-AI and data duties.
QCB AI in Finance
Governance and oversight aligned to QCB's FinTech and AI expectations.
Every banking objection, resolved by design.
The reasons public-cloud AI stalls in a Gulf bank — and how Iftah removes each one.
Data leaves the country
SaaS AI routes prompts with transaction, KYC, and account data through foreign regions — breaching CBUAE Master-System-of-Record and SAMA in-Kingdom control.
Every model and workload is pinned to an approved region, hybrid, or on-prem location; the Master System of Record and Confidential Data never leave the jurisdiction.
No proof of access
Shared multi-tenant endpoints give the bank no way to show who accessed which customer record.
Immutable, tamper-evident logs capture every prompt, retrieval, and decision — the supervisory trail SAMA and the CBUAE require, on demand.
Black-box decisions
Vendor models cannot satisfy SAMA and QCB expectations for explainability, bias testing, and human oversight on credit and risk.
Explainability, human-in-the-loop checkpoints, and model-version controls are built into the governance plane.
Custody is surrendered
Sending Confidential Data to a third-party AI provider transfers de facto custody and risks secondary use for vendor training.
The bank owns the model, the data, and the full inference record; nothing is used to train anyone else's model.
Shadow AI spreads
Each business unit adopts its own SaaS tool — fragmented guardrails and ungovernable IP leakage.
One control plane applies uniform policy, access, and guardrails across every entity and cloud.
Each workload runs where its regulator demands.
From an in-Kingdom sovereign region to air-gapped core systems — one governance standard across all of it.
Sovereign in-Kingdom region
Customer-facing copilots and analytics in a SAMA-registered local region.
Multi-cloud per entity
A Saudi entity and a DIFC/ADGM arm run in different clouds — governed as one.
Bare metal for fraud & AML
Real-time fraud and AML screening on isolated GPUs with deterministic sub-second latency.
Air-gapped core
Core banking and payments AI with no cross-border data path whatsoever.
High-value AI, in-region and auditable.
- AML & sanctions monitoring
Transaction monitoring, screening, and SAR narrative drafting aligned to SAMA AML/CTF rules.
- Real-time fraud detection
Payment-anomaly and fraud scoring on isolated, low-latency infrastructure.
- Explainable underwriting
Document-grounded credit and SME risk assessment with auditable model outputs.
- Bilingual service copilots
Arabic-English customer-service and contact-center automation that keeps data in-region.
- RM & compliance copilots
Retrieval over internal policy, product, and regulatory documents for relationship managers and officers.
- Regulatory reporting & KYC
Automated reporting, KYC/onboarding document processing, and control-testing assistance.
What banking risk and procurement ask first.
Next step