The UAE banking sector stands at a pivotal moment in its digital transformation journey. As one of the most technologically advanced banking markets globally, the region faces both unprecedented opportunities and evolving security challenges.

Recent regulatory changes from the Central Bank of the UAE (CBUAE) are reshaping the landscape, requiring financial institutions to rethink how they protect customers and maintain trust.

Beyond SMS and OTPs

For years, SMS and email one-time passwords (OTP) have served as the backbone of digital authentication across banking channels. These methods, while convenient, are increasingly vulnerable to sophisticated threats such as SIM swapping, phishing, and malware interception. According to industry data, SIM swap attacks and phishing remain among the top fraud vectors, with malware capable of intercepting SMS OTPs on compromised devices. The result: higher fraud losses, more disputes, and reputational risk for banks.

Recognizing these risks, the CBUAE has mandated a phased transition away from SMS and email OTP for sensitive operations, including online card transactions, payments, account updates, and device provisioning, with an exact deadline set for March 31, 2026.

It is essential to note that SMS OTP remains a valid solution and continues to play a crucial role in the region’s digital banking ecosystem. The shift is not about discarding SMS OTP, but about elevating security standards for high-risk transactions.

Push-based authentication: Security meets user experience

UAE banks are already adapting, and many of them are no longer relying on SMS OTP to perform 3-D secure transactions. Leading banks have already begun informing customers that, in the coming months, these services will be discontinued and fully integrated within their mobile apps in the form of push-based authentication.

When a sensitive action is initiated, the bank triggers a secure push notification via its mobile app. Customers can review transaction details and approve with face ID, touch ID, or a secure app PIN, eliminating the need to type codes, reducing phishing risk, and removing dependency on telco routing.

This method is not only faster and more secure, but it also typically reduces OTP delivery costs and improves completion rates.

The business value of this transition is clear: customers benefit from a better user experience with one-tap approvals, banks achieve stronger security through device-bound and biometric authentication, and there is a clear path to regulatory compliance. Integration is straightforward – on one side, the mobile software development kit (SDK) binds the device and handles secure delivery, and on the other, the bank’s authentication server issues and validates challenges.

Recent data underscores the urgency and impact of these changes:

• 50 per cent of UAE consumers have fallen for a digital or payment scam, with 15 per cent being victims multiple times.
• 75 per cent of customers are willing to switch banks over inadequate fraud protection.
• According to our numbers, push notifications, as a primary channel, offer a secure and low-cost default for app users, while SMS remains essential for universal reach, boasting a 98 per cent open rate.
• WhatsApp serves as a high-trust fallback, with open rates exceeding 90 per cent and supporting two-way customer engagement.

Fraud prevention: Speed, security, and scale

Authentication is only the first step. Effective fraud prevention requires banks to communicate with customers instantly and seamlessly across multiple channels. Fragmented tools and manual resolution processes often lead to delayed responses, increased disputes, and higher operational costs.

Customers may bounce between apps, IVR, and email while losses grow. For example, imagine a customer receiving a suspicious login alert and quickly confirming it via push notification – or, if needed, being escalated to an in-app chat for immediate assistance.

A unified, automated communication platform enables banks to notify customers instantly, whether via push, SMS, or WhatsApp, using intelligent routing and failover to ensure every critical message reaches its intended recipient.

Automation is also transforming routine fraud scenarios. For example, “Was this you?” checks or suspicious login alerts can now be handled automatically, reducing resolution times and protecting margins. When escalation is needed, seamless handover to human agents through in-app chat or secure web calling ensures that customers receive timely, contextual support without having to repeat their issue or switch channels. Enhancements such as channel recommendations, send-time optimisation, behavioral segmentation, and intelligent failover are making fraud alerts more relevant, timely, and effective.

The result is a fraud prevention framework that is not only more secure but also more customer-centric.

Layered defenscs are vital. MNOs can utilise their network to support Mobile Identity APIs to deliver real-time, carrier-verified signals that reinforce and amplify existing controls for defense-in-depth – driving faster detection, stronger security, and fewer fraud attempts.

The direction for UAE banking is clear: security, compliance, and customer experience must advance together. As regulators raise the bar, banks have an opportunity to transform fraud management from a cost centre into a strategic advantage. By embracing strong authentication and unified communication, the industry can protect customers, foster trust, and accelerate digital growth. Ultimately, the move away from legacy OTP methods represents more than a compliance exercise – it’s an opportunity to redefine customer trust in the digital era.

As this evolution unfolds, it is essential for banks to partner with technology providers who understand both the regulatory landscape and the technical complexities of secure digital banking. With deep expertise in authentication, omnichannel communication, and fraud prevention, Infobip has been at the forefront of supporting financial institutions through this transition, helping them navigate new requirements while delivering seamless and secure experiences to their customers.

The writer is the head of Customer Success EMEA, Infobip.

Cyberattacks rarely come out of nowhere. Most hackers do their homework and are constantly looking for clues that a company’s guard is down. While we’re all told to fix weak passwords and update old software, there are quieter, more overlooked signs that signal, “Hey, we’re an easy target”.

One such sign is your ever-growing digital footprint. As businesses adopt new tools, including cloud platforms, apps, and third-party services, their exposure increases. If your security team isn’t keeping up, attackers might find old logins, forgotten test sites, or exposed cloud storage.

Therefore, it is necessary to keep an eye on what’s exposed — from old websites to open storage — to ensure that security spending keeps up with the new tools the company is adding.

Managing cyber risks

Another common, yet overlooked, indicator is the rise in phishing emails. Hackers could be testing who falls for what, spoofing internal addresses, or figuring out who has privileged access. Take every phishing report seriously. Look for patterns. Are certain roles being targeted? Are fake emails getting sneakier? Keep your team in the loop and build a strong feedback system to spot attacks.

Public exposure, such as funding or big partnership announcements, attracts unwarranted attention. Hackers are watching. They read the same press releases and LinkedIn posts that customers and investors do, and are aware that the actions following these developments, such as fast hiring and priority onboarding that can create distractions; it’s a perfect time to strike. In these moments, it is important to tighten access, double-check alerts, and prep teams for potential threats.

Using your personal device for work — especially key personnel like C-suite executives, founders, or engineers — increases vulnerability. If these devices aren’t covered by mobile device management (MDM) or endpoint detection tools, they become invisible risks.

Any compromised device can give attackers access to your organisation’s source code, customer data, and financial information. Building an effective executive cybersecurity programme, with secure apps, enforced MFA (multi-factor authentication), and training on mobile-specific threats is critical. Verify compliance regularly, not just through policy, but through tools like MDM platforms, endpoint security solutions, and mobile threat defense systems.

Supply chain attacks are a favorite among sophisticated threat actors. Even if your organisation is secure, compromised vendors, especially those with API or data access, can be used to leapfrog into your systems. Attackers often view a breached vendor as the first domino. If multiple partners have been hit, it’s more likely someone is already probing you, especially if you share similar tech stacks or cloud platforms.

A system has to be set to keep tabs on vendors regularly after a contract is signed. The system should be able to do regular check-ins for breach notifications and security updates for any third party that connects to your network.

Many organisations may have an incident response plan on paper, but not in practice. A long PDF with flowcharts might tick the compliance box. However, if no one’s ever tested it, it’s just theory. When a real attack happens, teams often freeze, because no one’s sure who does what, contact info is outdated, or decisions get stuck waiting on approvals. These problems usually don’t show up until everything’s already on fire. Attackers count on this kind of confusion. The slower the response, the more time they have to move laterally, encrypt systems, or exfiltrate sensitive data undetected.

Regularly conduct tabletop exercises involving not just IT and security but also legal, HR, PR, and executive leadership.

Simulate real-world scenarios like ransomware or insider threats and assess how your team performs under pressure. Focus on response speed, communication flow, and clarity of action.

Use the outcomes to refine and evolve your response plan; remember, in cybersecurity, practice isn’t optional. It’s survival.

Awareness is your armour

Cyberattackers follow the breadcrumbs, and those clues are often left by organisations that are growing fast and missing the warning signs. Spotting them early means you’re staying ahead of cyberthreats. In this fight, awareness is your early warning system and your best defense.

The writer is an enterprise analyst at ManageEngine.

Read: ‘Cybersecurity is a shared responsibility’: AICTO DG Mohamed Ben Amor shares insights

The UAE’s banking sector sits at the intersection of a national digital agenda and a thriving, diversified economy, using technology as both a growth engine and a resilience strategy.

Forward-thinking regulation amplifies this shift: the Central Bank of the UAE, alongside innovation-friendly financial centres such as Abu Dhabi Global Market and Dubai International Financial Centre, has fostered test-and-learn sandboxes, pragmatic guidelines for digital onboarding and e-KYC, and clear rulebooks for emerging models such as open banking, digital assets and embedded finance.

Guided by an ambition to deliver world-class digital services and seamless experiences, banks are re-architecting core systems around cloud, APIs and data platforms to enable real-time, mobile-first finance.

At the core of this transformation lies embedded finance, which allows for the seamless integration of financial services into non-financial platforms, allowing any business to perform financial operations, such as digital payments, without leaving its platform.

Driving innovation through banking

The UAE’s embedded finance sector is expanding rapidly, with revenues expected to rise from $1.56bn in 2024 to $5.5bn by 2029, representing a compound annual growth rate (CAGR) of 28.6 per cent. This substantial market growth has translated into transformative impacts on a number of industry subverticals including business-to-business (B2B) payments.

This solution offers digital invoice submission and processing capabilities with real-time status updates, previously available only through standalone service providers.

Traditional B2B invoice payment processes have long been characterised by inefficiency and lack of transparency. Invoices are often submitted via e-mail and followed up with phone calls requesting status updates, leaving suppliers without visibility into the invoice approval process.

Advanced invoice management solutions offer a streamlined, digitised channel for B2B buyers to efficiently manage invoices directly from their own systems. Now suppliers can upload invoices and supporting documents for the goods supplied to a buyer through a dedicated portal.

The solution has built-in configurable logic to perform purchase order (PO) to invoice matching services. Upon successfully meeting the configured criteria, eligible invoice data is sent to the buyer’s ERP systems for further booking and approval.

The solution brings efficiency and transparency to the entire invoice submission and approval process with minimal disruption to the existing approval setup. This efficiency extends beyond individual transactions, significantly impacting the broader supply chain. A strong supply chain boosts business growth by streamlining operations, cutting costs and enabling swift market adaptation.

Supply chain finance brings in the element of cash flow optimisation, improving the financial health of the entire value chain.

Transforming B2B payment ecosystem

Embedded invoice management solutions are delivering direct advantages for suppliers by offering greater visibility into their receivables. When delivered through banks’ platforms, these solutions create additional value, enabling suppliers to track and manage payments more efficiently.

Given banks are highly regulated entities, these institutions are uniquely equipped to manage critical financial processes, particularly when integrated with advanced technologies while ensuring data security and confidentiality.

Furthermore, the market is seeing the rise of flexible implementation options, including white-label capabilities. This allows businesses to present supplier portals as their own branded interfaces, maintaining brand consistency while leveraging sophisticated banking technology and compliance infrastructure.

In the UAE, SMEs play a critical role in driving economic diversification, innovation and job creation, contributing significantly to the country’s non-oil GDP.

By automating invoice processing and enabling early payment through embedded supply chain finance, the solution strengthens SMEs’ cash flows, directly supporting their working capital needs and business growth.

The future of transactions

Ultimately, this transformation in invoice management is a major step forward for B2B transactions. The embedded approach benefits buyers by streamlining their procurement-to-payment processes.

Automated invoice matching against PO ensures that only legitimate invoices enter the approval workflow, reducing processing errors and improving efficiency.

Looking ahead, as more businesses recognise the operational and financial benefits of unified, embedded solutions, B2B invoice payments are set to become the standard rather than the exception, fundamentally reshaping how B2B commerce operates in the UAE and beyond.

This transformation represents more than technological advancement, it embodies a fundamental shift toward customer-centric, efficiency-driven financial services that support business growth and economic development – key attributes in an increasingly competitive global marketplace.

The writer is the group head of Transaction Banking, Emirates NBD.

M42, a global health leader powered by artificial intelligence (AI), technology and genomics, on Monday announced the incorporation of M42 Saudi Arabia, marking a new phase in its partnership with the kingdom and reinforcing its support for Saudi Arabia’s Vision 2030 healthcare transformation.

The announcement was made during the Global Health Exhibition (GHE) in Riyadh, highlighting the company’s commitment to advancing precision, preventive and predictive healthcare across the kingdom.

Building on over 12 years of collaboration with the Saudi Ministry of Health (MoH) through the operation of more than 40 Diaverum clinics across 33 cities, including Riyadh, Jeddah, Makkah and Madinah, M42 said the new entity represents the next stage in a “trusted partnership grounded in performance, impact and shared purpose.”

M42 Saudi Arabia to support advanced patient care

Under M42 Saudi Arabia, the company will continue providing renal care through its Diaverum network while expanding into areas such as multi-omics, population health programmes, metabolic and lifestyle disease management, and digital integration.

The launch aligns with M42’s goal to partner with Saudi Arabia in realising its Vision 2030 ambition for a future-ready and sustainable health system, focusing on advanced patient care and the kingdom’s growing life sciences sector, including clinical trials and R&D.

“The incorporation of M42 Saudi Arabia is a natural step for us in building a globally scaled health intelligence ecosystem that works in partnership with local institutions to shift from reactive care to precision, prevention and prediction,” said Dimitris Moulavasilis, group CEO at M42.

Ziyad Kabli, COO for the Middle East and Asia at M42, added: “For more than a decade, our work in Saudi Arabia has centred on providing high-quality renal care through Diaverum. The launch of M42 Saudi Arabia marks our expansion from specialty services to system-wide collaboration in precision, preventive and predictive health.”

The company said the incorporation will enable Saudi-led pilot programmes, collaborative research, and partnerships with government and private healthcare institutions, reinforcing the kingdom’s leadership in innovation-driven health delivery.

The expansion follows M42’s broader regional growth, including the launch of Jordan’s first virtual hospital, the Digital Health Centre, in collaboration with the Jordanian Ministry of Health and Ministry of Digital Economy and Entrepreneurship.

In Bahrain, M42 is partnering with Mumtalakat through Amana Healthcare – Bahrain to provide long-term care and post-acute rehabilitation services in Al Jasra.

India is planning to allow direct foreign investment in state-run banks of up to 49 per cent, more than double current limits, according to a person directly involved in the policy discussions.

The finance ministry has been discussing the matter with the Reserve Bank of India (RBI), the country’s banking sector regulator, over the past couple of months, said the person, adding that the proposal has yet to be finalised.

Foreign interest in India’s banking industry is on the rise as evidenced by Dubai-based Emirates NBD’s recent $3bn purchase of a 60 per cent stake in RBL Bank and Sumitomo Mitsui Banking Corp’s $1.6bn acquisition of a 20 per cent stake in Yes Bank which the Japanese lender later raised by another 4.99 per cent.

Read more-Dubai’s Emirates NBD to buy 60% stake in India’s RBL Bank for $3bn

State-run banks are also seeing interest from overseas investors and raising the foreign ownership limit will help them gain more capital in the coming years, the person said.

The Nifty PSU Bank index rose as much as 3.02 per cent to a record high of 8053.4 after the Reuters report, and closed the session 2.22 per cent higher.

Narrowing the gap

A second source confirmed a hike from the current cap of 20 per cent is under discussion, adding that the move is also part of an attempt to narrow the gap between regulations for government-owned and private banks. India allows foreign ownership of up to 74 per cent for private lenders.

The proposal to increase the cap for state-run banks to 49 per cent has not been previously reported.

Both sources declined to be identified as discussions are not public. India’s finance ministry and the RBI did not immediately respond to Reuters’ emails seeking comments.

India’s robust economic growth, averaging 8 per cent over the past three fiscal years, has led to rising demand for credit, increasing the attractiveness of the country’s lenders. Deals in India’s financial sector jumped 127 per cent to $8bn between January and September.

Twelve banks

India has 12 government-owned banks, with combined assets of INR171trn rupees ($1.95trn) as of March that account for 55 per cent of the banking sector.

The government plans to retain a minimum shareholding of 51 per cent in state-run banks, according to the first source. At present, the government has much higher ownership in all 12 banks.

Current foreign ownership in state-run banks ranges from a high of about 12 per cent in Canara Bank to near zero in UCO Bank as of September 30, according to data from stock exchanges.

In general, state-run banks are viewed as weaker than their private peers. Often tasked with providing credit to less affluent sections of society and opening branches in the hinterlands, the banks have been more prone to bad loans and have had weaker returns on equity.

Keeping safeguards

The RBI has taken a number of steps in the past few months to reduce and ease regulations in the banking sector, while becoming more open to allowing foreign banks to own larger stakes in Indian private lenders.

But certain safeguards will stay to avoid arbitrary control and decision-making, the first source said, adding that a cap on voting rights of 10 per cent for a single shareholder will remain in place.