Fintech Displacement

Q1 trajectory - VARA's mandatory CRO appointment requirement, combined with the ADGM FSRA's equivalent Approved Person obligations, meant GCC fintechs entering the licensing pipeline in early 2026 were generating CRO demand at a rate materially above local supply; many firms were accepting non-resident CRO appointments as interim measures pending VARA's substance requirements tightening.

Q2 trajectory - SAMA's March 2026 open banking licensing launch added a Saudi-domiciled CRO requirement for payment fintechs operating under the new framework; the SAMA Payment Systems Oversight Framework update imposed enhanced risk governance obligations that pushed Saudi fintechs to elevate the CRO from a compliance support function to a board-level appointment.

Q3 catalyst - The intersection of VARA's evolving derivatives and tokenisation rulebook, SAMA's operational risk requirements, and the absence of a unified GCC AI governance standard creates a CRO role that must navigate regulatory fragmentation across multiple regimes simultaneously; demand is net positive but the profile required - multi-jurisdictional, blockchain-literate, Arabic-language-proficient - is extremely scarce and driving extended search timelines.

Q1 trajectory - VARA's operational permit prerequisites require a resident MLRO with demonstrable AML/CFT and blockchain-asset experience; with nearly 50 supervised firms and a growing application pipeline, the pool of eligible UAE-resident MLROs was already insufficient in Q1 2026, with recruitment timelines running 6-8 months and some firms reporting inability to meet VARA's 12-month post-licence compliance appointment deadline.

Q2 trajectory - SAMA's open banking licensing introduced KYC and AML obligations for third-party providers accessing bank data, creating a new MLRO-equivalent compliance function requirement for Saudi open banking fintechs that did not previously exist in the sandbox phase; this expanded the GCC MLRO demand set beyond the VARA-dominated Dubai market.

Q3 catalyst - The VARA MLRO function is being redefined by AI: licensed VASPs are deploying AI-driven transaction monitoring systems, but VARA's supervisory expectations around MLRO accountability for AI-generated alerts and false-positive management are not yet fully codified; MLROs who can articulate AI oversight methodology to regulators will command significant market premium through Q3 2026 and into 2027.

Q1 trajectory - No GCC regulator had published a formal AI governance framework specific to fintech as of Q1 2026; the UAE AI Office's broader strategy did not translate into licensing-stage AI governance requirements at VARA or CBUAE, leaving the Director of AI Governance role largely absent from GCC fintech organisational charts.

Q2 trajectory - Leading GCC fintechs - particularly those with EMEA or APAC dual presence subject to EU AI Act or MAS AI governance expectations - began importing AI governance frameworks from their home jurisdictions, creating demand for AI governance directors who could operationalise standards across jurisdictions; a small number of Q2 search briefs for this role emerged from Dubai and Riyadh-headquartered fintechs.

Q3 catalyst - The role remains nascent but is directionally in creation mode; fintechs seeking VARA licences while also holding MiCA CASP authorisation in Europe are the primary demand segment, as they face dual AI governance obligations from two regulators with materially different frameworks; expect Q3 2026 to see the first cohort of permanent Director of AI Governance appointments at GCC-headquartered cross-border fintechs.

Q1 trajectory - VARA's updated tokenisation and derivatives rulebook required existing VARA-licensed product suites to be reviewed for regulatory alignment; CPOs at Dubai-based fintechs faced a product rationalisation exercise in Q1 2026, retiring or restructuring offerings that sat outside VARA's updated activity classifications.

Q2 trajectory - SAMA's open banking licensing created a new product architecture opportunity: fintechs building third-party data aggregation and payment initiation products for the Saudi market required CPOs who could navigate SAMA's technical API standards and data consent frameworks, shifting CPO hiring criteria in Riyadh towards regulatory-product hybrid profiles.

Q3 catalyst - The absence of a unified GCC product liability framework for AI-driven financial products means CPOs must self-regulate AI feature releases, creating differentiated risk exposure depending on whether the fintech's primary regulator is VARA, SAMA, or ADGM FSRA; CPOs building compliant-by-design AI product architectures are positioned as defensive hires, whilst those without this capability face board-level pressure.

Q1 trajectory - SAMA's instant payment system (Sarie) and the broader GCC central bank digital currency (mBridge) coordination began reshaping payments infrastructure expectations; Heads of Payments at Saudi fintechs were increasingly drawn into SAMA dialogue on scheme compliance and operational resilience.

Q2 trajectory - The March 2026 SAMA Payment Systems Oversight Framework update introduced enhanced obligations for payment system operators including risk governance, operational continuity, and regulatory reporting; Heads of Payments became the operational owners of these new obligations, expanding their compliance burden materially beyond traditional scheme management.

Q3 catalyst - SAMA's formal open banking licensing means payment fintechs now operate within a regulated API economy; the Head of Payments role is being redefined around third-party ecosystem governance, API liability management, and consumer consent framework oversight, demanding a profile that combines traditional payments expertise with fintech platform and regulatory partnership skills.

Q1 trajectory - VARA's cybersecurity and technology governance requirements, embedded in its VASP Licence conditions, placed named CTO accountability on ICT risk management, resilience testing, and cold-storage infrastructure oversight; GCC fintechs hired to this requirement through H2 2025, producing a cohort of technology executives with regulatory filing experience uncommon in the region previously.

Q2 trajectory - SAMA's updated oversight framework imposed technology resilience obligations on payment system operators, drawing Saudi-domiciled CTOs into regulatory engagement that previously sat with the CRO or Compliance function; the blurring of ICT risk and technology strategy in SAMA's framework is creating ambiguity around mandate boundaries that some firms are resolving through CTO mandate expansion and others through separate Head of Technology Risk appointments.

Q3 catalyst - AI infrastructure governance - specifically the ownership of AI model deployment pipelines, data centre and cloud dependency disclosures to VARA and SAMA, and incident reporting for AI-driven system failures - is landing on the CTO function in the absence of dedicated AI governance executives; Q3 is likely to see the first regulatory-driven CTO accountability cases in the GCC, setting precedent for how the role is structured going forward.

Q1 trajectory - SAMA's open banking framework requires licensed third-party providers to implement robust data consent management, data minimisation, and customer data portability; this directly created a CDO-level obligation at open banking fintechs that previously had no formal data governance executive, expanding the addressable market for CDO appointments in Saudi Arabia through H1 2026.

Q2 trajectory - VARA's anti-money laundering data obligations and the requirement to maintain auditable transaction data for supervisory review are drawing VARA-licensed firms' CDOs into compliance workflows; the intersection of blockchain data immutability and VARA's data access requirements for supervisory purposes is a novel technical-governance challenge sitting squarely on the CDO.

Q3 catalyst - The GCC's broader data localisation requirements - UAE Federal Data Protection Law and Saudi PDPL - add a data sovereignty dimension to the CDO role that is distinct from the EU GDPR framework; CDOs at GCC fintechs with cross-border data flows must navigate both domestic localisation rules and international data transfer obligations, making the role structurally more complex than its EMEA equivalent and supporting continued demand through Q3.