DFSA and C:>DIR Release Landmark Paper on Cyber Resilience in the Age of Agentic AI

The Dubai Financial Services Authority (DFSA) and the Cambridge Digital Innovation and Regulation Initiative (C:>DIR) have released a joint paper examining how frontier and agentic artificial intelligence will transform cyber resilience in financial services. For fintech professionals, this research highlights the urgent need to evolve security frameworks as AI systems gain the speed and authority to act autonomously.

What was announced

The paper, titled Frontier and agentic AI: cyber resilience in the financial sector, was released on 2 November 2026 for discussion at the Dubai FinTech Summit. It explores the shift from static AI models to agentic systems—AI that possesses the capability to use connected tools and act under delegated authority. This transition introduces new risks where AI-enabled activity becomes faster, more adaptive, and significantly harder to trace, potentially overwhelming existing approaches to operational resilience and third-party risk management. This includes the ability to work out what happened after an incident.

The analysis puts the deployed system rather than the underlying model at the centre of its analysis, evaluating AI-related cyber resilience across four connected dimensions:

• Speed: Whether institutions can safely reduce significant cyber exposure before it has serious consequences.
• Reach: Whether institutions understand the shared technology and services they depend on, including those beyond their direct suppliers.
• Authority: Whether consequential actions by AI-enabled systems stay within their intended mandates.
• Trust: Whether institutions can establish what happened, bring unfinished activity under control, and continue or restore critical operations reliably.

The report also highlights how reliance on shared cloud infrastructure, identity services, software components, and recovery arrangements can create operational dependencies. These vulnerabilities are not always visible through direct supplier relationships, making it difficult for firms to establish what happened during a breach or to bring autonomous activity back under human control.

"For the Dubai Financial Services Authority, the practical question is how these capabilities interact with access, authority, critical financial operations, and increasingly complex technology and service provider networks. This paper brings together emerging thinking and will prompt wider discussion on how regulators and firms can prepare for these developments."

Mark Steward, Chief Executive of the DFSA

The companies involved

The Dubai Financial Services Authority (DFSA) is the independent regulator of financial services conducted in or from the Dubai International Financial Centre (DIFC). As a prominent regulator in the Middle East, the DFSA oversees a wide range of entities and has been increasingly active in shaping the region's fintech and digital asset landscape. The authority plays a critical role in maintaining the integrity of the DIFC as a global financial hub.

The Cambridge Digital Innovation and Regulation Initiative (C:>DIR) is an initiative of Financial Innovation for Impact (Fii). Fii is an organization focused on the intersection of technology and financial services, with Bryan Zhang serving as its Executive Chair. Zhang is also the Co-Creator of C:>DIR. These organizations work to bridge the gap between academic research and regulatory practice, particularly concerning how emerging technologies like artificial intelligence impact global financial stability and institutional integrity. By partnering with established regulators like the DFSA, these initiatives aim to provide a common vocabulary for both the public and private sectors to address the hazards and promises of AI deployment.

What FF News has reported before

FF News has closely followed the rapid expansion of the financial ecosystem in Dubai and the wider GCC region. Recent coverage includes the launch of a tokenized private credit fund by Zamanat, which aims to close the SME financing gap with a $100 million vehicle. We also reported on Sav securing $3.5 million in Pre-Series A funding to scale its AI-native wealth platform for expats. This focus on digital innovation is further evidenced by ICBC listing $713 million in dual-currency green bonds on Nasdaq Dubai and Sav's partnership with Emirates Gold to automate gold investments for global investors.

What this means

This announcement signals a shift in regulatory focus from AI ethics to the hard mechanics of operational survival. By prioritizing "agentic" AI—systems that can actually execute tasks rather than just suggest them—the DFSA is acknowledging that the traditional "human-in-the-loop" safeguard is becoming a bottleneck. The industry is now under pressure to prove that it can govern systems that move faster than human oversight. This raises a critical question for the sector: if an AI agent exceeds its authority through a shared third-party cloud service, who is legally and operationally liable? Firms that cannot map these invisible dependencies face significant regulatory scrutiny as the speed of cyber threats accelerates.