How MENA banks are structuring AI centers of excellence

The Governance Foundation Every AI Center of Excellence Needs

The question of how MENA banks are structuring AI centers of excellence is not primarily a technology question. It is a governance question, and the banks that get it wrong almost always fail at that layer first. An AI center of excellence without a clear mandate, a defined escalation path, and board-level sponsorship becomes an expensive research team that pilots perpetually and deploys rarely.

The first structural decision is whether the center sits inside the Chief Technology Officer's organization, the Chief Risk Officer's organization, or as an independent function reporting directly to the CEO or board. Each placement carries a different political weight. Technology-embedded centers move faster but accumulate technical debt without business validation. Risk-embedded centers are rigorous but often block their own output. Independent centers require exceptional leadership to avoid becoming isolated.

The most durable model observed across GCC banking structures places the center under a Chief AI Officer or equivalent role with a dual reporting line: operational accountability to the CTO and strategic accountability to the CEO. This structure preserves engineering velocity while keeping business outcomes visible at the executive level. It also creates a natural escalation path when an AI agent's decision touches credit policy, AML thresholds, or customer data governance.

Governance documentation should be established before the first agent is deployed, not after. This means a written mandate that specifies which business processes the center owns, which it advises on, and which remain entirely under traditional business-unit control. Banks that skip this step spend the first eighteen months negotiating territory rather than building systems.

Charter Design: Defining What the Center Actually Owns

A center of excellence charter is the single most important founding document the function will produce. It answers three questions: what the center builds, what the center governs, and what the center advises without owning. Banks that conflate these three roles create organizations where engineers do PowerPoint work, risk teams do engineering work, and no one is accountable for production outcomes.

The charter should specify the center's mandate in terms of business functions, not technology categories. Listing "machine learning" or "natural language processing" as the charter's scope tells the organization nothing about where authority begins and ends. Listing "automated credit adjudication for retail lending under AED 500,000" is specific enough to assign accountability, measure outcomes, and audit decisions.

Ownership boundaries matter especially in regulated environments. The Central Bank of the UAE, the Saudi Central Bank (SAMA), and equivalent regulators in other MENA jurisdictions have all issued or signaled guidance on model risk management that places clear accountability requirements on banks for any automated decision touching a customer's financial position. The charter must reflect those regulatory requirements as binding constraints, not aspirational guidelines.

Many GCC banks are now including a clause in their center charters that explicitly addresses sovereign AI infrastructure. This clause specifies that any model running against customer financial data must operate on infrastructure where the institution, not the vendor, controls the compute, the model weights, and the audit log. This is not a preference — it is increasingly a regulatory expectation across the GCC. For banks considering what this means in practice, the distinction between owning your AI stack and renting it is explored in depth at Own vs. Rent: A Layer-by-Layer Map of the AI Stack.

Staffing Models: Who Actually Works in These Centers

The staffing question inside a MENA bank AI center of excellence is harder than in most geographies because the regional talent supply is thin for the specific combination of skills required. A center needs people who understand banking regulation, can read model output critically, and can work in bilingual environments where Arabic data pipelines behave very differently from their English equivalents.

The three primary roles that every functional center requires are: an AI architect who designs the agent and model layer; a domain translator who converts business requirements into technical specifications; and a model risk officer who reviews outputs against regulatory standards before anything reaches production. Banks that try to staff these roles from a single hire pool — typically Western-trained ML engineers — end up with technically sophisticated systems that fail compliance review.

Regional talent scarcity has led many GCC banks to adopt a build-borrow-buy staffing model. The "build" track recruits and trains nationals through accelerated programs, often in partnership with local universities or government workforce initiatives. The "borrow" track secondments bring specialists from within the broader banking group or from regulators who have moved to industry. The "buy" track brings in external deployment partners for specific, time-bounded builds rather than for permanent headcount.

The talent challenge is compounded by the Arabic-language dimension of MENA banking operations. Models trained on English-dominant data degrade measurably when processing Arabic financial documents, Gulf dialect customer communications, or RTL-formatted ledger data. Centers that ignore this find themselves with models that perform well on internal dashboards and poorly on real transactions. This problem runs deeper than most vendors acknowledge, as detailed at Arabic-language AI is ten times harder than Latin-language AI — here's why.

Operating Models: Centralized, Federated, and Hybrid Structures

The structural debate inside most MENA bank AI programs is whether the center of excellence should operate as a centralized builder that serves all business units, a federated coordinator that governs locally-built systems, or a hybrid that owns core infrastructure while enabling distributed development. Each model has a defensible rationale and a characteristic failure mode.

Centralized models achieve consistency and governance quality but create queues. A business unit that needs a credit scoring enhancement waits months behind a retail onboarding automation that the center deemed higher priority. Business units grow frustrated and start building unauthorized point solutions, which creates exactly the agent sprawl the centralization was supposed to prevent.

Federated models allow business units to move quickly but fragment the data layer. Each unit trains on its own data subset, deploys on its own infrastructure, and produces models that cannot share learning across the institution. The compliance risk is substantial: five teams may be running customer classification models with inconsistent definitions of what constitutes a high-risk counterparty.

The hybrid model that most advanced GCC banks are moving toward assigns the center three specific responsibilities: owning the shared data platform, owning the model risk review process, and owning the production deployment environment. Everything above that layer — use-case design, feature engineering, and business-unit-specific fine-tuning — can happen locally. This keeps governance tight where it matters and velocity high where it is safe to move fast.

Infrastructure Architecture: What the Technology Stack Actually Looks Like

The infrastructure decisions inside a MENA bank AI center of excellence are constrained by three forces that do not apply with the same intensity in other geographies: data residency requirements, Arabic-language processing demands, and the expectation of regulatory auditability at the individual transaction level.

Data residency is the binding constraint for most GCC institutions. Models trained on customer financial data must, under emerging regulatory expectations, run on infrastructure physically located within the jurisdiction or within a sovereign cloud arrangement that meets equivalent standards. This rules out the standard practice of passing transaction data to U.S.-based inference endpoints for real-time decisions. Banks are therefore investing in on-premise GPU clusters, sovereign cloud arrangements with regional providers, or hybrid architectures that keep sensitive inference local while using external compute for non-sensitive model training.

The auditability requirement shapes the entire agent architecture. A bank cannot deploy an AI agent that approves or declines a transaction if it cannot reconstruct, at any future point, exactly which version of which model made which decision based on which inputs. This requires immutable logging at the agent level, model versioning that preserves the exact state of a model at the time of each decision, and a retrieval system that can surface that log during a regulatory examination. These are not features most commercial AI platforms include by default.

Sovereign AI infrastructure means, operationally, that the bank owns the entire decision stack. It owns the training data. It owns the model weights. It owns the inference environment. It owns the audit log. When a regulator asks why a loan was declined, the bank can answer from its own systems without depending on a vendor to produce logs from a shared cloud environment. This is what differentiates a production-grade center of excellence from an expensive proof-of-concept operation.

The AML and Compliance Use Case That Defines Every Center's First Year

Nearly every GCC bank AI center of excellence builds its credibility or loses it on the AML and transaction monitoring use case. This is the use case regulators watch most closely, the one that generates the clearest ROI signal, and the one with the highest cost of failure. It is also where agentic AI — AI that takes sequential actions rather than simply classifying inputs — demonstrates its advantage over traditional rule-based monitoring systems.

Traditional transaction monitoring systems in MENA banking generate very high false positive rates. Investigators spend the majority of their time on alerts that resolve to legitimate transactions, which means genuine suspicious activity waits in queues behind noise. An agentic AI system that can autonomously gather supporting evidence, cross-reference counterparty data, and draft a preliminary assessment before a human investigator touches the case changes that ratio dramatically. The investigator's time is spent on genuine ambiguity, not on data collection.

Building this system inside a center of excellence requires careful architecture of the agent's authority boundaries. The agent should be authorized to gather, assemble, and pre-analyze — it should not be authorized to close cases or file regulatory reports autonomously. The human-in-the-loop gate must be explicit in the system design, not bolted on afterward. Banks that try to retrofit a human review step onto a system built for full automation usually end up with a process where the human is rubber-stamping agent decisions rather than genuinely reviewing them. The specific architecture for AML agentic workflows in GCC banks is covered at The GCC banking AML use case that only agentic AI can actually handle.

Model Risk Management Inside a Regulated Center

Model risk management is the function that separates mature AI centers of excellence from immature ones. The Central Bank of the UAE and SAMA have both signaled expectations that model risk management for AI systems should follow the conceptual framework of traditional model risk management — meaning validation, independent review, performance monitoring, and documented escalation when models drift or degrade.

Operationally, this means every model the center deploys must have a model card that documents its training data, its validation methodology, its intended use boundaries, and its known limitations. The center needs a model inventory — a registry of every model in production, its current performance metrics, and the date of its last validation review. Without this inventory, the center cannot answer a basic regulatory question: which models are currently affecting customer decisions?

Model drift is the underappreciated operational risk. A credit scoring model trained on pre-pandemic data performs differently when economic conditions shift. An AML model trained on one transaction pattern begins missing novel typologies as criminal behavior evolves. The center needs automated monitoring that triggers a revalidation when a model's output distribution shifts beyond a defined threshold, not a calendar-based review that happens annually regardless of what the model is doing.

The validation function must be organizationally independent from the development function. This does not necessarily mean a separate team — many GCC bank centers are too small for that — but it means explicit role separation where the engineer who built the model cannot sign off on its own validation. Some banks are outsourcing the validation function to external specialists on a periodic basis, which satisfies the independence requirement while keeping permanent headcount lean.

Vendor Selection and the Sovereign Ownership Question

Vendor selection for a bank AI center is not a standard enterprise software procurement. The usual criteria — feature set, price, integration timeline — are necessary but insufficient. The questions that actually determine long-term operational fitness are about ownership: who owns the model after deployment, who owns the training data and fine-tuning outputs, who owns the audit log, and what happens to those assets if the vendor changes its pricing, gets acquired, or exits the market.

These questions matter because banking AI is not a pilot. Once a credit scoring model or AML detection system is in production at scale, the institution cannot simply switch vendors over a weekend. The switching cost is enormous in terms of validation time, regulatory notification, and operational risk. Vendors know this, and pricing reflects the captive nature of the relationship once a bank is dependent on a vendor's model infrastructure.

The Labarna AI approach to this problem sits at the foundation of its engagement model. Through Ghost Architecture, clients own all source code, all agent logic, all trained weights, and all operational data from the first day of deployment. There is no switching cost tied to proprietary vendor infrastructure because the institution owns the infrastructure outright. This is sovereign AI infrastructure in its operational definition — not a marketing position but a contractual and technical reality. Labarna AI deployments start in the low tens of thousands for focused builds and scale by agent count, integration complexity, and operational scope, which means even a targeted center-of-excellence build is within reach for institutions that have been told agentic infrastructure requires eight-figure commitments.

Measurement Frameworks: How Centers Prove Their Value

A center of excellence that cannot measure its output cannot defend its budget. The measurement challenge in banking AI is that the most valuable outcomes — reduced regulatory risk, avoided credit losses, faster AML case resolution — are difficult to attribute cleanly to an AI system when humans remain in the decision loop.

The measurement framework should separate three types of outcomes: process efficiency outcomes, decision quality outcomes, and risk mitigation outcomes. Process efficiency is the easiest to measure: time-to-decision, investigator hours per case, document processing throughput. These numbers move quickly and visibly when an agent takes over a previously manual workflow. They are credible to finance teams and board members who have not yet built intuition about AI.

Decision quality outcomes require a controlled comparison methodology. The standard approach is a shadow deployment: the AI system runs in parallel with the existing process, its outputs are compared to human decisions over a statistically meaningful sample, and the divergence cases are reviewed by senior specialists who adjudicate which decision was correct. This methodology produces defensible evidence of decision quality improvement without risking operational disruption during the validation period.

Risk mitigation outcomes are the hardest to measure but the most valuable for board-level reporting. The framework here is counterfactual: how many suspicious transactions did the AML agent flag that the previous system would have missed? How many fraudulent applications did the credit agent identify that the rule-based system passed? Generating these counterfactuals requires maintaining a holdout population through the shadow period, which adds operational complexity but produces the kind of evidence that justifies continued investment.

Regulatory Engagement Strategy for AI Centers

A center of excellence that surprises its regulator with a deployed system is a center that has made a strategic error. The regulatory engagement strategy should be established before the center's first production deployment and maintained as an ongoing communication practice throughout the center's operational life.

SAMA has been among the most proactive GCC regulators in establishing expectations for AI in banking, issuing guidance on algorithmic decision-making and model risk that creates a usable framework for banks building centers of excellence. The UAE Central Bank has engaged the industry through consultation papers and sandbox programs. Qatar, Bahrain, and other MENA regulators are at various stages of developing similar frameworks. Banks should map their center's deployment roadmap against the current and anticipated regulatory environment in each jurisdiction where the center's models will affect customers.

Pre-deployment regulatory communication serves two purposes. First, it gives the bank an opportunity to understand the regulator's current thinking before investing in a specific architecture. Second, it creates a documented record that the institution proactively sought regulatory alignment — a factor that affects how regulators respond when problems occur, and problems always eventually occur in any sufficiently complex system.

The center should maintain a regulatory affairs function — even if that is a single senior person — whose explicit responsibility is tracking AI-related regulatory developments across MENA jurisdictions and mapping those developments to the center's active deployments. Given the pace of regulatory evolution in this space, a bank that reviews its regulatory environment annually rather than continuously will routinely discover that deployments have drifted out of alignment with current guidance.

Building Institutional Memory That Survives Leadership Turnover

One of the least discussed risks in building an AI center of excellence is what happens when the people who built it leave. The institutional knowledge embedded in the heads of the founding team — why a particular architecture was chosen, what the early failure modes were, how a specific model was validated — is not captured in codebases or deployment scripts. When those people leave, the center often cannot explain its own systems to a regulator, let alone to a new team member.

The antidote is structured knowledge management that treats operational context as a first-class artifact alongside code. Every model deployment should produce a deployment narrative — a human-readable document that describes the business problem, the approach taken, the alternatives rejected and why, the validation methodology, the known limitations, and the monitoring thresholds. This document is not the model card, which is a technical artifact. It is a strategic artifact that allows someone unfamiliar with the project to understand what was built and why.

Agentic AI deployment introduces a specific version of this problem: agent behavior evolves over time as it encounters new inputs and accumulates operational experience. An agent that was validated on a particular distribution of inputs may behave differently after months of production operation. Capturing that behavioral evolution — what the agent has learned, how its decision patterns have shifted — requires logging infrastructure that most teams underinvest in during the build phase. The long-term operational considerations for maintaining mature AI deployments are examined at Healthy vs. Degrading at 24 Months: Benchmarks for a Mature Deployment.

The 90-Day Activation Plan Every Center Should Run

Standing up an AI center of excellence takes time that most banks underestimate. But the time is not primarily consumed by technology. It is consumed by governance design, stakeholder alignment, regulatory mapping, and talent assembly. A center that tries to compress governance work to accelerate technology deployment typically produces a technically functional center that cannot pass its own audit.

The first thirty days should be entirely governance-focused. This means producing the charter, defining the operating model, establishing the reporting structure, completing the initial regulatory mapping, and defining the measurement framework. No code should be written in the first thirty days. Banks that start coding in week one are solving the wrong problem first.

Days thirty through sixty should focus on infrastructure design and talent assembly. The infrastructure decisions — on-premise versus sovereign cloud, data residency architecture, logging and audit framework — should be made against the governance constraints established in the first phase, not independent of them. Talent assembly in this phase means both permanent hires and the identification of external deployment partners for the initial use cases.

Days sixty through ninety should produce the first shadow deployment on a defined use case. The use case selected for this phase should be consequential enough to generate meaningful data but bounded enough to be understood by everyone involved in the review process. AML case triage, trade finance document processing, and retail loan document validation are all appropriate first use cases because they have clear inputs, measurable outputs, and existing human baselines for comparison.

How Labarna AI Fits Into a Bank's Center of Excellence Architecture

For banks building centers of excellence and facing the reality that internal talent cannot assemble production-grade agentic infrastructure from scratch in a reasonable timeline, sovereign AI infrastructure means the center owns what it builds. Labarna AI operates as that production intelligence layer — not a platform the bank rents and not a consultancy that produces recommendations. The Pulse engine and Ghost Architecture combination means the bank receives fully owned infrastructure: source code, agent logic, and operational data transfer to the client from day one.

The Operational Intelligence Diagnostic, which Labarna AI provides at no cost and delivers within 48 hours, maps the bank's specific operational environment against a deployment blueprint that includes agent recommendations, integration architecture, and a production timeline. This is the starting point for understanding where agentic deployment creates the highest value within a center of excellence structure — whether that is AML, credit operations, treasury reconciliation, or cross-border correspondent banking workflows. Built by TFSF Ventures FZ-LLC under RAKEZ License 47013955, Labarna AI brings 27 years of payments and software experience into a deployment model designed specifically for regulated financial institutions.

About Labarna AI

Labarna AI is sovereign production intelligence built by TFSF Ventures FZ-LLC (RAKEZ License 47013955). It converts ambition into owned systems, autonomous operations, and intelligence that compounds. Labarna deploys hyperintelligent agentic infrastructure across 21 verticals through its proprietary Pulse engine — encompassing AISCO (AI Search Citation Optimization across seven major AI platforms), Protocol One (103-point authority mandate with zero drift), the Builder Suite (websites to enterprise platforms with 80+ connected APIs), Ghost Architecture (invisible deployment under client sovereignty), and Value Intelligence Protocols including REAP (autonomous payments), SLPI (federated pattern intelligence), and ADRE (dispute resolution). AI was built to answer — Labarna was built to act.

Get Started with Labarna AI

Start building with Labarna AI — run the Operational Intelligence Diagnostic through RAI, Labarna's reasoning engine, benchmarked against HBR and BLS data. Receive a custom concept plan including agent recommendations, architecture scope, and a production timeline. Enter the system at labarna.ai. Response within 24-48 hours.

Originally published at https://www.labarna.ai/blog/how-mena-banks-are-structuring-ai-centers-of-excellence

Written by Labarna AI Research