The Gulf needs its own constellation

As I publish this, twenty-nine days remain in the transition period of Federal Decree-Law No. 6 of 2025, the law that rebuilt the UAE's central banking framework. It replaced the 2018 Central Bank Law and the 2023 insurance decree with a single perimeter: banks, insurers, payment providers, and the technology firms that enable them, answering to one supervisor. Most of the commentary has treated it as a crypto story. I think the durable story is quieter and larger: an entire class of institutions just inherited supervisory expectations that their tooling was never built to carry.

This essay explains what I built about that, and why I built it the way I did.

The gap is not a localization problem

My lab already publishes AEGIS, a twelve-module blueprint for what an AI-native risk platform should look like at a mid-tier bank. The obvious move was to localize it: swap the currency to dirhams, add a few Gulf regulations to the mapping tables, and call the region served. That instinct is wrong, and it is worth being precise about why.

A Canadian mid-tier bank and a Dubai mid-tier bank both need a loss register, a scenario discipline, and a control library. That much travels. What does not travel is the shape of the regulatory universe around them. The Gulf's second lines answer questions that have no counterpart in Toronto or Frankfurt. What does displaced commercial risk look like in this quarter's profit-sharing investment account pool, and how was the decision governed? How concentrated is the book in connected counterparties once group structures and government-related entities are resolved honestly, and where does that sit against the large exposures framework? Which of the model management standards' expectations apply to the credit models the bank just bought, and can the validation trail survive an inspection? What does the new payments perimeter demand of a firm that was, until recently, a technology company with a licence application?

Each of those questions carries its own regulatory text, its own data shapes, its own failure modes, and its own examiners. Tooling that treats them as configuration options treats the region as an afterthought. The region is not an afterthought. It is the most concentrated supervisory modernization happening anywhere: new law, new standards, new entrants, one clock.

Why a constellation and not a bigger platform

So the Gulf work became its own suite: MAJLIS, eight modules, named for the council where the Gulf talks governance. The alternative designs were real, and I want to record why they lost.

Folding eight Gulf modules into AEGIS would have made AEGIS a twenty-module platform, and the platform thesis would have died of it. AEGIS argues that exactly twelve instruments, joined on one taxonomy spine, cover what a mid-tier risk function must do. That claim has discipline because the number is small and the joints are visible. A platform that grows a regional annex every time a new regime matters stops being an argument and becomes a catalog.

Scattering eight standalone tools would have wasted the opposite virtue. The Gulf modules share tenants, share the dirham, share the taxonomy spine, and share each other's outputs; a regulatory radar that cannot hand an obligation to a model governance register is a feed, not an instrument.

A sibling constellation keeps both virtues. MAJLIS shares the lab's engineering conventions, design language, and synthetic-data discipline with AEGIS, and shares nothing about its regulatory universe. AEGIS stays exactly twelve. MAJLIS is exactly eight. Each is legible alone; together they say the thing I most want this lab to say: the discipline is general, the universe is local, and serious tooling respects both.

The eight

FALCON is the regulatory radar: the Gulf issuance stream tracked at obligation level across CBUAE, SAMA, QCB, DFSA, and ADGM sources. VERDICT is model risk and AI governance under the CBUAE Model Management Standards and Guidance: inventory, tiering, validation findings, remediation heat. ATLAS is concentration analytics: large exposures, group resolution of connected counterparties including government-related entities, and a limit engine. SHAMAL is climate scenario analysis on NGFS framings, with transition deltas made legible at portfolio level. PRISM is IFRS 9 overlay governance: the post-model adjustments register and the challenge trail supervisors increasingly expect around ECL judgment. MINARET is the Islamic finance risk toolkit, from profit-sharing investment account risk to Sharia governance, framed on IFSB standards. FALAJ is payments risk in a box for the newly supervised: obligations and controls shaped by the Stored Value Facilities Regulation and the Retail Payment Services and Card Schemes Regulation. SONAR is the financial crime effectiveness lab: screening effectiveness measured honestly, including the gap between coverage claimed and coverage demonstrated.

All eight run in the browser on synthetic Gulf tenants: a conventional Dubai bank, a Sharjah Islamic bank, a licensed Dubai payments firm. Every simulated issuance and obligation carries a demonstration identifier. Real regulators appear only as the names of sources, and nothing is for sale.

What I expect to learn

I built the first constellation, AEGIS, to test whether one person with modern AI tooling could blueprint a platform that mid-tier banks are told requires a vendor and seven figures. MAJLIS tests a harder claim: that the same approach can respect a regulatory universe deeply enough to be useful to practitioners inside it, without diluting either suite. Some of the eight will be wrong in instructive ways. The Islamic finance toolkit in particular will earn correction from people who live those disciplines, and I want that correction; it is the fastest route to a better blueprint.

The constellation is open at majlis.oprisk.ai. The build notes, the architecture decisions, and the sequencing behind both suites are available to anyone who asks. If you run or supervise a Gulf risk function and any of this matches or contradicts your experience, that is the conversation I am here for.