The Quiet Harmonisation. How GCC Regulators Are Rewriting the Rules - On Their Own Terms
Converging where it counts, diverging where it matters.
There is a temptation to frame GCC financial regulation as a catch-up story. Basel III arriving late. IOSCO principles slowly being absorbed. Disclosure frameworks bolted onto markets built for a different era.
That framing is wrong. What is happening across the Gulf is something more deliberate: a structured engagement with international standards that accepts what serves regional ambitions, adapts what conflicts with structural realities, and occasionally rejects what does not fit. This is not compliance by necessity. It is calibrated convergence by design.
SAMA and Basel: Early Adoption, Conservative Calibration
Saudi Arabia’s engagement with Basel goes back further than most observers appreciate. SAMA issued its Basel III capital rules in December 2012, ahead of most European jurisdictions still navigating EU legislative process. The Net Stable Funding Ratio minimum of 100% was implemented in January 2016, well before the internationally agreed deadline. Basel IV’s revised operational risk standardised approach has since been fully incorporated into the SAMA Rulebook.
Where SAMA diverges is at the margin, not the core. Foreign bank branches are excluded from the framework and expected to follow home regulation. The D-SIB surcharge is noted but marked “not relevant to Saudi banks at the present” And SAMA retains explicit authority to impose a countercyclical capital buffer above the standard 2.5% Basel ceiling - preserving macroprudential flexibility for a commodity-cycle-exposed economy where oil revenue shocks transmit to bank balance sheets through mechanisms the standard CCyB calibration does not capture well.
These are not failures to comply. They are intelligent choices about where the standard must flex.
CMA: From Closed Market to IOSCO-Aligned Hub
The CMA’s transformation is the most dramatic in the region. Until 2015, the Saudi Exchange was effectively closed to foreign participation. The Qualified Foreign Investor programme changed that; MSCI Emerging Markets inclusion in 2019 accelerated it. But institutional investors noticed that the regulatory architecture had not kept pace with the access - governance standards were inconsistent, related-party disclosure was weak, comply-or-explain provisions were more honoured in the breach.
The CMA has spent the years since systematically closing those gaps: mandatory audit and nomination committees, enhanced executive compensation disclosure, progressively relaxed foreign ownership constraints. In January 2026, the QFI gateway was removed entirely, opening the Saudi Exchange to all non-resident foreign investors. By Q3 2025, international investors already held over SAR 590 billion in Saudi equity markets.
The current consultation - closed late June 2026 - proposes stricter disclosure obligations, real-time material event reporting, and potentially mandatory XBRL tagging for annual filings. This last proposal would align the CMA with reporting standards already in place across the EU and parts of Asia. The CMA is no longer building for a domestic audience alone.
DFSA: Sophisticated Convergence, Deliberate Carve-Outs
The DFSA operates in a different register. As a free-zone regulator under English common law, its peer set is the MAS and the FCA, not its regional neighbours. By end-2024, it had grown to 902 regulated entities - 14% year-on-year - with 75% growth in wealth management licences. Its Chief Executive sits on the IOSCO Board. It has signed 117 bilateral MoUs. This is an authority competing for recognition at the global tier.
But the DFSA’s most significant 2026 development is not about convergence. It is about deliberate and sophisticated divergence.
Consultation Paper 172, launched in May 2026, proposes significant amendments to the DFSA’s Islamic Finance Rules. The proposals clarify when a firm requires an Islamic endorsement - essentially when it holds itself out as conducting business in accordance with Sharia. Execution-only distribution of sukuk or takaful without Sharia representations does not trigger the requirement. Active marketing and advice on Sharia-compliance does. The Takaful disclosure proposals go further: requiring transparency around fee calculations, surplus-sharing mechanisms, and additional contribution obligations.
None of this has a Basel or IOSCO equivalent, and it shouldn’t. Basel’s capital framework was written for interest-bearing balance sheets. IOSCO’s disclosure principles assume conventional securities. When a sukuk is structured as an ijara rather than a bond, the risk transfer mechanics and governance obligations are genuinely different - and GCC regulators are on their own in designing the appropriate architecture.
The stakes are not small. Global sukuk issuance hit USD 264.8 billion in 2025. The UAE is now the second-largest sukuk issuer globally. DIFC holds over USD 100 billion in outstanding sukuk listings. Designing regulatory infrastructure for this market is standard-setting at scale.
The Bigger Picture
GCC regulators are not merely receiving international standards. They are participating in their design. IOSCO Board membership matters. Real-world experience of regulating a hundred-billion-dollar sukuk market, rapidly digitalising banking systems, and capital markets newly opened to global investors generates regulatory knowledge that feeds back into the global system.
The Basel Committee and IOSCO were built around G10 experience. The Islamic finance architecture, the commodity-cycle macroprudential toolkit, the digital asset regulatory experimentation - these are areas where GCC regulators are genuinely at or near the frontier. The question is whether the standard-setters are listening.
Based on current trajectories, the answer seems to be: slowly, but increasingly, yes.