Shari’ah Governance for UAE Financial Institutions: What You Actually Have to Build

Shari’ah governance is not the act of certifying a product as compliant. It is the institutional machinery that decides who certifies, on what authority, subject to whose override, checked by whom, and reported to whom. UAE law sets that machinery out in mandatory terms rather than leaving each institution to design its own.

The distinction separates two professions. Determining whether a structure is Shari’ah-compliant is scholarly work. Determining whether the institution has lawfully constituted the bodies that make that determination, appointed them correctly and documented their decisions is legal and regulatory work. This guide is about the second.

• Central Bank of the UAE ↗

The structure has three levels. Above the institution sits the Higher Shari’ah Authority, attached to the Central Bank, whose resolutions and fatwas bind the sector. Inside the institution sits its own Internal Shari’ah Supervision Committee, which issues fatwas binding on the institution. Beneath the ISSC sit two separate divisions — internal Shari’ah control and internal Shari’ah audit — which make decisions operational and test whether they were followed.

Each layer does a different job and none substitutes for another. An institution with an excellent ISSC and no functioning audit division has not complied; nor has one with strong internal divisions and an ISSC that has drifted from HSA positions. The structure is assessed as a whole, and a board should review it the same way.

The Higher Shari’ah Authority is established under Article 24 of Federal Decree-Law No. 6 of 2025 as an authority attached to the Central Bank. Article 24(1) provides for not fewer than five and not more than seven members, appointed by a decision of the Central Bank for renewable three-year terms.

Its functions include giving opinions on regulatory rules and on sovereign sukuk issuances, and approving Shari’ah-compliant monetary instruments. It is a small standing body whose output is binding across the sector, which is why tracking its resolutions belongs on an institution’s compliance calendar rather than on a reading list.

• UAE Legislation Portal ↗

The HSA’s original legal basis was Article 17 of Federal Decree-Law No. 14 of 2018. That article is marked as repealed in the Central Bank Rulebook, and the live provision is Article 24 of Federal Decree-Law No. 6 of 2025. Almost all published commentary, and a good deal of transaction and policy documentation, still cites the 2018 article.

This is a practical test rather than a pedantic one. If a board paper or external memorandum still cites Article 17 for the existence of the HSA, it was written against superseded law and every other proposition in it deserves the same check. Not established on the public record: the 2025 law’s precise repealing provision or its own entry-into-force article.

Article 24(8) of Federal Decree-Law No. 6 of 2025 makes HSA resolutions and fatwas binding on internal Shari’ah supervisory committees and on Islamic financial institutions. Article 75 makes an institution’s own ISSC fatwas binding on that institution, but expressly only where they do not conflict with HSA resolutions and fatwas. Article 76, dealing with the ISSC’s report, states that the HSA’s opinion shall be binding and final.

The hierarchy is closed at the top. Management cannot overrule its own ISSC; the ISSC cannot depart from the HSA; the HSA’s view is final. An internal escalation policy has to be built inside that hierarchy, and a governance manual giving management a casting vote on a Shari’ah question describes something the statute does not permit.

Article 75 of Federal Decree-Law No. 6 of 2025 requires every Islamic financial institution to establish an independent Internal Shari’ah Supervision Committee composed of specialists competent to issue Islamic financial fatwas. Its remit extends to all of the institution’s business, products, services and contracts.

That word all is doing work. The obligation is not to review a sample of new products at launch but to supervise the institution’s activity as a whole. Institutions treating the ISSC as a transaction-by-transaction approval gate tend to have a structural gap on legacy products, on contract variations, and on practice that has drifted from an approved structure.

• UAE Legislation Portal ↗

Article 75 sets three specific restrictions on ISSC members. They may not hold executive positions at the institution. They may not provide outside services to it. They may not hold shares or interests in it.

These are structural prohibitions, not disclose-and-manage rules. The conflict must be absent rather than declared and mitigated, a materially higher bar than most corporate conflict policies apply. It also narrows the appointable pool, because a scholar advising the institution in any other capacity is caught by the second limb — often discovered when a preferred candidate turns out to be ineligible rather than merely conflicted.

Article 75 provides that disagreements are referred to the Higher Shari’ah Authority for a final and binding determination. There is no internal route around it and no mechanism by which the institution resolves the difference itself.

The practical consequence is a sequencing question governance manuals often miss. If a product has been approved internally but the position is contested against an HSA resolution, proceeding before escalation completes converts a Shari’ah disagreement into a regulatory exposure. Write the escalation route into the ISSC charter and the product-approval process, with a defined hold position, rather than improvising it.

Article 75 requires two separate divisions: an internal Shari’ah control division and an internal Shari’ah audit division. They are separated deliberately because they perform opposite functions. Control operates inside the business process, checking compliance as business is written and as contracts are executed. Audit tests that process independently and after the fact.

Combining them into one Shari’ah function, however well resourced, does not satisfy the requirement as drafted. Nor does outsourcing the audit division wholesale while keeping a nominal internal head, since the statute frames both as divisions of the institution with approved heads. For a small institution the design question is how to staff two genuinely separate functions, not whether it can avoid having two.

The head of each of the two divisions must be approved by the institution’s board, by the ISSC, and by the Higher Shari’ah Authority. Three approvals for a single internal appointment, one of them from the regulator.

This is the detail most likely to break a hiring timetable. An institution filling a control or audit headship on an ordinary internal-approval cycle has not accounted for a regulatory approval sitting in the chain, and a vacancy in either role is a visible governance gap. Succession planning for these two roles is a board matter, not a human-resources matter.

The Central Bank’s Standard Re. Shari’ah Governance for Islamic Financial Institutions, circular reference STA-LFI-GOV-2020, took effect on 21 April 2020 and is in force. It requires a three-lines-of-defence model, an ISSC of at least five members with at least one third of them Emirati, an Internal Shari’ah Control Division and an Internal Shari’ah Audit Division.

One oddity is worth knowing about: the Standard still states its legal basis as the 2018 Central Bank law, whose HSA article is marked repealed, so the regulator’s own rulebook carries a superseded citation. The Standard is not thereby invalid, and regulatory instruments routinely survive the replacement of their enabling statute. What it shows is that a citation found in an official rulebook still needs verifying against the statute itself.

Beyond it, the Central Bank maintains related instruments confirmed by title: a Standard on institutions housing an Islamic window, guidance notes on the ISSC’s annual Shari’ah report and on the ISSC charter, a Standard on the Shari’ah compliance function with its guidance note, and Standards on external Shari’ah audit for Islamic financial institutions and for Takaful companies. Their issue dates are not established here, so confirm current versions directly.

• Central Bank of the UAE ↗

A wholly Islamic institution conducts only Shari’ah-compliant business, so its governance structure and its business are coextensive. An Islamic window is a compliant operation run inside an otherwise conventional institution, and it raises questions the wholly Islamic model never faces: segregation of funds and accounting, allocation of shared functions and staff, disclosure to customers, and how far the ISSC’s remit reaches into a business that is mostly conventional.

Both models are recognised and regulated. The Central Bank maintains a dedicated Standard on regulatory requirements for financial institutions housing an Islamic window. In the DIFC, the DFSA regulates Islamic financial business through a special endorsement on the firm’s licence, and a firm may be wholly Islamic or run a window; requirements confirmed there include a Shari’a Supervisory Board of at least three competent scholars, Shari’a reviews and internal audit, and AAOIFI accounting standards. In ADGM the FSRA operates its own Islamic Finance Rules module under the Financial Services and Markets Regulations, with IFR 6.2 governing the Shari’a Supervisory Board for an Islamic Fund. None of these regimes recognises another’s approval automatically.

• DFSA ↗
• ADGM ↗

A workable sequence is to constitute the ISSC first, because the committee has to approve the divisional heads; to draft the ISSC charter against the Central Bank guidance note on charters; to identify division heads early given the triple approval; and to write the HSA escalation route into the product-approval process before the first contested product rather than after it.

Three things are worth verifying rather than inheriting. That any citation for the HSA reads Article 24 of Federal Decree-Law No. 6 of 2025, not Article 17 of the 2018 law. That the Central Bank Standards and guidance notes in use are current, since their issue dates are not established here. And that ISSC candidates are clear of all three independence limbs, not merely the obvious one.

LEXNOVA is a lawyer-matching service. It is not a law firm and not a Shari’ah advisory body, gives no legal advice, issues no fatwas and certifies nothing. It matches you with an independent lawyer who works in this area, every match reviewed by a person, and the engagement runs directly between you and that lawyer.