Payments firms have used machine learning against fraud for decades. What has changed is how widely AI is now used, how closely regulators are watching it, and how quickly criminals are using the same tools to attack the systems meant to stop them.

Where AI is used in payments

Real-time fraud detection is the most mature use. Models combine transaction data, device signals, behavioural biometrics and merchant patterns to score each payment in milliseconds. Most firms layer several techniques, such as gradient boosting, neural networks and rules, so that a weakness in one does not leave an open door. Well-tuned models also cut false declines, which cost merchants sales and annoy cardholders.

Credit scoring and underwriting with machine learning is growing fast in GCC markets, where many customers have thin credit files. Models use transaction history, bill payments and other alternative data to decide in seconds. This is the use most clearly classed as high-risk under the EU AI Act.

AML transaction monitoring is moving from fixed rules to adaptive models that produce fewer alerts while catching more genuine cases. Supervisors now ask not only whether monitoring exists but whether it works for the risks of the firm's own business.

Payment routing uses machine learning to send each transaction down the path most likely to be approved at the lowest cost, taking account of card type, amount, merchant category, geography and issuer behaviour. Large acquirers and processors now treat this as standard.

Criminals are using AI too

Generative AI has made it cheaper and easier to create synthetic identities, fake documents and deepfake videos that get past identity checks, and to run social engineering at scale. Europol has warned that deepfakes are being used for document forgery and impersonation in financial onboarding. Fraud models trained on past patterns have to keep adapting to attacks that did not exist when they were trained.

Payment firms should also watch for systematic probing: large numbers of small transactions used to map detection thresholds before a larger attack. Instant payment systems, where money moves irrevocably within seconds, are especially exposed.

The EU AI Act

After the EU's AI Omnibus, which entered into force on 27 July 2026, the high-risk obligations for Annex III systems apply from 2 December 2027. For payment and credit firms, the main in-scope uses are credit scoring and creditworthiness assessment, and risk assessment and pricing in life and health insurance. AI used to detect financial fraud is explicitly excluded, as is biometric verification used only to confirm a person's identity, although firms should check that each system really falls within those exclusions.

High-risk systems need technical documentation, evidence of data quality and bias checks, decision logging, clear information for deployers and human oversight. For real-time systems, oversight means that people can monitor, override and stop the system, not that they review every decision. Firms with an EU presence should finish an inventory of their AI systems against the criteria now, while there is time to close gaps.

GCC context

GCC regulators have so far set principles and guidance for AI in financial services rather than a binding AI law like the EU's. The UAE has a national AI strategy and joint guidance from its financial regulators on adopting new technologies; Saudi Arabia's data and AI authority, SDAIA, has published AI ethics principles; and Qatar is developing its approach through QCB. The direction is the same as in Europe: firms will be expected to document and take responsibility for AI decisions that affect customers. A compliance programme built for the EU AI Act can be designed so that it also meets GCC expectations as they develop.