AI Regulation Tracker  /  Finance and lending

Egypt Puts AI Risk-Scoring Firms on a Mandatory Register

Under FRA Board Decision No. 279 of 2025, any firm that uses artificial intelligence and digital data analytics to score credit and operational risk for Egypt's non-bank finance sector must now enroll in a formal register run by the Financial Regulatory Authority. Registered providers face a capital floor, quarterly reporting, contract filing, and inspections, and non-bank financiers are barred from using unregistered providers. The register is operational and existing firms have a six-month window to comply. This is a binding regulatory framework, not guidance.

By Anthony Guerriero  ·  The Leveraged Years Regulatory Research  ·  Published July 20, 2026  ·  Last updated July 20, 2026

Most AI regulation you read about aims at the model or the output: label the deepfake, disclose the chatbot, audit the hiring tool. Egypt has taken a different route. It has gone after the vendor. Decision No. 279 of 2025 does not try to police every algorithm that touches an Egyptian borrower. It licenses the companies that supply those algorithms to lenders, and it makes the lenders responsible for only buying from licensed suppliers. That is a supply-chain approach to AI oversight, and it is worth understanding because it is a model other regulators can copy.

What the decision actually requires

The register covers firms that provide technological systems for risk assessment to the non-bank financial sector, which the FRA describes as companies that rely on sophisticated technological tools, including artificial intelligence and digital data analytics, to assess credit and operational risk. To enroll, a provider must clear a capital bar: minimum paid-up capital of EGP 10 million, with alternative structures available for firms that meet a higher shareholders' equity threshold or are majority-owned by an experienced technology firm.

Registration is not a one-time formality. According to the reporting on the decision, registered companies are subject to ongoing obligations that include complying with FRA decisions, enabling regulatory inspections, maintaining strict confidentiality of data, avoiding conflicts of interest, and "submitting quarterly reports to the Authority on the outcomes of their activities." Registration runs in multi-year terms and must be renewed before it lapses, so the provider stays inside the supervisory tent for as long as it operates.

The lender side of the rule is where the teeth are. The decision "prohibits non-banking financial companies and entities from dealing with unregistered risk assessment providers." A non-bank financier that wants to hire a registered provider must "notify the FRA of their intention to contract with any registered provider prior to concluding an agreement" and file a copy of the contract with the Authority. A financier can still use its own in-house scoring system, but only with prior FRA approval. There is no quiet way to plug in an unvetted third-party AI model.

How it is enforced

The FRA gave itself a graduated set of sanctions. For non-compliance it can issue written warnings, order "temporary suspension for up to one year," or move to "delisting with a ban on re-registration for periods ranging from six months to five years," up to permanent removal from the register. Delisting is the real deterrent here, because a provider that loses its registration cannot legally be hired by any non-bank financier in Egypt. Suspension freezes the business; delisting can end it.

Existing technology-based risk assessment companies were given a six-month window to bring themselves into compliance, which is why the practical effect is landing in 2026 even though the decision carries a 2025 number. If you are already scoring risk for Egyptian lenders, the clock is running.

Why a US professional should care

The FRA does not regulate anyone in the United States, so there is no direct US legal effect. The reason this matters is market access. If you advise or run a US fintech, insurtech, or analytics vendor that sells AI-driven credit or operational risk-scoring, Egypt is a live and growing non-bank finance market, and the door into it now has a lock on it. You cannot simply license your model to an Egyptian consumer-finance or microfinance company and let them deploy it. Either your firm registers with the FRA and accepts its capital, reporting, contract-filing, and inspection regime, or your prospective client is legally barred from using you.

That reframes several things for US counsel and operators. Deal structure comes first: work out whether the US vendor registers directly, sets up an Egyptian entity that meets the EGP 10 million capital floor, or licenses through an already-registered local partner. Contracts change too, because any agreement has to be filed with the FRA and has to survive inspection, which means the confidentiality, data-handling, and audit terms you draft are going to be read by a regulator, not just a counterparty. And the quarterly reporting obligation means someone has to own an ongoing compliance function, not just close the sale. For accountants and finance advisors supporting these firms, the capital and reporting requirements are squarely in your lane.

The broader signal is the one to file away. A regulator has decided that the way to govern AI in lending is to license the model vendors and forbid lenders from touching unlicensed ones. If that supply-chain model spreads, selling AI risk-scoring across borders starts to look less like software distribution and more like operating a regulated financial service in every market you enter.

What to do now

If you or a client sells AI or analytics risk-scoring into Egypt's non-bank finance sector, treat Decision No. 279 as a market-entry gate and map your position against it: are you a provider that must register, or are you supplying a lender that now can only buy from registered providers. Check the EGP 10 million capital route against the alternative equity and ownership structures to see which fits. Assume any contract will be filed with and inspected by the FRA, and build the confidentiality, conflicts, and data terms accordingly. Stand up the quarterly reporting capability before you need it, not after a request arrives. And if you already have Egyptian lender clients, confirm where you sit against the six-month transition window, because operating unregistered is what triggers suspension and delisting.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. This briefing summarizes a foreign regulatory decision. Confirm how any development applies to your situation with qualified counsel in the relevant jurisdiction.