Payroll Fraud and Salary Diversion: Controls for GCC Employers

Is payroll a specific target for fraud and phishing? Short answer: Yes, and it has been named as one. The FBI’s Internet Crime Complaint Center identified payroll diversion as a distinct scheme in 2018, the UK’s National Crime Agency named salary diversion fraud in 2021, and the FBI issued a further alert in April 2025 on criminals impersonating employee self-service portals to redirect pay. Wage protection systems across the GCC support wage-payment compliance, but their validation rules and payment data differ by country. They should not be treated as a substitute for the employer independently confirming that a change to an employee’s bank details was genuinely requested and authorised by that employee.

Payroll fraud is not a variant of general cybercrime that happens to touch a finance system. It is a category with its own name, its own method and its own official warnings, and it works because a payroll cycle is designed to move money on a fixed date with a small number of approvals. A fraudulent instruction that arrives inside that cycle, correctly formatted and on time, behaves exactly like a legitimate one.

 

Payroll fraud is a named target in the official record

Four official publications name payroll or salary payments directly. They are all United States or United Kingdom sources, which matters for how they should be read, and it is stated below each figure.

In September 2018 the FBI’s Internet Crime Complaint Center (IC3) issued a public service announcement titled Cybercriminals Utilize Social Engineering Techniques To Obtain Employee Credentials To Conduct Payroll Diversion. It described attackers phishing employee credentials, entering self-service systems, and redirecting the direct deposit to an account they control, often a prepaid card. Its recommendation was a control instruction: apply heightened scrutiny to bank information initiated by employees seeking to update or change direct deposit credentials.

A year later, IC3 attached numbers to it. Between 1 January 2018 and 30 June 2019 it received 1,053 complaints of payroll-diversion-type business email compromise, with a total reported loss of 8,323,354 US dollars and an average loss per complaint of 7,904 US dollars. Over the same period, the dollar loss from direct deposit change requests rose by more than 815 per cent. These are United States complaint figures and should not be presented as a regional or global measure.

In April 2025 the FBI warned that criminals were buying search advertising to impersonate legitimate employee self-service portals, with payroll accounts named among the targets: once inside, the attacker can change the direct deposit information and redirect future payments. In the United Kingdom, the National Crime Agency’s National Economic Crime Centre defined the method precisely in a 2021 alert on payment diversion fraud: salary diversion fraud involves fraudsters impersonating an employee and contacting the payroll department to change the account details into which the salary is paid. The UK government’s public fraud campaign carries the same term and recommends sign-off processes and delay periods for approvals to changes to bank or payroll details.

 

What the official record does not yet say

Two absences are worth stating plainly, because they change what an employer can rely on.

First, the most recent IC3 Internet Crime Report, covering 2025, records 24,768 business email compromise complaints and 3,046,598,558 US dollars in reported losses, but does not break payroll diversion out as a category at all. The recognition sits in the 2018 and 2019 announcements, not in the current taxonomy.

Official United States and United Kingdom sources expressly use the terms payroll diversion and salary diversion fraud. For the GCC, the research reviewed for this article did not identify an official payroll fraud incidence or loss statistic that can safely be presented as a regional measure.

That is different from saying that GCC authorities publish no fraud or phishing figures. For example, the UAE Cyber Security Council has published general phishing and cyber-risk statistics. Those figures are useful as cybersecurity context but are not payroll-specific and should not be presented as evidence of the prevalence of payroll diversion.

 

Why wage protection does not replace bank-detail verification

Wage protection systems across the GCC are designed to strengthen wage-payment compliance, but they do not operate in exactly the same way. Their validation rules, data fields and payment processes differ by country.

In the UAE, MOHRE describes WPS as ensuring that workers receive the wages registered in their employment contracts and that they are paid on time. In Saudi Arabia, wage files submitted through Mudad contain employee wage and reconciliation data, and official technical specifications include beneficiary name, account and IBAN information. Oman goes further in its published description: its Ministry of Labour states that WPS compares the wage recorded in the employment contract with the wage transferred to the worker’s bank account. Bahrain now operates an Enhanced Wage Protection System with a more structured submission and approval process.

The practical fraud-control point is therefore narrower than saying that WPS does not check the destination account.

A wage protection system should not be treated as a substitute for the employer’s own controls over changes to employee bank details. Public WPS documentation does not provide a single GCC-wide guarantee that every change to an employee’s payment instructions has been independently confirmed as having been requested and authorised by that employee. Employers should therefore maintain their own verification, approval and audit trail for bank-detail changes before those details enter a payroll run.

 

How the position differs by country

United Arab Emirates

For establishments within MOHRE’s jurisdiction, WPS monitors payment of wages through approved channels and measures compliance against wages registered under the employment relationship. It should not be described merely as checking that a payment took place.

Current public MOHRE material reviewed for this article does not establish a general rule that WPS independently authenticates whether an employee personally requested and authorised a particular bank-detail change. That authorisation should therefore remain part of the employer’s payroll control process, alongside the file-level checks set out in our WPS pre-submission checklist for UAE payroll.

Free-zone, DIFC and ADGM entities should not automatically be treated as subject to the same MOHRE WPS process. The applicable licensing, employment and wage-payment arrangements should be confirmed for each entity.

Saudi Arabia

Wage protection files are submitted through Mudad. MHRSD states that the service processes employee pay and reconciliation information, compares compliance information and requires bank accounts for the establishment and its registered employees.

The official wage-file technical specification also identifies the beneficiary’s name and account or IBAN and requires the establishment to perform IBAN validation.

The safer fraud-control conclusion is not that beneficiary information is absent. It is that the public documentation reviewed does not establish that Mudad independently confirms that a change of bank details was genuinely requested and authorised by the employee. Employers should maintain their own verification and approval evidence for such changes.

Qatar

Qatar’s WPS provides government oversight of wage payments and is intended to support full and timely payment of wages. Earlier ILO material documented limitations in the way salary files were validated, but those historical observations should not be presented as proof of the exact controls operating in 2026.

The employer should independently verify bank-detail changes, because no current official public source reviewed for this article establishes a substitute for the employer’s employee-authorisation control.

Oman

Oman’s WPS is a joint system of the Ministry of Labour and the Central Bank of Oman. The Ministry states that the system compares the wage registered in the employment contract with the wage transferred to the worker’s bank account and identifies whether the transferred wage matches, exceeds or falls below the contractual amount.

The Ministry also states that an employee’s wage may be transferred to more than one bank account belonging to that employee.

Employers should still independently authenticate requests to change bank details, because wage-payment monitoring and employee authorisation of a master-data change are separate control questions.

Bahrain

Bahrain operates a current Enhanced Wage Protection System that centralises wage processing through the LMRA framework. Employers appoint a Wages Responsible Person through the applicable LMRA process, with authorised persons able to audit and review wage files before submission.

Employers should use the available role structure to separate preparation, review and approval wherever practicable.

Kuwait

Kuwait requires regulated wage-payment processes through the relevant labour and banking framework. Current public material reviewed for this article is not sufficiently detailed to state definitively whether the system authenticates employee ownership or authorisation of every destination-account change.

Employers should therefore verify bank-detail changes independently rather than assume a technical control is present or absent. The country-by-country transfer windows that shape when these checks have to happen are set out in our guide to GCC payroll deadlines for 2026.

 

The three ways a fraudulent instruction enters a payroll cycle

1. The bank detail change

A message that appears to come from an employee asks payroll or HR to update the account their salary is paid into. It is polite, it is plausible, and it usually arrives in the days before the input cut-off, when the team is busiest. Both the National Crime Agency and the UK government’s fraud campaign describe this as the defining shape of salary diversion. It requires no access to any system. It requires only that the request be actioned by the person who receives it.

2. The self-service credential

Where employees can change their own bank details in a self-service portal, the attacker does not need to persuade anyone. The 2018 IC3 announcement and the FBI’s April 2025 alert describe the same route: harvest the credential through a phishing page or a look-alike portal reached through a paid search result, log in as the employee, change the destination account. The FBI noted that the fraudulent address mimics the legitimate one with minimal differences, such as a minor misspelling.

3. The instruction that arrives above the payroll team

The third route does not touch employee data at all. An instruction arrives that appears to come from a senior figure, asking for an off-cycle payment, an advance, a correction, or a change to a supplier or entity account used in the run. It is effective because it inverts the control: the person who would normally question it is the person it appears to come from.

All three converge at the same point. The altered detail joins the file, the file is correctly formatted, and every automated check downstream is satisfied.

 

Controls that hold, and where they sit in the cycle

The controls below are operational rather than technical, which is the point: each one is a decision about sequence and authority, not a product. Read the third column first, because a control placed at the wrong moment in the cycle does not work.

Control	What it stops	Where it sits in the monthly cycle
Bank detail changes are handled on a separate channel from payroll inputs and, where practicable, outside the payroll input window	The spoofed change request that relies on arriving while the team is under deadline pressure	Standing rule, enforced at the input cut-off
Every bank detail change is confirmed out of band, using a number or contact already held on file and never one supplied in the request itself	Both the impersonated employee and the genuinely compromised employee mailbox	At the point of change, before the record is amended
Maker and checker separation on employee master data, so the person who enters a bank account is not the person who approves it	A single captured account, whether taken by an attacker or misused internally	Master data maintenance, continuously
Multi-factor authentication on employee and manager self-service and on the payroll platform, with privileged accounts reviewed periodically	The credential phishing route into self-service described by the FBI in 2018 and again in April 2025	Continuous, with access reviews on a fixed schedule
A variance report at employee level against the prior cycle, including an explicit list of every bank account changed since the last run	All three entry routes. This is the last point at which an altered detail is visible as a difference rather than as a number	After processing, before sign-off
Named sign-off on the payroll output, not only approval of the inputs	An instruction that entered above or around the payroll team and was never in the input set	Before the bank or wage protection file is prepared
One named owner per entity for the wage protection submission role, with a documented deputy and a defined handover, and the available role structure configured so that preparation, review and approval are separated	Concentration of the whole submission in a single credential where the system provides for separated roles, as in Bahrain’s Enhanced Wage Protection System	Standing, reviewed at every joiner and leaver in the payroll team

Bahrain illustrates why this control matters. Its current Enhanced Wage Protection System centralises wage processing through the LMRA framework. Employers appoint a Wages Responsible Person through the applicable LMRA process, with authorised persons able to audit and review wage files before submission. Employers should use the available role structure to separate preparation, review and approval wherever practicable. Running these checks as a scheduled exercise rather than an ad hoc one is covered in our note on best practices for payroll audits and compliance.

 

What the criminal law already covers

Payroll diversion can engage existing cybercrime, fraud, impersonation and unauthorised-access offences. The applicable offence and penalty depend on the jurisdiction and the facts of the incident.

In the United Arab Emirates, Federal Decree-Law No. 34 of 2021 on combatting rumours and cybercrimes covers the full sequence. Article 11 addresses creating a fake website, account or email attributed falsely to a person, with a heavier penalty where the impersonated party is a government entity. Article 2 covers unauthorised access to an information system, with an increased penalty where the access is for the purpose of acquiring data unlawfully. Article 40 covers obtaining an asset for oneself or a third party through fraud techniques or false impersonation over an information network, carrying imprisonment of at least one year and a fine of between 250,000 and 1,000,000 dirhams. Article 15 covers capturing the data of an electronic payment instrument.

In Saudi Arabia, the Anti-Cyber Crime Law issued under Royal Decree No. M/17 maps onto the same conduct. Article 4 covers acquiring movable property for oneself or others through fraud or the use of a false name or identity, and illegally accessing bank data with intent to obtain data, information, funds or services, with imprisonment of up to three years and a fine of up to 2,000,000 riyals. Article 5 covers unlawful access with intent to alter or redistribute private data, which is the shape of an altered wage file, with imprisonment of up to four years and a fine of up to 3,000,000 riyals. Article 3 covers interception of data transmitted through a network.

In Qatar, Law No. 14 of 2014 on cybercrime prevention addresses this conduct. The official text on Al Meezan sets out impersonation and obtaining property through fraud or a false identity over an information network at Article 11, alongside forgery of electronic documents at Article 10. Compliance check required: penalty amounts should be confirmed against the official text before being relied on.

Equivalent cybercrime and electronic fraud provisions apply in Oman, Bahrain and Kuwait. In Oman, the current source is the Cybercrime Combat Law issued under Royal Decree No. 61/2026 in June 2026, which replaced the earlier cybercrime regime. Compliance check required: the exact articles and penalty ranges in these states were not verified against primary texts for this article and are therefore not stated here. Confirm them with counsel in the relevant state before acting on them.

 

If payroll data is compromised, breach-notification obligations may apply

A payroll dataset is among the densest collections of personal data an employer holds: identity numbers, salary, bank account and dependants. A phishing attack or account compromise that reaches it may also create personal-data breach obligations, and the notification duty is separate from anything owed to a labour authority or a bank. The notification test and deadline depend on the jurisdiction. The underlying exposure is covered more broadly in our article on data security risks in payroll management.

United Arab Emirates, federal regime

Article 9 of Federal Decree-Law No. 45 of 2021 requires a controller to notify the competent authority where a personal-data breach would prejudice the privacy, confidentiality or security of personal data. The statutory text leaves the notification period and procedure to the Executive Regulations, so no fixed numeric federal deadline is stated in Article 9 itself. Notification to the affected data subject is also required in the circumstances specified by Article 9, with the detailed period and procedure addressed through the implementing framework.

DIFC

Articles 41 and 42 of DIFC Law No. 5 of 2020 do not impose a general 72-hour deadline. A reportable personal-data breach must be notified to the Commissioner as soon as practicable in the circumstances. Where a breach is likely to result in a high risk to the security or rights of a data subject, the affected data subject must also be informed as soon as practicable, and where there is an immediate risk of damage, communication must be prompt.

ADGM

Under the ADGM Data Protection Regulations 2021, the controller must notify the Office of Data Protection without undue delay and, where feasible, no later than 72 hours after becoming aware of a breach that is likely to result in a risk to affected individuals. Where the breach is likely to result in a high risk, the affected individual must also be notified without undue delay.

Saudi Arabia

Article 24 of the Implementing Regulations of the Personal Data Protection Law requires the controller to notify the competent authority within no more than 72 hours after becoming aware of a personal-data breach where the incident may harm the personal data or data subject or conflict with the data subject’s rights or interests. Where the breach may cause damage, the data subject must be notified without undue delay. This 72-hour requirement is confirmed directly by SDAIA’s official Implementing Regulations rather than by professional-firm commentary alone.

Qatar

Article 14 of Qatar’s Personal Data Privacy Protection Law establishes the breach-notification obligation. The National Cyber Governance and Assurance Affairs’ official breach-notification guideline states that controllers should notify the authority and affected individuals within 72 hours of becoming aware of a breach where the breach may cause damage. The 72-hour position can therefore be sourced to the regulator’s own guidance.

Oman

Oman’s current data-protection framework requires notification to the Ministry of Transport, Communications and Information Technology within 72 hours where the relevant breach-notification threshold is met. The Ministry’s published guidance also provides for notification of the affected data subject within 72 hours where the breach poses serious harm or high risk.

Bahrain

Under Bahrain Resolution No. 43 of 2022, a data manager must notify the Personal Data Protection Authority within 72 hours of discovering a breach, unless the breach is unlikely to affect data subjects’ rights. Where a breach presents a high risk to data subjects, communication to affected individuals may also be required, subject to the applicable exceptions.

Kuwait

Articles 8 and 9 of CITRA’s Data Privacy Protection Regulation provide that an in-scope service provider must notify CITRA of a personal-data breach within no more than 72 hours after becoming aware of the incident and must notify the personal data owner within the same 72-hour period, subject to the exceptions in Article 9. This applies to organisations that fall within the regulation’s service-provider scope, which should be confirmed before treating the rule as a universal obligation.

This guidance reflects OPS’s current understanding of applicable requirements as at 16 September 2026 and does not constitute legal advice. Entity scope, breach-notification obligations and regulatory requirements should be confirmed against the applicable authority or professional adviser before action is taken.

 

What the financial regulators do and do not cover

A recurring assumption in finance teams is that the bank’s fraud controls will catch a diverted salary. The regulatory position across the region is narrower than that, and it is worth reading precisely.

Saudi Arabia’s Counter-Fraud Framework, issued by the Saudi Central Bank in October 2022, requires member organisations to send one-time passwords to verify all payments instructed, for new and existing beneficiaries, and to notify the customer when a new payee is added. The Central Bank of Bahrain’s Operational Risk Module requires licensees to counter fraudulent phishing attempts made by telephone, message or email, to run customer awareness campaigns, and to operate enhanced fraud monitoring of movements in customers’ accounts using limits on value, volume and velocity. The Central Bank of Kuwait’s 2023 instructions on electronic payment of funds require providers to develop policies, procedures, systems and controls for detecting fraud. The Central Bank of Oman’s consumer protection framework requires licensed entities to hold policies protecting customers against internal or external fraud and to notify the regulator of significant breaches of consumer data without undue delay. In the United Arab Emirates, Article 149 of Federal Decree-Law No. 6 of 2025 requires licensed financial institutions to implement fraud prevention and detection mechanisms covering unauthorised transactions, social engineering and identity theft.

Fraud controls operated by banks and other regulated financial institutions do not remove the employer’s responsibility to maintain appropriate controls over payroll master data. Banks, payment systems and wage-protection platforms may perform their own account, format, identity or transaction validations, so the employer’s approval chain should not be described as the only place where beneficiary information can be compared.

The employer’s distinct advantage is the employment context. HR and payroll know whether an employee requested a change, how the request was received and whether it was approved under the organisation’s process. That is why an independent employer-side verification step remains necessary before amended bank details are used in payroll.

What OPS sees in practice A control weakness OPS sees is sequencing. Where employee bank-detail changes travel through the same channel and timing as ordinary payroll inputs, they can enter the cycle under the same deadline pressure. Moving those changes to a separate verification process, outside the payroll input window where operationally feasible, can reduce that risk. The second control is a variance report that lists changed bank accounts as changes, not as values, so the reviewer is looking at a short list of differences rather than a long list of numbers.

 

What this means for Finance, HR and Payroll

For Finance

Ask to see the bank account change list for the last three cycles in each country you run. If it cannot be produced as a list, the control is not in place, whatever the process document says. Then confirm that sign-off is on the payroll output and not only on the input file, because an instruction that bypassed payroll will never appear in the inputs. This is the sign-off step many providers skip.

For HR

Employee self-service is the route the FBI named twice. Multi-factor authentication on self-service, and a rule that a bank detail change made in the portal triggers a notification to the employee’s address of record, turn a silent change into a visible one. Where employees are asked to send bank details by email at all, the channel itself is the weakness.

For Payroll

The cut-off is a control, not an administrative convenience. Holding it is what creates the time for validation and variance review to happen before release rather than after. Where a country runs a tight statutory window, as Oman does, that time has to be protected deliberately rather than found.

 

How OPS builds these control points into the monthly cycle

OPS runs a defined monthly payroll governance cycle for each client entity, configured to its own payroll calendar, approval flow and statutory rules and maintained through monthly service controls. Inputs are checked for completeness and control before processing begins. Validation, quality assurance and variance review are carried out on the payroll output, and the client reviews and confirms that output before the bank or wage protection file is prepared. Nothing is released until the client signs off.

Each entity has a named specialist who owns it end to end, with a named backup rather than a shared queue, which keeps the approval chain attached to people who know what the previous cycle looked like. Where regulatory change affects a market, it is applied to the calendar and configuration before the cycle it affects. Reporting and approval evidence is retained so that a change can be traced to the point it entered, which is what makes a payroll function audit-ready in the operational sense rather than the promotional one. Audit readiness here describes operating discipline, not a legal or regulatory guarantee. This is what managed payroll is built to hold, and it is one of the reasons multi-entity groups are consolidating GCC payroll under one accountable provider.

One example from OPS’s own work: a healthcare operator of around 270 staff across the United Arab Emirates and Saudi Arabia moved to a named specialist with a named backup and an audit-ready evidence pack, which removed the key-person dependency in that payroll function and gave it a full audit trail.

Ask OPS to review your payroll control points If bank detail changes reach your payroll team on the same channel as monthly inputs, or if sign-off is taken on the input file rather than the calculated output, those are the two control points worth checking before your next cycle. Review My Payroll Controls

 

Frequently asked questions

 

Is payroll a named target for fraud and phishing?

Yes. The FBI’s Internet Crime Complaint Center named payroll diversion as a distinct scheme in a September 2018 public service announcement and reported figures for it in September 2019. The FBI issued a further alert in April 2025 on criminals impersonating employee self-service portals, naming payroll accounts among the targets. In the United Kingdom, the National Crime Agency named salary diversion fraud in a 2021 alert and the government’s public fraud campaign uses the same term. The research reviewed for this article did not identify an equivalent GCC authority publication expressly naming payroll diversion or salary diversion fraud.

What is payroll diversion fraud?

A fraud in which the account a salary is paid into is changed to one the attacker controls. It is carried out either by impersonating the employee in a request to HR or payroll, or by obtaining the employee’s self-service credentials and changing the details directly. The payroll run itself is legitimate. Only the destination is wrong, which is why the payment completes normally.

Does the Wage Protection System stop a fraudulent salary diversion?

Not necessarily. GCC wage protection systems primarily support wage-payment compliance, but their validation models differ by country. Some systems compare wage data with employment contracts and worker bank-account information, and current systems may perform additional data and payment validations. WPS should therefore not be treated as an employee-authorisation control. An employer should independently verify a request to change employee bank details, retain evidence of approval and review changed payment details before payroll release. These controls address the question that WPS alone should not be assumed to answer: was this particular change genuinely requested and authorised by the employee?

How should an employer verify a change of employee bank details?

Confirm it out of band, using a telephone number or contact already held on the employee record rather than any contact given in the request. Keep bank detail changes off the payroll input channel and outside the input window. Require a second approver for the change to the master record, and make sure every changed account appears on the variance report reviewed before sign-off. The United Kingdom government’s fraud campaign makes the same recommendation, advising sign-off processes and delay periods for approvals to changes to bank or payroll details.

Who should approve payroll before the bank file is released?

Someone who is reviewing the output rather than the input, with enough authority to stop the run. Approving the input file catches errors in what was submitted. Only a review of the calculated output against the previous cycle catches a change that entered after submission, or one that never appeared in the inputs at all. In OPS’s monthly cycle the client reviews and confirms the output, and nothing is released until that sign-off is given.

If payroll data is stolen, who must be told and how quickly?

The answer depends on the jurisdiction and on the facts of the breach. In the UAE, the federal regime requires qualifying breaches to be reported but does not state a fixed numeric deadline in Article 9 itself. The DIFC requires notification as soon as practicable rather than within a fixed 72-hour period, and ADGM uses a 72-hour standard where feasible for qualifying breaches. Saudi Arabia’s Implementing Regulations provide a 72-hour regulator-notification requirement when the statutory threshold is met. Qatar’s regulator guideline also uses 72 hours for qualifying notifications, Oman uses a 72-hour notification framework, and Kuwait’s CITRA regulation provides for 72-hour notifications by service providers within its scope. Bahrain Resolution No. 43 of 2022 provides for notification to the Personal Data Protection Authority within 72 hours of discovering a qualifying breach. Any actual incident should be assessed separately, because the regulator, notification threshold, affected-person obligation and additional cybersecurity reporting requirements may differ by entity and jurisdiction.

Does outsourcing payroll reduce exposure to payroll fraud?

It depends entirely on which controls come with it. What is worth asking a provider is specific: is there a separate channel and verification step for bank detail changes, is there maker and checker separation on employee master data, is a variance report produced at employee level that lists changed bank accounts, is sign-off taken on the output rather than the input, and is there one named owner per entity with a documented backup. A provider that can evidence those runs a control chain. A provider that processes what it is sent does not.

 

Last reviewed

This guidance reflects OPS’s current understanding of applicable requirements and does not constitute legal advice. Cybercrime, data protection and wage protection rules across these markets change regularly; confirm any specific obligation, deadline or penalty with the relevant authority or professional adviser before acting on it. 

 

Sources

• FBI Internet Crime Complaint Center — Payroll Diversion PSA, 18 September 2018; Business Email Compromise PSA, 10 September 2019, for the payroll diversion complaint and loss figures
• FBI: Cyber Criminals Impersonating Employee Self-Service Websites, 24 April 2025; IC3 2025 Internet Crime Report
• United Kingdom National Crime Agency — Amber Alert on Payment Diversion Fraud, 16 November 2021; Stop! Think Fraud, protecting your business
• International Labour Organization — Assessment of the Wage Protection System in Qatar, June 2019; Wage Protection Systems in the Gulf Cooperation Council Countries, November 2025
• Wage protection authorities: MOHRE, United Arab Emirates; MHRSD Wage Protection File Upload Service, Saudi Arabia; Oman Government Portal, WPS connection service; LMRA Wage Protection Guideline and WPS User Manual, Bahrain
• Cybercrime legislation: UAE Federal Decree-Law No. 34 of 2021; Saudi Anti-Cyber Crime Law, Royal Decree No. M/17; Qatar Law No. 14 of 2014; Oman Cybercrime Combat Law, Royal Decree No. 61/2026
• Data protection: UAE Federal Decree-Law No. 45 of 2021; DIFC Law No. 5 of 2020; ADGM Office of Data Protection, breach notifications; Oman MTCIT, personal data protection; Bahrain Law No. 30 of 2018 and Resolution No. 43 of 2022; SDAIA guide to the Saudi PDPL; CITRA Data Privacy Protection Regulation, Kuwait
• Financial regulators: SAMA Counter-Fraud Framework v1.0, October 2022; CBB Rulebook Volume 1, Operational Risk Module; CBK Instructions for Regulating the Electronic Payment of Funds, May 2023; CBO Financial Consumer Protection Regulatory Framework; CBUAE Article 149, Fraud Prevention
• General UAE cyber-risk context, not payroll-specific: UAE Cyber Security Council statements carried by WAM, the Emirates News Agency
• Secondary corroboration, disclosed as such: Clyde & Co on the Saudi implementing regulations; Baker McKenzie on Saudi breach notification; DLA Piper on Qatar; Clyde & Co on Bahrain Resolution 43 of 2022; ASAR on Bahrain reporting obligations; BSA LAW in Chambers on the UAE executive regulations; Al Tamimi & Company on Qatar Law No. 14 of 2014