The Impact of Fintech Innovations and Financial Inclusion on Banks’ Cyber Risk in GCC

This chapter examines how the rapid expansion of digital payments and financial inclusion in Gulf Cooperation Council (GCC) economies relate to cyber risk in the financial sector, benchmarked against a small set of advanced comparator markets (Malaysia, Singapore, and the United Kingdom). It combines financial sector cyber incidents data from Center for International & Security Studies, University of Maryland with World Bank Global Findex indicators of account ownership, digital-payment usage and mobile-money penetration over the period 2014–2025, using linear interpolation between survey waves to construct annual series. Incident data are normalized by population to derive rates per 100,000 inhabitants, enabling cross-country comparison independent of scale. Descriptive evidence shows that GCC economies have made substantial progress in digital-payment inclusion, closing part of the gap with the advanced-economy frontier but still falling short of comparator benchmarks. Within the GCC, the United Arab Emirates, Saudi Arabia, and Kuwait form a high-adoption cluster, while Oman lags and Qatar cannot be evaluated due to missing data. The incident dataset reveals a distinct threat profile: GCC finance-sector events are concentrated in exploitation of internet-facing application servers and external denial-of-service attacks, often with a hacktivist dimension, whereas comparator markets display a broader mix of data breaches, multi-vector campaigns and more complex attack chains. Correlation analysis and simple OLS regressions linking incident rates to financial inclusion indicators yield weak and statistically non-robust relationships. Once normalized by population, cyber incident intensity exhibits only modest associations with digital-payment usage and account ownership, and a negative association with mobile-money usage that is more pronounced in GCC economies but still explains only a limited share of variation. These findings do not support strong claims that expanding financial inclusion automatically raises or reduces cyber incidents. Instead, they suggest that the financial inclusion-cyber risk nexus is mediated by institutional and structural factors, such as regulatory governance, supervisory capacity, and incident reporting frameworks, that lie beyond headline inclusion metrics. The chapter concludes that financial inclusion and cyber resilience are co-evolving aspects of financial modernization, and that policy efforts in the GCC should prioritize coordinated progress in both digital access and the governance of cyber risk.