Concerns about oversupply and a potential slowdown in Dubai’s real estate market do not appear to be troubling landlords at the ultra-luxury end, where annual rentals are pushing well into multi-million-dirham territory.

Real estate brokerage Exclusive Links says it completed one of Dubai’s highest-value residential rental transactions of 2025 last month, securing a Dhs4.25m annual lease for a mansion in Dubai Hills Estate.

The fully furnished home spans 18,749 square feet and features expansive living areas, a private swimming pool, jacuzzi, landscaped outdoor spaces and six-car underground parking.

The property is close to championship golf courses, premium retail outlets, top-tier schools and business districts.

James Gosling, who handled the transaction for Exclusive Links, said the firm secured a VIP tenant — already residing in Dubai — within just one week of the property being listed.

“Large, well-positioned homes in established master-planned communities are attracting serious enquiries quickly, provided they are priced and marketed correctly,” Gosling told Gulf Business.

“We are also seeing sustained demand for long-term ultra-prime rentals from tenants who value flexibility, capital mobility, or who maintain multiple global residences. Dubai’s depth of luxury stock now supports both paths, which is why the rent-versus-buy decision at this level is increasingly strategic rather than purely financial,” he added.

While Dhs4.25m a year would be considered an exceptional rental by most standards, verified data seen by Gulf Business suggests some tenants are paying even higher rents in the same area.

At least two other properties in Dubai Hills Estate have secured leases worth Dhs25m and Dhs22m respectively over 24-month periods.

In the same neighbourhood, the Dhs4.25m annual rental ranks among the highest recorded recently, with at least ten properties being leased for between Dhs2.2m and Dhs2.75m per year. Several other homes in the area have also fetched rents exceeding Dhs3m annually.

Further afield, current listings on the Palm Jumeirah advertised on property portal Property Finder show some signature villas being marketed for rents above Dhs16m a year.

Asked why tenants capable of affording such rents might opt not to buy, Gosling said the decision often reflects a desire to assess options before committing long term.

“Many ultra-high-net-worth tenants choose to rent initially while they familiarise themselves with Dubai, assess communities, schooling and lifestyle fit,” he said. “After 12–24 months, a significant proportion transition into ownership once they are confident in their long-term plans.”

These ultra-prime rentals also coincide with the UAE attracting the highest number of dollar millionaires globally last year.

Private wealth advisory firm Henley & Partners reported that the UAE was on track for a net inflow of 9,800 millionaires, ahead of the US, which recorded a net inflow of 7,500.

Slowdown? What slowdown?

Multi-million-dirham rentals appear to sit alongside some warnings that oversupply risks may be building in Dubai’s property market.

In May last year, Fitch Ratings cautioned that Dubai property prices could fall by up to 15 per cent in the second half of 2025 and into 2026, amid an estimated 120,000 new units expected to come online in 2026, up from 90,000 in 2025.

Those projections, however, have been widely debated across the industry.

At Gulf Business’ latest real estate panel in November, Lewis Allsopp, chairman of Allsopp & Allsopp, dismissed predictions of an imminent downturn, pointing instead to population growth, infrastructure expansion and more than $700bn in long-term investment commitments.

Read more: Gulf Business Real Estate Summit — Dubai defies gravity with record sales, soaring prices

“Dubai remains highly attractive to high-net-worth individuals, including premier league footballers,” Allsopp said. “Real-world demand contrasts sharply with short-term reports suggesting weakness.”

“In fully developed areas such as the Palm, prices have absolutely skyrocketed over the years,” he added.

“It all depends on location.”

Most major stock markets in the Gulf were mixed in early trade on Monday amid weaker oil prices as investors weighed oversupply concerns against geopolitical risks.

Brent crude futures were down 52 cents, or 0.8 per cent, to $60.23 a barrel, as adequate global supplies offset concerns about supply disruptions after the US captured Venezuelan President Nicolas Maduro in an audacious raid over the weekend.

Read more: Maduro is out but it’s unclear who is running Venezuela

Saudi Arabia’s benchmark index dropped 0.2 per cent, extending losses from the previous session’s 1.8 per cent fall. Oil giant Saudi Aramco slipped 0.6 per cent.

The kingdom’s non-oil private business sector remained in growth territory in December, though expansion slowed to a four-month low and new order growth decelerated, according to a survey released on Monday.

Dubai’s main share index dropped 0.6 per cent, with blue-chip developer Emaar Properties losing 1.4 per cent and toll operator Salik retreating 1.7 per cent.

In Abu Dhabi, the index was down 0.6 per cent.

OPEC+ kept oil output unchanged on Sunday after a quick meeting that avoided discussing the political crises affecting several of the producer group’s members.

Qatar bucked the regional trend, with its index rising 0.8 per cent.

The Gulf’s biggest lender, Qatar National Bank QNBK.QA, advanced 1 per cent.

Egypt and Qatar signed a memorandum of understanding to boost cooperation in LNG sales and imports, including terms for supplying Qatari shipments to Egypt’s Ain Sokhna and Damietta ports, Egypt’s petroleum ministry said on Sunday.

Twenty years ago this week, H.H. Sheikh Mohammed bin Rashid Al Maktoum became the Ruler of Dubai, marking the start of a period that would redefine federal governance and accelerate the emirate’s rise as a global hub.

On 4 January 2006, Sheikh Mohammed assumed the role of Ruler of Dubai. He became Prime Minister of the UAE shortly thereafter in February 2006.

READ MORE: From humble beginnings to global heights: Sheikh Mohammed’s journey unveiled in new biography

The milestone was marked over the weekend at a high-level meeting attended by UAE president Sheikh Mohamed bin Zayed Al Nahyan, alongside current and former ministers who have served in the UAE Government since 2006.

Congratulating Sheikh Mohammed, UAE president Sheikh Mohamed bin Zayed described the UAE Government as an inspiring model of development that places people at the heart of its priorities, guided by a vision aligned with the future aspirations of Emiratis.

For Sheikh Mohammed, the anniversary is a moment of reflection.

“Today, we mark 20 years since I assumed the office of Prime Minister — two decades spent working alongside a dedicated team that has given its utmost to this nation,” he said.

“In the life of a nation, 20 years may not be a long time, but the UAE has given this period a significance as vast as its achievements.”

That journey, he said, saw the UAE transform “in record time” from a regional leader into a global force, built on a development model centred on quality of life, human empowerment, a resilient economy and exceptional government efficiency.

“We were determined to be at the forefront of development to ensure a high quality of life, stability, progress and prosperity for the UAE and its people,” Sheikh Mohammed said.

“Today, we rank at the top of several fields, and the UAE has become a whole world within one country.”

He paid tribute to long-standing members of his leadership team, thanking Sheikh Mansour bin Zayed Al Nahyan, Sheikh Saif bin Zayed Al Nahyan and Sheikh Abdullah bin Zayed Al Nahyan for their roles over the past two decades, while also pointing to the next generation of leadership, including Sheikh Hamdan bin Mohammed in defence and Sheikh Maktoum bin Mohammed in finance.

“The people of the UAE love being number one,” Sheikh Mohammed said. “Our President aims for us to be number one by desiring the best for us. We in the UAE government are determined to realise this vision, as our people deserve the best.”

He added: “Twenty years have passed so swiftly, and the next 20 will also pass in this manner. However, we must all strive to leave a mark — one that drives our nation forward and endures the passing of time. Our best years are yet to come.”

A 20-year timeline of transformation

Sheikh Mohammed’s two decades of leadership can be traced through a series of defining milestones that reshaped Dubai’s economy, institutions and global standing.

Over this period, Dubai’s economic scale and international relevance expanded sharply.

Since 2006, the emirate’s economy has more than doubled in real terms, its population has grown from around 1.3 million to more than 3.6 million.

Dubai has consistently ranked among the world’s leading cities for trade, tourism, aviation and foreign investment, underpinned by a governance model focused on speed, diversification and long-term planning.

Listed below are just some of the key achievements over the last two decades.

2006–2010
The period is marked by rapid infrastructure expansion across aviation, transport and real estate. Dubai International Airport accelerates its rise as a global hub, while large-scale urban development reinforces Dubai’s role as a regional business and tourism centre. In 2009, the Dubai Metro officially opens too.

2010
The inauguration of Burj Khalifa becomes a defining global moment, symbolising Dubai’s ambition and confidence.

2011–2015
Economic diversification gathers pace. Dubai’s GDP reached approximately Dhs389bn by 2014, driven by trade, tourism, transport, financial services and real estate. The emirate strengthens its position as a global trading hub, supported by world-class ports, logistics and aviation infrastructure.

2016–2019
Dubai intensifies its focus on future readiness. Smart government initiatives, digital services and innovation frameworks are rolled out, while long-term strategies reinforce competitiveness. By 2019, Dubai International Airport is handling more than 86 million passengers a year, making it consistently the world’s busiest airport for international traffic.

2020–2021
Despite global disruption caused by Covid-19, Dubai maintain momentum. Expo 2020 Dubai, held from October 2021 to March 2022, attracted more than 24 million visitors.

2022–2024
Dubai’s post-pandemic recovery is swift. GDP reaches Dhs429bn in 2023, growing more than 3 per cent year on year, led by transport, trade, tourism and financial services. Tourism rebounds strongly, with 17.15 million international visitors in 2023, surpassing pre-pandemic levels.

The Gulf’s financial sector has made remarkable strides in digital innovation. From mobile-only neobanks and biometric identity systems to AI-powered lending tools and open banking frameworks, GCC banks are redefining what modern finance looks like.

Countries like the UAE, Saudi Arabia, and Bahrain now stand among the world’s most ambitious fintech adopters, and broader MENA markets such as Egypt are also building strong foundations for fintech innovation and regulatory reform.

But as digital progress accelerates, so too does the risk. Beneath the surface of seamless customer experiences lies a growing vulnerability: the rapidly expanding and often under-secured world of APIs, the invisible infrastructure powering almost every modern banking service.

The expanding edge of exposure

As banks across the GCC migrate to cloud platforms like AWS and Azure, they are expanding their digital footprint, and with it, their attack surface. APIs sit at the centre of this transformation, enabling connections between mobile apps, core banking systems, and cloud services. But these same APIs also create direct pathways into sensitive data and operations. Without visibility and protection, they become high-value entry points for attackers.

The nature of API architecture introduces unique risks. Unlike traditional web applications, APIs are designed to expose functionality, which also exposes vulnerabilities. Attackers exploit this by bypassing conventional defences, abusing business logic, or automating credential stuffing attacks. With APIs increasingly used to access sensitive systems directly, they have become one of the most valuable targets for sophisticated threat actors.

Growing importance of APIs

APIs aren’t just connecting bank systems; they’re increasingly serving as the infrastructure behind embedded finance in super apps. In the GCC, platforms like Careem, BOTIM, and other everyday apps have integrated wallet, payment, or lending features directly into everyday services like ride-hailing and communication. While this trend unlocks new convenience for consumers and revenue streams for banks, it also introduces new risks. When financial APIs extend into third-party environments, banks cede some control over how those APIs are accessed, secured, and monitored.

Further, the movement towards open banking APIs and increased interconnectivity between banks, applications, and the aggregators facilitating these connections presents sophisticated detection challenges for security teams. This shift makes API visibility even more critical because what was once a back-end interface is now a public-facing, high-traffic attack surface.

Despite growing awareness, most institutions still face a critical gap: visibility. Many financial organisations lack a complete, real-time inventory of their APIs, including undocumented, deprecated, or shadow APIs that operate beyond the scope of standard security tools.

Gaps in visibility weaken an institution’s ability to manage risk, making them as much a strategic concern as a technical one.

When security budgets outpace security outcomes

The good news is that banks are taking action. Across the GCC, cybersecurity budgets are increasing, and API security is being treated as a strategic priority. But investment alone does not guarantee results, especially when efforts focus on checklists instead of actual risk.

The challenge lies in execution. Static API documentation cannot keep up with agile development and third-party integrations. What is needed is continuous discovery that automatically identifies all exposed APIs, including undocumented or shadow endpoints.

Once discovered, APIs should be classified by risk. Not all endpoints pose the same threat. Those connected to customer data or payment systems require stronger protection than those serving public content.

Just as important is understanding how APIs behave under normal conditions. Security teams need this baseline in order to detect subtle anomalies. This matters even more now that attackers are using AI to imitate legitimate traffic and slip past rule-based filters.

At the same time, banks must manage the risks within their own AI systems. Regional regulators are calling for greater oversight of models used in fraud detection, credit scoring, and anti-money laundering. This places new demands on security teams, who must treat API and AI risk as part of the same operational discipline.

Cyber offence gets an AI upgrade

Artificial intelligence has become a cornerstone of digital banking in the GCC, powering everything from generative chatbots and dynamic credit scoring to fraud analytics and portfolio optimisation. But the same technology is being turned against banks.

Threat actors are increasingly leveraging AI to automate the discovery and exploitation of API vulnerabilities. These tools can scan vast swaths of internet-facing infrastructure in seconds, identify misconfigurations, and launch precision attacks that are difficult to detect with legacy defences.

In response, financial institutions must adopt AI not only as a business enabler but as a defensive weapon. Advanced API security today requires machine learning models capable of real-time traffic and behavioural intent analysis, threat correlation, and autonomous response.

Compliance is not a finish line

Regulators across the GCC have introduced stricter rules to keep pace with digital transformation. New requirements include enhanced authentication for digital banking, tighter controls on data sharing, and specific guidelines for API security within open banking frameworks.

These efforts are essential, but regulation alone does not guarantee protection. A mindset focused solely on compliance can lead to minimum standards being met without real security progress. The most forward-looking banks go further, treating API security not just as a regulatory obligation, but as an opportunity to build trust, enable innovation, and reduce business risk.

Ownership, not just oversight

Addressing API risk is not just a technical challenge. It requires organisational ownership. Increasingly, banks are appointing API security champions within their development teams. These individuals act as liaisons between engineering, risk, and compliance, helping to embed security from design through to deployment.

Full-spectrum ownership means making API security part of every function — from DevOps and architecture to fraud prevention and legal. Institutions that take this approach are better positioned to turn awareness into effective action.

When banks have clear visibility and control over their APIs, they can move faster. With discovery, classification, monitoring, and protection in place, teams can launch open banking products with confidence, integrate fintech services securely, and build digital experiences that reinforce trust.

GCC banks have already shown global leadership in digital transformation. Those that bring the same strategic focus to API security will not only reduce cyber risk but also accelerate innovation. In a digital-first world, security is no longer a constraint. It is the foundation for faster growth and smarter innovation.

Read: Re-inventing the commercial banking experience in the Middle East

Saudi Arabia’s Ministry of Human Resources and Social Development has announced two decisions to increase Saudisation rates in specialised professions, as the kingdom seeks to expand Saudi participation in the labour market and create quality job opportunities, the Saudi Press Agency (SPA) reported.

Under the first decision, Saudisation in engineering professions will be raised to 30 per cent, alongside an increase in the minimum wage for Saudi engineers to SAR8,000 ($2,133) per month in the private and non-profit sectors. The measure will take effect on December 31, 2025, and will apply to establishments employing five or more workers across 46 engineering roles, SPA said.

Read: UAE raises minimum wage for Emiratis in private sector from Jan 1

The targeted professions include architect, power generation engineer and industrial engineer.

The ministry said that employees counted towards Saudisation must be accredited by the Saudi Council of Engineers. Companies will be given a six-month grace period from the date of issuance before the decision comes into force.

Saudisation rates to rise in procurement in the private sector

In a second decision, the ministry raised Saudisation rates in procurement professions in the private sector to 70 per cent, effective November 30, 2025.

This measure applies to establishments with three or more employees working in 12 key procurement roles, including procurement manager, contracts manager and warehouse keeper, according to SPA.

The procurement decision also includes a six-month preparation period before enforcement, allowing companies time to align their workforce structures with the new requirements.

The ministry said the measures are intended to improve the work environment, broaden employment opportunities for Saudi citizens and increase national participation in vital economic sectors.

SPA reported that the ministry has published a procedural guide on its website outlining the professions covered, methods for calculating Saudisation rates and steps required for compliance.

Establishments were urged to adhere to the new rules to avoid penalties.