AI agents in Islamic finance: what they can do, what scholars say they must not do

From answering to acting

Large language models arrived as text generators. Ask a question, get a paragraph. The agentic turn, roughly 2024 onward, connected those models to tools and let them loop: decide a step, call a tool, read the result, decide the next step. A travel agent example is the cliché; a finance example is more useful.

Suppose an Islamic bank wants to know, every morning, whether any of the leased assets backing its sukuk programme has been put to an impermissible use. A chatbot cannot do that. An agent can: pull the lease register, query the tenant database, compare each tenant's activity code against the Shariah board's exclusion list, pull any news mentions, and write a report with the three cases that need a human to look. That is useful, safe, and already technically possible.

Now suppose the bank lets the same agent decide that one of the three cases is "probably fine" and close it. That is the line, and it has been crossed by nobody responsible, and it is exactly what this page is about.

Where agents already help

Across Islamic and conventional banks, AI tools now handle customer queries, draft documents, monitor transactions for fraud, and run first-pass compliance checks. In the Islamic context specifically, published use cases include:

• Screening listed companies against ratio thresholds and business-activity exclusions. This is rule-following against a published methodology, which software does well. HalalScreener, which publishes this site, does this for stocks, ETFs and crypto.
• Purification calculations for dividends tied to impermissible income.
• Document drafting from board-approved templates.
• Transaction monitoring where the rules are explicit, for example flagging late-payment charges that would need to go to charity rather than revenue.

What is not disclosed as live in any regulated Islamic institution: an agent that executes financial transactions or product approvals with no human sign-off. Vendor material describes the pattern, which is worth understanding, but describes it as a design, not a deployment.

The rulings that fence agents in

The traditions differ in structure and reach the same operational conclusion: an agent may retrieve, check and report; a qualified human rules.

How an agent would actually call a Shariah check

Agents act by calling tools. The engineering question is whether those calls are standardised and logged. In November 2024 Anthropic published the Model Context Protocol (MCP), an open standard that lets an AI system connect to data sources and tools through one interface instead of a bespoke integration for each. Other vendors have adopted compatible approaches.

Why this matters outside engineering: under a protocol like MCP, "check this tenant against the exclusion list" becomes a discrete, logged call to a named tool with a recorded answer. An auditor, or a Shariah board, can replay the log. Vendor commentary on GCC banking describes the same idea as pre-execution validation: before an agent can subscribe to a sukuk or move funds, a validation layer checks asset backing, eligibility and compliance, and records the result. That pattern is sound. Whether any bank has deployed it is a separate question, and the answer today is not publicly.

Five rules for a safe agent

Use these as a test for any product, including ours.

1. Limits set by humans, in advance. The exclusion list, the ratio thresholds, the actions permitted. Written by a Shariah board, versioned, with the version recorded on every decision.
2. Logs for every action. What tool was called, with what input, what came back, what the agent did next. If the agent cannot produce the log, it should not have the authority.
3. Gates where a human must sign. Structure approval, issuance, breach rulings, redemption, any novel case. The agent stops and waits; it does not estimate the answer.
4. Review dates on the rules. Rulings change. A rule encoded in 2026 needs an owner and a date by which a human confirms it still stands.
5. A named person accountable. Not the vendor, not "the model". A person at the institution whose job includes answering for what the agent did.

If a product fails any of the five, the problem is governance, not technology, and better technology will not fix it.

What this means for sukuk specifically

Sukuk are the ideal first application because so much of their lifecycle is rule-bound repetition: calculating distributions, maintaining the tangible-asset ratio, monitoring asset use, filing reports. Those are exactly the tasks the five rules permit. The tasks they forbid, approving the structure and ruling on breaches, are a small fraction of the hours but the whole of the authority.

We lay out the step-by-step version in the agentic sukuk lifecycle, and the infrastructure it depends on in tokenised sukuk.

What we will track here

Regulatory statements on automated Shariah compliance from Bank Negara Malaysia, the Securities Commission Malaysia, the Central Bank of Bahrain, the UAE's Higher Shariah Authority, Saudi Arabia's Capital Market Authority, and Iran's Securities and Exchange Organization; AAOIFI or IFSB guidance on AI; and any disclosed deployment of an agent with transaction authority at a regulated Islamic institution. As of October 2026 we have found no binding guidance from any of them that addresses agents specifically. That gap is itself the most important fact on this page.