An Islamic financial institution makes a promise to everyone it deals with: that its products and operations comply with Shari'ah. Customers often choose it for that reason, and investors and regulators rely on it. Shari'ah governance is what makes the promise credible: the structures and processes that check, independently and continuously, that the institution is doing what it says.
In 2024 AAOIFI issued a revised Governance Standard No. 1, Shari'ah Governance Framework, together with a set of new standards that sit around it (GS 18 to GS 22). They take effect on 1 January 2026. This article summarises what has changed and what institutions should be doing now. It is an independent summary by ifSPACE; for the exact requirements, read the standards themselves.
A framework, not a single board
The earlier approach centred on the Shari'ah supervisory board (SSB). The revised framework keeps the SSB at its heart but treats Shari'ah compliance as the job of the whole institution. GS 1 (2024) sets out fourteen principles, developed after a joint project with the IFSB, that cover:
- the framework itself and the role of regulators;
- a recommended central Shari'ah board at national level;
- the organs of Shari'ah governance and the roles of the board and senior management;
- the SSB, the Shari'ah compliance function, internal Shari'ah audit and external Shari'ah audit;
- Islamic windows and Islamic subsidiaries of conventional groups;
- the business model and stakeholders, including participatory stakeholders such as investment account holders;
- application across sectors such as banking, takaful, capital markets and microfinance;
- transparency and disclosure.
It applies to all Islamic financial institutions, including the Islamic windows of conventional institutions, in every sector.
The four organs
At a minimum, every institution needs four organs:
| Organ | Role |
|---|---|
| Shari'ah supervisory board | Issues binding fatwas and rulings and supervises compliance |
| Shari'ah compliance function | Monitors and advises on compliance day to day, usually through a Shari'ah compliance department |
| Internal Shari'ah audit | Gives the board and SSB independent assurance on controls |
| External Shari'ah audit | Gives stakeholders independent third-party assurance |
External Shari'ah audit is a significant step. It becomes annual and, for public interest institutions, mandatory after a three-year transition from the effective date.
A clear hierarchy of authority
The framework defines "Shari'ah principles and rules" by a hierarchy:
- AAOIFI Shari'ah standards;
- the regulator's Shari'ah-related requirements;
- rulings of the central Shari'ah board, where one exists;
- Shari'ah-related requirements of AAOIFI's accounting standards;
- the approvals and rulings of the institution's own SSB.
Where compliance, audit or rating work meets an ambiguity in the first four levels, the SSB's clarification prevails. This hierarchy gives auditors and compliance officers a clear benchmark to test against.
Everyone has a role
The framework is explicit that Shari'ah compliance cannot be left to the SSB alone.
- The board has ultimate responsibility. It approves policies on Shari'ah governance and non-compliance risk, oversees the implementation of rulings, protects the SSB's independence and assesses its performance.
- Senior management implements the framework, gives the SSB complete and timely information, gives all Shari'ah organs access to records, reports significant non-compliance, prepares a statement of compliance and provides an SSB secretariat.
- Regulators should license only authorised institutions to offer Shari'ah-compliant services and ensure the framework is in place.
The supporting standards
GS 1 (2024) is the umbrella. Several standards fill in the detail:
- GS 19: appointment and composition of the SSB, including at least three Shari'ah scholars appointed by shareholders for three to five years, fit and proper criteria and disqualification grounds.
- GS 20: the SSB's functions and operations, including at least four meetings a year, 75% attendance, documented rationale and dissent, an escalation protocol for non-compliance, and detailed independence rules.
- GS 21: the SSB's review and its annual report to shareholders, with prescribed minimum contents. GS 19 and GS 21 together replace the old GS 1 and GS 2.
- GS 18: the Shari'ah decision-making process, including the minimum contents of a fatwa and a frank treatment of the psychological tendencies, such as framing, anchoring and overconfidence, that can distort decisions.
- GS 22: Islamic subsidiaries and associates of conventional institutions, limiting the parent's influence to proportional board representation and preventing the entity from placing funds with conventional institutions.
- GS 9 and GS 11: the Shari'ah compliance function and internal Shari'ah audit.
- ASIFI 6: external Shari'ah audit.
What institutions should be doing now
Map the gaps. Compare current arrangements with each standard: SSB composition and contracts, meeting frequency and attendance, charter, compliance and audit functions, reporting lines.
Review the SSB's independence. Check remuneration, family and business links, shareholdings and consultancy relationships against the new rules, and document conflicts of interest.
Strengthen documentation. Put in place a product approval checklist, a standard format for queries to the SSB, minutes that record rationale and dissent, and a mechanism to revisit earlier fatwas.
Prepare for the new SSB report. The report has prescribed contents, including primary opinion, exceptions, limitations, additional opinions on matters such as non-compliant income and zakah, and other significant matters. The supporting review needs planning, working papers and quality assurance.
Plan for external Shari'ah audit. Public interest institutions should prepare well before it becomes mandatory.
Train people. Board members, management and staff need to understand their roles. The framework also expects continuing professional development for SSB members.
Mind the windows and subsidiaries. Islamic windows need segregation of funds and operations; Islamic subsidiaries of conventional groups must review shared services, board composition and placements with the parent.
Why it matters
The revised framework raises the bar, but it also brings clarity. Institutions get a common benchmark; boards and management know what is expected of them; SSBs gain stronger protection for their independence; and stakeholders get more consistent and informative reporting. For professionals, these standards are central to the CPAAGE syllabus and increasingly to everyday work in Shari'ah compliance and audit.
Key points
- GS 1 (2024) and the new GS 18 to GS 22 take effect on 1 January 2026.
- Fourteen principles cover regulators, organs, the board, management, windows, subsidiaries, sectors and disclosure.
- Four minimum organs: SSB, compliance function, internal Shari'ah audit and external Shari'ah audit.
- A five-level hierarchy of Shari'ah principles and rules sets the benchmark for compliance and audit.
- Institutions should map gaps, review SSB independence, strengthen documentation and train their people now.