Legacy App Modernization in Dubai for Government, Insurance and Banking

ZTABS modernizes legacy applications for Dubai enterprises in government, insurance, banking and free zone operations. Dubai government entities operate Oracle Forms and legacy database systems managing licensing, permits and citizen services. Insurance companies run policy administration on aging platforms. Banking institutions operate core systems requiring modernization for digital transformation. ZTABS is remote-first by design from our Houston, Texas office.

Dubai's legacy modernization demand spans government Oracle Forms migration for citizen service digitisation, insurance platform modernization for regional market competitiveness, banking core system upgrades for digital banking and open finance, and free zone administration system modernization.

Legacy app modernization in Dubai at a glance

Need	What we build	Key requirement
Government	Oracle Forms migration	Citizen service, Makani, UAE Pass
Insurance	Platform modernization	Policy administration, claims
Banking	Core system upgrades	CBUAE, digital banking
Free zone	Administration modernization	Zone-specific regulation
Enterprise	Legacy system migration	PDPL, data residency

Government Oracle Forms modernization

Dubai government entities operate Oracle Forms applications managing licensing, permits, inspections, payments and citizen interactions. These systems encode complex regulatory workflows accumulated over decades.

Licensing systems. Business licensing, professional licensing and activity permits processed through Oracle Forms with multi-step approval workflows, document management and fee calculations. Legacy forms replaced with modern web and mobile citizen services.

Permit and inspection systems. Building permits, safety inspections and compliance certifications managed through legacy workflows. Modernization enabling digital submission, automated routing, mobile inspection and real-time status tracking.

Payment processing. Government fee collection through legacy payment gateways. Modernization supporting current payment methods and integration with government payment platforms.

Makani integration. Dubai uses Makani smart addressing system. Not Abu Dhabi Onwani. Government systems modernized with appropriate geo-location and addressing integration.

Insurance platform modernization

Dubai insurance companies operate policy administration, claims and distribution systems on legacy platforms requiring modernization for digital distribution and regulatory compliance.

Policy administration. Motor, medical, property and marine insurance policy lifecycle management on legacy systems. CBUAE regulatory requirements addressed at each migration phase. Rating algorithms, coverage terms and policy document generation modernized.

Claims processing. Claims from notification through assessment, approval and settlement. Legacy workflow systems modernized with automated damage assessment, digital document collection and mobile claims capability.

Distribution systems. Broker and agent distribution channel systems with commission management, production tracking and regulatory reporting. Legacy interfaces modernized for digital distribution.

Banking core modernization

Dubai banks operate core systems processing retail and corporate banking, trade finance and treasury operations.

Core banking. Account management, transaction processing and customer information modernized for digital banking, real-time payments and API-based open finance.

Trade finance. Letters of credit, guarantees and documentary collections processed on legacy systems. Modernization enabling digital trade finance with blockchain-ready architecture where appropriate.

Treasury operations. FX, money market and derivatives processed on legacy platforms. Modernization for real-time position management and regulatory reporting.

UAE and DIFC regulation

UAE PDPL. Federal PDPL Article 2 excludes government data and entities from PDPL scope. The special-law exclusion concerns data whose protection and processing are regulated by specific health or banking legislation, not every record belonging to an entire health or banking organisation. Free zones with their own data protection laws have their own frameworks outside federal PDPL. Actual PDPL applicability depends on entity, data type and processing nexus.

DIFC 2025 consolidated. DIFC Data Protection Law applies to controllers and processors incorporated in DIFC wherever they process data. Others, regardless of incorporation, are covered when processing personal data in the DIFC under stable non-occasional arrangements. Different from onshore UAE PDPL. Different regulator, different requirements.

Azure UAE regions. UAE North is Dubai. UAE Central is Abu Dhabi with restricted availability. Cloud infrastructure selection based on actual workload requirements and data residency obligations.

AWS UAE region. me-central-1 in UAE separate from me-south-1 in Bahrain. Not interchangeable for data residency purposes.

Core42. Merger of Injazat, G42 Cloud and Inception. Actual current product and service offerings verified.

Makani. Dubai smart addressing system. Not Abu Dhabi Onwani. Correct addressing system referenced per jurisdiction.

WhatsApp. Customer service window is 24 hours from the last user message. Outside this window, only pre-approved message templates to opted-in recipients. Not unlimited messaging after initial contact.

Cloud terms. Actual cloud training, log, backup, SDK and support terms verified per provider. Not assumed terms.

UAE Pass. ICP actual onboarding, product, user and role permissions. Not all government services automatically integrated.

Strangler fig for government systems

Seam selection. Government seams: licensing, permits, inspections, payments, document management, reporting. Each function extracted independently with its own validation period.

Single authoritative write. One system authoritative for each licence and period during coexistence. Government dual-write dangerous for regulatory status tracking. CDC with versioning and conflict detection.

Reconciliation. Idempotency keys enforced by receiving side. Finite retries with DLQ. Unknown outcomes require reconciliation before replay, especially for licence status changes, permit approvals and fee payments.

Data migration methodology

Government data. Licence records, permit histories, inspection records, payment transactions and citizen data migrated with regulatory verification. Arabic and English bilingual content preserved. Document attachments migrated with metadata.

Insurance data. Policy records, claims history, premium accounting and regulatory reporting data migrated with actuarial verification against representative populations. Multi-currency data preserved with historical exchange rates.

Banking data. Account records, transaction history and regulatory data migrated with reconciliation against agreed validation controls.

Data type mapping. Types, nulls, time zones, currency, rounding, identifiers, encoding, history and crosswalks reconciled. Government-specific: licence types with regulatory classification, permit expiry dates, inspection schedules, fee schedules where VAT at 5 percent applies to commercial transactions; sovereign government services may be outside VAT scope. Insurance-specific: policy inception and expiry with Hijri and Gregorian dates, multi-currency premiums. Banking-specific: settlement dates, regulatory reporting periods.

Cutover rehearsal. Observable acceptance with measurable RTO, RPO and latency targets. Government cutover timed for licensing cycle boundaries. Insurance cutover timed for renewal periods. Banking cutover timed for settlement cycles.

Inventory and discovery

Dubai enterprise modernization begins with inventory of applications, users, scheduled jobs, database procedures, reports, file and API dependencies, vendor contracts, supported versus end-of-life versions. Discovery documents known dependencies; undiscovered dependencies may surface during parallel operation.

Business rules discovered with users through representative transaction analysis. Government rules validated against current regulatory requirements. Insurance rules validated against CBUAE requirements. Banking rules validated against CBUAE requirements.

Integration and dependency management

Government integrations. Inter-entity connections, payment gateway, Digital Dubai platform, UAE Pass identity and document management systems. Each integration documented and migration coordinated.

Insurance integrations. CBUAE regulatory reporting, broker and agent systems, reinsurer connections.

Banking integrations. CBUAE regulatory reporting, SWIFT, payment network and correspondent bank connections.

Authentication versus authorisation. Authentication identity distinct from entity-level, role-level and transaction-level authorisation. Government systems require audit trail for all authorisation changes.

Modernization approach selection

Dubai enterprises need clear criteria for choosing between approaches.

Targeted remediation. Adding specific capabilities to otherwise functional systems. Example: adding API layer to Oracle Forms for mobile citizen access while keeping forms for back-office processing.

Re-platforming. Moving to modern infrastructure while preserving logic. Example: migrating Oracle Forms licensing to cloud while preserving approval workflow rules.

Re-architecture. Decomposing monolith into services. Example: extracting licensing, permits, inspections and payments as independent services.

Full rebuild. Ground-up development after assessing keep, upgrade and configure alternatives. Oracle Forms current release 14.1.2 exists; the decision to rebuild rather than upgrade depends on actual architecture constraints, integration requirements, platform supportability assessment and business needs, not a universal end-of-support trigger.

Regression and testing

Representative business-critical paths: licensing lifecycle, permit workflow, insurance policy lifecycle, banking transaction lifecycle. Meaningful integration, performance and manual UAT with domain expert approval.

Cost and timeline

Legacy system modernization follows the published cost guide.

Tier	Range	Timeline	Example
UI Modernization	$40K to $100K	8 to 16 weeks	New frontend, API wrapper, improved UX
Re-Platforming	$100K to $250K	16 to 32 weeks	Modern stack, containerization, cloud, data migration
Re-Architecture	$250K to $400K	8 to 14 months	Decompose monolith, event-driven, modern data layer
Full Rebuild	$400K to $500K+	12 to 18+ months	Ground-up rebuild, agreed availability target, rehearsed staged cutover

Vendor comparison

Ranges are 2026 US-buyer guide-based estimates for re-platforming a 10 to 15 year old business-critical system using a strangler fig approach, modern stack, API wrappers, phased data migration and regression harness.

Vendor type	Typical cost	Timeline
Freelance or dev collective	$40K to $130K	5 to 12 months
Offshore systems integrator	$60K to $200K	8 to 14 months
ZTABS	$100K to $280K	6 to 12 months
Big 4 consultancy	$300K to $1M+	10 to 18 months
SaaS replacement vendor	$50K to $200K implementation	4 to 9 months

Ranges are 2026 US-buyer benchmarks from the published cost guide. Parallel-running infrastructure, senior knowledge transfer and where applicable compliance revalidation can add a combined scope-dependent $100K to $500K+ planning allowance. The guide's examples are SOX, HIPAA and FDA; actual applicable regime depends on the engagement.

Proposal evaluation criteria

Evaluate any vendor proposal against these six criteria regardless of price tier.

Criterion	What to verify
Strategy, deliverables and acceptance	Defined modernization phases with measurable acceptance criteria at each stage
Data source-of-truth and reconciliation	Which system is authoritative per object and period, agreed reconciliation tolerances and exception register
Rehearsal, cutover and rollback	Rehearsed cutover with RTO and RPO targets, documented rollback feasibility after schema and data changes
Security, privacy, compliance and approval scope	Applicable regulations identified with actual approval authority and scope
Full recurring costs	Licensing, parallel-run infrastructure, support, monitoring and decommission costs beyond initial build
Human roles and responsibilities	Provider and customer trainer-validator-support split, agreed working languages, translated materials review and on-site responsibilities where needed

How delivery works

ZTABS is remote-first by design from our Houston, Texas office. Overlap with Dubai business hours for coordination and review.

Logs and retention

Logs minimise and redact secrets and regulated payloads with actual retention and legal holds. Government records retained per emirate and federal requirements. Insurance records retained per CBUAE requirements. Banking records retained per CBUAE requirements. DIFC records per DIFC Data Protection Law retention requirements.

Cutover rehearsal detail

Observable acceptance with measurable RTO, RPO and latency targets. Government cutover timed for licensing cycle boundaries. Insurance cutover timed for renewal periods. Banking cutover timed for settlement cycles.

Rollback feasibility assessed after schema, data and contract changes. Licence status changes, permit approvals, insurance premium settlements and banking transactions may not be automatically reversible. Compensations can require legal, regulatory or accounting review.

Data type mapping for Dubai industries

Dubai industry data has unique types requiring careful migration planning. Government: licence types with activity classification codes, permit reference numbers with entity identifiers, Makani smart addressing codes, Emirates ID numbers, fee schedules where VAT at 5 percent applies to commercial transactions, Hijri and Gregorian calendar dates. Insurance: policy numbers with insurer-specific formats, premium amounts in AED with multi-currency conversion for reinsurance, medical insurance categories with Dubai Health Authority requirements. Banking: IBAN formats, SWIFT codes, trade finance document reference numbers, treasury deal identifiers with counterparty references.

Free zone administration modernization

Dubai's numerous free zones operate their own administration systems for company registration, licensing, visa processing and compliance monitoring. Legacy administration platforms require modernization for digital service delivery and regulatory reporting.

Company registration. Free zone registration workflows with activity licensing, share capital management, director and shareholder records. Legacy systems modernized for digital onboarding and self-service.

Visa processing. Employment visa, residence permit and establishment card processing through legacy systems. Modernization for digital submission and status tracking.

Compliance monitoring. Annual compliance checks, financial reporting requirements and licence renewal processing. Legacy batch processes modernized for continuous compliance monitoring.

Assessment methodology

Application archaeology for Dubai systems covers Oracle Forms PL/SQL analysis for business rule extraction, database analysis for data structure documentation, integration mapping for inter-entity connections, and bilingual content analysis for Arabic and English language requirements. Insurance assessment covers policy administration rule extraction, claims workflow analysis and CBUAE regulatory reporting. Banking assessment covers core banking programme analysis and CBUAE regulatory reporting.

When ZTABS is not the right fit

• The system still works and nobody is asking for changes. Wait for a real forcing function.
• Oracle ERP implementation. Licensed vendor selection and implementation scope.
• On-site embedded team. ZTABS is remote-first by design. On-site staffing, training and support retainers for this engagement are separately agreed.
• DIFC or CBUAE regulatory advisory. This engagement builds platforms, not regulatory advice. Regulatory advisory is separately engaged.

White-label AI products

ZTABS builds custom white-label AI products for clients to brand and resell. Dubai technology companies can commission white-label AI platforms for distribution under their own brand.

Risks and mitigations

Business rule gaps. Oracle Forms PL/SQL archaeology combined with parallel operation catches undiscovered rules within agreed discovery coverage. Government domain experts validate extracted licensing and permit rules with sign-off; undiscovered rules remain a managed residual risk.

Bilingual content. Arabic and English content migrated with language-specific validation. Right-to-left rendering and Arabic typography preserved in modern interfaces.

Data residency. UAE data residency for covered data, contracts and applicable entity obligations scoped at engagement start. Full-stack residency including storage, backups, logs, support access and subprocessor jurisdictions verified per provider before commitment. Azure UAE North in Dubai and UAE Central in Abu Dhabi have different product availability; actual workload and region suitability checked and agreed before selection.

Handover

Modernization handover includes runbooks, data lineage, licensing, support contacts and accountable owners. Government handover includes regulatory compliance documentation, inter-entity integration specifications and bilingual content documentation.