Banking Cybersecurity UAE: CBUAE C 1/2026

Where an ordinary intrusion goes in a bank

A call or a click
Phishing, a voice call to the help desk, a stolen password.
35%of financial and insurance breaches began with phishing (20%) or credential abuse (15%). Exploiting a vulnerability led at 22%. Verizon DBIR 2026
A sensitive identity
Not only domain administrators. Payment operators, the staff who maintain limits and beneficiaries, and the help desk that can reset any of them.
A critical platform
Core banking, cards, payments, and the cloud and suppliers behind them.
34%of financial and insurance breaches involved a third party. Verizon DBIR 2026
Money movement
Payment release, limits and beneficiaries. Whether one stolen identity is enough depends on how maker-checker rules are enforced.

The clock starts when the event is significant.

T + 0After a significant event on a Critical Operation

4 hoursT + 0
When to report
Tell the Central Bank what happened and which Critical Operations are affected.
Within four hours, before they are clear. Someone must be named to make that call.
Test our four-hour call. Run a table-top for the 4h, 24h and 72h notices, with named owners and a draft of each message.
24 hoursNext day
What recovery means
Send a summary: the nature of the event, actions taken, likely impact and the expected time to return to normal.
Restore payments, cards and core ledgers inside the tolerance for disruption your Board approved.
72 hoursThird day
Who decides
Notify any high-risk incident, as defined in your Board-approved policy.
Your Board-approved policy decides what counts as high-risk. The Board owns that policy, so write it before the night you need it.

What changes for a bank

The same security decision gets a different answer once money and a regulator are in the picture.

Who to protect first

Domain and cloud administrators.

The people who release money, the staff who change limits and beneficiaries, and the help desk that can reset them.

How to rank suppliers

By spend, or by the data they hold.

By the Critical Operation each one can stop, and by whether the Central Bank must first have no objection.

What recovery means

Restore the systems from backup.

Restore payments, cards and core ledgers inside the tolerance for disruption your Board approved.

When to report

When the facts are clear.

Within four hours, before they are clear. Someone must be named to make that call.

Fraud and security

Two teams, two queues.

One case path for account takeover, with agreement on who can freeze a session, an account or a payment channel.

The rules set the clock

The Central Bank of the UAE replaced its operational risk standards with a regulation that names owners, deadlines and approvals. It has been in force since 14 September 2026.

The Board owns it

The Board itself, not a committee, approves risk appetite, tolerance for disruption and the continuity and recovery plans. It reviews them at least annually. It may hand the annual review of the continuity and recovery plans to a committee, but must approve the first plans itself and review them at least every three years.

The ledger stays in the UAE

The Master System of Record must be continuously maintained and stored in the UAE, including when it is outsourced. Branches of foreign institutions may keep an up-to-date copy here instead, with Central Bank approval.

Outsourcing needs a no-objection

Before outsourcing any activity whose disruption could significantly affect a Critical Operation, the bank must obtain the Central Bank’s notice of non-objection.

Rules and frameworks behind this page

Source: Central Bank of the UAE, Operational Risk Management Regulation C 1/2026 (English text). This is analysis, not legal advice.

UAE rules, by who you are

Which UAE rule reaches a bank

A mainland bank answers to the Central Bank of the UAE. A bank in ADGM answers to the FSRA. A bank in DIFC answers to the DFSA. The duties look alike. The deadlines do not.

Binding law
Regulator rule
Standard or policy
Contract term

Mainland banks and banking groups

Federal

Regulator ruleFederal Decree-Law No. 6 of 2025 and the CBUAE Operational Risk Management Regulation and Standards, with banking and information-security standards.

Keep an ICT and cybersecurity risk framework. Assess and treat risk. Monitor and test controls. Run incident response, recovery and continuity. Manage vulnerabilities, access, third parties and critical systems. The ICT and cybersecurity requirements took effect on 14 September 2026.

Confirm: Test frequency for each control comes from the instrument that applies to your licence. There is no single monthly or quarterly cycle for every control.

Banks licensed in ADGM

Abu Dhabi

Regulator ruleADGM FSRA General Rulebook and Cyber Risk Management Rules, in effect from 31 January 2026.

A written cyber risk framework approved by the governing body. An ICT asset inventory. Regular risk assessment. Controls to protect, detect, respond and recover. An annual framework review and annual cybersecurity training. Material cyber incidents reported to the FSRA immediately and no later than 24 hours after you become aware.

Confirm: Read the FSRA rule and guidance for your permission.

Banks authorised in DIFC

Dubai

Regulator ruleDFSA Rulebook, General (GEN) Module, Cyber Risk Management Rules.

A governing-body-approved cyber framework, reviewed regularly, with the incident response plan reviewed at least yearly. A current ICT asset inventory with regular risk assessment. Protection, detection, response and recovery. Yearly cybersecurity training. Notice to the DFSA of a material incident as soon as reasonably practicable and no later than 72 hours.

Technology and outsourcing suppliers to banks

Federal

Contract termOutsourcing and third-party requirements in the bank’s own regulation, passed down by contract.

Suppliers meet security, audit, incident-notice and data-handling terms set by the bank. Small size does not exempt a supplier from these terms.

Confirm: Read the clauses in your actual contract.

This is analysis, not legal advice. A security control does not automatically mean an annual audit or a fixed test cycle. We state a frequency only where the rule does. Rules differ by regulator, so one regulator’s deadline does not carry over to another’s firms. Confirm your licence, the current rulebook and any regulator direction with your counsel.

What a bank asks us first

Test our four-hour callRun a table-top for the 4h, 24h and 72h notices, with named owners and a draft of each message.
Rank suppliers by what they can stopMap outsourced and cloud providers to Critical Operations and find the ones that need a no-objection.
Protect the people who move moneyReview privileged access for payment operators, limit and beneficiary maintainers, and the help desk.
Turn C 1/2026 into a work planCompare current practice with the regulation, then set owners, evidence and a Board calendar.

0of 4 done. Whatever is left is where we start.

Where we would start with a bank

Detect, Respond & RecoverRehearse the four-hour call, and the recovery of payments, cards and core ledgers.Crisis Management, Incident Response, Cyber Resilience Manage Cyber Risk & ExposureRank suppliers and exposed systems by the operation they can interrupt.Cyber Risk Assessments, External Attack Surface Management, Threat & Attack Path Analysis Secure & ComplyTurn the regulation into owners, evidence and a Board calendar.Regulatory Compliance, Audit Readiness, Control Design & Implementation

If you also operate in the US, the UK, India or Australia

UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.

United States

United Kingdom

India

Australia

Standards that follow your data, not your sector

Card, privacy, resilience and assurance standards reach a bank through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.

Card brand rule
Law
Buyer requirement
Voluntary certification

Card brand rule
PCI DSS
Payment Card Industry Data Security Standard
Your cards: issuing, acquiring, ATMs and online payments.
Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.
Source: PCI Security Standards Council
Law
GDPR
EU General Data Protection Regulation
You offer services to people in the EU, monitor them, or have an EU branch or EU-based processor.
A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).
Source: EUR-Lex, Regulation (EU) 2016/679
Law
DORA
EU Digital Operational Resilience Act
An EU-licensed subsidiary, or serving EU financial entities as an ICT provider.
Applies from 17 January 2025. Major ICT incidents go to the authority in stages: initial, intermediate and final report.
Source: EUR-Lex, Regulation (EU) 2022/2554
Buyer requirement
SOC 2
AICPA System and Organization Controls 2
Fintech and outsourcing partners often hold one. Ask for it in vendor reviews.
An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.
Source: AICPA, SOC suite of services
Voluntary certification
ISO/IEC 27001
Information security management systems
A common evidence point when you review critical suppliers.
The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.
Source: ISO, ISO/IEC 27001