Hello, my bank details changed last week. Please send my claim payment to the new account below. I need it by Friday. Thank you.
new-bank-details.pdf
Example request for illustration.
Insurance cybersecurity in the UAE: In an insurer, a convincing request can move a payout or a policy.
Insurers keep personal and health data for years, pay claims on documents that arrive by email, and rely on brokers and administrators who log in every day. An ordinary intrusion matters most where a person decides whether to trust a request.
Would your claims team approve this?
Choose what your team does
The email looks routine. The request is the whole attack.
A payout or policy changes
The payment goes to the attacker.
A changed bank detail, a redirected claim payment, or exported policy and health records. Whether one request is enough depends on the verification step.
A payment risk, handled
A change of bank details
A payment risk. Payee changes and large payouts get a check through a second channel, whoever asks.
Check payee and policy changes. Review how bank-detail, payout, policy and credential-reset requests are verified, including by the help desk.
- 20%of financial and insurance breaches began with phishing (Verizon 2026 DBIR)
- 34%of financial and insurance breaches involved a third party (Verizon 2026 DBIR)
Where an ordinary intrusion goes in an insurer
- A call or a click
Phishing, a call to the help desk, or a stolen broker or agent password.
20%of financial and insurance breaches began with phishing (Verizon 2026 DBIR) - A sensitive identity
Claims handlers who can change a payee, service staff who can change a policy, broker portal users, and the help desk that can reset any of them.
- A partner platform
Broker portals, third-party administrators, loss adjusters and repairers, and the cloud behind the policy and claims systems.
- A payout or policy changes
A changed bank detail, a redirected claim payment, or exported policy and health records. Whether one request is enough depends on the verification step.
- A clock
A significant event on a Critical Operation must reach the Central Bank within four hours.
4 hCBUAE Operational Risk Management Regulation C 1/2026, Article 15.2.1
What changes for an insurer
The same security decision gets a different answer once claims payments, brokers and policyholder data are in the picture.
Who to protect first
Domain and cloud administrators.
Claims handlers who can change a payee, service staff who can change a policy, and the help desk that can reset them.
How to rank partners
By spend, or by the data they hold.
By what they can do. A small broker with portal access and authority to bind or pay can carry more risk than a large vendor that never touches customer data.
A change of bank details
A routine record update.
A payment risk. Payee changes and large payouts get a check through a second channel, whoever asks.
How long to keep data
As long as it might be useful.
Claim and policy files hold identity documents and health details. Set retention limits and clear the copies in mailboxes and shared drives.
What recovery means
Restore the systems from backup.
Keep claims intake and payment running, by hand if needed, especially when claim volumes surge after a major event.
The rules set the clock and the supplier list
The Central Bank of the UAE regulates insurers, brokers and the insurance professions. Its operational risk regulation covers (re)insurers as Licensed Financial Institutions, and an insurer standard still sets rules for outsourcing and data.
Outsourcing needs a no-objection
An insurer needs the Central Bank’s prior non-objection before outsourcing a material activity, including to a related party. The Central Bank will generally not allow core insurance activities or internal audit to be outsourced (C 25/2022 Standards, Art. 12(7) and 12(8)).
The data stays yours
Provider contracts must give the insurer unfettered access to its data during the contract and after it ends. Providers must report data breaches to the insurer promptly and keep their own continuity plans (Art. 12(5)(a), 12(5)(g), 12(1)(e)).
The Board and the yearly report
The Board itself approves risk appetite, tolerance for disruption and the continuity and recovery plans, and reviews them at least yearly (C 1/2026, Art. 4.2). Senior management assesses internal control yearly and reports to the Board and the Central Bank (Art. 5.6).
Rules and frameworks behind this page
- CBUAECBUAE Operational Risk Management Regulation C 1/2026Covers (re)insurers as Licensed Financial Institutions. Board-approved tolerance for disruption and event notice within 4 hours (Art. 15.2.1).
- CBUAECBUAE Risk Management and Internal Controls Standards for Insurance Companies, C 25/2022In force. Prior non-objection for outsourcing, data access and breach reporting terms for providers, and yearly internal control assessment.
- CBUAECBUAE Insurance Brokers’ Regulation C 1/2024In force from 15 February 2025. Brokers must show cyber security arrangements to be licensed, and control access to insurer sales platforms.
- UAEUAE Personal Data Protection Law, Federal Decree-Law 45 of 2021Applies outside free zones that have their own data law. Art. 2 excludes personal banking and credit data, and health data, where other legislation governs them. Breach notice goes to the UAE Data Office (Art. 9).
- CBUAECBUAE Open Finance Regulation C 03/2025Insurers are in the first phase. Secure interfaces, two-factor authentication, no scraping, and immediate notice of events that disrupt service.
Source: Central Bank of the UAE Rulebook, Regulation C 1/2026 and Risk Management and Internal Controls Standards C 25/2022. This is analysis, not legal advice.
UAE rules, by who you are
Which UAE rule reaches an insurer, a Takaful operator or a broker
Mainland insurance sits under the Central Bank. Brokers carry explicit data duties that insurers do not share. ADGM and DIFC firms follow their own regulators.
Insurance companies and Takaful operators
FederalRegulator ruleFederal Decree-Law No. 6 of 2025 and the CBUAE Insurance Risk Management and Internal Controls Regulation and Standards.
Risk management and internal controls that fit the insurer’s profile. Technology and information-security risk sits inside that framework.
Confirm: Do not assume bank-specific controls apply to insurers. Read the insurance instruments for your licence, and check whether the CBUAE Operational Risk Management Regulation, which covers licensed financial institutions generally, also applies to you.
Insurance brokers
FederalRegulator ruleCBUAE Insurance Brokers’ Regulation, including Article 16.
Policies to prevent and resolve data-security breaches. Protect personal data. Store personal data in the UAE. Keep a secure backup at a separate location for the 10-year retention period. Run cyber incident response arrangements.
Confirm: Article 16 binds brokers. Do not apply its storage rule to insurers without checking their own rules.
Insurers licensed in ADGM
Abu DhabiRegulator ruleADGM FSRA General Rulebook and Cyber Risk Management Rules, in effect from 31 January 2026.
A governing-body-approved cyber framework, an ICT asset inventory, regular risk assessment and tested response and recovery. Review the framework and train staff at least yearly. Report material cyber incidents to the FSRA immediately and no later than 24 hours after you become aware.
Confirm: FSRA guidance points to 24 hours in relevant cases.
Insurers authorised in DIFC
DubaiRegulator ruleDFSA Rulebook, General (GEN) Module, Cyber Risk Management Rules.
A governing-body-approved framework reviewed regularly, with the incident response plan reviewed at least yearly. A current ICT asset inventory. Yearly staff training. Notice of a material incident no later than 72 hours.
Claims administrators, TPAs and insurtech suppliers
FederalContract termThe insurer’s outsourcing rules and contract terms.
Suppliers meet security, audit, incident-notice and data-handling terms the insurer sets. They also handle personal data under the UAE PDPL where it applies.
This is analysis, not legal advice. A security control does not automatically mean an annual audit or a fixed test cycle. We state a frequency only where the rule does. Rules differ by regulator, so one regulator’s deadline does not carry over to another’s firms. Confirm your licence, the current rulebook and any regulator direction with your counsel.
34%
Of financial and insurance breaches involved a third party (Verizon 2026 DBIR)
What an insurer asks us first
Run a table-top for the 4, 24 and 72 hour notices, using a claims-payment fraud as the event.
Tier intermediaries by data access and authority to bind or pay, and set the evidence we need from each.
Review how bank-detail, payout, policy and credential-reset requests are verified, including by the help desk.
Compare provider contracts with the non-objection, data access and breach reporting duties in the insurer standards.
Where we would start with an insurer
Detect, Respond & RecoverRehearse a claims-payment fraud and a core-platform outage, including the four-hour call and a manual claims fallback.Crisis Management, Incident Response, Cyber ResilienceSecure & ComplyRank brokers and administrators by what they can do, and turn the rules into owners, contract terms and evidence.Third-Party & Supply-Chain Risk, Regulatory Compliance, Audit ReadinessProtect What MattersProtect the points where payees and policies change, and the claim files that sit outside the core systems.Identity & Access Security, Data Security, Identity Security Posture Management (ISPM)
If you also operate in the US, the UK, India or Australia
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
- 72hoursNAIC Insurance Data Security Model Law (#668)A model law that each state adopts in its own form. Licensees keep a written information security program, oversee service providers, and notify the commissioner no later than 72 hours after a cybersecurity event.
- 72hoursNew York DFS Cybersecurity Regulation, 23 NYCRR Part 500Covers anyone licensed under the New York Insurance Law, among others. Notice of a cybersecurity incident is due no later than 72 hours after it is determined; an extortion payment must be reported within 24 hours.
- UKPRA Supervisory Statement SS1/21, Operational resilienceApplies to UK Solvency II insurers, Lloyd’s and its managing agents. Firms set impact tolerances for important business services and had to stay within them no later than 31 March 2025.
- UKFCA Handbook SYSC 15A, Operational resilienceApplies to Solvency II firms and other listed firms, but not to firms whose head office is outside the UK. Like the PRA, it centers on important business services and impact tolerances.
- 72hoursUK GDPR personal data breach reporting (ICO)A notifiable breach must reach the ICO without undue delay and no later than 72 hours after the firm becomes aware. Claims and policy files that hold health details raise the stakes for the notice.
- 6hoursCERT-In Directions under section 70B(6), 28 April 2022Service providers, intermediaries, data centers, body corporates and government bodies must report listed cyber incidents to CERT-In within 6 hours and keep ICT logs for a rolling 180 days within India.
- 18monthsDigital Personal Data Protection Rules, 2025Notified in November 2025. Most duties start 18 months later. They include breach notice to the Board, with a detailed report within 72 hours, and a one-year minimum for logs and personal data.
- 72hoursAPRA CPS 234 Information SecurityCovers APRA-regulated banks, insurers and superannuation funds. Keep security in step with the threat, test controls, and tell APRA of a material incident within 72 hours and a material control weakness within 10 business days.
- 72hoursAPRA CPS 230 Operational Risk ManagementIn force from 1 July 2025 for APRA-regulated entities. Name your critical operations, set tolerance levels for disruption, manage material service providers, and tell APRA within 72 hours of a disruption to a critical operation.
- 30daysPrivacy Act 1988: Notifiable Data Breaches schemeCovers organisations and agencies under the Privacy Act. Assess a suspected breach within 30 days. If it is likely to cause serious harm, tell the OAIC and the people affected.
Standards that follow your data, not your sector
Card, privacy, resilience and assurance standards reach a insurer through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.
- Law
- Card brand rule
- Buyer requirement
- Voluntary certification
- Law
DORA
EU Digital Operational Resilience Act
EU insurers, reinsurers and intermediaries are named in Article 2.
Applies from 17 January 2025. Major ICT incidents go to the authority in stages: initial, intermediate and final report.
Source: EUR-Lex, Regulation (EU) 2022/2554 - Law
GDPR
EU General Data Protection Regulation
You insure or serve people in the EU, or have an EU establishment.
A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).
Source: EUR-Lex, Regulation (EU) 2016/679 - Law
HIPAA
US Health Insurance Portability and Accountability Act, Security Rule
US health plans, and anyone handling their health data as a business associate.
A rewrite was proposed on 6 January 2025. As of June 2026 it is not final, and the current Security Rule stays in force.
Source: US HHS, HIPAA Security Rule - Card brand rule
PCI DSS
Payment Card Industry Data Security Standard
Premiums or claims paid by card.
Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.
Source: PCI Security Standards Council - Buyer requirement
SOC 2
AICPA System and Organization Controls 2
Brokers, administrators and claims vendors that process your policyholder data.
An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.
Source: AICPA, SOC suite of services - Voluntary certification
ISO/IEC 27001
Information security management systems
A common evidence point for outsourced claims and administration.
The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.
Source: ISO, ISO/IEC 27001
What to read before you talk to us
Industry BriefIndustry Brief: Insurance Cyber Risk PrioritiesWhere insurer exposure concentrates: payees, brokers, claims files and recovery.
ArticleUAE Cybersecurity Regulatory Landscape: A Practical Executive ViewHow UAE obligations layer, and which ones follow your license and your data.
Expert BriefingExpert Briefing: Identity Security in the Age of Session TheftHow a stolen session and a help desk reset get past sign-in, and how to contain them.
ArticleThird-Party Risk Beyond the QuestionnaireWhy supplier questionnaires miss exposure, and a better way to judge brokers and administrators.
Practitioner Field NotePlaybook: Running a Cyber Resilience ExerciseHow to run an exercise that tests business decisions, such as a claims fallback.
Practitioner Field NotePlaybook: Testing Ransomware RecoveryHow to test whether policy and claims systems can be rebuilt after ransomware.
Sources and method. This page is analysis, not legal advice.
- Central Bank of the UAE, Operational Risk Management Regulation C 1/2026 (Rulebook)
- Central Bank of the UAE, Risk Management and Internal Controls Standards for Insurance Companies, C 25/2022 STA (Rulebook)
- Central Bank of the UAE, Insurance Brokers’ Regulation C 1/2024 (Rulebook)
- Central Bank of the UAE, Open Finance Regulation C 03/2025 (Rulebook)
- UAE Federal Decree-Law 6 of 2025, Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business (UAE Legislation)
- UAE Federal Decree-Law 45 of 2021, Personal Data Protection (UAE Legislation)
- Verizon, 2026 Data Breach Investigations Report, executive summary (financial and insurance sector combined, global)
- CBUAE Rulebook
- Federal Decree-Law No. 6 of 2025, UAE Legislation
- ADGM FSRA, IT risk management and cyber incident reporting
- DFSA, Cyber risk supervision
- Securities and Commodities Authority