Status of the regulation
The CBUAE Rulebook shows C 1/2026 as ‘Effective from 14/9/2026’ with status In-Force. Article 20.1 says the regulation takes effect one month after publication in the Official Gazette. Article 19.1 cancels and replaces Circular 163/2018 and the Operational Risk Standards of 29 August 2018. The regulation was issued under Federal Decree-Law 6 of 2025. The Regulatory Development Department of the Central Bank is the reference for interpretation, and the Central Bank may issue standards or guidelines to elaborate on it.
The regulation applies to Licensed Financial Institutions. Banks are defined as juridical persons licensed to primarily take deposits. Foreign bank branches in the State are within the definition.
What the regulation requires, article by article
| Area | Article | Requirement in substance |
|---|---|---|
| Board ownership | 4.2 | The Board, and not a Board committee, must approve and review at least annually key operational risk and resilience strategies and policies, including risk appetite, tolerance for disruption in severe but plausible scenarios, and Business Continuity and Disaster Recovery Plans |
| Critical Operations | 1.8 to 1.10, 3.4 | Defined terms. Banks must identify Critical Operations and all assets needed to deliver them, including people, technology, processes, data, facilities and third-party providers, and map the interdependencies. The map is updated through change management |
| ICT and cybersecurity | Art. 8 | A robust ICT and cybersecurity risk framework inside operational risk; protection, detection, response and recovery programs that are regularly tested; policy covering access control, identity management, Critical Information Asset protection, network security, vendor management, vulnerability testing, information classification, patch management and more; strategy to renew or retire obsolete and unsupported systems (8.8) |
| Data location | 8.9 | The Master System of Record must be continuously maintained and stored within the UAE, including under outsourcing. Branches of foreign institutions may, subject to Central Bank approval, instead keep an up-to-date copy in the UAE |
| Testing | 7.13, 7.14, 11.10 | Periodic stress tests, including penetration testing. For Critical Functions at least, penetration testing by an independent third party with results presented to the Board. Business continuity and disaster recovery tested at least annually for Critical Operations, including key third-party providers where relevant |
| Incident learning | 9.2, 9.4.4 | Identify and address the root cause of all material Incidents, and update response and recovery plans from lessons learned. Communication plans include an analysis with lessons learned after an Incident is resolved |
| Change | 12.5 | Changes in Operations material to Critical Operations or customers need thorough testing, rollback plans, a parallel run of old and new ICT systems for a predefined minimum period, an external expert report, Central Bank notice with that report at least 30 calendar days before implementation, and written no-objection before going live |
| Third parties | 13.3 to 13.12 | Risk assessment and due diligence first; Central Bank non-objection before outsourcing an activity whose disruption could significantly affect Critical Operations (13.5); written contracts with data, confidentiality and termination terms (13.6); provider must comply with Central Bank requests, including on-site examinations for outsourcing that could affect Critical Operations (13.7); flow-down to subcontractors (13.8); register and metrics (13.9); exit plans (13.11); the Central Bank may require discontinuation of an arrangement or of an over-reliant Critical Operation (13.12) |
| Notification | 15.2, 15.3 | For events that significantly impact or may significantly impact the continuity or integrity of Critical Operations: notify the Central Bank within 4 hours, with the Critical Operations affected; summary report within 24 hours; notice on return to normal. Notify within 72 hours of any high-risk Incident, with criteria set in Board-approved policy |
| Sanctions | 17 | Supervisory action and administrative and financial sanctions, which may include replacing or restricting Senior Management or Board members, interim management, fines and bars from the UAE financial sector |
Five things to do first
-
Board paper on ownership. Put the annual approval of risk appetite, tolerance for disruption and continuity plans on the Board calendar. A committee approval does not meet Article 4.2.
-
Critical Operations map. Build or refresh the map required by Article 3.4, including third parties. Use it as the base for testing, notification and outsourcing decisions.
-
Third-party register and exit plans. List every arrangement that supports a Critical Operation. For each, check whether non-objection was needed or obtained, whether the contract meets 13.6 to 13.8, and whether an exit plan exists and has been tested.
-
Change pipeline. Identify planned system replacements or migrations that touch Critical Operations. Build the 30-day notice, external expert report and parallel run into the plan now.
-
Incident notification. Name the owner of the call to the Central Bank, set the 4-hour, 24-hour and 72-hour steps in the Board-approved incident policy, and keep the evidence. Test it in the next exercise.
Questions for the Board
-
Which are our Critical Operations, and who signed the map?
-
Which outsourcing arrangements would need Central Bank non-objection if proposed today? Which existing ones have it?
-
Where is our Master System of Record, including copies held by providers?
-
When did an independent party last penetration-test our Critical Functions, and when did the Board see the results?
-
Who makes the call to the Central Bank within 4 hours, and have they rehearsed it?
About the evidence
We read the full English text of C 1/2026 on the CBUAE Rulebook on 9 October 2026. Article 20.1 provides for publication in Arabic and English. We did not read the Arabic text. The five actions are Cybrilliant analysis, not legal advice.
Sources
-
Central Bank of the UAE, Operational Risk Management Regulation C 1/2026, Rulebook. Accessed 9 October 2026. rulebook.centralbank.ae/en/rulebook/operational-risk-management-regulation
-
UAE Federal Decree-Law No. 6 of 2025 (Central Bank law), UAE Legislation portal. Accessed 9 October 2026. uaelegislation.gov.ae/en/legislations/3284
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionDetect, Respond & RecoverSpot attacks early and get back to business fast.See how we work →Related service
Cyber Resilience & Recovery
Use this industry view to prioritize Banking operational-resilience decisions under the CBUAE regulation.