UAE Central Bank Operational Risk Regulation: What Banks Must Now Do
The Central Bank of the UAE’s Operational Risk Management Regulation took effect on 14 September 2026. It was issued under Circular No. 1/2026 and replaces the operational risk regulation and standards that had applied since August 2018.
Who It Covers
It applies to licensed financial institutions, including banks and (re)insurers, whether they are incorporated in the UAE or operate through a branch or subsidiary. For customers, the practical aim is fewer and shorter outages of account access, transfers, card payments and other services people rely on every day.
Main Requirements
- Critical operations: institutions must identify them and map the people, technology, data, facilities and third parties behind each one. Payment systems and other time-critical services are on the minimum list.
- Board accountability: the board is ultimately responsible for operational resilience. It must approve and review at least once a year the risk appetite, disruption tolerances and a written plan for continuing or restoring operations.
- Incident reporting: the Central Bank must be notified within 4 hours of an event and told which critical operations are affected, followed by a summary report within 24 hours.
- Outsourcing: firms must keep enough in-house expertise and cannot rely excessively on outsourcing. They stay responsible for security and continuity when a third party or cloud provider runs a service. The master system of record must be kept in the UAE.
What It Does Not Do
The rules aim to reduce outages and improve defences against cyber threats, but they cannot rule out technical faults. They also do not give customers an automatic right to compensation for every interruption.
