New UAE Central Bank rules target outages, fraud and cyberattacks

The UAE Central Bank’s new Operational Risk Management Regulation came into force yesterday, September 14, 2026, establishing a more stringent framework to safeguard the continuity of services provided by banks and licensed financial institutions, particularly against technology failures, cyberattacks, fraud, system failures and disruptions involving third-party companies on which institutions rely to deliver services. The new regulation replaces the previous operational risk management standards and requirements issued in 2018.

The regulation is of direct relevance to customers as the use of mobile banking applications, instant transfers, digital wallets and payment cards continues to expand, with an increasing number of services shifting to electronic channels. As a result, any technical disruption can prevent customers from accessing their accounts, delay money transfers or payments, or render their cards unusable at a time when waiting may not be an option.

Under the new requirements, which have been circulated to banks’ management teams, the Central Bank requires institutions to establish comprehensive contingency plans and identify “critical operations” whose disruption could cause significant harm to customers, the institution itself or the financial system.

Depending on the nature of each institution’s activities, these operations include:

Under the regulation, institutions must establish clearly defined disruption tolerance levels for each critical operation, including the maximum acceptable duration of an interruption and the level of impact that can be tolerated.

This represents an important shift from simply having plans to restore systems to demonstrating that an institution can continue providing essential services, or restore them, within predefined timeframes and within approved impact tolerances.

The regulation places direct responsibility for overseeing operational risk and resilience on the institution’s board of directors. The board is responsible for approving strategies, policies and risk appetites, while senior management is responsible for implementing them and ensuring the availability of appropriate systems, resources and qualified personnel.

This means that dealing with service disruptions is no longer viewed solely as a technical matter for IT departments.

The requirements cover information technology risk management and cybersecurity, the protection of systems and data, monitoring vulnerabilities, and testing business continuity and disaster recovery plans.

Incident management must also cover the entire incident lifecycle — from detection, classification and containment through to service recovery, root-cause analysis and the implementation of measures designed to prevent recurrence.

The requirements also oblige institutions to notify the Central Bank promptly upon becoming aware of any significant deviation from the requirements or a major incident, in addition to providing the supervisory data and reports requested by the regulator.

An institution remains responsible for the security and continuity of its services even when certain operations are outsourced to a technology provider, cloud-computing company or payment-processing provider. Outsourcing does not relieve the institution of its responsibilities to the regulator.

For customers, the new regulation is expected to reduce the likelihood and duration of service disruptions, accelerate service recovery, strengthen data protection and improve institutions’ preparedness to deal with cyberattacks.

However, the regulation does not mean that service disruptions will become impossible, nor does it in itself establish an automatic right to compensation for every interruption.