UAE edition · one platform for six regulatory regimes

Third-party risk, built around UAE regulation.

NexaPair verifies vendors, finds hidden links between suppliers and your own staff, and maps every step to what your regulator expects. Every feature on this site is marked Live, Preview or Coming soon.

Take the walkthrough Open the tool

Find your regulator

Honest status on every feature
Deployable in a UAE cloud region
English and Arabic
Fictional data in every demo

OnboardingZavaro Cloud Payments FZ-LLC

Trade licenceDubai free zone · activeLive
TRN15 digits · format validFormat check
IBANStructure and checksum validFormat check
Beneficial owners2 declared · register check pendingLive
UAE and UN listsNo matchLive
Staff linkA director's mobile matches an employeeLive

Fictional vendor · demo data

Your regulator

Pick a regime to see what it expects of vendor risk.

A short orientation for each regime, and how NexaPair covers it today. Each regulator page carries the full requirement map.

Central Bank of the UAE

Applies to: Banks, finance companies, insurers, exchange houses and payment service providers licensed onshore.

What it expects

Obtain a CBUAE notice of non-objection before outsourcing any activity whose disruption could significantly affect Critical Operations. CBUAE Operational Risk Management Regulation Art. 13.5
No third-party arrangement without first doing a risk assessment and due diligence. CBUAE Operational Risk Management Regulation Art. 13.3
For operational risk events that significantly affect, or may affect, Critical Operations (e.g. events that trigger BCP or DR, or materially affect customers, operations, profit or capital): first notify the CBUAE, naming the affected Critical Operations. CBUAE Operational Risk Management Regulation Art. 15.2, 15.2.1
The Master System of Record, including all Confidential Data, must be continuously maintained and stored in the UAE. Foreign bank branches may keep a UAE copy updated at least daily, with CBUAE approval. CBUAE Outsourcing Regulation for Banks Art. 6.1, 6.2
Contracts must oblige the provider to comply with CBUAE requests and reporting, and to allow CBUAE on-site examinations for Critical Operations outsourcing. CBUAE Operational Risk Management Regulation Art. 13.7

How NexaPair covers it

LiveBoard pack
LiveReadiness view for each regulator, also in the Board pack
LiveEquivalent-resilience and concentration checks
LiveVendor and subcontractor (fourth-party) mapping
LiveCritical-operations register
LiveDue diligence cases by tier
LiveExplainable risk score with factor weights and minimum-tier rules
LiveMaterial-change notice and non-objection gate

Summarised from our source-by-source regulatory map. Items marked To be confirmed are still being checked. Not legal advice.

Open the CBUAE page

Federal law applies alongside every regime: data protection, AML and sanctions, beneficial ownership, tax registration, anti-bribery and cybercrime. See federal law

Notification clocks

Six regulators, very different clocks.

Write the shortest clock that applies to you into vendor contracts, so the vendor tells you well inside it. For a CBUAE institution that is 4 hours; for an ADGM firm it is 24 hours, running through weekends.

See all notification timelines

4 hCBUAE · an event significantly affecting a critical operationCBUAE Operational Risk Management Regulation Art. 15.2, 15.2.1
72 hCBUAE · a high-risk incident under the Board's criteria, a separate triggerCBUAE Operational Risk Management Regulation Art. 15.3
Now · 24 h maxFSRA (ADGM) · a suspected material cyber incident, weekends includedFSRA Cyber Risk Management Rules GEN 3.5.18; GEN 8.10
ImmediatelyDESC (Dubai) · threats, hacks, leaks or interceptionDubai Electronic Security Centre Law Art. 14(4)
ImmediatelyVARA · a material breach of a Material Outsourcing agreementVARA Company Rulebook - Part IV Outsourcing Part IV, Section H.1-H.2
24 hSanctions · freeze funds after a listing decisionTargeted Financial Sanctions regulation Art. 15 (freezing)

Start here

New to third-party risk in the UAE? Start with these.

TPRM in the UAENine stages from inventory to Board reporting, each with the UAE rules that apply.IndustriesBanks, insurers, VASPs, government, healthcare and more: the rules and the usual risks.Maturity self-assessmentTen questions. Your level and your top three gaps, worked out on this page.FAQNon-objection, incident clocks, data location, sanctions lists and more, with sources.

For every team

One dial. Every department. Three steps each.

Nobody needs to be a vendor-risk expert. Turn the dial to your team and NexaPair shows what to do, while it runs the checks behind the scenes.

FinancePay the right party, every time.

Turn the dial

Finance and Accounts Payable

Pay the right party, every time.

Your three steps

1Open the vendor
2Look at the bank badge
3Release or hold the payment

NexaPair does the rest

Account owner confirmed by test deposit for Indian accounts
Accounts shared with employees or other vendors flagged
UAE IBAN and TRN checks at entry

What you see: green means pay; anything else comes with the reason.

Check an IBAN

The platform

Eight engines, each with a demo you can try.

NexaVerifyLive UAE · Coming soon UAE onboarding checksTrade licence, TRN, IBAN and beneficial owner for UAE vendors, plus live registry and bank checks for Indian vendors.Verify a vendor NexaGraphLive Hidden connectionsShared phones, bank accounts, directors and addresses between vendors and your own staff.Find a hidden link NexaScoreLive Explainable riskEvery factor and weight visible, with minimum-tier rules and due diligence by tier.Build a score NexaSentinelLive Monitoring and incident clocksSanctions, filings, court and credit changes become alerts, and incident reporting clocks run for each UAE regime you select.Trigger an alert NexaPilotLive AI that earns the right to actBriefs and triage today, with your choice of model. Autonomy only where it proves itself.Set the AI's bar ResilienceLive Critical operations and exitsMap critical operations to vendors and subcontractors, test recovery times, and gate material changes.Check an operation AssessLive Arabic and English questionnairesQuestionnaires in the vendor's language, with AI review of the evidence and a person deciding.Review some answers Cyber postureLive Outside-in security signalsEmail security records, certificate expiry and security headers, read passively from public signals.Check a domain

New in the product Live

Now live for CBUAE-licensed institutions.

Critical operations mapped to the vendors behind them, and CBUAE incident notices tracked against their clocks. Other regulators follow.

Open the tool

The Critical operations screen in the NexaPair demo for Noorvale Bank PJSC, a fictional UAE bank. Operation CO-01, Retail payments and remittances, shows a 4-hour impact tolerance, a 2-hour recovery time, four providers and a dependency map linking them to shared subcontractors. — Live in the product: a critical operation with the providers and subcontractors behind it. Fictional bank and vendors.

The Incident notices tab of the CBUAE pack in the NexaPair demo. For a fibre cut affecting critical operations, the first notice to the Central Bank (Art. 15.2.1, within 4 hours) has been sent, the summary report (Art. 15.2.2, within 24 hours) is overdue and awaiting approval, and the notice of resumption (Art. 15.2.3) is due. — Live in the product: CBUAE incident notices, each against its clock. Fictional bank, vendors and incidents.

UAE checks

The checks a UAE vendor file needs.

In the product, the licence, TRN and owners are recorded with the evidence a reviewer checks, and every owner is screened. On this site, some run as format checks. Each one says which.

Run the format checks

Trade licenceLiveStatus and expiry, mainland or free zone.
Tax registration (TRN)LiveRegistration for VAT and corporate tax. Format check runs on this site.
IBAN structure and checksumFormat checkA genuine check you can run here, before any payment detail is saved.
Beneficial ownerLiveWho ultimately owns or controls the vendor.
UAE Local Terrorist List and UN listLiveScreening against the lists UAE firms must apply.
Sanctions and PEPLiveConsolidated lists through OpenSanctions, re-checked while the vendor is active.
Indian vendors, checked at the sourceLiveCompany register, PAN, GST, litigation and bank-account owner, for cross-border suppliers.
PDPL cross-border transfersLiveA check before personal data goes to a vendor outside the UAE.

Interactive walkthrough · about 4 minutes

Onboard a critical UAE vendor yourself, start to finish.

A UAE bank brings on a Dubai cloud payments provider. You play six departments in turn and click the glowing button at each step.

Start the walkthrough

1 Request · Procurement
2 UAE checks · NexaPair, automatically Preview
3 Connections · Compliance
4 Score · Risk
5 Decision · Compliance
6 Central Bank · Risk and Legal
7 Incident · Operations
8 Board · Board

Value, not cost

What a joined-up programme is worth to you.

Move the sliders to match your organisation. The estimate counts only time saved, before a single prevented fraud or outage.

Vendors onboarded or reviewed each year

Hours of work per vendor today

Person-days preparing for an inspection

Cost of an hour of staff time

How we estimate it

We multiply vendors by hours per vendor, add inspection preparation at eight hours a day, halve the total, and multiply by your hourly cost. Prevented fraud, outages and findings are not counted.

Estimated value each year

hours saved

full-time people freed

Illustrative only. Assumes onboarding, review and inspection preparation take half the time they do today. Your results depend on your starting point.

Two-minute tours