UAE third-party risk, answered.

There is no single UAE law on third-party risk. The duty comes from each sector regulator. The CBUAE requires a Board-approved third-party risk strategy and due diligence before any arrangement, and the DFSA, FSRA and VARA each have outsourcing rules.

Federal laws on data protection, AML, sanctions and beneficial ownership apply to dealings with vendors in every sector.

Open the regulation hub

The Operational Risk Management Regulation has applied since 14 September 2026. For third parties it asks for a Board-approved strategy (Art. 13.1), enough in-house capability to avoid over-reliance (Art. 13.2), a risk assessment and due diligence before any arrangement (Art. 13.3), and equivalent resilience from providers behind Critical Operations (Art. 13.4).

It also requires contracts with CBUAE access (Arts. 13.6 to 13.8), an up-to-date register and ongoing oversight (Art. 13.9), and viable contingency and exit plans (Art. 13.11).

Open the CBUAE page

From 1 January 2026 the Securities and Commodities Authority was reconstituted as the Capital Market Authority (CMA), under Federal Laws 32 and 33 of 2025. Virtual assets now sit within the CMA's remit, which may overlap with VARA for Dubai VASPs.

Secondary sources report a grace period to 1 January 2027 for firms newly brought into scope. Update vendor and licence records that still name the SCA.

Open the CMA page

For onshore federal and emirate legislation, English versions are translations, and the Arabic text prevails if the two conflict. The DIFC and ADGM legislate in English.

For bilingual contracts and templates, state which language governs, and take legal advice on your own documents.

Two separate rules apply under C 1/2026. Before outsourcing any activity whose disruption could significantly affect Critical Operations, obtain a CBUAE notice of non-objection (Art. 13.5).

For a material change to a Critical Operation, which can include a change of provider, notify the CBUAE at least 30 calendar days before implementation with an external expert's report, and get its written no-objection first (Arts. 12.5.5 and 12.5.6). Banks also need prior non-objection for material outsourcing under C 14/2021 (Art. 8.1), and insurers under C 25/2022 (Art. 12.2(d)).

Try the go-live gate

Yes, for material arrangements. DFSA firms inform the DFSA of any material outsourcing (GEN 5.3.22(1)), and the rule states no timing. FSRA firms inform the regulator about material outsourcing (GEN 3.3.32(1)), and the FSRA's January 2026 letter asks for a full list of providers, including group functions.

VASPs notify VARA in advance of any new or materially changed Material Outsourcing, and before any cross-border outsourcing.

Compare outsourcing rules

There are two separate triggers. For an operational risk event that significantly affects, or may affect, Critical Operations, notify the CBUAE within 4 hours (Art. 15.2.1), send a summary report within 24 hours (Art. 15.2.2), and notify it when normal operations resume (Art. 15.2.3).

Separately, any high-risk incident under the Board-approved classification criteria must be notified within 72 hours (Art. 15.3). The 72-hour notice is a trigger of its own and runs separately from the 4-hour chain.

Start the clocks in the demo

ADGM firms notify the FSRA of a suspected material cyber incident immediately on discovery, with a 24-hour backstop for the first report; the consultation text says weekends and public holidays count. DFSA firms notify a material cyber incident no later than 72 hours after becoming aware, according to secondary sources.

VASPs report a material cybersecurity event to VARA no later than 72 hours from detection, and a material breach of a Material Outsourcing agreement immediately. Personal data breaches go to the ADGM Office of Data Protection within 72 hours where feasible, and to the DIFC Commissioner as soon as practicable.

See every notification timeline

For CBUAE institutions, the Master System of Record (the data needed to run Critical Operations) must be continuously maintained and stored in the UAE, including when an activity is outsourced (C 1/2026 Art. 8.9). Branches of foreign institutions may keep an up-to-date UAE copy instead, with CBUAE approval.

Banks also need CBUAE approval and the customer's prior written consent before sharing Confidential Data outside the UAE. Health information for services provided in the UAE must stay in the UAE except where a Health Authority decision allows otherwise.

Compare data rules

The Personal Data Protection Law (Federal Decree-Law 45/2021) covers personal data processed onshore and in non-financial free zones. It excludes government data and sectors with their own laws, and the DIFC and ADGM have their own data protection laws. Processors act on the controller's instructions.

Transfers abroad rely on an adequacy decision, a treaty or limited exceptions. The Executive Regulations had not been issued at our last check, so breach timing and transfer details are still to be set.

Open the federal law page

Screen customers, counterparties, beneficial owners and related persons against the UAE Local Terrorist List and the UN Consolidated List (Cabinet Decision 74/2020, Art. 21). Subscribe to the EOCN's email alerts and re-screen immediately after each update.

Funds of a listed person must be frozen without delay, which means within 24 hours of the listing decision. Lists from other countries may matter for your business, but they do not replace the UAE and UN lists.

Under Cabinet Resolution 109/2023, a beneficial owner is a natural person who owns or controls 25% or more of the shares or votes, directly or indirectly. If there is none, it is whoever controls the company by other means, and failing that the senior managing official.

Companies keep a beneficial owner register, file it with the registrar and report changes within 15 days. DIFC and ADGM entities, listed companies and wholly government-owned companies follow other regimes.

A Tax Registration Number has 15 digits and starts with 100. The Federal Tax Authority's public EmaraTax service shows the legal name and status for a TRN. The National Economic Register covers onshore licences; confirm free zone licences with the issuing authority, or with the DIFC and ADGM registers.

A free zone company trading onshore needs a mainland branch or representative office. On this site you can run TRN and IBAN format checks. In NexaPair, the licence and TRN are recorded with the evidence a reviewer checks, and an expiring licence raises an alert.

Run the format checks

Under CBUAE C 1/2026, a legally binding written contract covers rights, duties, data ownership, confidentiality and termination. For Critical Operations it must let you inspect records and receive audit and risk reports, oblige the provider to meet CBUAE requests and allow on-site examinations, and carry the same terms to subcontractors who receive your data (Arts. 13.6 to 13.8).

DFSA and VARA rules add cooperation with the regulator, access to premises, service levels, exit assistance and stated data locations.

Contracting, stage 4

There is no single UAE-wide cycle. VARA expects each arrangement to be assessed before it starts and at least annually. The FSRA expects providers to be risk-rated so that the rating sets review frequency.

The CBUAE expects ongoing assessment, including the provider's financial condition, and at least annual testing of BCP and DR plans for Critical Operations. A common approach is to set review frequency by tier and to review sooner when a monitoring alert fires.

Ongoing monitoring, stage 6