Third-party risk, sector by sector.

UAE rules that apply

• Obtain a CBUAE notice of non-objection before outsourcing any activity whose disruption could significantly affect Critical Operations.

  CBUAE Operational Risk Management Regulation Art. 13.5 · Timing: Before outsourcing

• The Master System of Record (all data, including personal data, needed to run Critical Operations) must be continuously maintained and stored in the UAE, including when activities are outsourced. Branches of foreign institutions may, with CBUAE approval, instead keep an up-to-date copy in the UAE.

  CBUAE Operational Risk Management Regulation Art. 8.9 (definition: Art. 1.17)

• Prior CBUAE non-objection is needed to outsource any material activity, including to related parties. Core banking and key control functions (senior management oversight, risk, compliance, internal audit) are generally not permitted to be outsourced.

  CBUAE Outsourcing Regulation for Banks Art. 8.1, 8.2 · Timing: Before outsourcing (no day count stated)

• Sharing Confidential Data outside the UAE needs CBUAE approval, the customer's prior written consent, and written acknowledgement that foreign authorities may access it. No sharing with jurisdictions lacking equivalent safeguards, or where secrecy laws would block supervisory access.

  CBUAE Outsourcing Regulation for Banks Art. 6.3-6.6, 6.9, 6.12

• 'Staff' includes third parties acting for the LFI. The LFI is responsible for staff conduct and must ensure Authorized Agents comply with the Regulation and Standards.

  CBUAE Consumer Protection Regulation Art. 1 (definitions), 3.2.2.7, 5.1.2.7

UAE rules that apply

• Keep a full, current register of all outsourcing arrangements (material and non-material) at entity and group level.

  CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.1(c)

• Get CBUAE 'no objection' before outsourcing any Material Business Activity. Core insurance and key control functions are generally not permitted.

  CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.2(d) · Timing: Before outsourcing

• Customer Confidential Data may not leave the UAE without CBUAE approval, the customer's prior written consent and an acknowledgement of possible foreign legal access. No outsourcing to jurisdictions without equivalent safeguards, or where secrecy laws block supervision.

  CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.7(c)-(e)

• Outsourcing a material business activity needs CBUAE non-objection. The request includes the materiality, risk and due-diligence summaries, internal audit and compliance agreement, and evidence of approval. The CBUAE has 20 business days to grant, ask for more information, or decline. Secondary source

  CBUAE Insurance Brokers Regulation - Outsourcing article Art. 17 · Timing: CBUAE review: 20 business days

• Brokers must not outsource any activities outside the UAE. Secondary source

  CBUAE Insurance Brokers Regulation - Outsourcing article Art. 17

UAE rules that apply

• For operational risk events that significantly affect, or may affect, Critical Operations (e.g. events that trigger BCP or DR, or materially affect customers, operations, profit or capital): first notify the CBUAE, naming the affected Critical Operations.

  CBUAE Operational Risk Management Regulation Art. 15.2, 15.2.1 · Timing: Within 4 hours

• Screen customers, counterparties, beneficial owners and related persons against the UAE Local Terrorist List and the UN Consolidated List. Subscribe to EOCN email alerts and re-screen immediately after each update.

  Targeted Financial Sanctions regulation Art. 21 (screening) · Timing: Immediately after each list update

• Freeze funds of listed persons without prior notice. Do not provide funds or services without EOCN permission.

  Targeted Financial Sanctions regulation Art. 15 (freezing) · Timing: Without delay = within 24 hours of the listing decision

• Continuous monitoring obligation. Secondary source

  AML/CFT/CPF Law Art. 19

• The CBUAE perimeter now extends to technology service providers that run platforms, protocols or infrastructure enabling financial services. Some vendors may themselves need a licence. Secondary source

  New Central Bank Law

UAE rules that apply

• Inform the DFSA of any material outsourcing arrangement.

  DFSA GEN outsourcing rules GEN 5.3.22(1) · Timing: No timing stated in the rule text

• The FSRA expects a full list of all providers, including software, custodians and group functions, with materiality assessed. Intragroup arrangements are outsourcing.

  FSRA GEN outsourcing rules Dear SEO letter 29 Jan 2026

• Outsourced CDD, eKYC and sanctions-screening tools fall under the AML Rulebook outsourcing rules and need periodic assurance.

  FSRA GEN outsourcing rules AML 9.3.1

• Notify the FSRA of a suspected material cyber incident immediately on discovery, with a 24-hour backstop for the initial report (Template A) emailed to incidents.fsra@adgm.com, copying the supervisor. Progress updates (Template B) follow at a frequency the supervisor sets.

  FSRA Cyber Risk Management Rules GEN 3.5.18; GEN 8.10 · Timing: Immediately; no later than 24 hours (CP text: including weekends and public holidays)

• Notify the DFSA of a material cyber incident through the ePortal form. Secondary source

  DFSA cyber risk management rules · Timing: As soon as reasonably practicable, no later than 72 hours after becoming aware

• Transfers out of the DIFC are allowed to adequate jurisdictions; otherwise use safeguards (BCRs, Commissioner SCCs, codes, certification) or listed derogations. A documented assessment of the recipient jurisdiction is required since the 2025 amendments.

  DIFC Data Protection Law Art. 26, Art. 27

UAE rules that apply

• The SCA is reconstituted as the Capital Market Authority (CMA). Vendor and licence records should show 'CMA' for onshore securities firms from 2026. Virtual assets now sit within the CMA perimeter, which may overlap with VARA for Dubai VASPs. Secondary source

  Capital Market Authority laws (SCA renamed CMA) · Timing: Grace period to 1 Jan 2027 (secondary source)

• The 2024 amendments added outsourcing requirements for licensed firms. The location in the Rulebook, the conditions, and any approval or notification duty to the regulator were NOT verified. To be confirmed

  SCA (now CMA) Rulebook for Financial Activities

UAE rules that apply

• The VASP stays fully accountable. Outsourcing that would materially impair internal controls or VARA oversight is prohibited. The MLRO, CISO and DPO roles may be outsourced, but VARA can require in-house staff.

  VARA Company Rulebook - Part IV Outsourcing Part IV, Section A

• Notify VARA in advance of any new or materially changed Material Outsourcing. VARA may object, and its concerns must be resolved first.

  VARA Company Rulebook - Part IV Outsourcing Part IV, Section H.3-H.4 · Timing: In advance

• Notify VARA before any cross-border outsourcing, and promptly if an overseas authority seeks access to VASP information.

  VARA Company Rulebook - Part IV Outsourcing Part IV, Section F · Timing: Prior to cross-border outsourcing; overseas access request: as soon as possible

• Notify VARA of a material breach of a Material Outsourcing agreement, or a development that could significantly affect operations, finances or reputation.

  VARA Company Rulebook - Part IV Outsourcing Part IV, Section H.1-H.2 · Timing: Immediately

• Report a material cybersecurity event, or an event that triggers the BCDR plan and materially affects operations, with its nature, scope, impact and mitigation, and whether other authorities were told.

  VARA Technology and Information Rulebook Part I, Section K, para 1 · Timing: As soon as reasonably practicable, no later than 72 hours from detection

UAE rules that apply

• Integrity and conflict-of-interest rules. Employees may not take part in procurements where they or their companies have an interest, and must report conflicts.

  Federal Government Procurement Law Art. 10(3)-(4)

• Contractors must be licensed companies. Sole proprietorships, civil companies and partnerships are excluded. The entity assesses efficiency, solvency and compliance.

  Dubai Government Services Outsourcing Law Art. 2; Art. 7(8), 7(15); Art. 10(2)

• Emiratisation: contractors employ at least one UAE National for every non-UAE National.

  Dubai Government Services Outsourcing Law Art. 3(7); Art. 19

• Assigning the contract or partnering with third parties needs the entity's prior written approval and a tripartite agreement.

  Dubai Government Services Outsourcing Law Art. 12(b)

• Use only DESC-certified private electronic security companies and hosts. Data centres and cloud providers need DESC certification to connect to DESC networks. Outsourcing partners may be certified.

  Dubai Electronic Security Centre Law Art. 14(8); Art. 6(11); Art. 15(b)

• Entities must report threats, hacks, leaks, interceptions or risks to DESC.

  Dubai Electronic Security Centre Law Art. 14(4) · Timing: Immediately

UAE rules that apply

• Health information and data for services provided in the UAE may not be stored, processed, generated or transferred outside the UAE, except in cases set by a Health Authority decision coordinated with MOHAP.

  Health ICT Law (health data localisation) Art. 13

• Retain health information for at least 25 years from the last health procedure.

  Health ICT Law (health data localisation) Art. 20(1)(a) · Timing: At least 25 years

• Health information (PII, PHI or copies) must not be stored, processed or transferred outside the UAE without a valid, specific DoH exemption.

  ADHICS v2 CO 9.2 (item 6)

• Third-party staff delivering services must work from within the UAE unless DoH grants an exemption. Secondary source

  ADHICS v2 CO 9.2 (item 7)

• Third parties must notify the entity in advance of changes, including relocation, reconfiguration and onboarding of sub-contractors.

  ADHICS v2 CO 2.3 (item 5) · Timing: In advance

• Background verification of contractors and third-party users before access, and revocation of access within 24 hours of exit.

  ADHICS v2 HR 2.1; HR 4.3 · Timing: Revoke access within 24 hours of exit

UAE rules that apply

• Management and technical security controls for designated critical entities. v2 reportedly adds AI, cloud (data location, key management, sovereignty) and IoT/OT controls. To be confirmed

  UAE Information Assurance Regulation / Standard

• Third-party security controls exist in the IAR family, but the clause IDs were not verified. To be confirmed

  UAE Information Assurance Regulation / Standard

• The national cyber incident response plan is a reference for firm-level incident response plans. Secondary source

  UAE Cyber Security Council national policies

• Use only DESC-certified private electronic security companies and hosts. Data centres and cloud providers need DESC certification to connect to DESC networks. Outsourcing partners may be certified.

  Dubai Electronic Security Centre Law Art. 14(8); Art. 6(11); Art. 15(b)

Sector-specific cyber standards for energy and utilities are not yet in our regulatory map. To be confirmed

UAE rules that apply

• Transfers are allowed to jurisdictions the Data Office approves as adequate, or where there is a treaty. Secondary source

  UAE Personal Data Protection Law (PDPL) Art. 22

• Continuous monitoring obligation. Secondary source

  AML/CFT/CPF Law Art. 19

• Screen customers, counterparties, beneficial owners and related persons against the UAE Local Terrorist List and the UN Consolidated List. Subscribe to EOCN email alerts and re-screen immediately after each update.

  Targeted Financial Sanctions regulation Art. 21 (screening) · Timing: Immediately after each list update

• Keep a beneficial owner register, a register of partners or shareholders, and nominee declarations, and file them with the registrar. Secondary source

  Beneficial Owner Procedures · Timing: Notify changes within 15 days (ADGM uses 30 days)

• Private-sector bribery: managers or employees soliciting or accepting (passive), and offering or giving (active). Secondary source

  Penal Code - bribery offences Art. 278 (passive); Art. 279 (active)

• Temporary work and outsourced labour must go through licensed agencies. The agency carries the employer's obligations even if the client defaults, and keeps worker records for at least 2 years. The client (beneficiary) must provide OHS and keep workers within agreed duties and hours. Secondary source

  Labour Law, agencies and WPS MD 51/2022 · Timing: Agency record retention: at least 2 years