One map for six regulators

A UAE group can answer to several supervisors at once: a bank onshore, an asset manager in the DIFC, a custody arm in ADGM, a virtual-asset business in Dubai. Each regulator writes its own third-party rules. They share a spine, and they differ in the details that decide whether a project goes live on time.

What every regime asks

• The firm stays responsible. Outsourcing moves the work, not the accountability (CBUAE C 14/2021 Art. 2.1; DFSA GEN 5.3.21; VARA Company Rulebook Part IV, Section A).
• Due diligence comes before signature. CBUAE C 1/2026 Art. 13.3 bars any arrangement without a prior risk assessment, and the FSRA expects contracts not to be signed before due diligence is done.
• Contracts give the regulator access: information, premises and on-site examination (C 1/2026 Art. 13.7; DFSA GEN 5.3.22; VARA Part IV, Section G).
• A register of arrangements is kept current. The FSRA's January 2026 letter expects it to include software and group functions.

Where they differ

The biggest difference is what you must do before go-live. The CBUAE asks for its non-objection before outsourcing anything whose disruption could significantly affect a Critical Operation (C 1/2026 Art. 13.5). A material change to a Critical Operation needs at least 30 calendar days' notice, an external expert's report and written no-objection (Art. 12.5.5 and 12.5.6). Banks also need non-objection for any material outsourcing under C 14/2021 Art. 8. The DFSA and FSRA ask you to inform them of material outsourcing, and neither rule states a timing. VARA wants notice in advance of new or materially changed Material Outsourcing and may object, plus prior notice of any cross-border outsourcing.

Incident clocks differ too. A CBUAE institution notifies within 4 hours when an event significantly affects a Critical Operation, then sends a summary within 24 hours. An ADGM firm reports a suspected material cyber incident immediately, with a 24-hour backstop that runs through weekends. Dubai entities covered by the DESC law report threats and hacks immediately.

One register and one tiering model can serve every regulator. The notices and clocks are what change.

Two gaps to watch

The SCA became the Capital Market Authority on 1 January 2026, and virtual assets now sit within its federal remit, which may overlap with VARA in Dubai. The CMA's outsourcing provisions could not be verified in an accessible official text, so treat that pack as a gap and ask the regulator or counsel. Outside financial services, sector rules bite hard: Abu Dhabi's ADHICS bars health data leaving the UAE without a Department of Health exemption.

What to do this quarter

• Keep one register and record, for each arrangement, which regulator's notice or approval it triggers.
• Write the shortest applicable clock into vendor contracts, so the vendor tells you well inside it.
• Put the non-objection step into the workflow, so go-live cannot happen before it is on file.