Central Bank of the UAE

Board members carry ultimate responsibility for the operational risk and resilience framework, even where Board committees exist.

CBUAE Operational Risk Management Regulation · Art. 4.1

The full Board (not a committee) approves and reviews key operational risk and resilience strategies and policies, including risk appetite and disruption tolerance. The Board also approves the initial BCP and DR plans; their annual review may be delegated.

CBUAE Operational Risk Management Regulation · Art. 4.2 · Timing: At least annually

Board-approved strategy, policies and processes for third-party risk, integrated into the operational risk framework.

CBUAE Operational Risk Management Regulation · Art. 13.1

The bank stays fully responsible for outsourced risks. It needs a Board-approved materiality policy, Board or committee approval of material arrangements, conflict-of-interest management, and timely reporting of material risks to the Board.

CBUAE Outsourcing Regulation for Banks · Art. 2.1, 2.5.1-2.5.4

Materiality criteria: effect on risk control and performance, impact of provider failure, effect on regulatory compliance, and the nature of the data shared.

CBUAE Outsourcing Standards for Banks · Standards s.2.3

The insurer stays fully responsible for outsourced risks and must apply the same oversight as for in-house activities. It needs a materiality process, and the Board must assess continuity risk.

CBUAE Risk Management and Internal Controls Regulation for Insurers · Art. 12.2(a)-(c), 12.3

'Staff' includes third parties acting for the LFI. The LFI is responsible for staff conduct and must ensure Authorized Agents comply with the Regulation and Standards.

CBUAE Consumer Protection Regulation · Art. 1 (definitions), 3.2.2.7, 5.1.2.7

No third-party arrangement without first doing a risk assessment and due diligence.

CBUAE Operational Risk Management Regulation · Art. 13.3 · Timing: Before entering the arrangement

Provider due diligence should cover financial capacity, experience, governance and internal controls, security including cyber, staffing, and country and legal risk.

CBUAE Outsourcing Standards for Banks · Standards s.2.2

Do not expose personal data to an API provider until onboarding and due diligence are complete. Pen-test the institution's and API providers' systems.

Joint Guidelines for FIs Adopting Enabling Technologies · Paras 3.7, 3.18 · Timing: Pen tests at least annually

Obtain a CBUAE notice of non-objection before outsourcing any activity whose disruption could significantly affect Critical Operations.

CBUAE Operational Risk Management Regulation · Art. 13.5 · Timing: Before outsourcing

For material changes to Critical Operations (which can include a change of provider): notify the CBUAE with an external expert's report, and obtain written no-objection before implementing.

CBUAE Operational Risk Management Regulation · Art. 12.5.5, 12.5.6 · Timing: At least 30 calendar days before implementation

Prior CBUAE non-objection is needed to outsource any material activity, including to related parties. Core banking and key control functions (senior management oversight, risk, compliance, internal audit) are generally not permitted to be outsourced.

CBUAE Outsourcing Regulation for Banks · Art. 8.1, 8.2 · Timing: Before outsourcing (no day count stated)

A non-objection request should contain: a description of the activity, summaries of the materiality assessment, risk assessment and due diligence, internal audit and compliance agreement, related agreements, a compliance confirmation, and evidence of Board approval. Early engagement with the CBUAE is encouraged.

CBUAE Outsourcing Standards for Banks · Standards s.8

Get CBUAE 'no objection' before outsourcing any Material Business Activity. Core insurance and key control functions are generally not permitted.

CBUAE Risk Management and Internal Controls Regulation for Insurers · Art. 12.2(d) · Timing: Before outsourcing

Outsourcing a material business activity needs CBUAE non-objection. The request includes the materiality, risk and due-diligence summaries, internal audit and compliance agreement, and evidence of approval. The CBUAE has 20 business days to grant, ask for more information, or decline. Secondary source

CBUAE Insurance Brokers Regulation - Outsourcing article · Art. 17 · Timing: CBUAE review: 20 business days

Engage the supervisor before implementing any material cloud arrangement.

Joint Guidelines for FIs Adopting Enabling Technologies · Principle 2.11; para 3.26 · Timing: Before implementation

Legally binding written contracts covering rights, duties, data ownership, confidentiality and termination. For Critical Operations, the LFI must be able to inspect records and receive audit and risk reports.

CBUAE Operational Risk Management Regulation · Art. 13.6

Formal contracts covering data ownership, CBUAE access to data, unfettered bank access during and after the term, non-disclosure, data destruction after termination, and data protection standards (including UAE information assurance standards where applicable).

CBUAE Outsourcing Regulation for Banks · Art. 5.1-5.4, 5.9

Written contracts setting out rights and obligations. Consider the provider's expertise, controls, financial viability and succession at contract end.

CBUAE Risk Management and Internal Controls Regulation for Insurers · Art. 12.4

Brokers remain fully liable for providers and must contractually bind providers to the regulation. Secondary source

CBUAE Insurance Brokers Regulation - Outsourcing article · Art. 17

Cloud and outsourcing contracts should cover roles, liability, disputes, supervisory access to information, and minimum controls.

Joint Guidelines for FIs Adopting Enabling Technologies · Principle 2.9

Contracts must oblige the provider to comply with CBUAE requests and reporting, and to allow CBUAE on-site examinations for Critical Operations outsourcing.

CBUAE Operational Risk Management Regulation · Art. 13.7

The CBUAE and its appointed agents must have access to the provider, including on-site visits and supervisory information.

CBUAE Outsourcing Regulation for Banks · Art. 5.7

Where customer or LFI data passes to subcontractors, the contract and CBUAE-access terms must also apply to them and be enforceable by contract.

CBUAE Operational Risk Management Regulation · Art. 13.8

The contract must state the extent and conditions of subcontracting. No third-party access to Confidential Data without specific authorisation.

CBUAE Outsourcing Regulation for Banks · Art. 5.5, 5.6

Do not over-rely on outsourcing; keep enough in-house staff, expertise and resources to run licensed activities.

CBUAE Operational Risk Management Regulation · Art. 13.2

The CBUAE may require an arrangement, or a Critical Operation that relies too heavily on providers, to be discontinued.

CBUAE Operational Risk Management Regulation · Art. 13.12

Consider concentration risk from relying on one provider for several arrangements, or from several providers depending on the same subcontractor.

CBUAE Outsourcing Standards for Banks · Standards s.2.1(4)

Identify the assets each Critical Operation depends on, including third-party service providers and intragroup entities, and record this in a mapping per Critical Operation that is updated through change management.

CBUAE Operational Risk Management Regulation · Art. 3.4

Minimum list of what counts as Critical Operations (e.g. payment and time-critical services, accurate financial records, solvency and liquidity management, and any operation the CBUAE deems critical).

CBUAE Operational Risk Management Regulation · Art. 3.5 (3.5.4 = any operation deemed critical by the CBUAE)

Where an arrangement relates to or affects Critical Operations, verify that the provider has at least an equivalent level of operational resilience, in normal conditions and during disruption.

CBUAE Operational Risk Management Regulation · Art. 13.4

Address reliance on third parties in the BCP and in the Critical Operations mapping.

CBUAE Operational Risk Management Regulation · Art. 13.10

Keep BCP and DR plans for Critical Operations, with annual second- and third-line review and at least annual testing.

CBUAE Operational Risk Management Regulation · Art. 11.1, 11.3, 11.10 · Timing: Test at least annually

Critical outsourced functions must be covered in the bank's DR and BCP plans, and providers must have their own plans.

CBUAE Outsourcing Regulation for Banks · Art. 2.5.5

Keep viable contingency and exit plans for third-party arrangements. The BCP must assess how hard the provider would be to substitute.

CBUAE Operational Risk Management Regulation · Art. 13.11

Arrangements should allow the activity to move to another provider or back in-house without undue delay. Contingency plans and termination provisions are expected.

CBUAE Outsourcing Standards for Banks · Standards s.2.1(3), 2.2(4), 5.1(7)

Material cloud arrangements need tested continuity plans and specific exit plans.

Joint Guidelines for FIs Adopting Enabling Technologies · Principles 2.18, 2.19

Resource third-party oversight. Minimum controls: an updated register of outsourced activities and third-party arrangements (for Critical Operations), performance and risk metrics, ongoing assessment including the provider's financial condition, and dependency management.

CBUAE Operational Risk Management Regulation · Art. 13.9 (13.9.1-13.9.4)

The compliance function regularly reviews and reports on providers' compliance.

CBUAE Risk Management and Internal Controls Regulation for Insurers · Art. 12.6

Keep a complete, current register of all outsourcing (material and non-material), solo and group-wide, with provider details, dates, service description, whether Confidential Data is involved, and materiality.

CBUAE Outsourcing Regulation for Banks · Art. 3.1, 3.2

Keep a full, current register of all outsourcing arrangements (material and non-material) at entity and group level.

CBUAE Risk Management and Internal Controls Regulation for Insurers · Art. 12.1(c)

Keep a log of cloud assets and their owners, plus current records of risk assessments and due diligence for supervisory review.

Joint Guidelines for FIs Adopting Enabling Technologies · Paras 3.28, 3.30

Incident management (Art. 9) covers ICT and cyber incidents. It must define the roles of staff and external parties and include communication plans for reporting to stakeholders, including the CBUAE.

CBUAE Operational Risk Management Regulation · Art. 9.1, 9.4.3, 9.4.4

For operational risk events that significantly affect, or may affect, Critical Operations (e.g. events that trigger BCP or DR, or materially affect customers, operations, profit or capital): first notify the CBUAE, naming the affected Critical Operations.

CBUAE Operational Risk Management Regulation · Art. 15.2, 15.2.1 · Timing: Within 4 hours

Send a summary report covering the event, the actions taken, the likely impact and the expected recovery timeframe.

CBUAE Operational Risk Management Regulation · Art. 15.2.2 · Timing: Within 24 hours

Notify the CBUAE when normal operations resume. The CBUAE may also set other notifications case by case.

CBUAE Operational Risk Management Regulation · Art. 15.2.3, 15.2.4 · Timing: On return to normal operations

Separate trigger: notify the CBUAE of any high-risk Incident, as defined by Board-approved classification criteria.

CBUAE Operational Risk Management Regulation · Art. 15.3 · Timing: Within 72 hours

Promptly notify the CBUAE of significant deviations from the Board-approved risk appetite, policies or disruption tolerance.

CBUAE Operational Risk Management Regulation · Art. 15.1 · Timing: Promptly

The provider must notify the bank of data breaches.

CBUAE Outsourcing Regulation for Banks · Art. 5.8 · Timing: Without undue delay

Notify the CBUAE of a material breach of an outsourcing agreement, or a significant development in an outsourced material activity. Provide the register and periodic reports on request.

CBUAE Outsourcing Regulation for Banks · Art. 9.1-9.4 · Timing: Immediately

Notify the CBUAE of significant data breaches, notify consumers where their security is at risk, and reimburse consumers' direct costs.

CBUAE Consumer Protection Regulation · Art. 6.1.2.4

Licensed institutions must promptly notify affected customers of security breaches or fraud incidents and take corrective action. Secondary source

New Central Bank Law · Timing: Promptly

The Master System of Record (all data, including personal data, needed to run Critical Operations) must be continuously maintained and stored in the UAE, including when activities are outsourced. Branches of foreign institutions may, with CBUAE approval, instead keep an up-to-date copy in the UAE.

CBUAE Operational Risk Management Regulation · Art. 8.9 (definition: Art. 1.17)

The Master System of Record, including all Confidential Data, must be continuously maintained and stored in the UAE. Foreign bank branches may keep a UAE copy updated at least daily, with CBUAE approval.

CBUAE Outsourcing Regulation for Banks · Art. 6.1, 6.2 · Timing: Branch copy updated at least daily

The Master System of Record with Confidential Data stays in the UAE. Foreign insurer branches may keep a UAE copy updated at least daily, with CBUAE approval.

CBUAE Risk Management and Internal Controls Regulation for Insurers · Art. 12.7(a)-(b) · Timing: Branch copy updated at least daily

Sharing Confidential Data outside the UAE needs CBUAE approval, the customer's prior written consent, and written acknowledgement that foreign authorities may access it. No sharing with jurisdictions lacking equivalent safeguards, or where secrecy laws would block supervisory access.

CBUAE Outsourcing Regulation for Banks · Art. 6.3-6.6, 6.9, 6.12

Customer Confidential Data may not leave the UAE without CBUAE approval, the customer's prior written consent and an acknowledgement of possible foreign legal access. No outsourcing to jurisdictions without equivalent safeguards, or where secrecy laws block supervision.

CBUAE Risk Management and Internal Controls Regulation for Insurers · Art. 12.7(c)-(e)

Brokers must not outsource any activities outside the UAE. Secondary source

CBUAE Insurance Brokers Regulation - Outsourcing article · Art. 17

Comply with UAE data laws. The bank and its customers keep data ownership, and subcontractors handling Confidential Data must comply. Protect data from unauthorised access, including by provider staff.

CBUAE Outsourcing Regulation for Banks · Art. 4.1-4.4

Have a data management and protection function. Get informed express consent before sharing consumer data with third parties. Treat consumer information as confidential.

CBUAE Consumer Protection Regulation · Art. 6.1.2.1, 6.1.2.5, 6.2.2.1

Implement a robust ICT and cybersecurity risk framework, and keep the Board and senior management regularly informed of ICT and cyber exposures.

CBUAE Operational Risk Management Regulation · Art. 8.1, 8.4

Sanctions for breach can include fines, barring individuals from the sector, restricting Board or senior management powers, and interim management.

CBUAE Operational Risk Management Regulation · Art. 17.1, 17.2

The LFI must handle complaints about Authorized Agents and the products they sell, and train agents on complaint handling.

CBUAE Consumer Protection Regulation · Art. 8.1.2.4, 8.1.2.6, 8.1.2.7

The CBUAE perimeter now extends to technology service providers that run platforms, protocols or infrastructure enabling financial services. Some vendors may themselves need a licence. Secondary source

New Central Bank Law

Maximum administrative fine raised to AED 1 billion. Secondary source

New Central Bank Law