Regulator page
Who it applies to: Firms authorised by the FSRA in Abu Dhabi Global Market.
FSRA General Rulebook (GEN) - outsourcing rules
The FSRA rulebook site blocked fetching, so GEN 3.3.32(1) was seen only quoted inside the CP 3/2025 appendix. Any notification timing (e.g. under GEN 8.10) was not verified.
FSRA GEN Chapter 3.5 - Cyber Risk Management Rules
GEN 3.5.16 and 3.5.18 were confirmed in 2025-26 FSRA notices. Other sub-rule numbers come from the consultation draft; check them against the final rulebook. Breaches also go to the ADGM Office of Data Protection, and STRs to the FIU, separately.
ADGM Data Protection Regulations 2021
The section numbers for the processor contract and transfer provisions were not verified (the brochure says Part IV covers controller and processor duties and Part V covers transfers). ADGM's UBO filing window (30 days) is separate; see the UBO entry.
Mapped from our source-by-source research, checked on 3 November 2026. High-confidence items were checked on an official page; Secondary source means law-firm or other secondary sources only; To be confirmed means reported but not verified.
Identify outsourcing of functions directly related to Regulated Activities. Do due diligence on suitability, supervise effectively, and act on provider failures.
Do due diligence on ICT service providers. Contracts must require them to meet the firm's cyber requirements, notify cyber incidents, help with remediation and allow verification. Secondary source
Inform the Regulator about material outsourcing arrangements. Secondary source
Material outsourcing needs a written contract covering the prescribed factors. The FSRA expects performance metrics and default and termination clauses, and that contracts are not signed before due diligence.
Controllers must put safeguards in place with processors (data protection agreement, audits, due diligence). Secondary source
Keep a cyber incident response plan and test it. The UAE Cyber Security Council's national plan can serve as a reference.
Risk-rate providers to drive review frequency. Monitor KPIs, adverse news and ownership changes. Have a policy on onsite visits for overseas providers.
Run a resilience testing programme, at least annually for internet-facing systems. Secondary source
The FSRA expects a full list of all providers, including software, custodians and group functions, with materiality assessed. Intragroup arrangements are outsourcing.
Notify the FSRA of a suspected material cyber incident immediately on discovery, with a 24-hour backstop for the initial report (Template A) emailed to incidents.fsra@adgm.com, copying the supervisor. Progress updates (Template B) follow at a frequency the supervisor sets.
The controller notifies the Office of Data Protection of a personal data breach via the Online Registry Solution ('Notify the Office of Data Protection' then 'Data Breach Notification').
The processor notifies the controller of a breach; it does not notify the Commissioner.
Transfers out of ADGM go to adequate jurisdictions, or use appropriate safeguards (ADGM SCCs, BCRs) or derogations (consent, contract necessity, infrequent transfers). Secondary source
Keep a cyber risk management framework approved by the governing body and reviewed annually. Requirements include an asset inventory recording where each asset is stored, access control, MFA, encryption and patching. Secondary source
Controllers and processors implement appropriate technical and organisational security measures.
Outsourced CDD, eKYC and sanctions-screening tools fall under the AML Rulebook outsourcing rules and need periodic assurance.
Mapped from the built-in summary. Each line shows whether the feature is live in the product today.
This is a summary for orientation, not legal advice. Always rely on the official text, and take advice on your own situation. For federal legislation, the Arabic text prevails.
