Regulation hub
One map for UAE third-party regulation.
Six regulatory regimes, and the federal laws that sit across all of them. Start with the picker, then open the regime that applies to you.
Notification clocks
Incident notification timelines
Write the shortest clock that applies to you into vendor contracts, so the vendor tells you well inside it. For a CBUAE institution that is 4 hours; for an ADGM firm it is 24 hours, running through weekends.
- 4 hCBUAE · an event significantly affecting a critical operationCBUAE Operational Risk Management Regulation Art. 15.2, 15.2.1
- 72 hCBUAE · a high-risk incident under the Board's criteria, a separate triggerCBUAE Operational Risk Management Regulation Art. 15.3
- Now · 24 h maxFSRA (ADGM) · a suspected material cyber incident, weekends includedFSRA Cyber Risk Management Rules GEN 3.5.18; GEN 8.10
- ImmediatelyDESC (Dubai) · threats, hacks, leaks or interceptionDubai Electronic Security Centre Law Art. 14(4)
- ImmediatelyVARA · a material breach of a Material Outsourcing agreementVARA Company Rulebook - Part IV Outsourcing Part IV, Section H.1-H.2
- 24 hSanctions · freeze funds after a listing decisionTargeted Financial Sanctions regulation Art. 15 (freezing)
24 rules
| Regime | Instrument | Requirement | Timing |
|---|---|---|---|
| CBUAE | CBUAE Operational Risk Management Regulation Art. 9.1, 9.4.3, 9.4.4 | Incident management (Art. 9) covers ICT and cyber incidents. It must define the roles of staff and external parties and include communication plans for reporting to stakeholders, including the CBUAE. | Not specified |
| CBUAE | CBUAE Operational Risk Management Regulation Art. 15.2, 15.2.1 | For operational risk events that significantly affect, or may affect, Critical Operations (e.g. events that trigger BCP or DR, or materially affect customers, operations, profit or capital): first notify the CBUAE, naming the affected Critical Operations. | Within 4 hours |
| CBUAE | CBUAE Operational Risk Management Regulation Art. 15.2.2 | Send a summary report covering the event, the actions taken, the likely impact and the expected recovery timeframe. | Within 24 hours |
| CBUAE | CBUAE Operational Risk Management Regulation Art. 15.2.3, 15.2.4 | Notify the CBUAE when normal operations resume. The CBUAE may also set other notifications case by case. | On return to normal operations |
| CBUAE | CBUAE Operational Risk Management Regulation Art. 15.3 | Separate trigger: notify the CBUAE of any high-risk Incident, as defined by Board-approved classification criteria. | Within 72 hours |
| CBUAE | CBUAE Operational Risk Management Regulation Art. 15.1 | Promptly notify the CBUAE of significant deviations from the Board-approved risk appetite, policies or disruption tolerance. | Promptly |
| CBUAE | CBUAE Outsourcing Regulation for Banks Art. 5.8 | The provider must notify the bank of data breaches. | Without undue delay |
| CBUAE | CBUAE Outsourcing Regulation for Banks Art. 9.1-9.4 | Notify the CBUAE of a material breach of an outsourcing agreement, or a significant development in an outsourced material activity. Provide the register and periodic reports on request. | Immediately |
| CBUAE | CBUAE Consumer Protection Regulation Art. 6.1.2.4 | Notify the CBUAE of significant data breaches, notify consumers where their security is at risk, and reimburse consumers' direct costs. | Not specified |
| CBUAE | New Central Bank Law | Licensed institutions must promptly notify affected customers of security breaches or fraud incidents and take corrective action. Secondary source | Promptly |
| DFSA | DFSA cyber risk management rules | Notify the DFSA of a material cyber incident through the ePortal form. Secondary source | As soon as reasonably practicable, no later than 72 hours after becoming aware |
| DFSA | DIFC Data Protection Law Art. 41(1) | The controller notifies the Commissioner of a personal data breach. | As soon as practicable in the circumstances |
| DFSA | DIFC Data Protection Law Art. 41(2) | The processor notifies the controller of a breach. | Without undue delay |
| FSRA | FSRA Cyber Risk Management Rules GEN 3.5.18; GEN 8.10 | Notify the FSRA of a suspected material cyber incident immediately on discovery, with a 24-hour backstop for the initial report (Template A) emailed to incidents.fsra@adgm.com, copying the supervisor. Progress updates (Template B) follow at a frequency the supervisor sets. | Immediately; no later than 24 hours (CP text: including weekends and public holidays) |
| FSRA | ADGM Data Protection Regulations 2021 s.32 | The controller notifies the Office of Data Protection of a personal data breach via the Online Registry Solution ('Notify the Office of Data Protection' then 'Data Breach Notification'). | Without undue delay and, where feasible, within 72 hours of awareness |
| FSRA | ADGM Data Protection Regulations 2021 ODP Guidance Part 5, para 4.8 | The processor notifies the controller of a breach; it does not notify the Commissioner. | Without undue delay |
| VARA | VARA Company Rulebook - Part IV Outsourcing Part IV, Section H.1-H.2 | Notify VARA of a material breach of a Material Outsourcing agreement, or a development that could significantly affect operations, finances or reputation. | Immediately |
| VARA | VARA Technology and Information Rulebook Part I, Section K, para 1 | Report a material cybersecurity event, or an event that triggers the BCDR plan and materially affects operations, with its nature, scope, impact and mitigation, and whether other authorities were told. | As soon as reasonably practicable, no later than 72 hours from detection |
| VARA | VARA Technology and Information Rulebook Part II, Section C, para 2 | After notifying a data regulator or data subjects of a personal-data incident, notify VARA and give a summary (or a copy, if the regulator is in the UAE). | As soon as possible, within 24 hours of the other notification |
| Government and critical sectors | Dubai Electronic Security Centre Law Art. 14(4) | Entities must report threats, hacks, leaks, interceptions or risks to DESC. | Immediately |
| Federal law | UAE Personal Data Protection Law (PDPL) Art. 9 | The controller reports a breach that harms privacy, confidentiality or security to the Data Office, with investigation results; data subjects may also need notice. Detailed timing awaits the Executive Regulations. Secondary source | Immediately on becoming aware (period to be set by Executive Regulations) |
| Federal law | Targeted Financial Sanctions regulation Art. 15 (freezing) | Freeze funds of listed persons without prior notice. Do not provide funds or services without EOCN permission. | Without delay = within 24 hours of the listing decision |
| Federal law | Targeted Financial Sanctions regulation | Report via goAML: a Fund Freeze Report (FFR) for confirmed matches, and a Partial Name Match Report (PNMR) for potential matches, keeping the suspension in place until instructed. Secondary source | Within 5 business days (CBUAE and FSRA 2025 guidance) |
| Federal law | UAE e-invoicing | Both issuer and recipient need an Accredited Service Provider. Report system outages to the FTA. Vendor master data must support e-invoicing readiness. Secondary source | Outage report within 2 business days; large-business go-live 1 Jan 2027 |
Mapped from our source-by-source research, checked on 3 November 2026. High-confidence items were checked on an official page; Secondary source means law-firm or other secondary sources only; To be confirmed means reported but not verified.
Which rules apply to me?
Answer three questions. The answer is orientation only, so confirm it with your compliance or legal team.
Likely to apply To be confirmed
Orientation only, to be confirmed. Group structures, branches and activities outside your main licence can bring in more than one regime.
Every regime at a glance
CBUAE8 instruments mappedCentral Bank of the UAEBanks, finance companies, insurers, exchange houses and payment service providers licensed onshore.66 rulesOpen DFSA3 instruments mappedDubai Financial Services Authority (DIFC)Firms authorised by the DFSA in the Dubai International Financial Centre.15 rulesOpen FSRA3 instruments mappedFinancial Services Regulatory Authority (ADGM)Firms authorised by the FSRA in Abu Dhabi Global Market.16 rulesOpen CMA (formerly SCA)2 instruments mappedCapital Market Authority (formerly the Securities and Commodities Authority)Onshore capital-market firms formerly licensed by the SCA, which became the CMA on 1 January 2026. Virtual assets now sit within the CMA's federal remit too.2 rulesOpen VARA2 instruments mappedVirtual Assets Regulatory Authority (Dubai)Virtual asset service providers licensed in Dubai, including its free zones other than the DIFC.12 rulesOpen Government and critical sectors10 instruments mappedGovernment entities and critical sectorsFederal and local government entities, and operators of critical infrastructure such as energy, telecoms, health and transport.32 rulesOpen Federal law14 instruments mappedFederal law across every sectorEvery firm operating in the UAE, alongside its sector regulator.35 rulesOpen
Outsourcing approval and notice, by regulator
12 rules
| Regime | Instrument | Requirement | Timing |
|---|---|---|---|
| CBUAE | CBUAE Operational Risk Management Regulation Art. 13.5 | Obtain a CBUAE notice of non-objection before outsourcing any activity whose disruption could significantly affect Critical Operations. | Before outsourcing |
| CBUAE | CBUAE Operational Risk Management Regulation Art. 12.5.5, 12.5.6 | For material changes to Critical Operations (which can include a change of provider): notify the CBUAE with an external expert's report, and obtain written no-objection before implementing. | At least 30 calendar days before implementation |
| CBUAE | CBUAE Outsourcing Regulation for Banks Art. 8.1, 8.2 | Prior CBUAE non-objection is needed to outsource any material activity, including to related parties. Core banking and key control functions (senior management oversight, risk, compliance, internal audit) are generally not permitted to be outsourced. | Before outsourcing (no day count stated) |
| CBUAE | CBUAE Outsourcing Standards for Banks Standards s.8 | A non-objection request should contain: a description of the activity, summaries of the materiality assessment, risk assessment and due diligence, internal audit and compliance agreement, related agreements, a compliance confirmation, and evidence of Board approval. Early engagement with the CBUAE is encouraged. | Not specified |
| CBUAE | CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.2(d) | Get CBUAE 'no objection' before outsourcing any Material Business Activity. Core insurance and key control functions are generally not permitted. | Before outsourcing |
| CBUAE | CBUAE Insurance Brokers Regulation - Outsourcing article Art. 17 | Outsourcing a material business activity needs CBUAE non-objection. The request includes the materiality, risk and due-diligence summaries, internal audit and compliance agreement, and evidence of approval. The CBUAE has 20 business days to grant, ask for more information, or decline. Secondary source | CBUAE review: 20 business days |
| CBUAE | Joint Guidelines for FIs Adopting Enabling Technologies Principle 2.11; para 3.26 | Engage the supervisor before implementing any material cloud arrangement. | Before implementation |
| DFSA | DFSA GEN outsourcing rules GEN 5.3.22(1) | Inform the DFSA of any material outsourcing arrangement. | No timing stated in the rule text |
| FSRA | FSRA GEN outsourcing rules GEN 3.3.32(1) | Inform the Regulator about material outsourcing arrangements. Secondary source | No timing verified |
| CMA (formerly SCA) | SCA (now CMA) Rulebook for Financial Activities | The 2024 amendments added outsourcing requirements for licensed firms. The location in the Rulebook, the conditions, and any approval or notification duty to the regulator were NOT verified. To be confirmed | Not specified |
| VARA | VARA Company Rulebook - Part IV Outsourcing Part IV, Section F | Notify VARA before any cross-border outsourcing, and promptly if an overseas authority seeks access to VASP information. | Prior to cross-border outsourcing; overseas access request: as soon as possible |
| VARA | VARA Company Rulebook - Part IV Outsourcing Part IV, Section H.3-H.4 | Notify VARA in advance of any new or materially changed Material Outsourcing. VARA may object, and its concerns must be resolved first. | In advance |
Data residency and cross-border transfer
15 rules
| Regime | Instrument | Requirement | Timing |
|---|---|---|---|
| CBUAE | CBUAE Operational Risk Management Regulation Art. 8.9 (definition: Art. 1.17) | The Master System of Record (all data, including personal data, needed to run Critical Operations) must be continuously maintained and stored in the UAE, including when activities are outsourced. Branches of foreign institutions may, with CBUAE approval, instead keep an up-to-date copy in the UAE. | Not specified |
| CBUAE | CBUAE Outsourcing Regulation for Banks Art. 6.1, 6.2 | The Master System of Record, including all Confidential Data, must be continuously maintained and stored in the UAE. Foreign bank branches may keep a UAE copy updated at least daily, with CBUAE approval. | Branch copy updated at least daily |
| CBUAE | CBUAE Outsourcing Regulation for Banks Art. 6.3-6.6, 6.9, 6.12 | Sharing Confidential Data outside the UAE needs CBUAE approval, the customer's prior written consent, and written acknowledgement that foreign authorities may access it. No sharing with jurisdictions lacking equivalent safeguards, or where secrecy laws would block supervisory access. | Not specified |
| CBUAE | CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.7(a)-(b) | The Master System of Record with Confidential Data stays in the UAE. Foreign insurer branches may keep a UAE copy updated at least daily, with CBUAE approval. | Branch copy updated at least daily |
| CBUAE | CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.7(c)-(e) | Customer Confidential Data may not leave the UAE without CBUAE approval, the customer's prior written consent and an acknowledgement of possible foreign legal access. No outsourcing to jurisdictions without equivalent safeguards, or where secrecy laws block supervision. | Not specified |
| CBUAE | CBUAE Insurance Brokers Regulation - Outsourcing article Art. 17 | Brokers must not outsource any activities outside the UAE. Secondary source | Not specified |
| DFSA | DIFC Data Protection Law Art. 26, Art. 27 | Transfers out of the DIFC are allowed to adequate jurisdictions; otherwise use safeguards (BCRs, Commissioner SCCs, codes, certification) or listed derogations. A documented assessment of the recipient jurisdiction is required since the 2025 amendments. | Not specified |
| FSRA | ADGM Data Protection Regulations 2021 | Transfers out of ADGM go to adequate jurisdictions, or use appropriate safeguards (ADGM SCCs, BCRs) or derogations (consent, contract necessity, infrequent transfers). Secondary source | Not specified |
| Government and critical sectors | Dubai Information Security Regulation (ISR) | v3.0 reportedly bars storing or processing critical information outside the UAE, including in cloud services. To be confirmed | Not specified |
| Government and critical sectors | ADHICS v2 CO 9.2 (item 6) | Health information (PII, PHI or copies) must not be stored, processed or transferred outside the UAE without a valid, specific DoH exemption. | Not specified |
| Government and critical sectors | ADHICS v2 CO 9.2 (item 7) | Third-party staff delivering services must work from within the UAE unless DoH grants an exemption. Secondary source | Not specified |
| Government and critical sectors | Health ICT Law (health data localisation) Art. 13 | Health information and data for services provided in the UAE may not be stored, processed, generated or transferred outside the UAE, except in cases set by a Health Authority decision coordinated with MOHAP. | Not specified |
| Government and critical sectors | Health ICT Law (health data localisation) MOHAP Resolution 51/2021 | Exceptions under MOHAP Resolution 51/2021 include treatment abroad, overseas labs, research, insurers and claims, authority requests, personal devices and pharmacovigilance. Conditions include consent, encryption and a copy kept in the UAE. Secondary source | Not specified |
| Federal law | UAE Personal Data Protection Law (PDPL) Art. 22 | Transfers are allowed to jurisdictions the Data Office approves as adequate, or where there is a treaty. Secondary source | Not specified |
| Federal law | UAE Personal Data Protection Law (PDPL) Art. 23 | Without adequacy: limited derogations such as contractual undertakings, explicit consent and contract necessity. Details depend on the Executive Regulations. Secondary source | Not specified |
This is a summary for orientation, not legal advice. Always rely on the official text, and take advice on your own situation. For federal legislation, the Arabic text prevails.