White paperPDF · 7 pages · English
Article 13 made practical
A field guide to third-party risk under CBUAE Regulation C 1/2026: what it asks, how to organise it across departments, and a 90-day plan.
Resource library · free, no sign-up
Everything you need to get ready, ready to use.
Templates, a white paper and a readiness checklist for CBUAE Regulation C 1/2026, plus articles, videos and the UAE regulation hub. Use them whether or not you use NexaPair.
The library
Downloads are available on the live site.
ChecklistCSV and PDF · English
Article 13 readiness checklist
Every requirement as a question with an owner and an evidence column. Score yourself in an afternoon.
TemplateCSV for Excel · English
Register of outsourced activities
A starter register with the fields a supervisor asks for: service, criticality, data location, review dates and exit status.
TemplatePDF · English
Due diligence questionnaire
A questionnaire for suppliers of UAE and Indian financial institutions, grouped by risk area, with notes on good evidence.
TemplatePDF · English
Exit plan template
One plan per material or critical arrangement: triggers, alternatives, data return, transition steps and testing.
TemplatePDF · English
Incident notification template
For third-party incidents that affect a critical operation, with the facts each notice needs. Check the regulator's current channel before use.
Video guide9 min 41 s · 4 languages
CBUAE C 1/2026, explained
Why the rules came in and how to turn them into value, in English, Hindi, Arabic and French.
RegulationInteractive
Regulation hub
Which rules apply to you, plus notification, outsourcing and data-transfer tables across regulators.
Checklist10 questions · in your browser
Maturity self-assessment
Your programme's maturity level and top three gaps, with where to start. Nothing is sent or stored.
Regulation9 stages
TPRM in the UAE, stage by stage
The third-party lifecycle with the UAE rules for each stage, and how it lines up with ISO and NIST standards.
Regulation15 questions
FAQ on UAE third-party risk
Non-objection, incident clocks, data location, sanctions lists, beneficial owners and contracts, each answer with its sources.
Article5 min read
One map for six regulators
How the CBUAE, DFSA, FSRA, CMA (formerly SCA), VARA and the government frameworks approach vendor risk, and where they overlap.
Article4 min read
Screening vendors against the UAE sanctions lists
What the UAE Local Terrorist List and the UN lists mean for vendor onboarding and monitoring.
Article5 min read
The PDPL and your vendors
What the federal data protection law asks when vendors process personal data, including transfers outside the UAE.
Regulation
Central Bank of the UAE
Banks, finance companies, insurers, exchange houses and payment service providers licensed onshore.
Regulation
Dubai Financial Services Authority (DIFC)
Firms authorised by the DFSA in the Dubai International Financial Centre.
Regulation
Financial Services Regulatory Authority (ADGM)
Firms authorised by the FSRA in Abu Dhabi Global Market.
Regulation
Capital Market Authority (formerly the Securities and Commodities Authority)
Onshore capital-market firms formerly licensed by the SCA, which became the CMA on 1 January 2026. Virtual assets now sit within the CMA's federal remit too.
Regulation
Virtual Assets Regulatory Authority (Dubai)
Virtual asset service providers licensed in Dubai, including its free zones other than the DIFC.
Regulation
Government entities and critical sectors
Federal and local government entities, and operators of critical infrastructure such as energy, telecoms, health and transport.
Regulation
Federal law across every sector
Every firm operating in the UAE, alongside its sector regulator.
Filled in the readiness checklist? Book a call and we will go through your gaps with you, and show where NexaPair closes them.Book a readiness call