The third-party lifecycle, stage by stage.

CBUAE Board-approved strategy, policies and processes for third-party risk, integrated into the operational risk framework.

CBUAE Operational Risk Management Regulation Art. 13.1

CBUAE Do not over-rely on outsourcing; keep enough in-house staff, expertise and resources to run licensed activities.

CBUAE Operational Risk Management Regulation Art. 13.2

CBUAE Keep a complete, current register of all outsourcing (material and non-material), solo and group-wide, with provider details, dates, service description, whether Confidential Data is involved, and materiality.

CBUAE Outsourcing Regulation for Banks Art. 3.1, 3.2

FSRA The FSRA expects a full list of all providers, including software, custodians and group functions, with materiality assessed. Intragroup arrangements are outsourcing.

FSRA GEN outsourcing rules Dear SEO letter 29 Jan 2026

VARA Keep an Outsourcing Policy and a register with provider, scope, location, dates, contacts, materiality, and whether personal or confidential data is involved.

VARA Company Rulebook - Part IV Outsourcing Part IV, Section C

CBUAE Identify the assets each Critical Operation depends on, including third-party service providers and intragroup entities, and record this in a mapping per Critical Operation that is updated through change management.

CBUAE Operational Risk Management Regulation Art. 3.4

CBUAE Minimum list of what counts as Critical Operations (e.g. payment and time-critical services, accurate financial records, solvency and liquidity management, and any operation the CBUAE deems critical).

CBUAE Operational Risk Management Regulation Art. 3.5 (3.5.4 = any operation deemed critical by the CBUAE)

CBUAE Materiality criteria: effect on risk control and performance, impact of provider failure, effect on regulatory compliance, and the nature of the data shared.

CBUAE Outsourcing Standards for Banks Standards s.2.3

FSRA Risk-rate providers to drive review frequency. Monitor KPIs, adverse news and ownership changes. Have a policy on onsite visits for overseas providers.

FSRA GEN outsourcing rules Dear SEO letter 29 Jan 2026

CBUAE No third-party arrangement without first doing a risk assessment and due diligence.

CBUAE Operational Risk Management Regulation Art. 13.3 · Timing: Before entering the arrangement

CBUAE Provider due diligence should cover financial capacity, experience, governance and internal controls, security including cyber, staffing, and country and legal risk.

CBUAE Outsourcing Standards for Banks Standards s.2.2

DFSA Do due diligence when choosing providers, supervise the outsourced work effectively, and deal with any provider act or failure that could breach DIFC law.

DFSA GEN outsourcing rules GEN 5.3.21(3)

Federal law A beneficial owner is a natural person owning or controlling 25% or more of shares or votes, directly or indirectly. If there is none, record whoever controls by other means; failing that, the senior managing official. Secondary source

Beneficial Owner Procedures

Federal law A TRN is 15 digits and starts with '100'. Verify it on the FTA's public EmaraTax TRN verification service (no login; CAPTCHA). The result shows legal name, TRN and status. One TRN generally covers VAT and corporate tax, but status can differ by tax type. Secondary source

VAT and Corporate Tax registration (TRN)

Federal law Check onshore licences and activities via the NER (growth.gov.ae). Confirm against the issuing authority (DED/DET, free zone authority, or the DIFC/ADGM registers), since free-zone coverage in the NER is not confirmed. Secondary source

National Economic Register (NER) and licence checks

CBUAE Legally binding written contracts covering rights, duties, data ownership, confidentiality and termination. For Critical Operations, the LFI must be able to inspect records and receive audit and risk reports.

CBUAE Operational Risk Management Regulation Art. 13.6

CBUAE Contracts must oblige the provider to comply with CBUAE requests and reporting, and to allow CBUAE on-site examinations for Critical Operations outsourcing.

CBUAE Operational Risk Management Regulation Art. 13.7

CBUAE Where customer or LFI data passes to subcontractors, the contract and CBUAE-access terms must also apply to them and be enforceable by contract.

CBUAE Operational Risk Management Regulation Art. 13.8

DFSA The written contract must require the provider to supply information, give access to its premises, and deal openly and cooperatively with the DFSA.

DFSA GEN outsourcing rules GEN 5.3.22(2)(b), (3)

VARA Written contracts with mandatory terms. Material outsourcing adds service levels, contingency testing, regulator cooperation, exit assistance, insurance, and specified data and processing locations. Client data is returned or destroyed on exit.

VARA Company Rulebook - Part IV Outsourcing Part IV, Section D · Timing: Provider breach notice to VASP: without undue delay

DFSA Processing for a controller needs a legally binding written agreement with set contents: subject matter, duration, nature and purpose, data types, data subject categories, and processor commitments.

DIFC Data Protection Law Art. 24(1), 24(5)

CBUAE Obtain a CBUAE notice of non-objection before outsourcing any activity whose disruption could significantly affect Critical Operations.

CBUAE Operational Risk Management Regulation Art. 13.5 · Timing: Before outsourcing

CBUAE The Master System of Record (all data, including personal data, needed to run Critical Operations) must be continuously maintained and stored in the UAE, including when activities are outsourced. Branches of foreign institutions may, with CBUAE approval, instead keep an up-to-date copy in the UAE.

CBUAE Operational Risk Management Regulation Art. 8.9 (definition: Art. 1.17)

CBUAE Prior CBUAE non-objection is needed to outsource any material activity, including to related parties. Core banking and key control functions (senior management oversight, risk, compliance, internal audit) are generally not permitted to be outsourced.

CBUAE Outsourcing Regulation for Banks Art. 8.1, 8.2 · Timing: Before outsourcing (no day count stated)

DFSA Inform the DFSA of any material outsourcing arrangement.

DFSA GEN outsourcing rules GEN 5.3.22(1) · Timing: No timing stated in the rule text

VARA Notify VARA in advance of any new or materially changed Material Outsourcing. VARA may object, and its concerns must be resolved first.

VARA Company Rulebook - Part IV Outsourcing Part IV, Section H.3-H.4 · Timing: In advance

CBUAE Do not expose personal data to an API provider until onboarding and due diligence are complete. Pen-test the institution's and API providers' systems.

Joint Guidelines for FIs Adopting Enabling Technologies Paras 3.7, 3.18 · Timing: Pen tests at least annually

CBUAE Resource third-party oversight. Minimum controls: an updated register of outsourced activities and third-party arrangements (for Critical Operations), performance and risk metrics, ongoing assessment including the provider's financial condition, and dependency management.

CBUAE Operational Risk Management Regulation Art. 13.9 (13.9.1-13.9.4)

FSRA Risk-rate providers to drive review frequency. Monitor KPIs, adverse news and ownership changes. Have a policy on onsite visits for overseas providers.

FSRA GEN outsourcing rules Dear SEO letter 29 Jan 2026

VARA Risk-assess each arrangement, including materiality. Due diligence covers capacity, financial soundness, reputation, regulatory status, reliance on subcontractors and virtual-asset expertise.

VARA Company Rulebook - Part IV Outsourcing Part IV, Section B · Timing: Assess before start and at least annually; review providers at least annually

Federal law Screen customers, counterparties, beneficial owners and related persons against the UAE Local Terrorist List and the UN Consolidated List. Subscribe to EOCN email alerts and re-screen immediately after each update.

Targeted Financial Sanctions regulation Art. 21 (screening) · Timing: Immediately after each list update

Federal law Freeze funds of listed persons without prior notice. Do not provide funds or services without EOCN permission.

Targeted Financial Sanctions regulation Art. 15 (freezing) · Timing: Without delay = within 24 hours of the listing decision

CBUAE For operational risk events that significantly affect, or may affect, Critical Operations (e.g. events that trigger BCP or DR, or materially affect customers, operations, profit or capital): first notify the CBUAE, naming the affected Critical Operations.

CBUAE Operational Risk Management Regulation Art. 15.2, 15.2.1 · Timing: Within 4 hours

CBUAE Send a summary report covering the event, the actions taken, the likely impact and the expected recovery timeframe.

CBUAE Operational Risk Management Regulation Art. 15.2.2 · Timing: Within 24 hours

CBUAE Notify the CBUAE when normal operations resume. The CBUAE may also set other notifications case by case.

CBUAE Operational Risk Management Regulation Art. 15.2.3, 15.2.4 · Timing: On return to normal operations

CBUAE Separate trigger: notify the CBUAE of any high-risk Incident, as defined by Board-approved classification criteria.

CBUAE Operational Risk Management Regulation Art. 15.3 · Timing: Within 72 hours

FSRA Notify the FSRA of a suspected material cyber incident immediately on discovery, with a 24-hour backstop for the initial report (Template A) emailed to incidents.fsra@adgm.com, copying the supervisor. Progress updates (Template B) follow at a frequency the supervisor sets.

FSRA Cyber Risk Management Rules GEN 3.5.18; GEN 8.10 · Timing: Immediately; no later than 24 hours (CP text: including weekends and public holidays)

VARA Report a material cybersecurity event, or an event that triggers the BCDR plan and materially affects operations, with its nature, scope, impact and mitigation, and whether other authorities were told.

VARA Technology and Information Rulebook Part I, Section K, para 1 · Timing: As soon as reasonably practicable, no later than 72 hours from detection

Government and critical sectors Entities must report threats, hacks, leaks, interceptions or risks to DESC.

Dubai Electronic Security Centre Law Art. 14(4) · Timing: Immediately

Federal law The controller reports a breach that harms privacy, confidentiality or security to the Data Office, with investigation results; data subjects may also need notice. Detailed timing awaits the Executive Regulations. Secondary source

UAE Personal Data Protection Law (PDPL) Art. 9 · Timing: Immediately on becoming aware (period to be set by Executive Regulations)

CBUAE For material changes to Critical Operations (which can include a change of provider): notify the CBUAE with an external expert's report, and obtain written no-objection before implementing.

CBUAE Operational Risk Management Regulation Art. 12.5.5, 12.5.6 · Timing: At least 30 calendar days before implementation

CBUAE Keep viable contingency and exit plans for third-party arrangements. The BCP must assess how hard the provider would be to substitute.

CBUAE Operational Risk Management Regulation Art. 13.11

CBUAE The CBUAE may require an arrangement, or a Critical Operation that relies too heavily on providers, to be discontinued.

CBUAE Operational Risk Management Regulation Art. 13.12

CBUAE Arrangements should allow the activity to move to another provider or back in-house without undue delay. Contingency plans and termination provisions are expected.

CBUAE Outsourcing Standards for Banks Standards s.2.1(3), 2.2(4), 5.1(7)

CBUAE Material cloud arrangements need tested continuity plans and specific exit plans.

Joint Guidelines for FIs Adopting Enabling Technologies Principles 2.18, 2.19

Government and critical sectors Background verification of contractors and third-party users before access, and revocation of access within 24 hours of exit.

ADHICS v2 HR 2.1; HR 4.3 · Timing: Revoke access within 24 hours of exit

CBUAE Board members carry ultimate responsibility for the operational risk and resilience framework, even where Board committees exist.

CBUAE Operational Risk Management Regulation Art. 4.1

CBUAE The full Board (not a committee) approves and reviews key operational risk and resilience strategies and policies, including risk appetite and disruption tolerance. The Board also approves the initial BCP and DR plans; their annual review may be delegated.

CBUAE Operational Risk Management Regulation Art. 4.2 · Timing: At least annually

CBUAE The bank stays fully responsible for outsourced risks. It needs a Board-approved materiality policy, Board or committee approval of material arrangements, conflict-of-interest management, and timely reporting of material risks to the Board.

CBUAE Outsourcing Regulation for Banks Art. 2.1, 2.5.1-2.5.4

CBUAE Keep BCP and DR plans for Critical Operations, with annual second- and third-line review and at least annual testing.

CBUAE Operational Risk Management Regulation Art. 11.1, 11.3, 11.10 · Timing: Test at least annually