UAE Central Bank tightens operational risk rules for banks and financial institutions

The UAE Central Bank's new Operational Risk Management Regulation came into force on September 14, 2026, establishing stricter requirements for banks and licensed financial institutions to manage technology failures, cyberattacks, fraud, system failures and third-party disruptions.

The regulation requires institutions to establish comprehensive contingency plans and identify "critical operations" whose disruption could cause significant harm to customers, the institution itself or the financial system. Critical operations include transfers and payments, account access and salary processing, card operations and other essential services.

Institutions must define disruption tolerance levels for each critical operation, specifying the maximum acceptable duration of an interruption and the level of impact that can be tolerated.

The regulation places direct responsibility for operational risk and resilience on the institution's board of directors, which must approve strategies, policies and risk appetites. Senior management is responsible for implementing these policies and ensuring appropriate systems, resources and qualified personnel are available.

Requirements cover information technology risk management and cybersecurity, system and data protection, vulnerability monitoring, and business continuity and disaster recovery testing. Institutions must also manage the entire incident lifecycle from detection through to service recovery and root-cause analysis.

Institutions must notify the Central Bank promptly of any significant deviation from requirements or major incidents. Responsibility for service security and continuity remains with the institution even when operations are outsourced to technology providers, cloud-computing companies or payment processors.

For customers, the regulation is expected to reduce the likelihood and duration of service disruptions, accelerate service recovery and strengthen data protection.