New Central Bank operational risk regulation in force
Circular C 1/2026, the Operational Risk Management Regulation, has applied since 14 September 2026 and replaces the 2018 regime. It brings hard deadlines for incident notification, a UAE data residency rule, and prior Central Bank sign-off for material changes and critical outsourcing.
Central Bank licensees now run operational risk under Circular C 1/2026, the Operational Risk Management Regulation, which replaces the 2018 regime. The CBUAE Rulebook shows it in force from 14 September 2026. It "applies to all Licensed Financial Institutions that are juridical persons", which the regulation defines as banks, (re)insurance companies and other financial institutions licensed under Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business. The title undersells it. There are detailed chapters on operational resilience, ICT and cyber risk, incidents and third parties.
What the rules say
Circular No. 163/2018, the Operational Risk Regulation, and the Operational Risk Standards issued on 29 August 2018 are cancelled and replaced (Article 19). The new regulation runs to twenty articles, with a non-binding annex of risk assessment tools.
| Article | Subject | Core requirement |
|---|---|---|
| 2 | Framework | A documented framework to identify, assess, monitor, report and mitigate operational risk, including fraud |
| 3 | Operational resilience | A resilience strategy, mapping of Critical Operations and their dependencies, and contingency plans |
| 4 and 5 | Board and Senior Management | Ultimate responsibility with the Board; Senior Management implements and reports |
| 6 and 7 | Risk function and controls | An independent operational risk function under the Chief Risk Officer; three lines of defence |
| 8 | ICT and cyber | The Master System of Record must be "continuously maintained and stored within the UAE", including where outsourced |
| 9 and 10 | Incidents and risk data | Incident response plans, root-cause analysis, an incident register and reliable loss data |
| 11 | Business continuity | Plans covering severe scenarios, tested at least annually |
| 12 | Change management | Enhanced controls for material Changes in Operations |
| 13 | Third parties | Board-approved strategy; Central Bank non-objection for certain outsourcing |
| 15 and 16 | Reporting and disclosure | Event notification deadlines; public disclosure on operational risk |
Several provisions carry hard requirements. Before a material Change in Operations, an institution must procure an external expert to give independent assurance, notify the Central Bank with the expert's report at least 30 calendar days in advance, and obtain written no-objection before implementation (Article 12.5). Before outsourcing any activity that could, if disrupted, have a significant impact on its Critical Operations, it must obtain a notice of non-objection (Article 13.5).
Article 15 sets the clock for events that significantly affect, or may affect, Critical Operations. The institution notifies the Central Bank within 4 hours, provides a summary report within 24 hours, and notifies again on return to normal operations. High-risk incidents must be notified within 72 hours, with the high-risk criteria defined in Board-approved policies. Senior Management of banks and (re)insurance companies must also assess internal controls at least annually and give the report to the Board and the Central Bank (Article 5.6).
Breaches can lead to supervisory action and administrative or financial sanctions (Article 17).
Who is affected
Every Central Bank licensee that is a legal person: banks, insurers and reinsurers, and other financial institutions licensed under the Central Bank Law. Branches of foreign financial institutions may, with Central Bank approval, keep an up-to-date copy of the Master System of Record in the UAE (Article 8.9). The regulation is written for Central Bank licensees. A firm licensed only by another regulator is outside its stated scope.
Key dates
| Date | Event |
|---|---|
| 29 August 2018 | Previous Operational Risk Standards issued (now cancelled) |
| 14 September 2026 | Circular C 1/2026 in force, according to the CBUAE Rulebook |
What it means in practice
The regulation makes operational risk a supervisory gate for business decisions. Moving core systems, changing a major outsourcing provider or launching new operations can mean going to the Central Bank first. For a material change, add an external expert's report and a 30-day notice period.
Take a hypothetical Central Bank-licensed finance company that plans to migrate its core lending platform to a cloud provider. It should treat the project as a potential material Change in Operations. Then it should assess whether the outsourcing touches Critical Operations, confirm that its Master System of Record stays in the UAE, and build the notice period and external review into the timetable.
For groups deciding where to place a regulated entity, the data residency rule and the incident deadlines are the practical points. Reporting within 4 hours needs escalation lines that work at night and at weekends, not only in office hours.
What we do not yet know
The Rulebook page shows no separate issue or publication date, and the regulation has no transitional provision. The Central Bank will prescribe the format of the "regular reporting requirements" mentioned in Article 15.5 separately.
This piece appeared in Jurisdicta, Issue 002. General information only; not legal, tax or investment advice.