Is an insurer, in the United Arab Emirates

ADGM General Rulebook (GEN), Rule 3.5.18 · Read the law's page

• This binds an Authorised Person under the Abu Dhabi Global Market General Rulebook, a firm authorised by the ADGM Financial Services Regulatory Authority (reached by declaring that you hold a financial-services license), from 31 January 2026.
• Notify the Regulator immediately, and in any event no later than 24 hours, after you become aware or have information which reasonably suggests that a material Cyber Incident has occurred (Rule 3.5.18).
• Notification should use the prescribed incident reporting form available on the relevant electronic portal (Rule 3.5.18).
• Review your Cyber Incident Response Plan after a material Cyber Incident that is reportable under Rule 3.5.18 (Rule 3.5.16(4)).

ADGM General Rulebook (GEN), Rules 3.5.1 to 3.5.17 · Read the law's page

• This binds an Authorised Person under the Abu Dhabi Global Market General Rulebook, a firm authorised by the ADGM Financial Services Regulatory Authority (reached by declaring that you hold a financial-services license), from 31 January 2026.
• Establish and maintain a written Cyber Risk Management Framework approved by your Governing Body, with systems and controls proportionate to the nature, scale and complexity of your activities, and review it regularly and at least annually (Rule 3.5.1).
• Keep a current inventory of your ICT Assets and assess the Cyber Risk associated with them regularly and no less than annually (Rule 3.5.4).
• Establish a process for software updates that addresses security vulnerabilities in your ICT Assets, applies updates in a timely manner and prioritises critical updates (Rule 3.5.10).
• Implement appropriate encryption techniques to protect the confidentiality and integrity of information in transit, at rest, and at end of life (Rule 3.5.11).
• Monitor the effectiveness of your cyber systems and controls, run a comprehensive programme to test the resilience of your IT Systems and Networks regularly and, for internet-facing systems, at least annually, and prioritise and remedy adverse testing outcomes (Rule 3.5.14).
• Continuously monitor your IT Systems and Networks to detect Cyber Incidents and anomalies, and keep a process for escalating actual or potential Cyber Incidents (Rule 3.5.15).
• Establish and maintain a written Cyber Incident Response Plan, test its conditions and procedures regularly, and review it at least annually (Rule 3.5.16).

Operational Risk Management Regulation (C 1/2026), Articles 8 and 9 · Read the law's page

• This binds every Licensed Financial Institution of the Central Bank of the UAE that is a juridical person, that is a bank, a (re)insurance company or another licensed financial institution (reached by declaring that you hold a financial-services license), from 14 September 2026 (Scope and Article 1.16).
• Implement a robust ICT and cybersecurity risk framework within your Operational Risk management framework and Operational Resilience approach, with policies, processes and systems for ICT risk identification and assessment, mitigation consistent with the assessed risk level, regular monitoring and testing of the mitigating measures, and ongoing proactive management of ICT and cybersecurity risks (Article 8.1).
• Have an ICT and cybersecurity policy that at a minimum addresses governance and oversight controls, risk ownership, accountability and compliance, ICT security measures such as access controls, identity management, network security, vulnerability testing and information classification, data management, ICT operations such as change management and patch management, and systems development and acquisition (Article 8.6).
• Review your ICT and cybersecurity risk management regularly and test it regularly to identify gaps against your Risk Tolerance (Article 8.7).
• Proactively manage the ICT and cybersecurity systems you operate or that Third-Party Service Providers operate or make available to you, and keep a strategy and timeline for renewing or discontinuing obsolete and unsupported hardware and software (Article 8.8).
• Keep your Master System of Record continuously maintained and stored within the UAE, including when you outsource (Article 8.9).
• Comply with the regulations on ICT, cyber and information security issued by the relevant authorities in the UAE (Article 8.10).
• Develop and implement Incident Response and Recovery Plans that cover ICT and cybersecurity Incidents, and regularly review, test and update them (Articles 9.1 and 9.2).

Operational Risk Management Regulation (C 1/2026), Articles 9.4.4 and 15 · Read the law's page

• This binds every Licensed Financial Institution of the Central Bank of the UAE that is a juridical person, that is a bank, a (re)insurance company or another licensed financial institution (reached by declaring that you hold a financial-services license), from 14 September 2026 (Scope and Article 1.16).
• Notify the Central Bank of any Operational Risk event that significantly impacts or may significantly impact the continuity or integrity of Critical Operations, in particular any event that triggers or is likely to trigger your business continuity or disaster recovery plans, or has or is likely to have a material impact on your customers, operations, profitability or capital (Article 15.2).
• Within 4 hours of such an event, notify the Central Bank of the event and which Critical Operations are affected (Article 15.2.1).
• Within 24 hours of such an event, give the Central Bank a summary report of the nature of the event, the actions being taken, the likely impact and the timeframe for returning to normal operations, and notify the Central Bank when you return to normal operations (Articles 15.2.2 and 15.2.3).
• Notify the Central Bank within 72 hours of any high-risk Incident, applying criteria for categorising an Incident as high risk that your Board-approved policies define (Article 15.3).
• Include in your Incident Response and Recovery Plans communication plans to report Incidents, including to the Central Bank and other authorities where required (Article 9.4.4).

CBUAE Consumer Protection Standards (N 1158/2021) · Read the law's page

• It reaches you if you are a Licensed Financial Institution, meaning a bank or other financial institution licensed by the Central Bank of the UAE under Decretal Federal Law 14 of 2018 to carry on a licensed financial activity, and you provide Financial Products and/or Services to Consumers who are Natural Persons or Sole Proprietorships (Regulation, Scope of Application and Article 1; Standards, Introduction): when you reject a Consumer's application for a Financial Product and/or Service, disclose the reason for the rejection to the applicant, except where the reason is related to Financial Crime Compliance risks or as may be prohibited by law (Standard 2.1.1.26).
• When you decrease the credit limit on a card or close the card for business reasons, provide the Consumer with a notice and the reason for the limit decrease or closure (Standard 7.1.3.6).
• Ensure that a written response is provided to the Consumer on your decision regarding a Complaint, including full and complete reasons for the decision, subject to lawful obligations (Standard 8.1.1.4(e)).
• When a Consumer has verbally expressed dissatisfaction with a Financial Product and/or Service and frontline staff cannot resolve the matter to the Consumer's satisfaction, inform the Consumer of the right to file a written Complaint through your Complaint management process (Standard 8.1.2.1).
• Have in place a Consumer Complaint Management function situated in the UAE that is independent of the management of Retail Operations and monitors and reports the timed performance of the Complaint process quarterly to Senior Management (Standards 8.1.1.1, 8.1.1.2 and 8.1.1.4(g)).

DFSA Rulebook, General Module (GEN), Rule 5.5.19 · Read the law's page

• This binds an Authorised Person under the Dubai Financial Services Authority Rulebook in the Dubai International Financial Centre (reached by declaring that you hold a financial-services license).
• Notify the DFSA as soon as reasonably practicable, and in any event no later than 72 hours, after you become aware or have information which reasonably suggests that a material Cyber Incident has occurred, using the appropriate form on the DFSA electronic portal (Rule 5.5.19).
• Investigate a detected potential or actual Cyber Incident to determine its nature and extent (Rule 5.5.18).

DFSA Rulebook, General Module (GEN), Rules 5.5.2 to 5.5.18 · Read the law's page

• This binds an Authorised Person under the Dubai Financial Services Authority Rulebook in the Dubai International Financial Centre (reached by declaring that you hold a financial-services license).
• Establish and maintain a written Cyber Risk Management Framework approved by your Governing Body, with systems and controls appropriate to the nature, scale and complexity of your activities, and review it periodically and at least annually (Rule 5.5.2).
• Manage Third-Party Cyber Risk as an integral part of your framework (Rule 5.5.3).
• Establish a process for the management of software updates that addresses security vulnerabilities in your ICT Assets and applies updates in a timely manner (Rule 5.5.11).
• Monitor your IT Systems and Networks continuously to detect Cyber Incidents and anomalies, and keep a process for escalating actual or potential Cyber Incidents (Rule 5.5.16).
• Draw up and maintain a written Cyber Incident Response Plan, test its conditions and procedures regularly, and review it at least annually and after a major Cyber Incident (Rule 5.5.17).
• Investigate a detected potential or actual Cyber Incident to determine its nature and extent, and take immediate action to contain it (Rule 5.5.18).