United Arab EmiratesOperational Risk Management Regulation, notification of significant events and high-risk Incidents
Operational Risk Management Regulation (C 1/2026), Articles 9.4.4 and 15
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds every Licensed Financial Institution of the Central Bank of the UAE that is a juridical person, that is a bank, a (re)insurance company or another licensed financial institution (reached by declaring that you hold a financial-services license), from (Scope and Article 1.16).
- Notify the Central Bank of any Operational Risk event that significantly impacts or may significantly impact the continuity or integrity of Critical Operations, in particular any event that triggers or is likely to trigger your business continuity or disaster recovery plans, or has or is likely to have a material impact on your customers, operations, profitability or capital (Article 15.2).
- Within 4 hours of such an event, notify the Central Bank of the event and which Critical Operations are affected (Article 15.2.1).
- Within 24 hours of such an event, give the Central Bank a summary report of the nature of the event, the actions being taken, the likely impact and the timeframe for returning to normal operations, and notify the Central Bank when you return to normal operations (Articles 15.2.2 and 15.2.3).
- Notify the Central Bank within 72 hours of any high-risk Incident, applying criteria for categorising an Incident as high risk that your Board-approved policies define (Article 15.3).
- Include in your Incident Response and Recovery Plans communication plans to report Incidents, including to the Central Bank and other authorities where required (Article 9.4.4).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Article 168(1)(m) of the Federal Decree-Law lets the Central Bank fine a violating Licensed Financial Institution up to AED 1,000,000,000, alongside the other sanctions listed in Article 168(1).
- Rule
- Fixed only
- As of
- Currency
- AED
- Fixed cap
- 1,000,000,000
Who enforces it
Enforcement body
The Central Bank of the UAE, which may take supervisory action and impose administrative and financial sanctions for a violation of the Regulation.
Settledness
- As of
- Open questions
- Does an Incident that is not an Operational Risk event significantly impacting Critical Operations fall under the 4-hour notice of Article 15.2.1, or only under the 72-hour notice of Article 15.3 when it is high risk?
What this law does
The Operational Risk Management Regulation applies to all Licensed Financial Institutions that are juridical persons. Article 15.2 requires a Licensed Financial Institution to notify the Central Bank of any Operational Risk events that significantly impact or may significantly impact the continuity or integrity of Critical Operations. Article 15.2.1 requires the notice of such an event to the Central Bank within 4 hours, including what Critical Operations are affected.
Article 15.2.2 requires a summary report to the Central Bank within 24 hours of the nature of the event, the actions being taken, the likely impact and the timeframe for returning to normal operations. Article 15.3 requires a Licensed Financial Institution to notify the Central Bank within 72 hours of any high-risk Incident. The Regulation defines an Incident as an event that has or could potentially have an adverse effect on Critical Operations, or on Critical Information Assets.
Article 9.1 states that the Incidents a Licensed Financial Institution's response and recovery plans must cover include ICT and cybersecurity Incidents. Article 9.4.4 requires incident management to include communication plans to report incidents to internal and external stakeholders, including to the Central Bank and other authorities where required.
Article 17.1 of the Regulation provides that a violation of any provision of the Regulation may be subject to supervisory action and administrative and financial sanctions as the Central Bank deems appropriate. Article 168(1)(m) of the Federal Decree-Law on the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business lets the Central Bank impose a fine not exceeding one billion Dirhams on a violating Licensed Financial Institution. The Central Bank rulebook lists the Regulation as C 1/2026, effective from , with status In-Force.
When LexLint raises it
When your app profile says your app provides financial services.