United Arab EmiratesOperational Risk Management Regulation, ICT and cybersecurity management
Operational Risk Management Regulation (C 1/2026), Articles 8 and 9
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds every Licensed Financial Institution of the Central Bank of the UAE that is a juridical person, that is a bank, a (re)insurance company or another licensed financial institution (reached by declaring that you hold a financial-services license), from (Scope and Article 1.16).
- Implement a robust ICT and cybersecurity risk framework within your Operational Risk management framework and Operational Resilience approach, with policies, processes and systems for ICT risk identification and assessment, mitigation consistent with the assessed risk level, regular monitoring and testing of the mitigating measures, and ongoing proactive management of ICT and cybersecurity risks (Article 8.1).
- Have an ICT and cybersecurity policy that at a minimum addresses governance and oversight controls, risk ownership, accountability and compliance, ICT security measures such as access controls, identity management, network security, vulnerability testing and information classification, data management, ICT operations such as change management and patch management, and systems development and acquisition (Article 8.6).
- Review your ICT and cybersecurity risk management regularly and test it regularly to identify gaps against your Risk Tolerance (Article 8.7).
- Proactively manage the ICT and cybersecurity systems you operate or that Third-Party Service Providers operate or make available to you, and keep a strategy and timeline for renewing or discontinuing obsolete and unsupported hardware and software (Article 8.8).
- Keep your Master System of Record continuously maintained and stored within the UAE, including when you outsource (Article 8.9).
- Comply with the regulations on ICT, cyber and information security issued by the relevant authorities in the UAE (Article 8.10).
- Develop and implement Incident Response and Recovery Plans that cover ICT and cybersecurity Incidents, and regularly review, test and update them (Articles 9.1 and 9.2).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Article 168(1)(m) of the Federal Decree-Law lets the Central Bank fine a violating Licensed Financial Institution up to AED 1,000,000,000, alongside the other sanctions listed in Article 168(1).
- Rule
- Fixed only
- As of
- Currency
- AED
- Fixed cap
- 1,000,000,000
Who enforces it
Enforcement body
The Central Bank of the UAE, which may take supervisory action and impose administrative and financial sanctions for a violation of the Regulation.
What this law does
The Operational Risk Management Regulation applies to all Licensed Financial Institutions that are juridical persons. The Regulation defines a Licensed Financial Institution as Banks, (Re)Insurance Companies, and Other Financial Institutions licensed under the Central Bank Law. Article 8.1 of the Regulation requires a Licensed Financial Institution to implement a robust ICT and cybersecurity risk framework within its Operational Risk management framework and Operational Resilience approach.
Article 8.6 requires the ICT and cybersecurity policy to address, at a minimum, governance and oversight controls, risk ownership, accountability and compliance, and ICT security measures such as access controls, identity management, network security and vulnerability testing. Article 8.8 requires a Licensed Financial Institution to proactively manage its ICT and cybersecurity systems, including those operated or made available by Third-Party Service Providers.
Article 8.9 requires a Licensed Financial Institution's Master System of Record to be continuously maintained and stored within the UAE, including in the case of Outsourcing. Article 17.1 of the Regulation provides that a violation of any provision of the Regulation may be subject to supervisory action and administrative and financial sanctions as the Central Bank deems appropriate.
Article 168(1)(m) of the Federal Decree-Law on the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business lets the Central Bank impose a fine not exceeding one billion Dirhams on a violating Licensed Financial Institution. The Central Bank rulebook lists the Regulation as C 1/2026, effective from , with status In-Force.
When LexLint raises it
When your app profile says your app provides financial services.