The Central Bank of the UAE has put its Operational Risk Management Regulation, C 1/2026, into force for licensed financial institutions, effective on 14 September 2026.
Under Article 15.2, an institution must notify the Central Bank within four hours of an operational risk event that significantly impacts, or may significantly impact, the continuity or integrity of its Critical Operations, including which operations are affected. A summary report on the nature of the event, the actions being taken, the likely impact and the timeframe for recovery is due within 24 hours.
High-risk incidents must be reported within 72 hours, under criteria set in board-approved policies.
The regulation requires a board-approved operational resilience strategy, board oversight of ICT and cybersecurity risk management, and a board-approved strategy for third-party risk. Institutions must obtain a notice of non-objection before outsourcing any activity whose disruption could significantly affect Critical Operations, and must keep their Master System of Record in the UAE.