Table of Contents
The new Operational Risk Management Regulation issued by the Central Bank of the UAE came into effect on September 14, 2026, marking a significant regulatory shift in how the UAE’s financial sector approaches risk — moving beyond the traditional focus on preventing operational losses towards building institutions capable of continuing operations, adapting, recovering and learning from disruptions.
Known as Regulation No. C 1/2026, the new framework applies to all licensed financial institutions with legal personality and is not limited to banks. It establishes minimum requirements for operational risk management and operational resilience, while giving the Central Bank the authority to impose additional requirements when deemed necessary, as well as issue further standards or detailed guidelines.
New regulation replaces previous rules and circulars
The new regulation repeals and replaces Circular No. 163/2018 on the Operational Risk Management Regulation and its standards.
This means the UAE financial sector is moving from a regulatory framework introduced about eight years ago to a broader system designed to address the changing nature of risks arising from digital transformation, growing reliance on technology and third-party service providers, escalating cyber threats and increasingly complex interconnections between financial institutions and digital infrastructure.
Three lines of defence against risk
Under the new Operational Risk Management Regulation, the framework reinforces the principle of the three lines of defence within financial institutions.
The first line consists of business units, which are responsible for continuously identifying and controlling risks.
The second line comprises risk management and compliance functions, providing relatively independent oversight and challenging decisions made by business units.
The third line is internal audit, which provides independent assurance on the effectiveness of the institution’s risk management framework and controls.
Financial institutions must also maintain an independent operational risk management function with adequate resources, headed by the Chief Risk Officer (CRO).
Its responsibilities include developing an independent view of material risks, assessing the effectiveness of internal controls, reviewing the operational risk profile, identifying threats and vulnerabilities affecting critical operations, as well as providing training and raising risk awareness.
Cybersecurity moves to the heart of operational risk management
With the financial sector becoming increasingly dependent on digital services, the new framework places information and communications technology (ICT) risk management and cybersecurity at the core of the operational risk framework.
Financial institutions are required to implement an effective ICT and cybersecurity risk framework covering risk identification and assessment, mitigation measures, incident response and recovery, change management, data and technology services, patch management, business continuity and disaster recovery plans.
These frameworks must also be reviewed regularly to ensure they remain aligned with industry standards, best practices, and new and emerging threats and technologies.
In practical terms, this means cybersecurity is no longer a standalone technical function separated from risk management. It has become a core component of an institution’s ability to continue delivering essential services.
Stress testing and penetration testing
The regulation requires financial institutions to conduct periodic operational risk stress tests, including control environment testing and penetration testing.
For critical functions, periodic testing must include a penetration test conducted by an independent external party, with the results presented to the board of directors.
The requirement is particularly significant as it shifts the focus from assessing risks on paper to testing an institution’s actual ability to deal with disruption scenarios.
An institution may have a comprehensive contingency plan on paper, but if it cannot execute that plan during a real crisis, it would not, under the philosophy of the new framework, meet the required standard of operational resilience.
Business continuity: From plans to testing
The regulation requires financial institutions to maintain business continuity and disaster recovery plans for critical operations and integrate those plans into their operational risk management and resilience frameworks.
The framework does not stop at requiring institutions to have plans in place. It also requires exercises to test business continuity and disaster recovery under severe but plausible scenarios, ensuring that institutions can maintain critical operations during disruptions.
This highlights a fundamental principle underpinning the regulation: readiness is not measured by the existence of a plan, but by an institution’s ability to execute it.
Four-hour deadline for reporting major incidents
One of the most sensitive requirements concerns tighter rules for reporting operational events.. If an event has, or is likely to have, a significant impact on the continuity and safety of critical operations, the financial institution must notify the Central Bank within four hours, identifying the critical operations affected.
Within 24 hours, the institution must submit a brief report outlining the nature of the event, the measures taken, the potential impact and the expected timeframe for restoring normal operations.
Once normal operations have resumed, the Central Bank must be notified accordingly, together with any additional information or notifications the regulator may request on a case-by-case basis.
Financial institutions must also notify the Central Bank within 72 hours of any high-severity incident, in accordance with the institution’s incident classification criteria.
Customer protection becomes part of risk management
The regulation also extends beyond protecting the financial institution itself… If operational changes result in customers receiving materially inaccurate information — including payment confirmations, debit or credit transactions, or account balances — the institution must provide customers with clear information explaining how their accounts or transactions have been affected.
The regulation makes the financial institution responsible for losses suffered by customers as a result of an institutional error, in accordance with the consumer protection regulations issued by the Central Bank.
This reflects an important regulatory direction: linking operational resilience and service continuity directly to consumer protection.
Internal and external fraud
Fraud is also incorporated into the new operational risk framework. Financial institutions are required to address and manage risks associated with both internal and external fraud, including incidents and ongoing threats affecting customers.
This means fraud management is no longer treated solely as a security or compliance issue. It is considered part of the broader operational risk framework and must be identified, assessed, monitored, reported and mitigated accordingly.
Penalties can extend to management and boards
The strength of these requirements lies in the fact that they are not voluntary guidelines. The framework is subject to regulatory enforcement.
The Central Bank states that violations of any provision of the regulation or its accompanying standards may result in supervisory measures and administrative or financial sanctions deemed appropriate by the regulator.
These measures may include the removal, replacement or restriction of the powers of senior management or board members; arrangements for temporary management of the institution; financial penalties; or the prohibition of individuals from operating in the UAE financial sector.
This significantly elevates accountability from being solely an institutional responsibility to one that also rests with senior management and the highest levels of governance.
Why the new framework now?
The new regulation can be viewed against the backdrop of the major transformation the financial sector has undergone in recent years.
Risks no longer arise solely from employee errors or failures in internal procedures. Modern financial institutions rely on complex digital networks, data centres, cloud solutions, specialised service providers, payment platforms, banking applications, artificial intelligence systems and data analytics, alongside increasingly interconnected institutions and markets.
As a result, the failure of a single technology provider, a cyberattack, a disruption to a payment system or an error in a system update can rapidly spread from one unit within an institution to its customers and then to other institutions — and potentially to parts of the wider financial system.
This is why the concept of operational resilience extends beyond managing risk within an individual institution to protecting the continuity of critical financial functions.
From the 2018 framework to the 2026 regime.
A comparison between the new regulation and the previous framework issued in 2018 clearly demonstrates the scale of the shift.
The previous framework focused on establishing policies, processes, procedures, systems and controls to identify, monitor and mitigate operational risks, while emphasising the ultimate responsibility of the board of directors.
The new regulation adds several more sophisticated layers, most notably:
● Operational resilience
● Identification of critical operations
● Mapping of interdependencies
● Cybersecurity
● Third-party risk management
● Stress testing and penetration testing
● Four-hour incident reporting
● Change management
● Customer protection
● Data governance
● Public disclosure
The evolution is therefore more than a technical update to the previous framework. It represents a broader redefinition of what it means for a financial institution to be capable of managing risk in a highly interconnected digital economy.
What does this mean for financial institutions?
In practical terms, financial institutions will need to undertake a broad review of their internal frameworks rather than simply update their risk management policy documents.
Key priorities are expected to include:
1. Reviewing governance frameworks and responsibilities, ensuring clear roles and authorities for the board, senior management, risk management and internal audit functions.
2. Reassessing critical operations, including the assets and resources on which they depend.
3. Reviewing dependency maps covering systems, data, employees and third-party service providers.
4. Testing business continuity and disaster recovery plans, rather than simply maintaining them.
5. Strengthening cybersecurity readiness and directly integrating it into operational resilience.
6. Reassessing third-party service providers, particularly those supporting critical operations.
7. Enhancing internal reporting systems to enable material incidents to be escalated rapidly to senior management, the board and the Central Bank.
8. Developing data and analytics capabilities to monitor risk indicators and provide early warnings.
9. Strengthening change management to ensure that digital transformation projects themselves do not become sources of operational risk.
10. Building a stronger risk culture, making risk management a shared institutional responsibility rather than the sole responsibility of the risk management function.
A broader reading: Protecting the financial system from a “chain of disruption”
The real significance of the new regulation may extend beyond individual institutions… The modern financial sector operates as an interconnected network. One institution may depend on a technology provider, which in turn relies on other infrastructure; payment systems may depend on shared networks; and customers are increasingly reliant on digital applications and services.
In such an environment, a risk that begins as a relatively small incident within one institution can quickly become a wider problem if it disrupts an essential service, compromises data or interrupts payment operations.
This appears to underpin a clear philosophy behind the new framework:
It is not enough for a financial institution to be sound when everything is operating normally. It must also demonstrate its ability to continue operating when conditions deteriorate.
This is precisely where the importance of the shift from [Operational Risk Management] towards a broader concept combining risk management and [Operational Resilience] becomes evident.
