The CBUAE operational risk management regulation (Circular C 1/2026) took effect on 14 September 2026 and applies to every CBUAE-licensed financial institution that is a juridical person. It requires notice to the Central Bank within 4 hours of a significant event affecting Critical Operations, a summary within 24 hours, and independent penetration testing of Critical Functions.
- In force: 14 September 2026, according to the CBUAE Rulebook entry for C 1/2026.
- Replaces: Circular No. 163/2018 and the Operational Risk Standards issued on 29 August 2018.
- Covers: banks, (re)insurance companies and other financial institutions licensed under the Central Bank Law, where they are juridical persons.
- Notification clock: 4 hours (initial notice), 24 hours (summary report), a further notice on return to normal, and 72 hours for any high-risk incident.
- Testing: penetration testing of at least Critical Functions by an independent third party, with results presented to the Board; BCP and DR plans for Critical Operations tested at least annually.
- Accountability: sanctions can reach board members and senior management individually.
The regulation is wider than cyber security. It treats outages, fraud, vendor failures and cyber attacks as one operational risk problem, measured by their effect on Critical Operations. For most institutions the hardest change is the 4-hour clock, which is why we recommend testing your plan with an incident response and digital forensics team in the UAE before a real event tests it for you. If you need the broader picture of CBUAE cyber expectations (governance, access control, monitoring), our guide to CBUAE cybersecurity requirements for UAE banks covers it; this article focuses only on what C 1/2026 adds.
What does the CBUAE operational risk management regulation change?
The 2018 framework was largely about identifying and controlling operational losses. C 1/2026 adds operational resilience as a formal requirement. Under Article 3, each institution must identify its Critical Operations and map the people, technology, data, facilities, intragroup entities and third-party providers needed to deliver them, and keep that mapping current through change management. The CBUAE Rulebook text lists a minimum set of Critical Operations:
- payment systems, payment services and other time-critical services;
- accurate, up-to-date financial records;
- measuring and managing solvency and liquidity;
- any operation the Central Bank designates as critical.
Article 4 puts ultimate responsibility on the Board, whether or not it has committees. The Board itself must approve, and review at least annually, the operational risk appetite and tolerance statement and its tolerance for disruption under severe but plausible scenarios. The Board must also approve the initial business continuity and disaster recovery plans and review them at least every three years, with a committee permitted to carry out the annual review. The independent operational risk function sits within risk management under the Chief Risk Officer (Article 6).
On timing, Article 20 says the regulation takes effect one month after publication in the Official Gazette. The Rulebook records the in-force date as 14 September 2026, and Gulf News reported the same date.
Who must comply with C 1/2026?
The scope section applies the regulation to Licensed Financial Institutions (LFIs) that are juridical persons. Article 1.16 defines an LFI as a bank, a (re)insurance company or another financial institution licensed under the Central Bank Law to carry on at least one Licensed Financial Activity. In practice that means:
- Banks, including those operating in the UAE through a branch or subsidiary. With CBUAE approval, branches of foreign banks may meet the data-location rule by keeping an up-to-date copy of the Master System of Record in the UAE (Article 8.9).
- Finance companies and other CBUAE-licensed institutions, because the definition covers any financial institution licensed under the Central Bank Law.
- (Re)insurers licensed by the CBUAE.
- Fintechs that hold a CBUAE licence for a Licensed Financial Activity and are juridical persons. A technology company that serves banks without its own CBUAE licence is not an LFI, but it is pulled in through its clients’ third-party obligations.
That last point matters for vendors. Under Article 13, institutions must hold viable contingency and exit plans for material third-party arrangements, and the Central Bank may require an institution to discontinue an arrangement, or a Critical Operation, that depends too heavily on a third party. Crowe UAE also notes the expectation that providers supporting Critical Operations have at least an equivalent level of operational resilience. Our banking and finance cybersecurity practice sees this reaching cloud, core banking and payment processors first.
What are the CBUAE incident reporting timelines?
Article 15 sets four separate notification duties. They run in parallel, so a single event can trigger more than one.
| Deadline | What the CBUAE expects | Article |
|---|---|---|
| Within 4 hours | Notice of an Operational Risk event that significantly affects, or may significantly affect, Critical Operations, identifying the Critical Operations affected | 15.2.1 |
| Within 24 hours | A summary covering the nature of the event, actions being taken, likely impact and the expected timeframe for return to normal operations | 15.2.2 |
| On return to normal | Notice that normal operations have resumed | 15.2.3 |
| Within 72 hours | Notice of any high-risk Incident, judged against criteria set in Board-approved policies | 15.3 |
Three features catch institutions out. First, the 4-hour trigger is impact on Critical Operations, not the word “cyber”. A failed core banking upgrade, a card processor outage or a large fraud event can start the clock as easily as ransomware. Second, the trigger includes events that may significantly affect Critical Operations, so waiting for confirmed impact is risky. Third, the 72-hour track depends on your own Board-approved classification criteria. Article 9.4.1 expects severity to be classified against predefined criteria such as impact and expected time to return to normal, so weak criteria leave you exposed on both tracks.
Article 9 also requires an incident register, an inventory of internal and third-party response resources, communication arrangements that include the Central Bank, and root cause analysis of all material incidents.
What does the regulation require for penetration testing and resilience testing?
Penetration testing of Critical Functions
Article 7.13 requires periodic operational risk stress tests, including exercises such as penetration testing, covering ICT, physical controls, people-dependent controls and other risk vectors. Article 7.14 goes further: for at least Critical Functions, penetration testing must be carried out by an independent third party, and the results must be presented to the Board. The text we reviewed calls the testing “periodic” and does not fix a frequency, so set one in policy and be ready to justify it.
Note the two defined terms. Critical Functions (Article 1.8) are activities whose discontinuance could disrupt financial stability or essential economic services. Critical Operations (Article 1.10) are wider and include the Critical Functions plus the processes, services and assets that support them. Scope your independent tests from the Critical Functions list, then extend testing to the supporting assets in your Critical Operations map. Because Article 7.13 names physical and people-dependent controls, a network-only test will not cover the whole requirement. Our penetration testing guide for UAE organisations explains how to scope testers and methods.
Business continuity and incident response testing
- BCP and DR plans for Critical Operations must be tested regularly and at least annually, including key third-party providers where relevant, with results reported to the Board and Senior Management (Article 11.10).
- Exercises must use a range of severe but plausible scenarios (Article 11.11).
- Incident response and recovery plans must be regularly tested and updated (Article 9.2).
- Protection, detection, response and recovery programmes for ICT and cyber risk must be regularly tested (Article 8.5).
Which other obligations land on the security and IT teams?
- Data location: the Master System of Record must be continuously maintained and stored in the UAE, including where activities are outsourced (Article 8.9).
- Legacy technology: a strategy and timeline for renewing or retiring obsolete or unsupported systems, including those supplied by third parties (Article 8.8).
- Material change: for material changes to Critical Operations, an external expert must give independent assurance, the CBUAE must receive notice and the expert’s report at least 30 calendar days before implementation, and the institution needs the Central Bank’s written no-objection (Article 12.5).
- Customer impact: if a change produces materially erroneous information such as incorrect balances, the institution must explain how accounts were affected and help correct them, and it is liable for customer damage caused by its errors (Article 12.6).
- Disclosure: public disclosures must include the institution’s practices on protecting personal data (Article 16.4).
Trowers & Hamlins also notes that banks and (re)insurers must submit an annual internal controls report to both the Board and the CBUAE.
Test your clock before the CBUAE does. Our incident response team runs a C 1/2026 notification tabletop: a simulated event against your Critical Operations map, timed to the 4-hour and 24-hour deadlines, with a written gap report for the CRO and Board. Book a notification readiness tabletop with our incident response and digital forensics team.
How do you meet the 4-hour notification deadline? A readiness playbook
The regulation sets the deadlines; it does not tell you how to split the time. The internal timings below are our recommendation. Start the internal clock at detection, which is the conservative reading.
| Clock | Action | Owner | Output |
|---|---|---|---|
| T+0 | Log the event in the incident register, timestamp detection and open the incident bridge | SOC lead or incident manager | Register entry (Art. 9.4) |
| T+0 to T+1h | Check the event against the Critical Operations map: which operations are affected, or may be | Incident manager with business owners | List of affected Critical Operations (Art. 3.4) |
| T+1h to T+2h | Apply the severity criteria and decide whether the significant-impact threshold is met; escalate to the CRO; senior management alerts the Board as the resilience strategy requires | CRO | Recorded notification decision (Art. 9.4.1, 3.3) |
| T+2h to T+3h | Complete the pre-approved initial notice: what happened, affected Critical Operations, current status, named contact | Compliance with legal | Draft initial notice |
| T+3h to T+4h | Approve and submit through the agreed supervisory channel; record the time sent | Pre-delegated approver | Initial notice sent (Art. 15.2.1) |
| T+4h to T+24h | Gather facts for the summary; preserve forensic evidence; confirm recovery estimate with IT and vendors | Incident response lead | 24-hour summary (Art. 15.2.2) |
| By T+72h | If the incident meets the Board-approved high-risk criteria, send the high-risk notice | Compliance | 72-hour notice (Art. 15.3) |
| Recovery | Notify return to normal; complete root cause analysis and lessons learned; update the register and plans | CRO and incident response lead | Closure notice and RCA (Art. 15.2.3, 9.2) |
What must be in place before the event?
- A current Critical Operations map that the incident team can read in minutes, not a spreadsheet only the risk team understands.
- Severity and high-risk classification criteria approved by the Board.
- Initial notice and 24-hour summary templates, pre-approved by compliance and legal.
- Written delegation so someone can approve a notice at 3am on a public holiday.
- Contract clauses requiring key third parties to tell you about incidents fast enough for you to meet 4 hours.
- An incident response plan written for UAE organisations that references these timelines rather than the 2018 rules.
What happens if an institution falls short?
Article 17 allows supervisory action for breaches of the regulation or its Standards. Available measures include removing or restricting the powers of senior management or board members, appointing interim management, imposing fines and barring individuals from the UAE financial sector. Gulf News reported the same range of penalties when the regulation took effect. The personal reach of these sanctions is the main reason boards are asking for evidence, not assurances, that the 4-hour process works.
Where C 1/2026 sits alongside other obligations, such as data protection breach notification, map each duty once and run them from one incident process. Our regulatory compliance advisory for UAE, GCC and EU rules can build that combined register. This article is general information, not legal advice.
Ready to check your position? We review your incident response plan, classification criteria and Critical Operations map against Articles 3, 9 and 15 of C 1/2026 and give you a prioritised fix list. Contact our team to arrange a C 1/2026 incident readiness review.
Frequently Asked Questions
When did the CBUAE Operational Risk Management Regulation take effect?
The CBUAE Rulebook lists Circular C 1/2026 as in force from 14 September 2026. Article 20 provides that it takes effect one month after publication in the Official Gazette. It cancels and replaces Circular No. 163/2018 and the Operational Risk Standards issued in August 2018, so policies written against the 2018 rules should be updated.
Does C 1/2026 apply to fintech companies?
It applies to any Licensed Financial Institution that is a juridical person, which includes financial institutions licensed under the Central Bank Law to carry on a Licensed Financial Activity. A fintech with such a licence is in scope. A technology vendor without its own CBUAE licence is not, but its bank and finance company clients must manage it as a third party under Article 13.
Is the 4-hour notification only for cyber incidents?
No. The trigger is any Operational Risk event that significantly affects, or may significantly affect, Critical Operations. That includes system failures, failed changes, fraud and third-party outages as well as cyber attacks. The notice must identify which Critical Operations are affected, so institutions need an up-to-date Critical Operations map to meet the deadline.
Who must carry out penetration testing under the regulation?
Article 7.14 requires penetration testing of at least Critical Functions to be performed by an independent third party, with results presented to the Board. Article 7.13 adds periodic stress testing, including penetration testing, across ICT, physical and people-dependent controls. The text describes the testing as periodic rather than setting a fixed frequency.
How often must business continuity plans be tested?
Article 11.10 requires BCP and disaster recovery plans to be tested regularly and at least annually for Critical Operations, including key third-party providers where relevant. Results go to the Board and Senior Management. Article 11.11 requires exercises under a range of severe but plausible scenarios, so a simple failover test is unlikely to be enough on its own.
What penalties can the CBUAE impose for non-compliance?
Article 17 allows supervisory action for breaches. Measures include removing or restricting senior management or board members, appointing interim management, imposing fines and barring individuals from the UAE financial sector. Because sanctions can apply to individuals, boards increasingly want tested evidence that notification and resilience processes work.