UAE Central Bank redraws operational risk management rules for financial sector

The Central Bank of the UAE has introduced new regulations to overhaul the operational risk management approach in the financial sector, effective from September 14, 2026. The new Regulation No. C 1/2026 supersedes the previous Circular No. 163/2018, aiming to enhance the sector's ability to withstand and recover from disruptions, adapt to the evolving risk landscape, and incorporate cybersecurity into its core risk framework.

The regulation establishes a framework based on the three lines of defence model. The first line is comprised of business units that identify and control risks. The second line consists of risk management and compliance functions that provide independent oversight, while the third line is internal audit that offers assurance on the effectiveness of the institution's risk management framework.

A key feature of the new regulation is the emphasis on operational resilience, which is crucial in the current era of digital transformation and increasing cyber threats. Financial institutions must now engage in periodic operational risk stress tests, including control environment testing and penetration testing, to assess their ability to withstand real-life disruption scenarios. Additionally, institutions must conduct penetration tests by independent external parties for critical functions.

Reporting of major incidents requiring a significant impact on critical operations has also been tightened, with a mandatory notification to the Central Bank within four hours of such an event, followed by a detailed report within 24 hours. This swift reporting mechanism ensures that the Central Bank is informed promptly of potential disruptions to the financial sector.

In essence, these new regulations move the UAE financial sector from a reactive stance towards risk prevention to a proactive stance focused on maintaining operational continuity, adapting to changing risks, and fostering resilience in the face of disruptions.