UAE overhauls bank risk rules: 4-hour reporting, cyber tests and tougher penalties

The Central Bank of the UAE introduced Regulation No. C 1/2026 on September 14, 2026, ushering in a new era of risk management for the nation's financial institutions. This overhaul marks a departure from traditional risk prevention strategies to a more proactive approach, preparing institutions for operation continuity, adaptation, recovery, and learning from disruptions.

The regulation applies to all licensed financial entities with legal personhood and must adhere to minimum operational risk management and resilience standards, with the Central Bank empowered to impose additional requirements and guidelines as needed.

The Operational Risk Management Regulation introduces a three-tiered defense system within financial institutions, consisting of business units, risk management and compliance functions, and internal audit. These three lines of defense work together to identify, control, and mitigate risks, with the Chief Risk Officer (CRO) leading the independent operational risk management function. This structure encourages continuous risk identification, independent oversight, and rigorous risk assessment.

Cybersecurity is now firmly embedded in operational risk management, with financial institutions required to implement an effective ICT and cybersecurity risk framework. This includes risk identification, mitigation measures, incident response, recovery, change management, data and technology services, patch management, business continuity, and disaster recovery plans. These frameworks must be regularly reviewed to ensure alignment with industry standards and emerging threats.

Stress testing and penetration testing are pivotal components of the new regulation. Financial institutions must conduct periodic operational risk stress tests, including control environment testing and penetration testing. For critical functions, this necessitates independent external penetration tests, with results shared with the board of directors. This shift emphasizes the importance of practical resilience, rather than theoretical preparedness, in handling disruption scenarios.

The regulation also mandates the creation and testing of business continuity and disaster recovery plans. These are not merely documents but must be exercised under severe but plausible scenarios to ensure that institutions can maintain critical operations during disruptions. In line with this principle, reporting major incidents is streamlined, with financial institutions required to notify the Central Bank within four hours of any significant event that could compromise the continuity and safety of critical operations.