On 14 September 2026, the Central Bank of the UAE's Operational Risk Management Regulation (C 1/2026) came into force. It replaces the 2018 Operational Risk Regulation and Standards (Circular 163/2018) and, for the first time, puts operational resilience, business continuity, disaster recovery and incident notification into one binding regulation for every Licensed Financial Institution the Central Bank supervises.
This guide summarises what the regulation requires for continuity and resilience, the evidence that shows it is met, and where most programmes will need work. It is our reading of the official text in the CBUAE Rulebook; work from the regulation itself for compliance decisions.
Who it applies to
The regulation applies to all Licensed Financial Institutions (LFIs) that are juridical persons. The definition covers banks, insurance and reinsurance companies, and other financial institutions licensed by the Central Bank, including those operating under Islamic Shari'ah principles, and branches and subsidiaries in the UAE of institutions incorporated elsewhere.
Firms licensed in the DIFC or ADGM by the DFSA or the FSRA operate under those authorities' own rulebooks, which carry their own business continuity rules. Confirm with your regulator which regime applies to each entity.
What changed from the 2018 regulation
The 2018 framework was an operational risk regulation with continuity as one topic within it. C 1/2026 makes operational resilience an explicit objective, defined as the ability to deliver Critical Operations through disruption: identifying and protecting against threats, then responding, adapting, recovering and learning.
In practice, that adds four obligations most programmes will need to evidence afresh:
- A tolerance for disruption, approved by the Board, tested against severe but plausible scenarios.
- A mapping of every Critical Operation to the assets that deliver it.
- Hard notification deadlines to the Central Bank: 4 hours, 24 hours and 72 hours.
- Annual testing of business continuity and disaster recovery plans for Critical Operations.
Critical Operations and the mapping requirement
Article 3 requires each LFI to identify its Critical Operations and all assets required to deliver them: people, technology, processes, data, facilities and third-party service providers, including intragroup entities, and the interdependencies between them. The mapping must be formalised for each Critical Operation and kept current through change management.
At a minimum, Critical Operations include:
- the continued operation of payment systems, payment services and other time-critical customer services;
- maintaining accurate, up-to-date financial records for customers and the institution;
- measuring and managing solvency and liquidity in a timely way; and
- any operation the Central Bank deems critical.
This mapping is the backbone of everything else. Article 11 requires business continuity and disaster recovery plans to "leverage and refer to" it, and Article 9 requires incident management to cover every Critical Operation in it.
Plans: incident response, business continuity and disaster recovery
Article 3.6 requires three plans for all Critical Operations, developed proactively and reviewed regularly:
- Incident response plans to detect, respond to and recover from incidents, cyber incidents included.
- A business continuity plan setting out the procedures and systems needed to continue or restore operations.
- A disaster recovery plan for prolonged or permanent unavailability of assets.
Article 11 then sets what the BC and DR plans must contain:
| Requirement | Article |
|---|---|
| Disruption scenarios and how they affect Critical Operations, including interdependencies and loss of key staff | 11.4 |
| Scenarios ranging from recoverable outages to permanent loss of major assets | 11.5 |
| A quantitative and qualitative impact assessment or BIA per scenario, separating financial, operational, legal and reputational impact | 11.6 |
| Clear activation triggers, such as thresholds for maximum tolerable disruption | 11.7 |
| Measurable recovery time and recovery point objectives that reflect the Board's tolerance for disruption | 11.8 |
| Communication arrangements for the Board, Senior Management, staff, the Central Bank and other authorities, customers, the public and third parties | 11.9 |
Testing and review
Two review cycles and one testing cycle apply to Critical Operations:
- The second and third lines review the plans at least once a year. The regulation names the operational risk management function and internal audit (11.3).
- Plans are tested at least annually, including key third-party service providers where relevant, with results reported to the Board and Senior Management (11.10).
- Exercises run under a range of severe but plausible scenarios to test the ability to deliver Critical Operations through disruption (11.11).
Board responsibilities
The Board, not a Board committee, must approve and review at least annually the institution's operational risk appetite and tolerance, its tolerance for disruption, and its business continuity and disaster recovery plans (4.2). The Board may delegate the annual review of the BC and DR plans to a committee, but it must approve the initial plans itself and review them at least every three years.
Institutions designated as systemically important must have a Board operational risk committee or another designated Board committee for operational risk (4.9).
Incident management and notification
Article 9 requires incident response and recovery plans that cover the full incident life cycle:
- severity classification against predefined criteria;
- response and recovery procedures linked to the BCP;
- roles for recording, escalation and decisions;
- communication plans that include the Central Bank where required; and
- a register of every incident, with what happened, the actions taken and the outcome.
Root causes of all material incidents must be identified and addressed.
Article 15 sets the notification clock for events that significantly affect the continuity or integrity of Critical Operations, including any event that triggers, or is likely to trigger, the BC or DR plans:
- 1
Within 4 hours: notify the Central Bank
Tell the Central Bank about the event, including which Critical Operations are affected. Four hours is short; the decision on whether an event qualifies has to be quick and pre-agreed.
- 2
Within 24 hours: send a summary report
Describe the nature of the event, the actions being taken, the likely impact and the expected timeframe to return to normal operations.
- 3
On return to normal: notify again
Confirm to the Central Bank when operations are back to normal.
- 4
High-risk incidents: within 72 hours
Separately, any incident classified as high risk under your Board-approved criteria must be notified within 72 hours (15.3).
The Central Bank may also set further notifications, information requests and timeframes case by case, and must be told promptly of significant deviations from the Board-approved risk appetite or tolerance for disruption (15.1).
Third parties
Article 13 requires a Board-approved third-party risk strategy. Before relying on a provider for anything that affects Critical Operations, the institution must verify that the provider has at least an equivalent level of operational resilience. Outsourcing an activity whose disruption could significantly affect Critical Operations needs a prior notice of non-objection from the Central Bank (13.5). Where relevant, key providers should take part in BC and DR testing.
The evidence to keep ready
- Board approvals of the risk appetite, tolerance for disruption, and BC and DR plans, with dates
- The Critical Operations mapping, and the change records that keep it current
- Incident response, BCP and DR plans for each Critical Operation, with scenarios, triggers, RTOs, RPOs and communication arrangements
- Impact assessments per scenario, separating financial, operational, legal and reputational impact
- Annual test results for each Critical Operation, and their reports to the Board and Senior Management
- The annual second-line and internal audit reviews of the plans
- The incident register, root-cause analyses and every Central Bank notification with its timestamps
- Third-party resilience assessments and any non-objection notices
How BCMStack maps to the regulation
BCMStack covers the impact analysis, planning, testing and incident-record parts of the regulation. Risk appetite statements, the internal control report, the ICT and cybersecurity framework and third-party contracts sit outside it.
| Requirement | BCMStack module | What it covers |
|---|---|---|
| Critical Operations mapping (3.4) | BIA · Risk | Dependencies on processes, applications, locations and vendors; critical assets in the risk register |
| Impact assessment per scenario (11.6) | BIA | Impact over time across configurable categories, including financial, operational, regulatory and legal, and reputational |
| Activation triggers, RTO and RPO, communications (11.7 to 11.9) | BCP | Structured activation criteria, target recovery objectives, recovery steps and stakeholder communications, with approval and versioning |
| Annual testing under severe but plausible scenarios (11.10, 11.11) | Exercises | Test programmes, a scenario library, injects, observations and after-action reviews, including DR tests |
| Incident register and root causes (9.2, 9.4.5) | Incidents | Classification, status history, actions and root cause on every incident |
BCMStack's incident notification deadlines and reminders are built around SAMA's requirements today. UAE institutions using it should track the Central Bank's 4-hour, 24-hour and 72-hour steps explicitly until a CBUAE-specific clock ships.
Where to start
- Agree the list of Critical Operations with the Board, starting from the four the regulation names.
- Build the mapping for each one from your existing BIA dependencies, and connect it to change management.
- Set and approve a tolerance for disruption, then check that every plan's RTO and RPO fits inside it.
- Write the notification playbook: who decides an event qualifies, who notifies the Central Bank within 4 hours, and who owns the 24-hour report.
- Schedule this year's tests for every Critical Operation, including key third parties, and the Board reporting that follows.
For the UAE's national business continuity standard, which applies to all UAE entities and not only the financial sector, read NCEMA 7000:2021 explained.
Sources: CBUAE Operational Risk Management Regulation (C 1/2026), CBUAE Rulebook.