UAE: New OpRisk Rule Shifts GRC From Control to Resilience

On 14 September 2026, the Operational Risk and Operational Resilience Regulation of the Central Bank of the United Arab Emirates came into force, as Gulf News reports. Regulation No. C 1/2026 was issued back in February 2026 and replaces the 2018 framework. It applies to all licensed financial institutions with their own legal personality, not only banks. At its core lies a shift in benchmark: what counts is no longer the avoidance of operational losses, but the demonstrable ability to maintain operations, adapt, recover and learn from incidents. For GRC functions it is worth examining what this role shift structurally requires.

What exactly does the new regulation replace?

The Operational Risk Management Regulation of the Central Bank of the UAE, known as Regulation No. C 1/2026, fully replaces Circular No. 163/2018 on Operational Risk Management and its associated standards.

The regulation applies to all licensed financial institutions with their own legal personality, and is therefore not limited to banks. The Central Bank can impose additional requirements where needed and issue further standards or guidance. The framework therefore remains open to expansion rather than being closed once it takes effect.

Its timing fits into a larger picture. The regulation was issued as early as February 2026 as one of the implementing regulations under the new Central Bank Law, Federal Decree-Law No. 6 of 2025, which came into force on 16 September 2025, as the law firm Hadef & Partners sets out. Article 184 of that law gave institutions one year to reconcile their position with its provisions, which produced the deadline of 15 September 2026. The new operational risk regulation therefore takes effect exactly one day before that deadline. Anyone who treated the deadline as a purely licensing and corporate law date may have underestimated the operational part.

Why does operational resilience become the new benchmark?

The framework shifts the focus from the traditional avoidance of operational losses toward building institutions that can maintain operations, adapt, recover and learn from incidents.

The concrete lever for this is disruption tolerances. Institutions must identify critical operations whose failure could cause significant harm to customers, the institution itself or the financial system, and set a clearly defined tolerance for each of them: the maximum acceptable duration of an interruption and the level of impact that can still be borne. Depending on the business, these operations include transfers and payments, account access and salary processing, and the operation of all types of cards. The evidence therefore shifts from the existence of a recovery plan to the ability to deliver or restore the service within predefined timeframes and tolerances.

Compared with the 2018 framework, new elements include operational resilience, identification of critical operations, dependency mapping, cybersecurity, third-party risk management, stress and penetration testing, four-hour incident reporting, change management, customer protection, data governance and public disclosure.

The reporting obligation is staged rather than limited to a single deadline. If an event has, or is likely to have, a significant impact on the continuity and safety of critical operations, the institution must notify the Central Bank within four hours and identify the operations affected. Within 24 hours, a brief report follows on the nature of the incident, the measures taken, its potential impact and the expected timeframe for restoring normal operations. Once normal operations resume, the Central Bank must be informed again. For high-severity incidents under the institution’s own classification criteria, a further notification applies within 72 hours. Which operations count as critical and how they are prioritized is a question that the EBA Guidelines on critical functions also raise for European institutions.

What does this mean for the three lines of defense?

The regulation reaffirms the three lines of defense model, requires an independent operational risk function headed by the Chief Risk Officer, and explicitly extends accountability up to senior management and the board.

Business lines, as the first line, provide continuous identification, assessment and control of risks in day-to-day operations. Risk management and compliance, as the second line, provide relatively independent oversight and challenge first-line decisions where necessary. Internal audit, as the third line, provides independent assurance on the effectiveness of the framework. The independent operational risk function must be sufficiently resourced and must develop its own view of material risks, assess the effectiveness of internal controls, review the operational risk profile, identify threats and vulnerabilities affecting critical operations, and provide training and risk awareness.

The split of roles at the top is explicit: the board approves strategies, policies and risk appetite, while senior management implements them and ensures appropriate systems, resources and qualified staff. This structure is not new, but it now faces a sharper test: what counts is not the existence of the three lines, but whether they can deliver a shared situational picture within four hours in an actual event. How the interplay of the three lines shifts overall is described in the new Three Lines Model of the IIA Guidance.

What consequences apply in the case of breaches?

These are enforceable regulatory obligations, not voluntary guidelines. Breaches can trigger supervisory measures and administrative or financial sanctions, which can extend to the temporary external administration of the institution.

The catalogue of measures also includes the removal, replacement or restriction of the powers of senior management or board members, fines, and a ban from operating in the UAE financial sector. This range shows that the supervisor addresses not only the institution but also the individuals in charge at the top. For the GRC function, this means that evidence must be documented not only for the compliance department, but for the personal accountability of senior management.

What does this mean structurally for a GRC function?

A GRC function must be able to demonstrate that it knows its critical operations, has mapped their dependencies, and tests recovery rather than merely documenting risks.

The testing is prescribed in concrete terms. Institutions must conduct periodic operational risk stress tests, including assessments of the control environment and penetration testing. For critical functions, periodic testing must include a penetration test carried out by an independent external party, with the results presented to the board. Business continuity and disaster recovery plans are not merely to be maintained, but exercised under severe but plausible scenarios.

Financial institutions must also implement a framework for ICT and cyber risk covering risk identification and assessment, mitigation measures, incident response and recovery, change management, data and technology services and patch management. Incident management must cover the entire incident lifecycle, from detection, classification and containment through service recovery to root cause analysis and measures to prevent recurrence. Internal and external fraud becomes an explicit part of the operational risk framework, and therefore something to be identified, assessed, monitored, reported and mitigated rather than left to security or compliance alone.

The link to customer protection is also new. Where operational changes leave customers with materially inaccurate information, such as payment confirmations, debits and credits or account balances, institutions must clearly explain how accounts and transactions have been affected. Institutions are liable for losses customers suffer as a result of institutional errors, in line with the Central Bank’s consumer protection regulations. Where third parties are part of critical operations, third-party risk management requires governance that goes beyond a mere supplier register, as also described in the article on Third-Party Risk Governance.

How can this role shift be prepared for in concrete terms?

A first, verifiable step is for the risk committee to validate the register of critical operations at its next ordinary meeting and to decide a disruption tolerance for each operation, meaning a maximum outage duration and a bearable level of impact.

Building on that, a dependency map is worth assembling that brings together systems, data, staff and third-party providers per critical operation, together with a test of the business continuity plans that measures actual recovery time against the agreed tolerance rather than documentation. It is equally worth running through the full escalation chain once, from detected incident to the four-hour notification and the 24-hour summary report. Institutions outside the UAE would do well to apply the same benchmark already, even without an immediate reporting obligation to a supervisor there. Anyone who only tests recovery capability once a supervisor asks for it is testing too late.

FAQ

Frequently asked questions

Since when has the UAE Central Bank’s new Operational Risk Management Regulation been in force?

Regulation No. C 1/2026 was issued in February 2026 and came into force on 14 September 2026. It fully replaces the previous 2018 framework and has since applied directly to all licensed financial institutions in the country.

Which institutions does Regulation No. C 1/2026 apply to?

Regulation No. C 1/2026 applies to all licensed financial institutions with their own legal personality in the United Arab Emirates, not only banks. The Central Bank can additionally impose further requirements or issue further standards and guidance at any time, which keeps the framework open to expansion.

What is a disruption tolerance and what must it be set for?

For each critical operation, institutions must set a clearly defined disruption tolerance, consisting of the maximum acceptable duration of an interruption and the level of impact that can still be borne. The evidence therefore shifts from the existence of a recovery plan to the ability to deliver or restore the service within predefined timeframes and tolerances.

How much time do institutions have to report a critical operational incident?

The initial notification to the Central Bank must be made within four hours, identifying the critical operations affected. Within 24 hours, a brief report follows on the nature of the incident, the measures taken, its potential impact and the expected timeframe for restoring normal operations; the return to normal operations must also be reported. For high-severity incidents under the institution’s own classification criteria, a further deadline of 72 hours applies.

What testing does the regulation require in concrete terms?

It requires periodic operational risk stress tests including assessments of the control environment, as well as penetration testing. For critical functions, periodic testing must include a penetration test carried out by an independent external party, with the results presented to the board. Business continuity and disaster recovery plans must be exercised under severe but plausible scenarios.

What is new compared with the previous 2018 framework?

New elements include operational resilience, identification of critical operations, dependency mapping, cybersecurity, third-party risk management, stress and penetration testing, four-hour incident reporting, change management, customer protection, data governance and public disclosure. These topics move from being voluntary additions to mandatory components that institutions must implement in a demonstrable way.

Do institutions outside the UAE also need to take the new regulation into account?

The regulation does not create an immediate reporting obligation to a supervisor outside the UAE. It is nonetheless advisable to apply the same benchmark of demonstrable recovery capability already, since testing only after a supervisor asks for it comes too late, rather than acting proactively.

Sources

1. UAE overhauls bank risk rules: 4-hour reporting, cyber tests and tougher penaltiesGulf News
2. New UAE Central Bank rules target outages, fraud and cyberattacksGulf News
3. UAE Central Bank targets banking apps and card disruption with tougher risk rulesArabian Business
4. UAE Central Bank Law: 2026 Developments and the September 2026 Reconciliation DeadlineHadef & Partners
5. Operational Risk Regulation C 163/2018Central Bank of the UAE, Rulebook
6. UAE Overhauls Bank Risk Rules With Four-Hour Reporting, Cyber Tests and Tougher PenaltiesDubai Standard