Gulf News, 15 September 2026: The UAE Central Bank’s Operational Risk Management Regulation, effective 14 September 2026, introduces a stricter framework to safeguard continuity of banking services against cyberattacks, fraud, system failures and third‑party disruptions.
The regulation replaces the 2018 standards and reflects the growing reliance on digital banking channels such as mobile apps, instant transfers, wallets and cards. Customers are directly affected, as disruptions can block access to accounts, delay payments or disable cards.
Key requirements include:
-
Contingency planning: Institutions must identify “critical operations” (transfers, salary processing, card services) and define disruption tolerance levels, including maximum acceptable downtime.
-
Board oversight: Boards are accountable for strategies and risk appetite, while senior management must implement systems, resources and personnel.
-
Incident lifecycle management: Detection, containment, recovery, root‑cause analysis and prevention measures must be integrated.
-
Cybersecurity and IT risk: Institutions must monitor vulnerabilities, test disaster recovery, and protect systems and data.
-
Outsourcing accountability: Banks remain responsible for service continuity even when relying on cloud or payment providers.
Institutions must notify the Central Bank of major incidents or deviations and provide supervisory data. For customers, the regulation is expected to reduce disruption likelihood and duration, strengthen data protection, and improve resilience — though it does not guarantee compensation for every interruption.
For full story, click here.