The UAE Central Bank’s Operational Risk Management Regulation, C 1/2026, establishes minimum requirements for licensed financial institutions to manage operational risk and maintain operational resilience. Effective from 14 September 2026, the regulation places clear responsibilities on boards, senior management, risk functions, and business units to identify vulnerabilities, strengthen controls, and maintain critical operations during disruption. For banks and other covered institutions, understanding the regulation is only the first step. The priority is to translate its requirements into documented policies, measurable controls, reliable reporting, and tested recovery arrangements. This guide explains the main requirements and provides a practical approach to implementation. Source: CBUAE Operational Risk Management Regulation.
What Is the UAE Central Bank Operational Risk Regulation?
The CBUAE Operational Risk Management Regulation, C 1/2026, sets minimum requirements for managing operational risk and operational resilience. It applies to licensed financial institutions that are juridical persons, as specified in the regulation.
Operational risk arises from failures or weaknesses involving people, processes, systems, or external events. Examples include payment processing errors, internal fraud, cybersecurity incidents, inaccurate financial records, system outages, and failures involving external service providers.
Operational resilience refers to an institution’s ability to respond to disruption, adapt, recover, and continue delivering critical operations. Therefore, operational risk management is not limited to preventing losses. It must also prepare the institution to maintain essential services when preventive controls fail.
The regulation requires a comprehensive framework integrated into the institution’s broader risk management and governance arrangements. That framework must reflect the institution’s risk profile, risk appetite, tolerance for disruption, capital strength, and business environment.
The regulation also replaces the previous Operational Risk Regulation and Operational Risk Standards issued under Circular No. 163/2018. Institutions should therefore assess their existing arrangements against the current rulebook rather than assume that earlier policies remain sufficient.
Why the Regulation Matters for UAE Financial Institutions
Banks depend on interconnected processes, technology platforms, employees, data, and third-party services. A failure in one area can affect payments, customer access, financial reporting, liquidity management, and regulatory compliance.
The new requirements provide a structured basis for addressing these dependencies. They also reinforce the connection between risk governance and the institution’s ability to continue operating during severe but plausible disruptions.
Several priorities deserve particular attention.
Stronger Board Accountability
The regulation assigns ultimate responsibility to the board for ensuring that an adequate operational risk management framework is in place. This responsibility remains with the board even when committees support its work.
The board must approve and review key operational risk and operational resilience strategies and policies at least annually. These include the institution’s operational risk appetite and tolerance, as well as its tolerance for disruption affecting critical operations.
Better Integration of Risk and Internal Controls
Operational risk cannot be managed effectively through isolated risk registers or periodic compliance reviews. Institutions need consistent methods for identifying risks, assessing controls, monitoring exposure, reporting weaknesses, and assigning corrective actions.
The regulation requires an internal control system covering risk assessment, control activities, monitoring, information, and communication. It also requires clear accountability across the three lines of defence.
Greater Focus on Operational Resilience
Institutions must identify critical operations and understand the resources and dependencies needed to maintain them. They must also establish and regularly review incident response, business continuity, and disaster recovery arrangements.
This requirement is especially relevant to payment services, customer-facing banking channels, financial records, and processes needed to manage solvency and liquidity.
Key Requirements of the CBUAE Regulation
1. Establish a Comprehensive Operational Risk Framework
Institutions must maintain a documented framework that includes strategies, policies, procedures, systems, controls, and processes to identify, assess, monitor, report, and mitigate operational risk.
The framework should address:
- Governance structures, reporting lines, responsibilities, and delegated authority.
- Risk appetite, tolerance, limits, and thresholds for operational risk exposure.
- Methods for identifying risks and evaluating control design and effectiveness.
- Consistent risk terminology and assessment standards.
- Monitoring and reporting arrangements appropriate to different management levels.
- Approved mitigation strategies and controls.
- Internal and external fraud risks, including incidents and threats affecting customers.
The framework must cover material products, activities, processes, and systems, including those outsourced to or dependent on third-party service providers.
Institutions should begin by comparing existing policies and procedures with each applicable regulatory requirement. This review should identify what already meets the requirement, what needs improvement, and what is missing.
2. Define Governance and Accountability
The regulation distinguishes the responsibilities of the board, senior management, the operational risk management function, business units, control functions, and internal audit.
The board retains ultimate accountability for the framework and must approve key strategies and policies. Senior management is responsible for translating these decisions into effective policies, processes, controls, and systems across the institution.
The operational risk management function must have adequate resources and sufficient independence. The Chief Risk Officer is responsible and accountable for this function under the regulation.
The function should independently assess material risks, challenge the quality of risk assessments and controls, maintain risk management policies, monitor emerging threats, and report findings and recommendations.
The three lines of defence should work as follows:
- First line — Business and operational management: Identify and manage risks arising from daily activities and maintain effective controls.
- Second line — Risk management and compliance: Establish standards, provide oversight, challenge risk assessments, and monitor adherence to requirements.
- Third line — Internal audit: Provide independent assurance on the design and effectiveness of risk management and internal controls.
Clear responsibilities help prevent gaps, duplicated activities, and unresolved control weaknesses.
3. Strengthen Risk Assessment and Control Testing
A documented risk assessment should identify where operational failures may occur, evaluate their potential impact, and determine whether existing controls reduce exposure to acceptable levels.
Risk and control self-assessment (RCSA) can support this process. Business owners identify inherent risks, evaluate control effectiveness, determine residual exposure, and agree on corrective actions.
Institutions should also maintain a register of processes that identifies process owners and risk owners. This process universe helps ensure that risk assessments cover the institution’s activities rather than only the most visible departments.
Useful supporting practices include:
- Maintaining a consistent operational risk taxonomy.
- Recording incidents, losses, near misses, and root causes.
- Using key risk indicators (KRIs) to detect changes in exposure.
- Setting thresholds and escalating breaches.
- Testing controls under normal and stressed conditions.
- Tracking remediation actions to completion.
- Reviewing whether manual processes can be automated safely.
- Assessing technology risks associated with automated controls.
Insurance and other risk-transfer measures may complement these activities, but they do not replace effective internal risk management and controls.
4. Map Critical Operations and Dependencies
Operational resilience begins with understanding which services must continue during disruption and what resources support them.
The regulation identifies critical operations that include payment systems and time-critical customer services, maintaining accurate financial records, and managing solvency and liquidity in a timely manner. The Central Bank may also identify other critical operations.
Institutions should map the processes, people, information, technology, facilities, and third-party services that support each critical operation. This mapping should be updated through change management.
The purpose is to understand how a failure in one component could affect a wider service. For example, a technology outage may prevent customers from accessing payment services, while a third-party disruption may affect transaction processing or access to essential data.
Institutions should use this mapping to identify concentration risks, single points of failure, resource dependencies, and recovery priorities.
5. Integrate Cybersecurity, Incident Management, and Recovery
The regulation requires institutions to incorporate information and communications technology (ICT) and cybersecurity risks into their operational risk management and resilience arrangements.
Relevant controls include risk identification, mitigation, incident management, change management, regular monitoring, and testing.
Institutions must also maintain incident response and recovery plans for events that could disrupt critical operations. These plans should define:
- Incident classification and severity criteria.
- Responsibilities for response, escalation, and recovery.
- Internal and external communication arrangements.
- Required regulatory notifications.
- Procedures for recording and analysing incidents.
- Root cause analysis and measures to prevent recurrence.
- The resources required to restore critical services.
Business continuity and disaster recovery plans should address severe but plausible scenarios, including prolonged or permanent loss of important assets. Institutions should establish clear activation triggers, recovery time objectives, and recovery point objectives consistent with their approved tolerance for disruption.
Plans should be reviewed and tested regularly. Testing for critical operations must take place at least annually under the regulation, with results reported to the board and senior management. Relevant third-party providers should be included where appropriate.
6. Improve Risk Data and Management Reporting
Effective decisions depend on accurate, timely, and consistent risk information. Institutions need systems capable of monitoring exposure, analysing operational risk events and loss data, and supporting internal and external reporting, including during disruption.
Operational risk reports should provide a clear view of:
- The institution’s current risk profile and relevant indicators.
- Risk limits, thresholds, and breaches.
- Residual risks and control deficiencies.
- Emerging risks and significant incidents.
- Losses and root cause analysis.
- Relevant external events and regulatory changes.
- Recommendations from risk management, compliance, and assurance functions.
Reports should be understandable and actionable. Senior management should use them to prioritize remediation and escalate material issues. The board should receive information that supports oversight and timely decisions.
Institutions must also follow the applicable regulatory notification requirements. Under Article 15, significant operational risk events affecting, or likely to affect, the continuity or integrity of critical operations generally trigger notification to the Central Bank within four hours and a summary report within 24 hours. High-risk incidents have a separate notification requirement of 72 hours. Institutions should consult the regulation for the precise scope, conditions, and reporting details applicable to each event.
A Practical Implementation Roadmap
A structured implementation programme helps institutions move from regulatory interpretation to evidence of effective controls.
Step 1: Assign Ownership and Confirm Scope
Appoint an accountable executive sponsor and establish coordination between operational risk, compliance, business units, technology, business continuity, and internal audit.
Confirm which legal entities and activities fall within the regulation’s scope. Assign an owner to every applicable requirement and establish a process for reporting progress to senior management.
Step 2: Conduct a Regulatory Gap Assessment
Compare the current framework with the regulation article by article. Review policies, risk assessments, process registers, control evidence, incident records, reporting packs, and recovery plans.
Classify findings according to regulatory significance, exposure, and implementation urgency. Distinguish between missing controls, controls that exist but lack evidence, and controls that require improvement.
Step 3: Prioritize Critical Operations and Material Risks
Map critical operations and the resources supporting them. Assess vulnerabilities involving technology, people, data, facilities, third parties, and interdependencies.
Prioritize weaknesses that could interrupt essential services, cause material customer harm, breach risk tolerances, or prevent timely regulatory reporting.
Step 4: Update Policies, Controls, and Reporting
Revise the operational risk framework, risk appetite and tolerance statements, escalation procedures, incident management arrangements, and internal reporting.
Ensure that each material risk has an accountable owner, appropriate controls, relevant indicators, and a documented response when thresholds are exceeded.
Step 5: Test Scenarios and Recovery Arrangements
Conduct exercises based on severe but plausible disruptions. These may include a major cyber incident, payment system failure, loss of a critical third-party service, data corruption, or prolonged unavailability of key staff.
Evaluate whether response teams can activate plans, communicate effectively, restore services within approved targets, and meet notification obligations. Record findings and assign corrective actions.
Step 6: Maintain Evidence and Continuous Improvement
Keep documented evidence of risk assessments, board approvals, control testing, incidents, management reports, training, and remediation.
Monitor progress through defined milestones and indicators. Reassess the framework when material changes occur in products, processes, systems, outsourcing arrangements, or the institution’s risk profile.
Implementation should be treated as an ongoing management responsibility, not a one-time compliance exercise.
Common Implementation Mistakes
Financial institutions can weaken their programmes by treating regulatory implementation as a documentation project rather than an operational improvement effort.
Common mistakes include:
- Updating policies without changing day-to-day controls.
- Assigning responsibilities without giving owners sufficient authority or resources.
- Treating business continuity plans as documents that do not need realistic testing.
- Failing to include third-party dependencies in risk assessments.
- Collecting risk indicators without defining thresholds or escalation actions.
- Reporting incidents without investigating their root causes.
- Closing remediation actions without verifying that controls work.
- Overlooking risks introduced by new technology or process changes.
A practical corrective approach is to connect each regulatory requirement to an accountable owner, a functioning control, reliable evidence, and a review process.
Questions Leaders Should Ask
Boards and senior executives can use the following questions to assess whether implementation is progressing effectively:
- Has the board approved the required operational risk appetite, tolerance, and resilience policies?
- Have all critical operations and their key dependencies been identified?
- Can the institution demonstrate that material risks and controls are assessed consistently?
- Are incident reporting and escalation procedures aligned with the applicable regulatory timelines?
- Have business continuity and disaster recovery plans been tested against severe but plausible scenarios?
- Do management reports identify residual risks, control weaknesses, and overdue corrective actions?
- Can the institution demonstrate that material findings lead to measurable improvements?
The answers should be supported by documented evidence rather than informal assurances.
Frequently Asked Questions
What is the UAE Central Bank Operational Risk Management Regulation 2026?
It is the CBUAE regulation establishing minimum requirements for licensed financial institutions to manage operational risk and operational resilience. It covers governance, internal controls, risk assessment, critical operations, incident management, ICT and cybersecurity risks, recovery arrangements, and reporting.
When did the CBUAE Operational Risk Management Regulation become effective?
The official CBUAE Rulebook identifies C 1/2026 as effective from 14 September 2026. Institutions should consult the current official rulebook for the regulation’s applicable requirements and any subsequent updates.
Who is responsible for implementing the regulation?
The board retains ultimate responsibility for ensuring an adequate operational risk management framework. Senior management implements the approved framework, while the operational risk function, business units, compliance, and internal audit perform their respective oversight, control, and assurance responsibilities.
What is the role of risk and control self-assessment?
RCSA helps business owners identify inherent risks, evaluate existing controls, determine residual exposure, and define corrective actions. When supported by consistent methods and reliable evidence, it helps institutions identify gaps and improve operational risk decisions.
How can institutions demonstrate operational resilience?
They can demonstrate it through documented critical-operation mapping, identified dependencies, incident response procedures, tested business continuity and disaster recovery plans, defined recovery targets, reliable communications, and evidence that lessons from incidents and exercises lead to corrective action.
Conclusion
The UAE Central Bank Operational Risk Management Regulation requires financial institutions to connect governance, risk assessment, internal controls, operational resilience, and reporting within a comprehensive framework. Successful implementation depends on more than updating policies: institutions must understand their critical operations, test their ability to withstand disruption, establish clear accountability, and demonstrate that corrective actions work.
The most effective next step is a structured gap assessment against the official CBUAE rulebook, followed by a risk-based implementation plan with named owners and measurable milestones. Regular testing and management oversight can then help maintain alignment as risks and business operations evolve.
Related Professional Development
Professionals responsible for operational risk, compliance, banking operations, and internal controls can strengthen their practical capabilities through Gentex Training Center’s Operational Risk Management & Mitigation training course. The programme covers RCSA, risk governance, loss data analysis, key risk indicators, control design, mitigation planning, scenario analysis, and reporting. These capabilities can support the practical application of operational risk management principles, alongside institution-specific regulatory advice and compliance responsibilities.
About the Author
Adam
Operational Risk Management Expert at Gentex Training