Central Bank of the UAEchapter by chapter

Article 2.1-2.6Article 2: Operational Risk Management Framework

Licensed financial institutions must maintain a documented operational risk management framework covering governance, risk appetite, risk limits, fraud risk and periodic review upon material risk profile changes.

Article 3.1-3.6Article 3: Operational Resilience

Licensed financial institutions must maintain an operational resilience strategy, map critical operations and dependencies, and maintain incident response, business continuity and disaster recovery plans for them.

Article 4.1-4.9Article 4: Role of the Board of Directors

The Board of Directors bears ultimate responsibility for operational risk and resilience, must approve and review risk appetite, disruption tolerance and business continuity and disaster recovery plans, oversee ICT and cybersecurity risk, and systemically important institutions must have a Board operational risk committee.

Article 5.1-5.9Article 5: Role of Senior Management

Senior management must implement the board-approved operational risk framework, report risk appetite breaches to the board, maintain internal controls, and banks and insurers must conduct annual internal control assessments reported to the board and Central Bank.

Article 6.1-6.3Article 6: Operational Risk Management Function

LFIs must maintain a robust Operational Risk management function, reporting on risk profiles and policies to the Board regularly.

Article 7.1-7.12Article 7: Internal Control System - Structure and Reporting

The internal control system must cover risk assessment, control activities, monitoring, and communication, with three-lines-of-defence governance and timely operational risk reporting to the Board.

Article 7.13-7.14Article 7: Internal Control System - Stress Testing and Penetration Testing

LFIs must periodically stress-test operational risk controls, including penetration testing across ICT, physical, people-reliant controls; Critical Functions need independent third-party penetration testing reported to the Board.

Article 8.1-8.10Article 8: ICT and Cybersecurity Management

LFIs must maintain an ICT and cybersecurity risk framework with Board-reported risk appetite, resilient protection and recovery programmes, and continuous UAE-based maintenance of the Master System of Record.

Article 9.1-9.5Article 9: Incident Management

Licensed financial institutions must maintain and regularly test incident response and recovery plans covering incident classification, communication including to the Central Bank, and root cause remediation for critical operations.

Article 10.1-10.5Article 10: Risk Data and Systems

LFIs must maintain risk data systems and ICT capabilities enabling timely operational risk monitoring, reliable loss data aggregation, and accurate internal and external reporting, validated by internal audit and unhindered by group structures.

Article 11.1-11.11Article 11: Business Continuity Planning

LFIs must maintain and annually review Business Continuity and Disaster Recovery Plans for Critical Operations, ensuring scenarios and communication guidelines are defined.

Article 12.1-12.6Article 12: Change Management and Changes in Operations

LFIs must implement a robust change management process, ensuring thorough pre-implementation testing, external assessments, and customer impact communication for operational changes.

Article 13.1-13.12Article 13: Third Party Risk Management

Licensed financial institutions must keep Board-approved third-party risk strategy, perform due diligence before third-party arrangements, obtain Central Bank non-objection for critical outsourcing, and maintain outsourcing registers and contingency plans.

Article 14.1-14.7Article 14: Shari'ah Non-Compliance Risk

Islamic financial institutions must maintain a Shari'ah governance framework and Shari'ah non-compliance risk management, record income lost to non-compliance, report it to the Internal Shari'ah Supervision Committee, and segregate restricted and unrestricted investment and Takaful accounts.

Article 15.1-15.6Article 15: Notification and Reporting Requirements

LFIs must notify the Central Bank of significant operational risk events within 4 hours, provide a 24-hour summary report, and report high-risk incidents within 72 hours.

Article 16.1-16.6Article 16: Disclosure Requirements

Licensed financial institutions must maintain a disclosure policy and publicly report proportionate operational risk and resilience information, while foreign branches may publish a UAE framework summary.

Article 9.4.5-retRecord Retention — Incident register (nature of Incident, actions taken, outcomes)

Operational risk incident registers, recording incident nature, actions taken and outcomes, must be kept by reference to each incident's date; the retention period is not specified.

Article 7.8-retRecord Retention — Process universe register (all processes with process owner and risk owner)

Regulated entities must keep a continuously maintained process universe register listing all processes with their process owners and risk owners; no fixed retention period is specified.