Compliance & Governance
What do CBUAE rules say about cyber security and outsourcing?
How CBUAE rules cover cyber risk, incident reporting, outsourcing and cloud for UAE banks and licensed financial institutions, from the CBUAE Rulebook.
By VigilbasePublished
The Central Bank of the UAE (CBUAE) has no standalone cyber security regulation. Its cyber requirements sit in the Operational Risk Management Regulation, in force since 14 September 2026, which requires every licensed financial institution to run an ICT and cybersecurity risk framework and to report significant incidents. The Outsourcing Regulation for Banks governs material outsourcing, and joint guidelines on enabling technologies cover cloud computing. Both the operational risk and outsourcing rules require the master system of record to stay in the UAE.
Which CBUAE rules cover cyber security?
The CBUAE Rulebook lists the instruments below. The Rulebook itself notes that it has no legal effect and that the texts issued through formal channels, such as the UAE Official Gazette, prevail.
1.Operational Risk Management Regulation (C 1/2026, effective 14 September 2026): applies to all licensed financial institutions that are juridical persons, and replaces the 2018 Operational Risk Regulation and Standards.
2.Outsourcing Regulation for Banks and its Standards (C 14/2021, effective 15 July 2021): apply to all banks operating in the UAE, on a solo and group-wide basis.
3.Guidelines for Financial Institutions Adopting Enabling Technologies (issued 15 November 2021): joint guidance from the CBUAE, SCA, DFSA, and FSRA, including cloud computing.
4.Consumer Protection Regulation (C 8/2020) and Standards: include notifying the CBUAE of significant breaches of consumer data.
What does the Operational Risk Management Regulation require for cyber?
Article 8 sets the ICT and cybersecurity requirements for licensed financial institutions.
1.The board must approve, oversee, and ensure the effectiveness of the ICT and cybersecurity risk management framework.
2.The ICT and cybersecurity policy must cover, at a minimum, governance, risk ownership, security measures such as access controls, identity management, network security, vendor management security, and vulnerability testing, data management, ICT operations, and incident response, business continuity, and disaster recovery plans.
3.Protection, detection, response, and recovery programs must be regularly tested.
4.The master system of record must be continuously maintained and stored in the UAE, including when outsourced.
5.Institutions must also comply with ICT, cyber, and information security regulations issued by the relevant UAE authorities.
How must incidents be reported to the CBUAE?
For operational risk events that significantly affect, or may affect, the continuity or integrity of critical operations, an institution must notify the CBUAE within 4 hours and provide a summary report within 24 hours, then notify it again on returning to normal operations. Separately, any high-risk incident must be notified within 72 hours, using criteria defined in board-approved policies. Periodic testing of critical functions must include penetration testing by an independent third party, with the results presented to the board.
What do the outsourcing rules require from banks?
Banks remain fully responsible for the risks of anything they outsource.
1.Material outsourcing needs board approval and a prior notice of non-objection from the CBUAE.
2.Due diligence covers the provider's security, including cyber security.
3.Contracts must give the CBUAE, and any agent it appoints, access to the provider and the right to conduct on-site visits.
4.Providers must notify the bank of any breach of the bank's data without undue delay, and the bank must immediately notify the CBUAE of material breaches.
5.Confidential data must not be shared outside the UAE without CBUAE approval and the customer's prior written consent.
6.Banks need contingency plans to bring outsourced functions back in-house.
What does CBUAE guidance say about cloud?
The enabling technologies guidelines are guidance, not binding rules, and binding regulations take precedence over them. They say institutions should engage their supervisory authority about material cloud plans, including where approval may be needed, and assess the location of data centers. Cloud contracts should cover data center locations and advance notice of changes, regulators' rights to monitor and audit, and an exit plan. They also recommend vulnerability assessments and penetration tests specific to the cloud arrangement at least once a year.
How are CBUAE rules enforced?
Violations of the Operational Risk Management Regulation and its Standards may lead to supervisory action and administrative and financial sanctions. These can include withdrawing or restricting the powers of senior management or board members, interim management of the institution, fines, and barring individuals from the UAE financial sector.
Where does Vigilbase help with CBUAE evidence?
A 4-hour notification depends on knowing quickly what is affected. Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place, and each investigation records the evidence, action, and verification, which helps you produce the facts for incident notifications and board reporting. Managed Cloudflare operates WAF and DDoS controls in scope for online banking and APIs. Any security provider is a third-party arrangement under these rules, so treat the engagement through your outsourcing process, including whether it is material and needs CBUAE non-objection, and bring your data-location requirements to scoping.
About this guide
This guide summarizes texts in the CBUAE Rulebook as available in October 2026. It is not legal advice. The Rulebook has no legal effect, and the texts published through formal channels such as the UAE Official Gazette prevail. Confirm your obligations with the CBUAE and your legal counsel.
Key Takeaways
✓The CBUAE's cyber requirements sit in its Operational Risk Management Regulation, effective 14 September 2026, not in a standalone cyber regulation.
✓Significant operational risk events must be notified within 4 hours, and high-risk incidents within 72 hours.
✓Material outsourcing by banks needs board approval and a CBUAE non-objection, and the master system of record stays in the UAE.
✓Cloud guidance asks institutions to engage their supervisor on material cloud plans and to assess data center locations.
Sources
- CBUAE Rulebook: Operational Risk Management Regulation
- CBUAE Rulebook: ICT and cybersecurity management (Article 8)
- CBUAE Rulebook: notification and reporting requirements (Article 15)
- CBUAE Rulebook: Outsourcing Regulation for Banks
- CBUAE Rulebook: Outsourcing Standards for Banks
- CBUAE Rulebook: Guidelines for Financial Institutions Adopting Enabling Technologies
- CBUAE Rulebook: Consumer Protection Regulation
- CBUAE Rulebook
Related Solutions
Vigilbase services related to this guide
Frequently Asked Questions
Does the CBUAE have a cyber security regulation?
Not a standalone one. Cyber requirements sit in Article 8 of the Operational Risk Management Regulation, alongside the outsourcing rules for banks, consumer data rules, and cloud guidance. Institutions must also follow ICT and cyber regulations issued by other relevant UAE authorities.
How quickly must UAE banks report incidents to the CBUAE?
Within 4 hours for operational risk events that significantly affect critical operations, with a summary report within 24 hours. High-risk incidents must be notified within 72 hours.Security operations responsibilitiesCoverage and incident response commitments
Can a UAE bank outsource security operations?
Yes, within the outsourcing rules. Banks stay fully responsible, material outsourcing needs board approval and a CBUAE non-objection, and contracts must give the CBUAE access and on-site visit rights.Security operations responsibilitiesEvaluate a managed security provider
Can UAE banks use cloud services outside the UAE?
The master system of record must be maintained and stored in the UAE, and confidential data may not be shared outside the UAE without CBUAE approval and the customer's prior written consent. CBUAE cloud guidance asks institutions to assess data center locations and engage their supervisor on material cloud plans.
Get Started
Ready to Improve Your Security?
Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.