"CBUAE compliance" isn't one rulebook
Ask five different CBUAE-licensed entities what their cybersecurity obligations are and you'll often get five different answers, because the Central Bank doesn't regulate through a single instrument. There are several overlapping ones, and which combination binds you depends on your licence category. Most institutions carry two or three at once without realising the full set applies to them.
The cross-sector baseline is the Operational Risk Management Regulation (Circular 1/2026, in force from 14 September 2026). It applies to all Licensed Financial Institutions — banks, insurers and other financial institutions — and covers ICT and cybersecurity management and incident management. Licence-specific instruments add their own technology risk and information security requirements on top, so check which apply to your licence category.
The same regulation treats cyber risk as part of operational risk. It requires a Board-approved risk appetite and tolerance statement for operational risk, business impact assessment, and recovery time and recovery point objectives, with business continuity and disaster recovery plans tested at least annually for Critical Operations — not numbers pulled from a policy template three years ago.
Two more frameworks apply narrowly but matter a great deal if they hit you. E-wallet and prepaid card issuers fall under the Stored Value Facilities Regulation, which requires float funds to be held in segregated accounts with licensed banks (Art. 11) and sets technology risk and information security requirements (Art. 12). Payment service providers fall under the Retail Payment Services and Card Schemes Regulation, which requires them to meet the UAE Information Assurance Standards at a minimum (Art. 13).
And then there's the one almost nobody is ready for: Open Finance. It requires specific, informed and freely given customer consent, at least two-factor authentication, secure open communication standards and a cyber incident response plan (Open Finance Regulation, Arts. 18, 19, 22 and 31) — and a bank can meet its other obligations and still fall short on Open Finance because its API gateway doesn't enforce consent properly.
What actually gets asked in a supervisory review
CBUAE reviews have moved away from "show me the policy" and toward "show me it firing." An examiner is far more likely to ask for the last board-level cyber risk report and what decision it triggered than to ask whether one exists at all. They'll want the escalation trail on your last three security incidents, however small, with time-to-detection and time-to-containment attached. They'll ask whether last cycle's penetration testing findings were actually remediated and independently retested — not just marked closed in a tracker somewhere.
The institutions that fail this kind of review usually aren't technically weak. They're undocumented. The gap is almost always in evidence discipline, not in the underlying controls.
What non-compliance actually costs
Under Federal Decree-Law No. 6 of 2025, CBUAE can impose administrative penalties, including fines of up to ten times the value of the violation, and can suspend, withdraw or revoke a licence (Art. 66). The quieter cost is reputational: correspondent banking partners increasingly run their own due-diligence checks on an institution's CBUAE supervisory history before extending or renewing a relationship, and a public enforcement notice follows you into those conversations.
Where boards are now expected to actually engage
Cyber risk used to sit with IT. CBUAE has been pushing it toward the boardroom for a few years now, and that shift changes what evidence an institution has to produce. A board that receives a single red-amber-green heat-map slide and moves on isn't demonstrating oversight — the Board must approve the operational risk appetite and tolerance statement, and in our experience reviewers look for quantified exposure and minutes showing the board actually pushed back on something.
The three-lines-of-defence question comes up constantly in our engagements: the business function running risk day-to-day, independent risk management and compliance functions challenging it, and internal audit testing whether the first two are doing their jobs. Examiners probe whether these lines are genuinely separate people, not the same person wearing two hats — because that's not oversight, it's a conflict of interest with a nicer name. Smaller finance companies without headcount for three full functions can run proportionate structures, but the principle holds regardless of size: nobody marks their own homework on cyber risk.
The gaps we keep finding, engagement after engagement
A few patterns show up often enough across ITSEC's CBUAE readiness work that they're worth naming plainly.
Risk registers that haven't been substantively touched in over a year are probably the single fastest way to trigger a finding — even when the underlying risks genuinely haven't changed much, a static register reads to an examiner as a risk function that isn't paying attention. Vendor risk assessments tend to happen once, at onboarding, and never again, even for vendors sitting directly on core banking or payment data; reviewers look for ongoing monitoring, not a one-time checkbox.
Incident response plans are frequently reviewed on paper and never actually exercised. The first time most of these plans get tested for real is during an actual incident, at 3am, when nobody has time to discover the plan's assumptions were wrong. Encryption key rotation is another one — a documented rotation schedule sitting next to production keys that haven't actually rotated on schedule is trivial for a reviewer to catch and reads badly once they do.
And Open Finance integrations built fast to hit a deadline often work fine for the business while quietly missing proper token expiry, scope limitation, or revocation handling — functional, but not what the regulation was actually asking for. None of this is exotic. It's the kind of thing a properly scoped readiness review catches months before a supervisory examination does, which is rather the point of running one proactively.
Speak with ITSEC about CBUAE compliance across Operational Risk Management, SVF, Retail Payment Services, and Open Finance.
Consult Cyber Experts →
