Regulation C 1/2026 replaces the 2018 rules, which applied to banks alone. For most businesses there is nothing to do: what changes is the legal basis on which a complaint is written when the bank gets it wrong. For anyone holding a Central Bank licence, however small, responsibility for the new control framework sits with the board, and the sanctions extend to the removal of senior managers.
What happened
Since Monday 14 September 2026 the Operational Risk Management Regulation of the Central Bank of the UAE (CBUAE), Regulation C 1/2026, has been in force. It was issued in February and is published on the official Rulebook with the status «in force». Operational risk is the risk of losing money because an internal process fails, a system goes down, a person makes a mistake, a fraud succeeds or a supplier does not deliver: it is the category that captures app outages, transfers credited twice, incorrect balances after an IT migration and cyber attacks. The regulation replaces Circular 163 of 2018, which was addressed to banks only. The new text applies to every financial institution licensed by the Central Bank that has legal personality: banks, insurance and reinsurance companies, and the «other financial institutions», meaning finance companies, exchange houses, payment service providers, and issuers of electronic money and stored value. UAE branches of foreign institutions are included.
What changes in practice
For a Central Bank licensee there are five obligations, and they apply immediately. First: an independent operational risk function with its own resources, answerable to the Chief Risk Officer, within a three-lines-of-defence control model, meaning those who operate, those who control and those who provide independent assurance. Second: periodic testing of critical operations, with penetration tests entrusted to an independent third party and the results presented to the board. Third: a map of third-party suppliers, including subcontractors that touch customer data, backed by enforceable contractual clauses. Fourth: notification to the Central Bank within 4 hours of any event affecting critical operations, a written report within 24 hours and, for incidents classified as high risk, notification within 72 hours. Fifth: every system change that may affect customers must be tested beforehand, with a rollback plan, an external expert's report delivered to the Central Bank at least 30 days in advance and its written no-objection. For a customer who simply holds an account one thing changes, and it is the one that matters most: Article 12.6 provides that where a system change produces incorrect information on balances, debits, credits or payment confirmations, the institution must explain to the customer how the account and its transactions were affected, and is liable for the losses the customer suffered as a result of the institution's error, under the consumer protection rules already in force.
Who it applies to
Directly, to any holder of a Central Bank of the UAE licence, in whatever form: the fintech licensed as a stored value facility or for retail payment services, the exchange house, the finance company, the insurer. It does not apply to holders of a free zone commercial licence, nor to firms authorised within DIFC (Dubai International Financial Centre) or ADGM (Abu Dhabi Global Market), which have their own regulators. Indirectly, it applies to anyone holding an account with a UAE bank, a wallet or a relationship with a licensed payment intermediary: there is nothing to do, but from this week there is a precise rule to cite when the institution gets it wrong. Companies that from 17 September must apply for a Central Bank licence at the end of the transitional period under Decree-Law 6/2025 will find this regulation among the requirements to be met.
The exposure
For the licensee the exposure is personal, not only corporate. Article 17 provides that the Central Bank may revoke, replace or restrict the powers of senior managers and board members, place the institution under temporary administration, impose fines and bar individuals from the UAE financial sector. A fintech founded by three people with a payment licence now carries the same structural obligations as a bank, in proportion to its size, and the board cannot delegate them to an external provider. For the account holder the exposure runs the other way: not using the right now available. A transfer stuck because of a migration error, an incorrect balance that causes a payment to the Federal Tax Authority (FTA) to fail, a payment confirmation that does not match a credit: until now these were generic complaints; from today they have an article of regulation behind them, and the bank knows it.
What to do now
A Central Bank licensee puts the five points above on the agenda of its next board meeting and measures the gap between what it has and what the regulation requires, starting with the 4-hour notification procedure: it is the obligation that is triggered without warning and that nobody improvises at two in the morning. Anyone with a system change planned, such as a new app or a core banking migration, counts back the 30 days' notice and the external expert's report before fixing the date. Anyone who simply holds an account keeps a record, from today, of every service failure affecting balances or payments: date, time, screenshot, loss suffered. If the bank has caused a cost, such as a late payment penalty or a missed order, the complaint is written citing Article 12.6 of Regulation C 1/2026 and the consumer protection rules, and is sent first to the bank's complaints unit and then, absent a reply within the deadline, to the Central Bank's complaint channels.
Sources
- https://rulebook.centralbank.ae/en/rulebook/operational-risk-management-regulation
- https://gulfnews.com/business/banking/uae-overhauls-bank-risk-rules-4-hour-reporting-cyber-tests-and-tougher-penalties-1.500675080
Published 16 September 2026 on the basis of public sources and official United Arab Emirates instruments. This is not legal or tax advice. Verify your position with a qualified professional before acting.