الرئيسيةتأمين تعطل خدمات السحابةعن مانتاسالمدونةتواصل معنا
المنصة
المدونة

The UAE just raised the bar on operational resilience

  • UAE Central Bank
  • Operational Resilience
  • Operational Risk
  • Risk Management
  • Business Continuity

We break down what the Central Bank's new risk framework means. Is your business ready?

On 14 September 2026, the Central Bank of the UAE (CBUAE) brought a significant piece of regulation into force. The new Operational Risk Management Regulation put in place new standards seeing that the gap between the old standards and today’s digital reality had become impossible to ignore. 

Customers locked out of mobile banking apps. Card payments failing during system upgrades. Technical disruptions met with vague apologies and no timeline for resolution. 

The message from the regulator is clear: resilience is no longer a best practice. It's a requirement.

What's changed

The framework is built around a fundamental shift in thinking from restoring systems to maintaining services. Institutions are no longer simply required to have recovery plans. They must show they can keep critical services running or quickly restore them when disrupted.

In practice, this means financial institutions must now:

Map critical operations and the impact their disruption could have. This includes cloud providers, third-party APIs, payment rails and any digital infrastructure the business depends on.

Define how long each critical operation can be down. Vague recovery timelines are no longer enough.

Report significant disruptions to the CBUAE within four hours, with a full report due within 24 hours. Institutions must identify the root cause of every major incident (Root-Cause Analysis), and include RCA in their regular risk reports to the board.

Regularly test continuity plans under real-world conditions to make sure they work when it matters.

The regulation also places direct responsibility for operational risk and resilience on the institution's board of directors, not its IT department. This makes it no longer just a technical matter but a governance one.

What this means for business today

What the Central Bank has recognised and what forward-thinking risk leaders are grappling with is that critical infrastructure failure is no longer a tail risk. It's an operational reality that demands a prepared response.

The bar for operational resilience is getting higher for all licensed financial institutions. Knowing your cloud dependencies, mapping your vulnerabilities, and defining what happens when critical services become unavailable is not a compliance exercise for banks alone. It is quickly becoming the standard by which any serious business will be measured.

The CBUAE has been clear that the regulation does not guarantee the elimination of service disruptions. What it does guarantee is that the response to disruption and responsibility for it is defined in advance.

How Mantas Cloud Outage Insurance Can Help

Operational readiness matters. But it doesn't make the cost of disruption disappear. Lost revenue, stalled operations, and the financial impact of even a few hours offline remain real, regardless of how prepared an institution is. That's precisely the gap that cloud outage insurance is built to close.

For Mantas Cloud Outage Insurance policyholders, the Root-Cause Analysis (RCA) for cloud incidents isn't an additional burden. It's built in as part of the service, ready for when the regulator asks.

That, ultimately, is what resilience looks like.

Sources:

This article is provided for general informational purposes only and does not constitute financial advice, a financial promotion, or an invitation or inducement to enter into any agreement in relation to the provision of a financial service or the acquisition of any financial product. The information contained herein should not be relied upon as a substitute for professional advice tailored to your specific circumstances.

The cloud outage insurance product referenced in this article is provided by Mantas Limited and is subject to the terms, conditions, and exclusions of the relevant policy documentation. Purchasing insurance does not guarantee compliance with any regulatory obligation. Institutions remain solely responsible for meeting their own regulatory requirements, including but not limited to Root-Cause Analysis (RCA) reporting obligations.

If you do not understand the contents of this article, you should consult an authorised financial adviser.