Operational Risk Management Regulation

A new regulation issued under Federal Decree-Law No. 6/2025 requiring all licensed financial institutions to establish formal operational risk management frameworks, including risk identification, controls, and reporting to the Board. Publication date is a best-sourced estimate: CBUAE's Rulebook confirms the circular number (C 1/2026) and an effective date of 14 September 2026, but the exact issuance/gazette-publication date was not independently located; based on the sequence of related 2026 circular numbers (C2 published mid-Feb, C3 published 19 Feb, C5 published 13 Mar), C1 was likely issued in late January/early February 2026.

What firms should do

Yes — establish or update Board-approved operational risk management framework ahead of the 14 September 2026 effective date

Regulator: Central Bank of the UAE
Type: New Regulation/Standard
Status: Final/In Force
Published: 1 Feb 2026
Takes effect: 14 Sept 2026
Reference: Circular No. 1/2026
Topic: Prudential
Impact: High

Read it on the regulator's website

Found automatically on the regulator's website and summarised by AI by Arakan Lexara. Not legal advice; check the official source before relying on it.

Arakan Lexara Weekly

Get the week's UAE regulatory changes every Monday.

Key developments, what firms are asked to do and the deadlines ahead. Free.

More from the Central Bank of the UAE

24 Jun 2026

Enforcement Notice

Medium impact

CBUAE fines a foreign bank branch AED 20 million and its head of compliance AED 300,000 for AML/CFT failures

CBUAE imposed a AED 20 million financial sanction on an unnamed foreign bank branch operating in the UAE for 'significant, repeated failures' in its AML/CFT framework, and separately fined the branch's head of compliance AED 300,000 for failing to fulfil his AML oversight responsibilities. This signals CBUAE's continued individual-accountability enforcement approach for MLRO/compliance officers, not just institutions.

16 Apr 2026GuidanceMedium impact

CBUAE Updates AML/CFT/CPF Guidance for Licensed Financial Institutions (Proliferation Finance, TBML, Correspondent Banking and CDD/KYC guidance, plus two best-practice manuals)

CBUAE released an updated package of four AML/CFT/CPF guidance documents (proliferation financing, trade-based money laundering/transshipment, correspondent banking, and customer due diligence/KYC) together with two best-practice manuals on risk-based-approach methodology and role-based staff training, described by the Governor as aligning UAE supervision with FATF and international standards. Licensed institutions should refresh AML/CFT policies, CDD procedures and training programs to reflect the updated guidance.

14 Apr 2026GuidanceMedium impact

CBUAE FAQs/Guidance on Article 62 — Carrying on Licensed Financial Activities through Emerging Technologies

CBUAE published FAQ-format guidance clarifying that Article 62 of Federal Decree-Law No. 6/2025 does not create new categories of regulated financial activity but ensures technology-neutral supervision across delivery channels, including Web3/decentralized systems, while confirming pure technology/infrastructure service providers are not directly regulated unless they perform licensed financial activities themselves. Entities have until 16 September 2026 (the law's one-year transition deadline) to adjust their activities/status.

13 Mar 2026New Regulation/StandardHigh impact

Remuneration Regulation for Banks and Insurance Companies

Aligned with Basel Committee and FSB compensation principles, this regulation requires banks, insurers, reinsurers and UAE branches of foreign institutions to identify Material Risk Takers, defer 3-5 years of variable pay for them, embed malus/clawback provisions in contracts, and have the Board approve remuneration policy annually via a dedicated Remuneration Committee. Institutions face a gap-analysis deadline of 11 October 2026 and full compliance by 14 July 2027.