UAE Financial Sector Cyber Rules: CBUAE, DFSA, FSRA and Dubai ISR

A financial firm in the UAE answers to a different cyber rulebook depending on where it is licensed, and all three main regulators tightened their rules between 2024 and 2026. Onshore banks, insurers and other licensed financial institutions follow the Central Bank of the UAE (CBUAE); firms in the Dubai International Financial Centre (DIFC) follow the Dubai Financial Services Authority (DFSA); firms in Abu Dhabi Global Market (ADGM) follow the Financial Services Regulatory Authority (FSRA). This guide sets out who is covered by which rules, the incident reporting clocks, the governance and control expectations, and how service accounts and other non-human identities fit. It is written for CISOs, compliance officers and operational risk teams at UAE banks, insurers, asset managers, brokers and fintechs, and at groups with entities in more than one zone. Federal and emirate government standards are covered in the UAE Information Assurance Standards Guide.

Sources: the DFSA and FSRA sections are based on the regulators' own published notices, read in November 2026. The CBUAE Rulebook text of the new Operational Risk Management Regulation could not be accessed, so the CBUAE section is based on secondary sources: summaries by the law firm Trowers & Hamlins, the advisory firm Crowe and Gulf News. Each CBUAE obligation names its source, and figures appear only where at least two of them agree. Confirm against the official text before relying on it.

Key takeaways

• Licence location decides the rulebook. CBUAE rules apply onshore, the DFSA's GEN module in the DIFC, and the FSRA's GEN module in ADGM; a group with entities in all three runs three reporting routes.
• Reporting clocks differ. Trowers & Hamlins, Crowe and Gulf News all report a 4-hour CBUAE notification for significant events affecting critical operations; the FSRA expects immediate notice with a 24-hour backstop; the DFSA asks for notice without delay and no later than 72 hours.
• Onshore resilience rules are new. Trowers & Hamlins and Gulf News report that the CBUAE Operational Risk Management Regulation took effect on 14 September 2026, replacing the 2018 operational risk rules.
• ADGM rules are recent. The FSRA's Cyber Risk Management Rules in GEN 3.5 took effect on 31 January 2026.
• Identity is called out. The DFSA's March 2026 letter on elevated threats lists privileged credential harvesting and asks firms to prioritise identity and access management controls.

Who regulates what

The Dubai ISR appears in many UAE compliance discussions, but it is a government sector scheme. Private financial firms meet it mainly as suppliers to Dubai government entities, where contracts can pass ISR requirements down to them.

CBUAE: the Operational Risk Management Regulation

The new regulation replaces the Operational Risk Regulation and Standards in force since 2018 (Trowers & Hamlins, Crowe). It applies to licensed financial institutions (LFIs) with legal personality, including banks and insurers (Trowers & Hamlins, Gulf News). The secondary sources disagree on the issue date, so it is left out here; check the CBUAE Rulebook.

• Governance: the board holds ultimate responsibility for operational risk and resilience and approves and reviews, at least annually, risk appetite and disruption tolerances (Trowers & Hamlins, Crowe).
• Critical operations mapping: LFIs map the people, technology, data, facilities and third parties behind each critical operation (Trowers & Hamlins), and link business continuity and disaster recovery plans to that mapping, with regular testing (Crowe).
• ICT and cyber: LFIs maintain ICT and cyber security risk management supported by protection, detection, response and recovery programmes (Crowe), and a strategy to replace or retire obsolete and unsupported hardware and software (Trowers & Hamlins).
• Data location: the Master System of Record must be kept in the UAE, including where functions are outsourced, with a CBUAE-approved route for foreign branches (Trowers & Hamlins, Crowe).
• Third parties: a board-approved third-party risk strategy, due diligence, equivalent resilience for providers supporting critical operations, and exit plans (Crowe); the CBUAE may require termination of over-dependent arrangements (Trowers & Hamlins).
• Testing: Gulf News reports periodic stress tests including penetration testing and an independent external penetration test for critical functions with results presented to the board. Trowers & Hamlins, Crowe and Pinsent Masons do not mention penetration testing, and a Dubai Standard report repeating the point appears to draw on the same Gulf News story, so this is not confirmed by an independent second source. Treat it as reported, not established, and check the Rulebook.

Incident reporting clocks compared

Each clock starts at a different point. Write the trigger wording for each regulator into your incident classification matrix and do not assume one internal deadline covers all three. Data protection breach reporting, financial intelligence unit reports and police reports run in parallel, as the FSRA notice reminds firms. See the Cyber Incident Reporting Requirements Map.

DFSA: cyber risk management in the DIFC

The DFSA expects firms to follow the cyber risk management rules in the GEN module. Waystone's summary, dated March 2024, describes a written framework approved by the governing body, senior management awareness of cyber vulnerabilities, a written incident response plan with periodic review, an ICT asset inventory, anti-malware, network security monitoring, user access management and training. The DFSA's supervision page lists the G7 Fundamental Elements and standards such as the NIST Cybersecurity Framework, ISO/IEC 27000, CIS Controls and the CSA Cloud Controls Matrix as references firms may use.

The DFSA letter of 27 March 2026 on elevated cyber threat levels asks firms to:

1. Monitor and assess the impact of threats on their own environment.
2. Report material incidents promptly through the ePortal form.
3. Register with the DFSA Cyber Threat Intelligence Platform (TIP), share intelligence and hunt proactively.
4. Review the cyber risk management framework for operational effectiveness.
5. Prioritise identity and access management and the security of internet-facing assets.
6. Test incident response with scenario-based simulations.

FSRA: Cyber Risk Management Rules in ADGM

The FSRA announced its cyber risk management framework on 29 July 2025, with an effective date of 31 January 2026 (Norton Rose Fulbright; the FSRA notice confirms GEN 3.5 took effect on that date). Norton Rose Fulbright describes a written framework integrated with overall risk management, board and senior management responsibility, controls proportionate to the firm's nature, scale, complexity and cyber risk, and periodic review of the framework.

FSRA Notice FSRA/FCCP/22/2026 of 29 January 2026 updated the incident templates: a streamlined Template A for the initial report and an enhanced Template B for progressive updates, aligned with the Financial Stability Board's April 2025 work on incident reporting. The supervisor sets the frequency of progressive updates case by case. The existing UAE Information Assurance Standards Guide notes that the FSRA told firms in October 2025 that adherence to new Cyber Security Council policies was not mandatory for them; check your regulator's current position.

What it means for non-human identities and AI agents

None of the three regimes uses the term non-human identity, but each one pulls machine credentials into scope.

• Critical operations mapping (CBUAE): the technology and third-party dependencies behind a critical operation include the service accounts, API keys and integration credentials that connect them. Record them in the mapping so a credential compromise can be traced to the operations it affects.
• Access management (DFSA): the DFSA's call to prioritise identity and access controls in response to privileged credential harvesting applies to automation and vendor accounts as much as to administrators. See the Privileged Access Management Guide.
• Materiality triggers (DFSA, FSRA): a leaked cloud key or a misused integration token can be a material cyber incident. Include NHI compromise scenarios in your classification so the 24-hour and 72-hour clocks are not missed.
• Data location (CBUAE): AI agents and SaaS integrations that copy records outside the UAE need checking against the Master System of Record rule.
• Third parties: list the credentials each provider holds into your systems as part of due diligence and exit planning. See the Third-Party Access Guide.

Compliance steps

1. Map entities to regulators: list every licensed entity, its regulator and the rule set that applies, including group service companies that support regulated entities.
2. Read the primary texts: CBUAE Rulebook, DFSA GEN module and FSRA GEN module, and record the version you mapped.
3. Build one classification matrix: with each regulator's trigger, clock, template and channel, plus data protection and law enforcement routes.
4. Map critical operations: for onshore LFIs, including identities, keys and third-party connections behind each one.
5. Close identity gaps: MFA and vaulting for privileged and vendor accounts, owners and rotation for service accounts and API keys, and monitoring of internet-facing assets.
6. Join threat sharing: register with the DFSA TIP where applicable and use FSRA channels for ADGM entities.
7. Exercise: run scenario-based simulations that test all three reporting routes, and test continuity plans for critical operations (our recommendation: at least annually).
8. Review annually: board review of the framework, risk appetite and disruption tolerances.

Framework mapping

The UAE regulators do not publish a NIST crosswalk. This mapping is NHI Mgmt Group's own.

Measuring progress

• Time from detection to regulator notice in exercises, per regulator, against 4, 24 and 72 hours.
• Share of critical operations with a complete dependency map including machine credentials.
• Privileged and vendor accounts with MFA or vaulted credentials.
• Service accounts and API keys with a named owner and a rotation date.
• Critical third parties with a tested exit plan.

Common failure patterns

• One deadline for all zones: a group playbook set to 72 hours misses the CBUAE 4-hour and FSRA 24-hour clocks.
• Treating the ISR as a financial rulebook: mapping a DIFC or ADGM firm to the Dubai ISR while missing its own regulator's GEN module.
• Dependency maps without identities: critical operation maps that list servers and suppliers but not the credentials linking them.
• Old classification criteria: incident severity criteria not updated for the new rules or the new FSRA templates.
• Offshore copies of records: integrations or analytics tools moving the system of record outside the UAE without the required approach.

Practitioner checklist

• List each entity's regulator and rulebook, and the date you last read it.
• Keep a reporting matrix with CBUAE, DFSA and FSRA triggers, deadlines and channels.
• Store FSRA Template A and B and DFSA ePortal access details with the incident team.
• Map critical operations, including service accounts, keys and vendor access.
• Prioritise MFA and vaulting for privileged, vendor and automation accounts.
• Register with the DFSA TIP where you hold a DFSA licence.
• Test continuity and incident response with realistic scenarios (we suggest at least annually).
• Check that the Master System of Record stays in the UAE for onshore LFIs.

Standards and references

• DFSA: Dear SEO Letter, Elevated Cyber Threat Levels (27 March 2026)
• DFSA: Cyber Risk Supervision
• FSRA: Notice FSRA/FCCP/22/2026, Updates to IT and Cyber Incident Reporting
• Norton Rose Fulbright: Cyber risk management in the ADGM
• Trowers & Hamlins: UAE Central Bank raises the bar on operational risk
• Crowe: UAE Central Bank Operational Risk Management Regulation
• Gulf News: UAE overhauls bank risk rules
• Waystone: Cyber Risk Management, DFSA rules

Related NHI Mgmt Group resources: UAE Information Assurance Standards Guide · UAE PDPL Guide · Financial Services Cyber Regulation Map · Service Account Security Guide. This guide summarises UAE financial sector cyber rules from the CBUAE, DFSA and FSRA as at 9 November 2026 and is not legal advice.