The Central Bank of the UAE (CBUAE) operational risk and resilience regulation

The regulation encompasses nine domains including operational risk governance, business continuity, cyber resilience, third-party risk management, and more. Each domain contains specific controls designed to strengthen the resilience of Licensed Financial Institutions (LFIs) against operational disruptions.

Deloitte’s insight narrows the regulatory scope to 49 critical controls across four main domains. This targeted approach helps organizations prioritize efforts, optimize resource allocation, and build a sustainable compliance framework aligned with CBUAE expectations.

Deloitte supports LFIs in embedding operational resilience into their culture and processes. This includes integrating risk governance, enhancing cyber defenses, ensuring business continuity, and managing third-party risks to withstand and quickly recover from disruptions. 

Deloitte provides a phased roadmap for implementing the regulation’s controls, including gap assessments, control design, testing, and continuous monitoring. Best practices emphasize collaboration across business units and leveraging technology for real-time risk insights.