One map for UAE third-party regulation.

NexaEncode · Regulation explorer

Every requirement, filtered to you.

178 requirements from 42 instruments, each with its source reference and how sure we are of it. Filter by regulator, sector and topic.

A sector shows the regimes that supervise it, plus federal law, which applies to everyone.

1. CBUAEGovernance and Board oversight

   Board members carry ultimate responsibility for the operational risk and resilience framework, even where Board committees exist.

   CBUAE Operational Risk Management Regulation Art. 4.1

2. CBUAEGovernance and Board oversight

   The full Board (not a committee) approves and reviews key operational risk and resilience strategies and policies, including risk appetite and disruption tolerance. The Board also approves the initial BCP and DR plans; their annual review may be delegated.

   CBUAE Operational Risk Management Regulation Art. 4.2 · Timing At least annually

3. CBUAEGovernance and Board oversight

   Board-approved strategy, policies and processes for third-party risk, integrated into the operational risk framework.

   CBUAE Operational Risk Management Regulation Art. 13.1

4. CBUAEConcentration and over-reliance

   Do not over-rely on outsourcing; keep enough in-house staff, expertise and resources to run licensed activities.

   CBUAE Operational Risk Management Regulation Art. 13.2

5. CBUAEResilience and business continuity

   Identify the assets each Critical Operation depends on, including third-party service providers and intragroup entities, and record this in a mapping per Critical Operation that is updated through change management.

   CBUAE Operational Risk Management Regulation Art. 3.4

6. CBUAEResilience and business continuity

   Minimum list of what counts as Critical Operations (e.g. payment and time-critical services, accurate financial records, solvency and liquidity management, and any operation the CBUAE deems critical).

   CBUAE Operational Risk Management Regulation Art. 3.5 (3.5.4 = any operation deemed critical by the CBUAE)

7. CBUAEDue diligence

   No third-party arrangement without first doing a risk assessment and due diligence.

   CBUAE Operational Risk Management Regulation Art. 13.3 · Timing Before entering the arrangement

8. CBUAEResilience and business continuity

   Where an arrangement relates to or affects Critical Operations, verify that the provider has at least an equivalent level of operational resilience, in normal conditions and during disruption.

   CBUAE Operational Risk Management Regulation Art. 13.4

9. CBUAEOutsourcing notice and approval

   Obtain a CBUAE notice of non-objection before outsourcing any activity whose disruption could significantly affect Critical Operations.

   CBUAE Operational Risk Management Regulation Art. 13.5 · Timing Before outsourcing

10. CBUAEContracts

    Legally binding written contracts covering rights, duties, data ownership, confidentiality and termination. For Critical Operations, the LFI must be able to inspect records and receive audit and risk reports.

    CBUAE Operational Risk Management Regulation Art. 13.6

11. CBUAEAudit and regulator access

    Contracts must oblige the provider to comply with CBUAE requests and reporting, and to allow CBUAE on-site examinations for Critical Operations outsourcing.

    CBUAE Operational Risk Management Regulation Art. 13.7

12. CBUAESubcontracting and fourth parties

    Where customer or LFI data passes to subcontractors, the contract and CBUAE-access terms must also apply to them and be enforceable by contract.

    CBUAE Operational Risk Management Regulation Art. 13.8

13. CBUAEOngoing monitoring

    Resource third-party oversight. Minimum controls: an updated register of outsourced activities and third-party arrangements (for Critical Operations), performance and risk metrics, ongoing assessment including the provider's financial condition, and dependency management.

    CBUAE Operational Risk Management Regulation Art. 13.9 (13.9.1-13.9.4)

14. CBUAEResilience and business continuity

    Address reliance on third parties in the BCP and in the Critical Operations mapping.

    CBUAE Operational Risk Management Regulation Art. 13.10

15. CBUAEExit and substitution

    Keep viable contingency and exit plans for third-party arrangements. The BCP must assess how hard the provider would be to substitute.

    CBUAE Operational Risk Management Regulation Art. 13.11

16. CBUAEConcentration and over-reliance

    The CBUAE may require an arrangement, or a Critical Operation that relies too heavily on providers, to be discontinued.

    CBUAE Operational Risk Management Regulation Art. 13.12

17. CBUAEData residency

    The Master System of Record (all data, including personal data, needed to run Critical Operations) must be continuously maintained and stored in the UAE, including when activities are outsourced. Branches of foreign institutions may, with CBUAE approval, instead keep an up-to-date copy in the UAE.

    CBUAE Operational Risk Management Regulation Art. 8.9 (definition: Art. 1.17)

18. CBUAECyber security controls

    Implement a robust ICT and cybersecurity risk framework, and keep the Board and senior management regularly informed of ICT and cyber exposures.

    CBUAE Operational Risk Management Regulation Art. 8.1, 8.4

19. CBUAEIncident reporting

    Incident management (Art. 9) covers ICT and cyber incidents. It must define the roles of staff and external parties and include communication plans for reporting to stakeholders, including the CBUAE.

    CBUAE Operational Risk Management Regulation Art. 9.1, 9.4.3, 9.4.4

20. CBUAEIncident reporting

    For operational risk events that significantly affect, or may affect, Critical Operations (e.g. events that trigger BCP or DR, or materially affect customers, operations, profit or capital): first notify the CBUAE, naming the affected Critical Operations.

    CBUAE Operational Risk Management Regulation Art. 15.2, 15.2.1 · Timing Within 4 hours

21. CBUAEIncident reporting

    Send a summary report covering the event, the actions taken, the likely impact and the expected recovery timeframe.

    CBUAE Operational Risk Management Regulation Art. 15.2.2 · Timing Within 24 hours

22. CBUAEIncident reporting

    Notify the CBUAE when normal operations resume. The CBUAE may also set other notifications case by case.

    CBUAE Operational Risk Management Regulation Art. 15.2.3, 15.2.4 · Timing On return to normal operations

23. CBUAEIncident reporting

    Separate trigger: notify the CBUAE of any high-risk Incident, as defined by Board-approved classification criteria.

    CBUAE Operational Risk Management Regulation Art. 15.3 · Timing Within 72 hours

24. CBUAEIncident reporting

    Promptly notify the CBUAE of significant deviations from the Board-approved risk appetite, policies or disruption tolerance.

    CBUAE Operational Risk Management Regulation Art. 15.1 · Timing Promptly

25. CBUAEResilience and business continuity

    Keep BCP and DR plans for Critical Operations, with annual second- and third-line review and at least annual testing.

    CBUAE Operational Risk Management Regulation Art. 11.1, 11.3, 11.10 · Timing Test at least annually

26. CBUAEOutsourcing notice and approval

    For material changes to Critical Operations (which can include a change of provider): notify the CBUAE with an external expert's report, and obtain written no-objection before implementing.

    CBUAE Operational Risk Management Regulation Art. 12.5.5, 12.5.6 · Timing At least 30 calendar days before implementation

27. CBUAEOther obligations

    Sanctions for breach can include fines, barring individuals from the sector, restricting Board or senior management powers, and interim management.

    CBUAE Operational Risk Management Regulation Art. 17.1, 17.2

28. CBUAEGovernance and Board oversight

    The bank stays fully responsible for outsourced risks. It needs a Board-approved materiality policy, Board or committee approval of material arrangements, conflict-of-interest management, and timely reporting of material risks to the Board.

    CBUAE Outsourcing Regulation for Banks Art. 2.1, 2.5.1-2.5.4

29. CBUAEResilience and business continuity

    Critical outsourced functions must be covered in the bank's DR and BCP plans, and providers must have their own plans.

    CBUAE Outsourcing Regulation for Banks Art. 2.5.5

30. CBUAERegisters and record keeping

    Keep a complete, current register of all outsourcing (material and non-material), solo and group-wide, with provider details, dates, service description, whether Confidential Data is involved, and materiality.

    CBUAE Outsourcing Regulation for Banks Art. 3.1, 3.2

31. CBUAEData protection

    Comply with UAE data laws. The bank and its customers keep data ownership, and subcontractors handling Confidential Data must comply. Protect data from unauthorised access, including by provider staff.

    CBUAE Outsourcing Regulation for Banks Art. 4.1-4.4

32. CBUAEContracts

    Formal contracts covering data ownership, CBUAE access to data, unfettered bank access during and after the term, non-disclosure, data destruction after termination, and data protection standards (including UAE information assurance standards where applicable).

    CBUAE Outsourcing Regulation for Banks Art. 5.1-5.4, 5.9

33. CBUAESubcontracting and fourth parties

    The contract must state the extent and conditions of subcontracting. No third-party access to Confidential Data without specific authorisation.

    CBUAE Outsourcing Regulation for Banks Art. 5.5, 5.6

34. CBUAEAudit and regulator access

    The CBUAE and its appointed agents must have access to the provider, including on-site visits and supervisory information.

    CBUAE Outsourcing Regulation for Banks Art. 5.7

35. CBUAEIncident reporting

    The provider must notify the bank of data breaches.

    CBUAE Outsourcing Regulation for Banks Art. 5.8 · Timing Without undue delay

36. CBUAEData residency

    The Master System of Record, including all Confidential Data, must be continuously maintained and stored in the UAE. Foreign bank branches may keep a UAE copy updated at least daily, with CBUAE approval.

    CBUAE Outsourcing Regulation for Banks Art. 6.1, 6.2 · Timing Branch copy updated at least daily

37. CBUAECross-border data transfer

    Sharing Confidential Data outside the UAE needs CBUAE approval, the customer's prior written consent, and written acknowledgement that foreign authorities may access it. No sharing with jurisdictions lacking equivalent safeguards, or where secrecy laws would block supervisory access.

    CBUAE Outsourcing Regulation for Banks Art. 6.3-6.6, 6.9, 6.12

38. CBUAEOutsourcing notice and approval

    Prior CBUAE non-objection is needed to outsource any material activity, including to related parties. Core banking and key control functions (senior management oversight, risk, compliance, internal audit) are generally not permitted to be outsourced.

    CBUAE Outsourcing Regulation for Banks Art. 8.1, 8.2 · Timing Before outsourcing (no day count stated)

39. CBUAEIncident reporting

    Notify the CBUAE of a material breach of an outsourcing agreement, or a significant development in an outsourced material activity. Provide the register and periodic reports on request.

    CBUAE Outsourcing Regulation for Banks Art. 9.1-9.4 · Timing Immediately

40. CBUAEDue diligence

    Provider due diligence should cover financial capacity, experience, governance and internal controls, security including cyber, staffing, and country and legal risk.

    CBUAE Outsourcing Standards for Banks Standards s.2.2

41. CBUAEGovernance and Board oversight

    Materiality criteria: effect on risk control and performance, impact of provider failure, effect on regulatory compliance, and the nature of the data shared.

    CBUAE Outsourcing Standards for Banks Standards s.2.3

42. CBUAEConcentration and over-reliance

    Consider concentration risk from relying on one provider for several arrangements, or from several providers depending on the same subcontractor.

    CBUAE Outsourcing Standards for Banks Standards s.2.1(4)

43. CBUAEExit and substitution

    Arrangements should allow the activity to move to another provider or back in-house without undue delay. Contingency plans and termination provisions are expected.

    CBUAE Outsourcing Standards for Banks Standards s.2.1(3), 2.2(4), 5.1(7)

44. CBUAEOutsourcing notice and approval

    A non-objection request should contain: a description of the activity, summaries of the materiality assessment, risk assessment and due diligence, internal audit and compliance agreement, related agreements, a compliance confirmation, and evidence of Board approval. Early engagement with the CBUAE is encouraged.

    CBUAE Outsourcing Standards for Banks Standards s.8

45. CBUAERegisters and record keeping

    Keep a full, current register of all outsourcing arrangements (material and non-material) at entity and group level.

    CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.1(c)

46. CBUAEGovernance and Board oversight

    The insurer stays fully responsible for outsourced risks and must apply the same oversight as for in-house activities. It needs a materiality process, and the Board must assess continuity risk.

    CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.2(a)-(c), 12.3

47. CBUAEOutsourcing notice and approval

    Get CBUAE 'no objection' before outsourcing any Material Business Activity. Core insurance and key control functions are generally not permitted.

    CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.2(d) · Timing Before outsourcing

48. CBUAEContracts

    Written contracts setting out rights and obligations. Consider the provider's expertise, controls, financial viability and succession at contract end.

    CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.4

49. CBUAEOngoing monitoring

    The compliance function regularly reviews and reports on providers' compliance.

    CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.6

50. CBUAEData residency

    The Master System of Record with Confidential Data stays in the UAE. Foreign insurer branches may keep a UAE copy updated at least daily, with CBUAE approval.

    CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.7(a)-(b) · Timing Branch copy updated at least daily

51. CBUAECross-border data transfer

    Customer Confidential Data may not leave the UAE without CBUAE approval, the customer's prior written consent and an acknowledgement of possible foreign legal access. No outsourcing to jurisdictions without equivalent safeguards, or where secrecy laws block supervision.

    CBUAE Risk Management and Internal Controls Regulation for Insurers Art. 12.7(c)-(e)

52. CBUAEOutsourcing notice and approval Secondary source

    Outsourcing a material business activity needs CBUAE non-objection. The request includes the materiality, risk and due-diligence summaries, internal audit and compliance agreement, and evidence of approval. The CBUAE has 20 business days to grant, ask for more information, or decline.

    CBUAE Insurance Brokers Regulation - Outsourcing article Art. 17 · Timing CBUAE review: 20 business days

53. CBUAECross-border data transfer Secondary source

    Brokers must not outsource any activities outside the UAE.

    CBUAE Insurance Brokers Regulation - Outsourcing article Art. 17

54. CBUAEContracts Secondary source

    Brokers remain fully liable for providers and must contractually bind providers to the regulation.

    CBUAE Insurance Brokers Regulation - Outsourcing article Art. 17

55. CBUAEGovernance and Board oversight

    'Staff' includes third parties acting for the LFI. The LFI is responsible for staff conduct and must ensure Authorized Agents comply with the Regulation and Standards.

    CBUAE Consumer Protection Regulation Art. 1 (definitions), 3.2.2.7, 5.1.2.7

56. CBUAEOther obligations

    The LFI must handle complaints about Authorized Agents and the products they sell, and train agents on complaint handling.

    CBUAE Consumer Protection Regulation Art. 8.1.2.4, 8.1.2.6, 8.1.2.7

57. CBUAEData protection

    Have a data management and protection function. Get informed express consent before sharing consumer data with third parties. Treat consumer information as confidential.

    CBUAE Consumer Protection Regulation Art. 6.1.2.1, 6.1.2.5, 6.2.2.1

58. CBUAEIncident reporting

    Notify the CBUAE of significant data breaches, notify consumers where their security is at risk, and reimburse consumers' direct costs.

    CBUAE Consumer Protection Regulation Art. 6.1.2.4

59. CBUAEOutsourcing notice and approval

    Engage the supervisor before implementing any material cloud arrangement.

    Joint Guidelines for FIs Adopting Enabling Technologies Principle 2.11; para 3.26 · Timing Before implementation

60. CBUAEContracts

    Cloud and outsourcing contracts should cover roles, liability, disputes, supervisory access to information, and minimum controls.

    Joint Guidelines for FIs Adopting Enabling Technologies Principle 2.9

61. CBUAEExit and substitution

    Material cloud arrangements need tested continuity plans and specific exit plans.

    Joint Guidelines for FIs Adopting Enabling Technologies Principles 2.18, 2.19

62. CBUAERegisters and record keeping

    Keep a log of cloud assets and their owners, plus current records of risk assessments and due diligence for supervisory review.

    Joint Guidelines for FIs Adopting Enabling Technologies Paras 3.28, 3.30

63. CBUAEDue diligence

    Do not expose personal data to an API provider until onboarding and due diligence are complete. Pen-test the institution's and API providers' systems.

    Joint Guidelines for FIs Adopting Enabling Technologies Paras 3.7, 3.18 · Timing Pen tests at least annually

64. CBUAEIncident reporting Secondary source

    Licensed institutions must promptly notify affected customers of security breaches or fraud incidents and take corrective action.

    New Central Bank Law · Timing Promptly

65. CBUAEOther obligations Secondary source

    The CBUAE perimeter now extends to technology service providers that run platforms, protocols or infrastructure enabling financial services. Some vendors may themselves need a licence.

    New Central Bank Law

66. CBUAEOther obligations Secondary source

    Maximum administrative fine raised to AED 1 billion.

    New Central Bank Law

67. DFSAGovernance and Board oversight

    Outsourcing does not remove regulatory obligations. The outsourced function is treated as carried out by the firm itself, including for group outsourcing.

    DFSA GEN outsourcing rules GEN 5.3.21(1)-(2)

68. DFSADue diligence

    Do due diligence when choosing providers, supervise the outsourced work effectively, and deal with any provider act or failure that could breach DIFC law.

    DFSA GEN outsourcing rules GEN 5.3.21(3)

69. DFSAOutsourcing notice and approval

    Inform the DFSA of any material outsourcing arrangement.

    DFSA GEN outsourcing rules GEN 5.3.22(1) · Timing No timing stated in the rule text

70. DFSAResilience and business continuity

    For material outsourcing, keep outsourcing policies, contingency plans and risk management programmes.

    DFSA GEN outsourcing rules GEN 5.3.22(2)(a)

71. DFSAAudit and regulator access

    The written contract must require the provider to supply information, give access to its premises, and deal openly and cooperatively with the DFSA.

    DFSA GEN outsourcing rules GEN 5.3.22(2)(b), (3)

72. DFSACyber security controls Secondary source

    Keep a cyber risk management framework approved by the governing body and consistent with recognised standards (e.g. NIST CSF, ISO 27000, CIS), with senior management oversight.

    DFSA cyber risk management rules GEN 5.5

73. DFSAIncident reporting Secondary source

    Notify the DFSA of a material cyber incident through the ePortal form.

    DFSA cyber risk management rules · Timing As soon as reasonably practicable, no later than 72 hours after becoming aware

74. DFSADue diligence To be confirmed

    Third-party cyber risk should be covered in the framework; the exact sub-rule was not verified.

    DFSA cyber risk management rules

75. DFSAContracts

    Processing for a controller needs a legally binding written agreement with set contents: subject matter, duration, nature and purpose, data types, data subject categories, and processor commitments.

    DIFC Data Protection Law Art. 24(1), 24(5)

76. DFSASubcontracting and fourth parties

    Sub-processors need the controller's prior written authorisation. A general authorisation is allowed if the processor gives notice of changes and considers objections.

    DIFC Data Protection Law Art. 24(2)

77. DFSACross-border data transfer

    Transfers out of the DIFC are allowed to adequate jurisdictions; otherwise use safeguards (BCRs, Commissioner SCCs, codes, certification) or listed derogations. A documented assessment of the recipient jurisdiction is required since the 2025 amendments.

    DIFC Data Protection Law Art. 26, Art. 27

78. DFSAIncident reporting

    The controller notifies the Commissioner of a personal data breach.

    DIFC Data Protection Law Art. 41(1) · Timing As soon as practicable in the circumstances

79. DFSAIncident reporting

    The processor notifies the controller of a breach.

    DIFC Data Protection Law Art. 41(2) · Timing Without undue delay

80. DFSARegisters and record keeping

    Controllers and processors keep written records of processing.

    DIFC Data Protection Law Art. 15

81. DFSAData protection

    Do a DPIA before high-risk processing. A DPO is mandatory for high-risk processing done systematically, with an annual DPO assessment filed with the Commissioner.

    DIFC Data Protection Law Art. 16, 19, 20 · Timing DPIA before processing; DPO assessment annually

82. FSRADue diligence

    Identify outsourcing of functions directly related to Regulated Activities. Do due diligence on suitability, supervise effectively, and act on provider failures.

    FSRA GEN outsourcing rules GEN 3.3.31(1), 3.3.31(3)(a)-(c)

83. FSRAOutsourcing notice and approval Secondary source

    Inform the Regulator about material outsourcing arrangements.

    FSRA GEN outsourcing rules GEN 3.3.32(1) · Timing No timing verified

84. FSRAContracts

    Material outsourcing needs a written contract covering the prescribed factors. The FSRA expects performance metrics and default and termination clauses, and that contracts are not signed before due diligence.

    FSRA GEN outsourcing rules GEN 3.3.32(3)

85. FSRARegisters and record keeping

    The FSRA expects a full list of all providers, including software, custodians and group functions, with materiality assessed. Intragroup arrangements are outsourcing.

    FSRA GEN outsourcing rules Dear SEO letter 29 Jan 2026

86. FSRAOngoing monitoring

    Risk-rate providers to drive review frequency. Monitor KPIs, adverse news and ownership changes. Have a policy on onsite visits for overseas providers.

    FSRA GEN outsourcing rules Dear SEO letter 29 Jan 2026

87. FSRASanctions and AML screening

    Outsourced CDD, eKYC and sanctions-screening tools fall under the AML Rulebook outsourcing rules and need periodic assurance.

    FSRA GEN outsourcing rules AML 9.3.1

88. FSRAIncident reporting

    Notify the FSRA of a suspected material cyber incident immediately on discovery, with a 24-hour backstop for the initial report (Template A) emailed to [email protected], copying the supervisor. Progress updates (Template B) follow at a frequency the supervisor sets.

    FSRA Cyber Risk Management Rules GEN 3.5.18; GEN 8.10 · Timing Immediately; no later than 24 hours (CP text: including weekends and public holidays)

89. FSRADue diligence Secondary source

    Do due diligence on ICT service providers. Contracts must require them to meet the firm's cyber requirements, notify cyber incidents, help with remediation and allow verification.

    FSRA Cyber Risk Management Rules GEN 3.5.2 (numbering as proposed in CP 3/2025)

90. FSRACyber security controls Secondary source

    Keep a cyber risk management framework approved by the governing body and reviewed annually. Requirements include an asset inventory recording where each asset is stored, access control, MFA, encryption and patching.

    FSRA Cyber Risk Management Rules GEN 3.5.1-3.5.13 (numbering as proposed) · Timing Framework reviewed at least annually

91. FSRAResilience and business continuity

    Keep a cyber incident response plan and test it. The UAE Cyber Security Council's national plan can serve as a reference.

    FSRA Cyber Risk Management Rules GEN 3.5.16

92. FSRAOngoing monitoring Secondary source

    Run a resilience testing programme, at least annually for internet-facing systems.

    FSRA Cyber Risk Management Rules GEN 3.5.14 (as proposed) · Timing At least annually

93. FSRAIncident reporting

    The controller notifies the Office of Data Protection of a personal data breach via the Online Registry Solution ('Notify the Office of Data Protection' then 'Data Breach Notification').

    ADGM Data Protection Regulations 2021 s.32 · Timing Without undue delay and, where feasible, within 72 hours of awareness

94. FSRAIncident reporting

    The processor notifies the controller of a breach; it does not notify the Commissioner.

    ADGM Data Protection Regulations 2021 ODP Guidance Part 5, para 4.8 · Timing Without undue delay

95. FSRACyber security controls

    Controllers and processors implement appropriate technical and organisational security measures.

    ADGM Data Protection Regulations 2021 s.30(1)

96. FSRAContracts Secondary source

    Controllers must put safeguards in place with processors (data protection agreement, audits, due diligence).

    ADGM Data Protection Regulations 2021

97. FSRACross-border data transfer Secondary source

    Transfers out of ADGM go to adequate jurisdictions, or use appropriate safeguards (ADGM SCCs, BCRs) or derogations (consent, contract necessity, infrequent transfers).

    ADGM Data Protection Regulations 2021

98. CMA (formerly SCA)Other obligations Secondary source

    The SCA is reconstituted as the Capital Market Authority (CMA). Vendor and licence records should show 'CMA' for onshore securities firms from 2026. Virtual assets now sit within the CMA perimeter, which may overlap with VARA for Dubai VASPs.

    Capital Market Authority laws (SCA renamed CMA) · Timing Grace period to 1 Jan 2027 (secondary source)

99. CMA (formerly SCA)Outsourcing notice and approval To be confirmed

    The 2024 amendments added outsourcing requirements for licensed firms. The location in the Rulebook, the conditions, and any approval or notification duty to the regulator were NOT verified.

    SCA (now CMA) Rulebook for Financial Activities

100. VARAGovernance and Board oversight

     The VASP stays fully accountable. Outsourcing that would materially impair internal controls or VARA oversight is prohibited. The MLRO, CISO and DPO roles may be outsourced, but VARA can require in-house staff.

     VARA Company Rulebook - Part IV Outsourcing Part IV, Section A

101. VARADue diligence

     Risk-assess each arrangement, including materiality. Due diligence covers capacity, financial soundness, reputation, regulatory status, reliance on subcontractors and virtual-asset expertise.

     VARA Company Rulebook - Part IV Outsourcing Part IV, Section B · Timing Assess before start and at least annually; review providers at least annually

102. VARARegisters and record keeping

     Keep an Outsourcing Policy and a register with provider, scope, location, dates, contacts, materiality, and whether personal or confidential data is involved.

     VARA Company Rulebook - Part IV Outsourcing Part IV, Section C

103. VARAContracts

     Written contracts with mandatory terms. Material outsourcing adds service levels, contingency testing, regulator cooperation, exit assistance, insurance, and specified data and processing locations. Client data is returned or destroyed on exit.

     VARA Company Rulebook - Part IV Outsourcing Part IV, Section D · Timing Provider breach notice to VASP: without undue delay

104. VARASubcontracting and fourth parties

     Sub-outsourcing terms are required. The provider notifies planned changes, and the VASP may object or terminate.

     VARA Company Rulebook - Part IV Outsourcing Part IV, Section E

105. VARAOutsourcing notice and approval

     Notify VARA before any cross-border outsourcing, and promptly if an overseas authority seeks access to VASP information.

     VARA Company Rulebook - Part IV Outsourcing Part IV, Section F · Timing Prior to cross-border outsourcing; overseas access request: as soon as possible

106. VARAAudit and regulator access

     For material outsourcing, the VASP, VARA and appointed bodies get full access to premises, systems, data and staff. Pooled audits and certifications cannot replace the VASP's own audit right.

     VARA Company Rulebook - Part IV Outsourcing Part IV, Section G

107. VARAOutsourcing notice and approval

     Notify VARA in advance of any new or materially changed Material Outsourcing. VARA may object, and its concerns must be resolved first.

     VARA Company Rulebook - Part IV Outsourcing Part IV, Section H.3-H.4 · Timing In advance

108. VARAIncident reporting

     Notify VARA of a material breach of a Material Outsourcing agreement, or a development that could significantly affect operations, finances or reputation.

     VARA Company Rulebook - Part IV Outsourcing Part IV, Section H.1-H.2 · Timing Immediately

109. VARAIncident reporting

     Report a material cybersecurity event, or an event that triggers the BCDR plan and materially affects operations, with its nature, scope, impact and mitigation, and whether other authorities were told.

     VARA Technology and Information Rulebook Part I, Section K, para 1 · Timing As soon as reasonably practicable, no later than 72 hours from detection

110. VARAIncident reporting

     After notifying a data regulator or data subjects of a personal-data incident, notify VARA and give a summary (or a copy, if the regulator is in the UAE).

     VARA Technology and Information Rulebook Part II, Section C, para 2 · Timing As soon as possible, within 24 hours of the other notification

111. VARARegisters and record keeping

     Give VARA access to compliance information within the timelines VARA sets.

     VARA Technology and Information Rulebook Part II, Section C, para 1 · Timing As communicated by VARA

112. Government and critical sectorsCyber security controls To be confirmed

     Management and technical security controls for designated critical entities. v2 reportedly adds AI, cloud (data location, key management, sovereignty) and IoT/OT controls.

     UAE Information Assurance Regulation / Standard

113. Government and critical sectorsDue diligence To be confirmed

     Third-party security controls exist in the IAR family, but the clause IDs were not verified.

     UAE Information Assurance Regulation / Standard

114. Government and critical sectorsResilience and business continuity Secondary source

     The national cyber incident response plan is a reference for firm-level incident response plans.

     UAE Cyber Security Council national policies

115. Government and critical sectorsCyber security controls To be confirmed

     A national cloud security policy exists; its content and applicability were not reviewed.

     UAE Cyber Security Council national policies

116. Government and critical sectorsIncident reporting

     Entities must report threats, hacks, leaks, interceptions or risks to DESC.

     Dubai Electronic Security Centre Law Art. 14(4) · Timing Immediately

117. Government and critical sectorsDue diligence

     Use only DESC-certified private electronic security companies and hosts. Data centres and cloud providers need DESC certification to connect to DESC networks. Outsourcing partners may be certified.

     Dubai Electronic Security Centre Law Art. 14(8); Art. 6(11); Art. 15(b)

118. Government and critical sectorsCyber security controls

     Comply with DESC rules (including the ISR), connect to a DESC or certified SOC, and get DESC approval before sharing electronic security data.

     Dubai Electronic Security Centre Law Art. 14(1)-(7)

119. Government and critical sectorsDue diligence To be confirmed

     v3.0 adds minimum security and compliance requirements for external parties and managed services.

     Dubai Information Security Regulation (ISR) ISR Domain 12 (per secondary source)

120. Government and critical sectorsData residency To be confirmed

     v3.0 reportedly bars storing or processing critical information outside the UAE, including in cloud services.

     Dubai Information Security Regulation (ISR)

121. Government and critical sectorsGovernance and Board oversight To be confirmed

     v3.0 reportedly requires a UAE National to head information security or act as CISO, reporting to top management.

     Dubai Information Security Regulation (ISR)

122. Government and critical sectorsDue diligence

     Contractors must be licensed companies. Sole proprietorships, civil companies and partnerships are excluded. The entity assesses efficiency, solvency and compliance.

     Dubai Government Services Outsourcing Law Art. 2; Art. 7(8), 7(15); Art. 10(2)

123. Government and critical sectorsData protection

     Contractors protect customer data privacy and confidentiality under Dubai Digital Authority and DESC processes.

     Dubai Government Services Outsourcing Law Art. 8(5)

124. Government and critical sectorsOther obligations

     Emiratisation: contractors employ at least one UAE National for every non-UAE National.

     Dubai Government Services Outsourcing Law Art. 3(7); Art. 19

125. Government and critical sectorsContracts

     Contracts must cover scope, service levels, revenue sharing, audit and termination, with a minimum term of 3 years (renewable). Exclusive contracts are banned unless there is a single bidder.

     Dubai Government Services Outsourcing Law Art. 9-11; Art. 21 · Timing Minimum term 3 years

126. Government and critical sectorsSubcontracting and fourth parties

     Assigning the contract or partnering with third parties needs the entity's prior written approval and a tripartite agreement.

     Dubai Government Services Outsourcing Law Art. 12(b)

127. Government and critical sectorsOngoing monitoring

     Performance KPIs, audit access, and monthly revenue reports reconciled by the entity.

     Dubai Government Services Outsourcing Law Art. 7(3); Art. 8(9); Art. 14; Art. 15; Art. 18 · Timing Monthly revenue reports

128. Government and critical sectorsData residency

     Health information (PII, PHI or copies) must not be stored, processed or transferred outside the UAE without a valid, specific DoH exemption.

     ADHICS v2 CO 9.2 (item 6)

129. Government and critical sectorsData residency Secondary source

     Third-party staff delivering services must work from within the UAE unless DoH grants an exemption.

     ADHICS v2 CO 9.2 (item 7)

130. Government and critical sectorsSubcontracting and fourth parties

     Third parties must notify the entity in advance of changes, including relocation, reconfiguration and onboarding of sub-contractors.

     ADHICS v2 CO 2.3 (item 5) · Timing In advance

131. Government and critical sectorsDue diligence

     Background verification of contractors and third-party users before access, and revocation of access within 24 hours of exit.

     ADHICS v2 HR 2.1; HR 4.3 · Timing Revoke access within 24 hours of exit

132. Government and critical sectorsExit and substitution

     Third-party assessors must not keep assessment data after the engagement; it must be erased from their assets.

     ADHICS v2 CO 7.2

133. Government and critical sectorsData residency

     Health information and data for services provided in the UAE may not be stored, processed, generated or transferred outside the UAE, except in cases set by a Health Authority decision coordinated with MOHAP.

     Health ICT Law (health data localisation) Art. 13

134. Government and critical sectorsCross-border data transfer Secondary source

     Exceptions under MOHAP Resolution 51/2021 include treatment abroad, overseas labs, research, insurers and claims, authority requests, personal devices and pharmacovigilance. Conditions include consent, encryption and a copy kept in the UAE.

     Health ICT Law (health data localisation) MOHAP Resolution 51/2021

135. Government and critical sectorsRegisters and record keeping

     Retain health information for at least 25 years from the last health procedure.

     Health ICT Law (health data localisation) Art. 20(1)(a) · Timing At least 25 years

136. Government and critical sectorsAnti-bribery and conflicts of interest

     Integrity and conflict-of-interest rules. Employees may not take part in procurements where they or their companies have an interest, and must report conflicts.

     Federal Government Procurement Law Art. 10(3)-(4)

137. Government and critical sectorsGovernment procurement

     A preferential margin is possible for in-country value, local products and SMEs, as set by the Executive Regulations.

     Federal Government Procurement Law Art. 7(8); Art. 22(2)

138. Government and critical sectorsGovernment procurement

     Grounds to exclude bidders (non-compliance, poor past performance, unpaid government dues), and to cancel awards for bribery, fraud or bid rigging.

     Federal Government Procurement Law Art. 24(1)-(3); Art. 25; Art. 27(2)

139. Government and critical sectorsGovernment procurement Secondary source

     Suppliers register on the Federal Supplier Register (Ministry of Finance) to bid on the Digital Procurement Platform, renewed annually.

     Federal Government Procurement Law · Timing Annual renewal

140. Government and critical sectorsGovernment procurement Secondary source

     Dubai: a central supplier registry within the unified contracts system; suppliers register on eSupply.

     Dubai and Abu Dhabi government supplier rules

141. Government and critical sectorsGovernment procurement Secondary source

     Abu Dhabi: DED-licensed suppliers self-register on ADGPG; other and international suppliers apply through the contracting entity. A profile is visible to all Abu Dhabi entities.

     Dubai and Abu Dhabi government supplier rules

142. Government and critical sectorsGovernment procurement

     ICV certificates are issued by about 21 authorised certifying bodies. A certificate is valid for 14 months from the date of the audited financial statements used.

     National In-Country Value (ICV) Programme · Timing Certificate validity: 14 months

143. Government and critical sectorsGovernment procurement

     For federal tenders, ICV certification is optional, but a supplier without a certificate scores zero for ICV.

     National In-Country Value (ICV) Programme

144. Federal lawIncident reporting Secondary source

     The controller reports a breach that harms privacy, confidentiality or security to the Data Office, with investigation results; data subjects may also need notice. Detailed timing awaits the Executive Regulations.

     UAE Personal Data Protection Law (PDPL) Art. 9 · Timing Immediately on becoming aware (period to be set by Executive Regulations)

145. Federal lawContracts Secondary source

     Processors act on controller instructions and both apply technical and organisational security measures. The processor article number was not verified (believed to be Art. 8).

     UAE Personal Data Protection Law (PDPL)

146. Federal lawCross-border data transfer Secondary source

     Transfers are allowed to jurisdictions the Data Office approves as adequate, or where there is a treaty.

     UAE Personal Data Protection Law (PDPL) Art. 22

147. Federal lawCross-border data transfer Secondary source

     Without adequacy: limited derogations such as contractual undertakings, explicit consent and contract necessity. Details depend on the Executive Regulations.

     UAE Personal Data Protection Law (PDPL) Art. 23

148. Federal lawData protection Secondary source

     DPO and DPIA duties for high-risk processing.

     UAE Personal Data Protection Law (PDPL) Art. 10 (DPO); Art. 21 (DPIA)

149. Federal lawSanctions and AML screening Secondary source

     STRs go exclusively to the FIU. The FIU head can suspend transactions for up to 10 days and freeze assets for up to 30 days.

     AML/CFT/CPF Law Art. 11; Art. 5

150. Federal lawOngoing monitoring Secondary source

     Continuous monitoring obligation.

     AML/CFT/CPF Law Art. 19

151. Federal lawBeneficial ownership Secondary source

     Knowingly giving false or misleading beneficial ownership information is a criminal offence (imprisonment and/or a fine of at least AED 20,000).

     AML/CFT/CPF Law Art. 35(1)

152. Federal lawOther obligations Secondary source

     Corporate fines of AED 5m-100m for ML/TF/PF by representatives; regulator administrative fines up to AED 5m; no limitation period for offences.

     AML/CFT/CPF Law Art. 27(1); Art. 17; Art. 37

153. Federal lawRegisters and record keeping Secondary source

     Keep CDD and transaction records for at least 5 years from the most recent event.

     AML Executive Regulations 2025 · Timing Minimum 5 years

154. Federal lawBeneficial ownership Secondary source

     UBO information must be updated when it changes.

     AML Executive Regulations 2025 · Timing Within 15 working days of a change (secondary source)

155. Federal lawSanctions and AML screening Secondary source

     Report suspicious transactions promptly via the FIU's electronic system (goAML).

     AML Executive Regulations 2025 · Timing Promptly

156. Federal lawSanctions and AML screening

     Screen customers, counterparties, beneficial owners and related persons against the UAE Local Terrorist List and the UN Consolidated List. Subscribe to EOCN email alerts and re-screen immediately after each update.

     Targeted Financial Sanctions regulation Art. 21 (screening) · Timing Immediately after each list update

157. Federal lawSanctions and AML screening

     Freeze funds of listed persons without prior notice. Do not provide funds or services without EOCN permission.

     Targeted Financial Sanctions regulation Art. 15 (freezing) · Timing Without delay = within 24 hours of the listing decision

158. Federal lawSanctions and AML screening Secondary source

     Report via goAML: a Fund Freeze Report (FFR) for confirmed matches, and a Partial Name Match Report (PNMR) for potential matches, keeping the suspension in place until instructed.

     Targeted Financial Sanctions regulation · Timing Within 5 business days (CBUAE and FSRA 2025 guidance)

159. Federal lawBeneficial ownership Secondary source

     A beneficial owner is a natural person owning or controlling 25% or more of shares or votes, directly or indirectly. If there is none, record whoever controls by other means; failing that, the senior managing official.

     Beneficial Owner Procedures

160. Federal lawBeneficial ownership Secondary source

     Keep a beneficial owner register, a register of partners or shareholders, and nominee declarations, and file them with the registrar.

     Beneficial Owner Procedures · Timing Notify changes within 15 days (ADGM uses 30 days)

161. Federal lawBeneficial ownership To be confirmed

     Fines of roughly AED 20,000-100,000 for register failures; the licence can be suspended for repeated violations.

     Beneficial Owner Procedures Cabinet Decision 132/2023 Art. 3(1)

162. Federal lawDue diligence Secondary source

     Free zone companies trading onshore must set up a mainland branch or representative office. Check that free zone vendors serving onshore clients have one.

     Commercial Companies Law

163. Federal lawDue diligence Secondary source

     Companies can now re-domicile between free zones and the mainland, so re-check the vendor's registering authority at each review.

     Commercial Companies Law

164. Federal lawBeneficial ownership Secondary source

     LLCs may issue share classes with different voting or economic rights, recorded in the Commercial Register. Control analysis needs the share-class data.

     Commercial Companies Law

165. Federal lawDue diligence Secondary source

     A TRN is 15 digits and starts with '100'. Verify it on the FTA's public EmaraTax TRN verification service (no login; CAPTCHA). The result shows legal name, TRN and status. One TRN generally covers VAT and corporate tax, but status can differ by tax type.

     VAT and Corporate Tax registration (TRN)

166. Federal lawOther obligations Secondary source

     Both issuer and recipient need an Accredited Service Provider. Report system outages to the FTA. Vendor master data must support e-invoicing readiness.

     UAE e-invoicing · Timing Outage report within 2 business days; large-business go-live 1 Jan 2027

167. Federal lawAnti-bribery and conflicts of interest

     Passive bribery by public officials, including foreign officials and international organisation staff.

     Penal Code - bribery offences Arts. 275, 276

168. Federal lawAnti-bribery and conflicts of interest Secondary source

     Private-sector bribery: managers or employees soliciting or accepting (passive), and offering or giving (active).

     Penal Code - bribery offences Art. 278 (passive); Art. 279 (active)

169. Federal lawAnti-bribery and conflicts of interest Secondary source

     Active bribery of public officials, trading in influence, and intermediaries. Vendor and agent payments are in scope.

     Penal Code - bribery offences Art. 280; Art. 281; Art. 282

170. Federal lawAnti-bribery and conflicts of interest To be confirmed

     A briber or recipient who reports before discovery may be exempt. There is a separate offence of failing to report a crime.

     Penal Code - bribery offences Art. 323 (failure to report)

171. Federal lawCyber security controls

     It is a crime to hack systems (with higher penalties for government systems), harm systems (aggravated for banking, health and critical facilities), or obtain confidential government, financial or commercial data, credentials or personal data without authority. Vendor access controls and contracts should reflect this.

     Cybercrime Law Arts. 2, 3, 4, 5, 6, 7, 8, 9, 12

172. Federal lawDue diligence Secondary source

     Temporary work and outsourced labour must go through licensed agencies. The agency carries the employer's obligations even if the client defaults, and keeps worker records for at least 2 years. The client (beneficiary) must provide OHS and keep workers within agreed duties and hours.

     Labour Law, agencies and WPS MD 51/2022 · Timing Agency record retention: at least 2 years

173. Federal lawOngoing monitoring To be confirmed

     Wages must be paid through WPS; MoHRE sanctions apply for delays. For outsourced staff on site, ask for WPS compliance evidence.

     Labour Law, agencies and WPS MR 598/2022 · Timing Salaries due via WPS by the 15th of the following month (secondary source)

174. Federal lawDue diligence Secondary source

     Check onshore licences and activities via the NER (growth.gov.ae). Confirm against the issuing authority (DED/DET, free zone authority, or the DIFC/ADGM registers), since free-zone coverage in the NER is not confirmed.

     National Economic Register (NER) and licence checks

175. Federal lawOther obligations

     Federal government works Monday to Thursday 7:30-15:30 and Friday 7:30-12:00; the weekend is Saturday and Sunday. Sharjah government works Monday to Thursday with a Friday-to-Sunday weekend. Private sector hours vary.

     Working week and public holidays

176. Federal lawOther obligations

     Official holidays: New Year (1 Jan); Eid al-Fitr (29 Ramadan-3 Shawwal); Arafat Day and Eid al-Adha (9-12 Dhul Hijjah); Hijri New Year (1 Muharram); Prophet's Birthday (12 Rabi al-Awwal); National Day (2-3 Dec). A holiday is not moved if it falls on another holiday or a weekend (Art. 3).

     Working week and public holidays Cabinet Resolution 27/2024, Art. 3

177. Federal lawOther obligations Secondary source

     2026 dates as announced: Eid al-Fitr 19-21 Mar (22 Mar if Ramadan had 30 days); Eid al-Adha incl. Arafat 26-29 May; Hijri New Year Mon 15 Jun; Prophet's Birthday Fri 28 Aug; National Day 2-3 Dec. 2027: only the fixed dates (1 Jan, 2-3 Dec) are known; Islamic holidays not yet announced.

     Working week and public holidays

178. Federal lawOther obligations

     English versions on uaelegislation.gov.ae are translations: if they conflict, the Arabic text prevails and is the reference for interpretation. The Dubai DESC law states the same. Bilingual templates should say which language governs.

     Arabic as the prevailing legal text

No requirement matches these filters.

Mapped from our source-by-source research, checked on 3 November 2026. High-confidence items were checked on an official page; Secondary source means law-firm or other secondary sources only; To be confirmed means reported but not verified.

This is a summary for orientation, not legal advice. Always rely on the official text, and take advice on your own situation. For federal legislation, the Arabic text prevails.

NexaBytes · One-minute regulatory updates

UAE rules in a minute.

Video clips of a minute or less from NexaPair and Kayak Strategic Advisors: one rule, its deadline and source, and what it means for your vendors.

• Four hours to tell the Central Bank

  52 seconds · NexaPair × Kayak Strategic Advisors

  CBUAEC 1/2026

  For operational risk events that significantly affect, or may affect, Critical Operations (e.g. events that trigger BCP or DR, or materially affect customers, operations, profit or capital): first notify the CBUAE, naming the affected Critical Operations.

  Within 4 hours

  How NexaPair helps: Incident records

  CBUAE Operational Risk Management Regulation Art. 15.2, 15.2.1 · Source

• 72 hours for a high-risk incident

  40 seconds · NexaPair × Kayak Strategic Advisors

  CBUAEC 1/2026

  Separate trigger: notify the CBUAE of any high-risk Incident, as defined by Board-approved classification criteria.

  Within 72 hours

  How NexaPair helps: Incident records

  CBUAE Operational Risk Management Regulation Art. 15.3 · Source

• ADGM: report a cyber incident at once

  52 seconds · NexaPair × Kayak Strategic Advisors

  FSRAGEN 3.5 (Notice of Publication 29 Jul 2025)

  Notify the FSRA of a suspected material cyber incident immediately on discovery, with a 24-hour backstop for the initial report (Template A) emailed to [email protected], copying the supervisor. Progress updates (Template B) follow at a frequency the supervisor sets.

  Immediately; no later than 24 hours (CP text: including weekends and public holidays)

  How NexaPair helps: Passive outside-in cyber posture: an A to F grade per vendor, history, scheduled re-checks and grade-drop alerts

  FSRA Cyber Risk Management Rules GEN 3.5.18; GEN 8.10 · Source

• Freeze without delay

  50 seconds · NexaPair × Kayak Strategic Advisors

  Federal lawCabinet Decision 74/2020

  Freeze funds of listed persons without prior notice. Do not provide funds or services without EOCN permission.

  Without delay = within 24 hours of the listing decision

  How NexaPair helps: Sanctions and PEP screening via OpenSanctions

  Targeted Financial Sanctions regulation Art. 15 (freezing) · Source

• VARA: notify immediately

  43 seconds · NexaPair × Kayak Strategic Advisors

  VARAVersion 19 May 2025 (PDF VARA_EN_36_VER20250519)

  Notify VARA of a material breach of a Material Outsourcing agreement, or a development that could significantly affect operations, finances or reputation.

  Immediately

  How NexaPair helps: Incident records

  VARA Company Rulebook - Part IV Outsourcing Part IV, Section H.1-H.2 · Source

• Dubai: report threats to DESC

  34 seconds · NexaPair × Kayak Strategic Advisors

  Government and critical sectorsDubai Law 15/2024

  Entities must report threats, hacks, leaks, interceptions or risks to DESC.

  Immediately

  How NexaPair helps: Incident records

  Dubai Electronic Security Centre Law Art. 14(4) · Source

Mapped from our source-by-source research, checked on 3 November 2026. High-confidence items were checked on an official page; Secondary source means law-firm or other secondary sources only; To be confirmed means reported but not verified. Kayak Strategic Advisors can help you scope and implement the change.