CBUAE compliance and requirements for licensed institutions that must show control, not just claim it.

What it is

What are the CBUAE regulations and what are they used for?

The Central Bank of the UAE (CBUAE) licenses and supervises institutions in the banking, insurance and payment system sectors, together with exchange houses and hawala providers. Its stated aim is the safety and soundness of those institutions, and it supervises on a risk-based footing, combining on-site examination with off-site review. The rules it expects them to follow are gathered in the CBUAE Rulebook, organised into four parts: provisions for all licensed financial institutions, then banking, insurance and other regulated entities.

For governance, risk and compliance, the Rulebook matters because it turns expectations into obligations. Regulations set the obligation; accompanying standards explain how the Central Bank expects it to be met. Firms ask us most about operational risk and resilience, cybersecurity, continuity, outsourcing, consumer protection and the governance that ties them together. Anti-money laundering sits in its own Rulebook section and is scoped separately.

Current position. The Rulebook is a living source, so the version that binds you is the one shown there today. The Operational Risk Management Regulation, Circular C 1/2026, is shown as in force for all licensed financial institutions that are juridical persons, and the earlier Operational Risk Regulation for banks, Circular C 163/2018, is marked repealed and replaced. The Rulebook also lists Federal Decree-Law No. (6) of 2025 among its laws. Confirm with your compliance and legal teams which provisions apply to your licence before the programme is planned.

Who it is for

Who needs CBUAE compliance?

Any institution holding a Central Bank licence is inside the Rulebook; the question is which parts. A retail bank, a reinsurer and a stored-value provider carry different sets of obligations. Firms usually reach us from one of four starting points:

• New rules have arrived. The Operational Risk Management Regulation now reaches insurers and other licensed institutions as well as banks, with resilience, incident, continuity and third-party expectations that many frameworks were not built for.
• A supervisory review or finding. An examination, a thematic request or a board query has shown that policies exist but evidence does not, and remediation needs owners and dates.
• A new licence, product or outsourcing plan. Launching a service, moving workloads to a cloud or offshore provider, or entering a group arrangement means outsourcing, data and consumer rules must be settled first.
• A group or partner asks for assurance. A parent, correspondent bank, fintech partner or insurer's reinsurer wants to see how CBUAE obligations are met before it relies on you.

What you gain is control you can show when the Central Bank asks; the regulator, not the programme, judges compliance.

Requirements

What are the main CBUAE requirements for GRC?

The list below follows the regulation titles and headings as they appear in the CBUAE Rulebook. It is a plain-language map, not a restatement of the law; each obligation is read against the current Rulebook text, and against the standards that accompany it, during the programme.

• Operational risk management framework: a framework approved by the board, clear roles for the board and senior management, a dedicated operational risk function and an internal control system, under the Operational Risk Management Regulation.
• Operational resilience: the ability to keep critical operations running through disruption, planned and tested rather than assumed.
• ICT and cybersecurity management: governance, access control, data protection and resilient technology behind the services the institution provides.
• Incident management: incidents recorded, analysed for root cause and communicated to the relevant authorities, including the Central Bank, where required.
• Risk data, systems and change: reliable risk data and systems, and controlled change to operations, products and technology.
• Business continuity planning: response, continuity and disaster recovery plans for critical operations, with defined recovery objectives and regular testing.
• Third parties and outsourcing: third-party risk management across licensed institutions and, for banks, the Outsourcing Regulation for Banks (Circular C 14/2021) and its standards: governance, an outsourcing register, data protection, written agreements, outsourcing outside the UAE, non-objection by the Central Bank and reporting.
• Consumer protection: the Consumer Protection Regulation (Circular C 8/2020) and its standards: disclosure and transparency, market and business conduct, protection of consumer data and assets, responsible financing, and complaint management.
• Governance and internal control: for banks, the Corporate Governance Regulation for Banks and the Internal Controls, Compliance and Internal Audit Regulation, each with standards; for licensed institutions, the Fitness and Propriety Regulation.
• Risk management and recovery: the Risk Management Regulation and Standards for banks, credit and climate-related financial risk rules, and the Recovery Planning Regulation.

Compliance process

How do you achieve CBUAE compliance?

There is no audit that ends in a certificate. Compliance is built into how the institution runs and then tested by the Central Bank when it chooses to supervise. Sterling helps you build and evidence it; the regulator reaches its own view, and your legal advisers interpret the law.

1. 01
   Map what applies to your licence.Licence category, entities, products, customer types and outsourcing arrangements set against the Rulebook, producing a register of every regulation and standard in scope.
2. 02
   Gap analysis: test current practice against each obligation.Policies, committees, systems, records and contracts reviewed heading by heading; what already works is kept, and each gap gets an action, owner, date and priority.
3. 03
   Implement and evidence the controls.Framework documents approved, risk and control assessments run, continuity and incident processes exercised, supplier files completed and staff trained, each step leaving its record.
4. 04
   Review independently of the build team.An internal compliance review or internal audit against the mapped obligations, reported to senior management and the board, with findings closed on evidence.
5. 05
   Face supervision prepared, and keep it running.Responses to Central Bank requests and examinations drawn from an existing evidence file, then periodic testing, register updates and Rulebook changes absorbed as they are issued.

Check the route before you sign. No consultant can declare an institution CBUAE compliant, and a "compliance certificate" offered for this Rulebook is not a regulatory document. Read every obligation in the current Rulebook yourself, keep interpretation with your legal advisers, and where you want an independent certificate for related work, such as ISO/IEC 27001 or ISO 22301, confirm the certification body's accreditation directly with the accreditation body under the Global ACI arrangement. How to choose a credible CBUAE compliance provider · The certification buyer's checklist

Cost

How much does CBUAE compliance cost?

The Rulebook binds a small exchange house and a systemically important bank very differently, so no single price means anything. A Sterling proposal shows each component and states everything that is included.

Timeline

How long does CBUAE compliance take?

An estimate of four to nine months covers most programmes, and it moves with the regulations in scope, the depth of existing controls and how quickly boards and committees approve. Controls need time to run so that records exist when a supervisor looks.

If a finding carries a remediation date, tell us on day one and we will plan around it accurately.

Your engagement

What your CBUAE compliance engagement includes

Sterling does not certify, attest or validate compliance, and there is no CBUAE certificate to issue; the Central Bank supervises and decides, and we work alongside your legal advisers rather than replacing them. Within that line, one team takes the programme from mapping to steady running, organised on Sterling OS™.

• Applicability register and gap analysis

  Every relevant regulation and standard mapped to your licence, with owners and a dated action plan.

• Design™ or Drive™ support

  Choose one level: Design™ guides your team as it builds the framework; Drive™ has Sterling manage the build with your owners approving.

• Effivity ISO & GRC software

  Registers, controls, incidents and evidence run in Effivity from day one, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Independent internal review

  A compliance review or internal audit against the mapped obligations, findings closed with evidence before supervisors ask.

• Sustain™ after go-live

  Periodic testing, register upkeep and new Rulebook provisions absorbed, with Automate™ delivered through Effivity.

Compliance decisions remain with the Central Bank of the UAE.

Often combined with

Standards organisations pair with CBUAE regulations

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
• Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
• BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• DORADORA compliance consulting for EU financial entities and ICT providers: ICT risk, incident reporting, resilience testing and third-party risk, evidenced.