CBUAE operational risk rules, what licensed firms must show

Have an operational risk management framework with strategies, policies, procedures, systems and controls to identify, assess, monitor, report and control operational risk in good time.

Integrate the framework into your broader risk management and governance.

Keep strategy, policies and processes consistent with your risk profile and appetite, and revise them when the risk profile changes materially.

Cover all material aspects of operational risk, including activities outsourced to or reliant on third parties.

Document at minimum the governance structure, policies including appetite and tolerance, assessment tools, common terminology, limits and thresholds, monitoring and reporting, and mitigation strategies.

Manage internal and external fraud risk within the framework, including incidents or threats affecting customers.

Have the Board bear ultimate responsibility for an adequate operational risk framework that is integrated into broader risk management and includes operational resilience.

Have the Board itself, not a committee, approve and review at least annually the operational risk and resilience strategies, the risk appetite and tolerance, the tolerance for disruption and the continuity and recovery plans, with a review of those plans at least every three years if delegated.

Run a formal process to oversee senior management and confirm approved strategies and limits are applied.

Have the Board approve, oversee and ensure the effectiveness of the ICT and cybersecurity risk management framework.

Make sure internal audit independently reviews the operational risk framework.

Build a strong operational risk culture and communicate the approach to staff, third parties and group entities.

Set up a Board operational risk committee or designated Board committee if you are designated systemically important, or if the Central Bank requires it.

Have senior management put the Board-approved framework and resilience strategy into effective policies, controls and systems.

Monitor the operational risk profile and material exposures through strong processes and reporting.

Report operational risk and resilience to the Board regularly, in a timely and proactive way.

Report any breaches or expected breaches of appetite, tolerance, thresholds and limits to the Board itself, not only a committee.

Assess the internal control system regularly, at least yearly for banks and insurers, and give a report on internal control to the Board and the Central Bank.

Regularly evaluate the design, implementation and effectiveness of ICT and cybersecurity risk management.

Provide enough staff, skills and resources, and make sure staff receive regular training.

Run an adequately resourced, sufficiently independent operational risk management function under the Chief Risk Officer.

Have the function form an independent view of risks and controls, challenge business use of tools, maintain policies, monitor the profile, identify threats, assess vulnerabilities of critical operations, and provide training.

Have the function report its findings and recommendations to the Board regularly.

Foster a strong control environment with an effective internal control system covering risk assessment, control activities, monitoring, and information and communication.

Cover all activities in the control system, including those fully or partly reliant on third parties.

Use control measures such as approval authorities, segregation of duties, dual control, limit monitoring, access safeguards, reconciliations and mandatory leave.

Review processes for manual steps that could be automated, and assess the accuracy and risks of automated controls.

Keep a register of processes, the process universe, with a process owner and risk owner for each.

Apply three lines of defence: business management, risk and compliance functions, and internal audit.

Monitor operational risk profiles and exposures with reporting that is comprehensive, accurate, consistent, actionable and timely in normal and stressed conditions.

Stress-test operational risk periodically, including exercises such as penetration testing across ICT, physical, people and other risk vectors.

Include independent third-party penetration testing, at least for Critical Functions, and present results to the Board.

Have an operational resilience strategy, with policies and controls, that helps you respond to, adapt to, recover from and learn from disruption.

Use the risk framework to find internal and external threats and failures in people, processes and systems and assess critical operations for vulnerabilities.

Set out when senior management must alert the Board about disruption or potential disruption.

Identify critical operations and the people, technology, processes, data, facilities and providers that support them, with their dependencies, in a map kept up to date through change management.

Treat payment systems and services, accurate financial records, solvency and liquidity management and anything the Central Bank designates as critical operations at minimum.

Develop and regularly review incident response, business continuity and disaster recovery plans for all critical operations.

Implement an ICT and cybersecurity risk framework covering risk identification, mitigation, regular monitoring and testing, and ongoing proactive management.

Address ICT and cybersecurity risk and resilience in your risk appetite and tolerance, including performance and tolerance for disruption.

Maintain ICT and cybersecurity infrastructure for current and projected needs, including during stress, to keep data and systems intact, confidential and available.

Keep the Board and senior management informed about ICT and cybersecurity risk exposures, incidents and weaknesses found in testing.

Run protection, detection, response and recovery programmes for ICT and cybersecurity, regularly tested and informing risk decisions.

Make the ICT and cybersecurity policy cover governance, risk ownership, security measures, monitoring, data management, operations, incident and recovery plans, project management and systems development.

Review ICT and cybersecurity risk management against industry standards, test it for gaps against tolerance, and use actionable threat intelligence.

Manage ICT systems proactively, including those run by providers, and plan the renewal or retirement of obsolete and unsupported hardware and software.

Keep the Master System of Record continuously in the UAE, including when outsourced, with branches of foreign institutions able to keep an up-to-date copy in the UAE with Central Bank approval.

Comply with regulations on ICT, cyber and information security issued by other relevant UAE authorities.

Develop and implement incident response and recovery plans for incidents that could disrupt critical operations, including ICT and cybersecurity incidents.

Review, test and update the plans using lessons from previous incidents and fix root causes of material incidents.

Keep an inventory of internal and third-party resources needed for response and recovery.

Cover the whole incident life cycle: severity classification, response and recovery procedures, roles, communication plans including to the Central Bank, and a register of incidents.

Make incident management cover all critical operations and all resources in the critical operations map.

Make sure risk information systems deliver the performance your risk profile needs, including under stress.

Have governance and internal controls to manage and protect data effectively.

Make ICT systems able to monitor operational risk and resilience, compile accurate risk and loss data, and meet internal and external reporting needs including during a crisis.

Subject aggregation and reporting processes to strong validation and periodic internal audit review.

Maintain continuity and disaster recovery plans for critical operations that fit into the operational risk and resilience framework, built on the critical operations map.

Have the second and third lines review the plans at least yearly for critical operations.

Identify disruption scenarios and how they affect critical operations, including dependencies and key staff unavailability.

Assess each scenario with a quantitative and qualitative impact or business impact analysis across financial, operational, legal and reputational effects.

Set clear triggers for activating the plans, such as maximum tolerable outage thresholds.

Set measurable recovery time and recovery point objectives that reflect the Board-approved tolerance for disruption.

Include communication arrangements for the Board, management, staff, authorities including the Central Bank, customers, the public and providers.

Review and test plans regularly, at least yearly for critical operations, include key providers where relevant, and report results to the Board and management.

Run exercises under severe but plausible scenarios to assess your ability to deliver critical operations through disruption.

Run a well-resourced change management process to plan, manage and approve changes in operations, including new, changed or discontinued products, processes and systems.

Involve the operational risk function throughout change management so controls and control functions are involved.

Set change policies that consider inherent risks, risk profile effects, controls, residual risk, limits, capacity, the role of the three lines, impacts on the critical operations map and data, and communication, including for emergency changes.

Monitor changes in operations after implementation to find and manage problems.

Have a Board-approved strategy and policies for assessing, monitoring and managing third party risk within the operational risk framework.

Avoid over-reliance on outsourcing and keep enough staff, expertise and resources to manage the activities you are licensed for.

Perform a risk assessment and appropriate due diligence before entering any arrangement with a provider.

For arrangements supporting critical operations, verify the provider has at least equivalent operational resilience.

Obtain the Central Bank's notice of non-objection before outsourcing any activity that could significantly affect critical operations if disrupted.

Govern provider arrangements by binding written contracts covering rights, obligations, data ownership and confidentiality, termination, and for critical operations the right to inspect records and receive audit and risk reports.

Require providers in contracts to comply with Central Bank requests and notifications, and for critical arrangements allow Central Bank on-site examinations.

Make the contract terms on inspection and regulator access enforceable against subcontractors where data may be shared with them.

Keep resources and controls to manage providers, including a register of arrangements for critical operations, performance and risk metrics, ongoing assessments including financial health, and management of dependencies.

Address reliance on providers in the continuity plan and in the map of critical operations assets.

Keep viable contingency and exit plans for providers material to critical operations, and assess how easily each provider could be replaced.

Be ready for the Central Bank to require you to end a provider arrangement or a critical operation that depends too heavily on providers.

Notify the Central Bank promptly of a significant deviation from your Board-approved risk appetite, policies or tolerance for disruption, or of a material operational risk that is not properly addressed.

Notify the Central Bank of events that significantly affect critical operations: within 4 hours with the affected critical operations, within 24 hours with a summary report, and again on return to normal operations.

Notify the Central Bank within 72 hours of any high-risk incident, as defined in Board-approved criteria.

Provide any operational risk information the Central Bank asks for, and meet its regular reporting and notification requirements.

Have a policy on public disclosure about operational risk and internal controls that sets what is and is not disclosed.

Publicly disclose key information about your operational risk and resilience approach and exposure, in proportion to your size and role.

Give insight in your disclosures into how you protect personal data.

Remain fully responsible for risks from any outsourced process or activity.

Have a process to decide the materiality of each outsourced activity.

Include policies in the risk governance framework to assess proposed outsourcing and to identify, measure, monitor and report its risks.

Provide at minimum a Board-approved materiality policy with Board or committee approval of material outsourcing, conflict of interest controls, clear roles, timely risk reporting to the Board, and coverage of critical outsourced functions in continuity plans.

Make sure providers keep appropriate information security, risk management and service delivery levels.

Stay responsible for compliance with all laws and regulations that apply to the outsourced activities.

Maintain a comprehensive, up-to-date register of all outsourcing arrangements, material and non-material, on a solo and group basis.

Record in the register the provider details, start and end dates, a service description, whether confidential data is involved and whether the arrangement is material.

Comply with all applicable UAE legislation and regulations when outsourcing involves managing and processing data.

Retain ownership of all data given to a provider, and keep customers' ownership and ability to exercise their rights.

Make sure subcontractors that handle confidential data fully meet the same requirements.

Secure your data from unauthorised access, including access by the provider or its staff.

Make sure agreements keep full ownership of data with the bank and customers, and let the Central Bank access it on request.

Give the bank unfettered access to its data for the whole agreement, including on termination.

Include data protection terms such as non-disclosure and data destruction after termination.

Set data protection standards in the agreement, including nationally recognised information assurance standards in the UAE.

Prevent the provider or its subcontractors from giving anyone else access to confidential data without specific authorisation from the bank or customer.

Specify how far and under what conditions subcontracting is allowed.

Give the Central Bank and its agents access to the provider, including on-site visits, and require the provider to supply data needed for supervision.

Require the provider to notify the bank without undue delay of any breach of the bank's data, especially confidential data.

Govern all outsourcing by formal contracts between the bank and the provider.

Keep the Master System of Record, including all confidential data, continuously in the UAE.

If you are a branch of a foreign bank, keep a copy of the Master System of Record, updated at least daily, in the UAE, subject to Central Bank approval.

Do not share customer confidential data outside the UAE without Central Bank approval, the customer's prior written consent and written acknowledgement that it may be accessed in legal proceedings abroad.

Do not outsource in a way that shares confidential data with a provider in a jurisdiction that cannot protect it as well as if it were kept in the UAE.

Make sure agreements with providers outside the UAE keep data ownership with the bank and customer and allow Central Bank access to the data.

Do not store data in a jurisdiction where bank secrecy or other laws limit access needed for supervision.

Consider how changes in economic, political, social, legal or regulatory conditions could affect a provider outside the UAE, and manage this through provider selection, contracts and continuity planning.

Consider other risks from foreign providers such as weaker infrastructure, legal differences and reputational risk.

Comply with all relevant personal data protection legislation before entering an outsourcing agreement with a party outside the UAE.

Set policies and monitoring controls for relationships that involve sharing confidential data outside the UAE.

Define concrete security requirements for each relationship that involves confidential data outside the UAE, and train staff on them.

Make sure subcontractors involved in sharing confidential data outside the UAE meet the same obligations.

Make sure third parties maintain an appropriate level of information security and service delivery.

Accept that the Central Bank may use its powers with providers outside the UAE through cooperation with foreign authorities.

Keep outsourced activities fully in scope of internal audit and compliance.

Have internal audit regularly review and report to the Board or audit committee on compliance with and effectiveness of outsourcing policies.

Have the compliance function regularly report on providers' compliance with applicable laws, regulations and policies.

Obtain the Central Bank's prior notice of non-objection before outsourcing any material activity, including to related parties.

Expect that the Central Bank will generally not permit outsourcing of core banking activities or key management and control functions such as risk, compliance, internal audit and senior management oversight.

Report regularly on outsourcing arrangements to the Central Bank in the format and frequency it sets.

Provide the outsourcing register to the Central Bank when it asks.

Notify the Central Bank immediately of a material breach of an outsourcing agreement or other development that could significantly affect operations, reputation or finances.