Read this first
This regulation addresses how institutions manage operational risk and resilience. It does not require that a delayed transfer be released, it does not create a guaranteed timeline for any individual customer, and it is not a remedy for frozen funds or for a compliance, sanctions or court-related hold. Those are governed by different rules and different processes.
The Central Bank of the UAE's Operational Risk Management Regulation, C 1/2026, came into effect on 14 September 2026 and is currently in force. It applies to Licensed Financial Institutions that are juridical persons, and it requires them to maintain comprehensive Operational Risk and Operational Resilience frameworks. The text is published in the official CBUAE Rulebook.
What follows is an explanation of the regulation for customers and businesses, not legal advice, and not a statement of how any regulator or institution will act in a particular case. Where the regulation is described, the wording stays close to the official text; readers should consult the Rulebook directly.
What changed?
The regulation puts operational risk and operational resilience on a formal footing. Institutions within scope are required to establish frameworks for identifying, assessing and managing operational risk, and to be able to keep functioning through disruption rather than only to recover afterwards.
Article 3 requires institutions to identify their Critical Operations. The text expressly includes the continued operation of payment systems, payment services and other time-critical customer services, along with the maintenance of accurate financial records. Institutions must also maintain incident response, business continuity and disaster recovery plans so that those operations can be sustained or restored when something goes wrong.
Two further articles matter for the same reason. Article 8 requires a robust framework for information and communications technology and cybersecurity risk. Article 13 strengthens third-party risk management — relevant because a great deal of payment and processing activity depends on outsourced providers and external platforms.
Why this matters to customers and businesses
Most people encounter operational risk only as a symptom: a payment that does not arrive, a banking app that will not open, a card that fails, a portal that shows a transfer as sent while the beneficiary sees nothing. System failures, cyber incidents and disruptions at third-party providers can all affect account access, transfers and payment services.
By naming payment systems, payment services and other time-critical customer services in the category of Critical Operations, the regulation signals that continuity of those services is a supervised expectation rather than an internal service-quality matter. That is a meaningful shift in the standard institutions are held to. It is not a guarantee that disruptions will not happen, and it does not give an individual customer a specific entitlement in a specific case.
Operational disruption versus a compliance or legal hold
This is the distinction that matters most, because the two situations look identical from the customer's side — money that has not arrived — and call for entirely different responses.
| Aspect | Operational or technical disruption | Compliance, sanctions or legal hold |
|---|---|---|
| Typical cause | System outage, ICT or cyber incident, failure at an outsourced or third-party provider, processing error | Compliance review, source-of-funds or source-of-wealth request, sanctions screening match, court order or enforcement step |
| What the bank can usually say | That a technical or service issue exists, often with a general restoration expectation | Often very little; the bank may be limited in what it is permitted to disclose |
| Who is affected | Frequently many customers at once | Usually a specific account, customer or single transaction |
| Sensible first response | Written confirmation of the incident, the transfer reference and the current status | Establish precisely what is being asked for, then prepare a complete, consistent documentary record |
| Relevance of C 1/2026 | Directly relevant — it governs how institutions must prepare for and manage such disruptions | Not a mechanism for release; different rules and processes govern these holds |
Illustrative comparison prepared for explanation only. It is not part of the regulation and does not describe how any institution or authority will treat a particular matter.
If a transfer is delayed, what should you establish first?
Before drawing any conclusion, it is worth establishing which category the matter falls into. The practical questions are narrow ones:
- Is the bank describing a technical or service issue, or has it said nothing about the cause?
- Has a compliance review been opened, or has the bank asked for information about source of funds or source of wealth?
- Is the payment sitting with a correspondent or intermediary bank rather than with the sending or receiving institution?
- Has a sanctions or screening process been triggered by a name, counterparty, country or currency involved in the payment?
- Is there a court order, enforcement step or other legal or regulatory restriction affecting the account or the funds?
Our page on a bank transfer held or delayed in the UAE sets out normal timing expectations and how to put these questions to both banks in writing; where the account itself is restricted rather than a single payment, the page on a frozen or restricted UAE bank account is the closer fit. No private party can override a bank's decision or an authority's instruction, and nothing here suggests otherwise.
What the new regulation does not mean
Because the regulation has been widely reported, it is worth being explicit about its limits. It does not require a delayed transfer to be released. It does not create a customer-specific guaranteed recovery or resolution timeline. It is not evidence that any particular delay is unlawful, improper or attributable to a failure by the institution. And it does not convert a compliance review, a sanctions screening outcome or a court-ordered restriction into an operational incident to which resilience requirements apply.
Descriptions of the regulation in the general press sometimes go further than the official text. Where the two differ, the Rulebook governs.
Primary sources
The regulation is published in full by the Central Bank of the UAE. Readers should consult the CBUAE Rulebook section for the Operational Risk Management Regulation and the wider CBUAE Rulebook directly, together with the Central Bank of the UAE website, in preference to secondary summaries, including this one.