United Arab Emirates: Operational Resilience & Critical Infrastructure

Operational Resilience & Critical Infrastructure

The CBUAE Open Finance Regulation is this cycle's defining development for operational resilience and critical infrastructure in the UAE. It establishes a centralised, consolidated trust framework and API layer intended to underpin cross-sectoral data-sharing and payment initiation across a wide range of licensee types: banks, finance companies, payment service providers, stored-value-facility providers, insurers, and crowdfunding operators. Commentary on the framework describes CBUAE as the first regulator globally to implement this particular consolidated trust-framework model, a claim about first-mover architecture rather than about any single incident or outage. The framework's critical-infrastructure significance lies in its centralising function: rather than each sector or each firm building bespoke data-sharing and payment-initiation connectivity, the Open Finance Framework provides a single trust layer that a broad population of licensees connects into, meaning the resilience and availability of that centralised layer itself becomes a systemically important consideration once broad participation is achieved.

It is worth noting explicitly that payment account information services and payment initiation services were not newly created by this framework: they were already permitted under the pre-existing Retail Payment Services and Card Schemes Regulation. What the Open Finance Framework adds is the centralised trust and API infrastructure that formalises, standardises, and broadens participation in those already-permitted activities, rather than introducing a new activity category from a standing start. This distinction matters for assessing the framework's operational-resilience footprint: the underlying activities have an operating history under the existing regime, even though the centralised infrastructure layer supporting them at scale is new.

Outlook

The pace and breadth of onboarding to the new trust-framework and API layer, particularly among non-bank licensee types such as stored-value-facility providers, insurers and crowdfunding operators, is the key variable to watch. The framework's stated ambition as a first-of-its-kind global implementation depends on broad cross-sectoral participation to realise its stated data-sharing benefit, and current evidence does not establish how quickly that participation is being achieved across licensee types.