title: United Arab Emirates — Operational Resilience & Critical Infrastructure | World Payments Monitor canonical: https://payments.gi/jurisdictions/united-arab-emirates/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infrastructure Confirmed confirmed 2026-06-27 Operational resilience for onshore institutions is built from sector regulations rather than a single DORA-style instrument: the CBUAE Operational Risk Management Regulation/Standards, the Outsourcing Regulation & Standards for Banks (covering material business activity, outsourcing registers, cross-border data and concentration risk), technology/cyber requirements embedded in the RPSCS (Article 13) and SVF regulations, and the Guidelines for Financial Institutions Adopting Enabling Technologies (cloud, API, DLT). PSPs/SVF licensees must maintain fit-for-purpose technology and cyber-resilience frameworks, incident management, and business-continuity plans with escalation/reporting to the Central Bank. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/united-arab-emirates/) Standing sub-brief · as of 7 July 2026 51 words · last cycle 2026-09-14 #### Operational Resilience & Critical Infrastructure There is no single consolidated operational-resilience instrument; the UAE builds resilience from outsourcing rules, operational-risk standards and RPSCS Article 13 technology-risk and information-security requirements. #### Outlook The trajectory remains 'established' rather than escalating, with no dedicated DORA-style instrument currently tracked in the regulatory horizon for this module. Periodic update · new data 2026-09-14 #### Operational Resilience & Critical Infrastructure The CBUAE Open Finance Regulation is this cycle's defining development for operational resilience and critical infrastructure in the UAE. It establishes a centralised, consolidated trust framework and API layer intended to underpin cross-sectoral data-sharing and payment initiation across a wide range of licensee types: banks, finance companies, payment service providers, stored-value-facility providers, insurers, and crowdfunding operators. Commentary on the framework describes CBUAE as the first regulator globally to implement this particular consolidated trust-framework model, a claim about first-mover architecture rather than about any single incident or outage. The framework's critical-infrastructure significance lies in its centralising function: rather than each sector or each firm building bespoke data-sharing and payment-initiation connectivity, the Open Finance Framework provides a single trust layer that a broad population of licensees connects into, meaning the resilience and availability of that centralised layer itself becomes a systemically important consideration once broad participation is achieved. It is worth noting explicitly that payment account information services and payment initiation services were not newly created by this framework: they were already permitted under the pre-existing Retail Payment Services and Card Schemes Regulation. What the Open Finance Framework adds is the centralised trust and API infrastructure that formalises, standardises, and broadens participation in those already-permitted activities, rather than introducing a new activity category from a standing start. This distinction matters for assessing the framework's operational-resilience footprint: the underlying activities have an operating history under the existing regime, even though the centralised infrastructure layer supporting them at scale is new. #### Outlook The pace and breadth of onboarding to the new trust-framework and API layer, particularly among non-bank licensee types such as stored-value-facility providers, insurers and crowdfunding operators, is the key variable to watch. The framework's stated ambition as a first-of-its-kind global implementation depends on broad cross-sectoral participation to realise its stated data-sharing benefit, and current evidence does not establish how quickly that participation is being achieved across licensee types. **Sources and findings (4)** 1. T1 [https://rulebook.centralbank.ae/en/rulebook/outsourcing-regulation-banks](https://rulebook.centralbank.ae/en/rulebook/outsourcing-regulation-banks) retrieved 2026-06-27 2. T1 [https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security](https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security) retrieved 2026-06-27 3. T1 [https://rulebook.centralbank.ae/en/rulebook/guidelines-financial-institutions-adopting-enabling-technologies](https://rulebook.centralbank.ae/en/rulebook/guidelines-financial-institutions-adopting-enabling-technologies) retrieved 2026-06-27 4. T1 [https://rulebook.centralbank.ae/en/rulebook/d-operational-risk](https://rulebook.centralbank.ae/en/rulebook/d-operational-risk) retrieved 2026-06-27