Stay up to date with our latest news
by Mark Scott, j. awan & partners | Risk Management Series
Four regulators across the GCC now have a regulatory framework for operational resilience that is either in force or nearing the point where these arrangements will soon take effect. The Central Bank of the UAE's Operational Risk Management Regulation, Circular 1/2026, came into effect on 14 September 2026, replacing Circular 163/2018 and the Operational Risk Standards issued in August that year. It requires firms to map their critical operations and the people, systems, data, facilities and third-party providers that deliver them, to set board-approved tolerances for disruption, and to maintain and regularly test incident response, business continuity and disaster recovery plans for each critical operation ¹.
In Qatar, all QFCRA-authorised firms other than captive insurers must be able to show, from 1 October, that they can remain below their approved impact tolerance for every critical operation under a severe but plausible disruption, not simply describe how they plan to ². Category A firms carry an additional deadline, with pre-2025 outsourcing agreements must be amended by 30 September to include the QFCRA's provider-premises access requirement ².
The DFSA released its own consultation on a comparable framework for DIFC firms in March, with comments closing on 26 May, with final rules expected before the end of the year³. In Kuwait, the Central Bank issued its own Cyber & Operational Resilience Framework in December 2025, describing the shift explicitly as a move “from foundational cybersecurity compliance to a resilience-first, maturity-oriented model⁴.
Other regulators in the region are moving the same way without calling out resilience as a specific set of regulations. SAMA folds resilience into its existing Business Continuity Management Framework and Cybersecurity Framework rather than a standalone regime. The ADGM's Financial Services Regulatory Authority addresses business continuity within its general Prudential Rules and has introduced a new Cyber Risk Management Framework, that was effective from 31 January 2026. Bahrain's central bank has covered the topic within its long-standing Operational Risk Management module for some years. The direction is consistent even where some approaches don’t quite extend into full resilience territory.
The UK went through a version of this process starting in 2021, and it's worth looking closely at what happened there, not necessarily as a model to copy, but as evidence of what regulation alone does and does not achieve. The UK's financial sector is more established than most of the GCC's, and its operational resilience regime is among the most developed in the world. However, that hasn't stopped, at times, the UK banks failing their customers, including the period after the rules were meant to have resolved the problem.
The failure that wrote the rules
TSB Bank is the case most often credited with shaping UK thinking on this. In April 2018, TSB migrated eight million customer records from Lloyds' systems onto a new platform over a single weekend. The migration failed. Roughly two million account holders were locked out of online and mobile banking, some for weeks. TSB received 204,000 complaints, around four times its normal volume, and 80,000 customers closed their accounts and moved to a competitor in the months that followed⁵. The total cost, once compensation, fraud losses, waived fees and additional staffing were added up, came to £330.2 million, against which TSB recovered £153 million from its IT provider. The bank posted a £101 million annual loss for 2018, and its chief executive left that September⁶.
The regulatory consequence took another four years to arrive. In December 2022, the FCA and PRA fined TSB £48.65 million, split £29.75 million and £18.9 million between them. The finding was not primarily about the technology. The regulators concluded that TSB had failed to organise and control the migration programme adequately and had failed to manage the operational risks arising from its IT outsourcing arrangements with a critical third-party supplier⁷.
Both parts of this matter. The governance element is the one usually quoted; a firm's resilience is not measured by the plan it holds on file, but by whether the people responsible understood, before the event, what could go wrong and what it would mean for customers. Eighty thousand customers didn't wait for TSB to explain itself. They moved their accounts. The outsourcing half is the one usually forgotten, and it is the same issue the region is now grappling with under a different name.
Reading the CBUAE regulation against that case, is how precisely the new UAE rules respond to it. Where a change is material to critical operations, an LFI must now test it thoroughly before implementation, hold a rollback plan, and, where one ICT system replaces another, run the old and new systems in parallel for a defined minimum period. It must appoint an external expert to provide independent assurance, have senior management review and respond to that report, notify the CBUAE at least 30 calendar days before implementation, and obtain the Central Bank's written no-objection before proceeding⁸.
A firm attempting the TSB migration in the UAE today would need the CBUAE’s consent before it began.
What happened after the rules were in force
The Bank of England, the PRA and the FCA finalised UK operational resilience rules in March 2021, brought them into force from March 2022, and required firms to prove by 31 March 2025 that they could stay within the impact tolerances they had set⁹. That is a three-year implementation window, and it runs almost exactly parallel to what the QFCRA is now asking of QFC firms. What it produced is more sobering than the rules themselves suggest.
UK Parliament's Treasury Committee found that nine major banks and building societies, Barclays, HSBC, Lloyds, Nationwide, Santander, NatWest, Danske Bank, Bank of Ireland and Allied Irish Bank, accumulated at least 803 hours of unplanned IT outages between January 2023 and February 2025, more than 33 days combined, across at least 158 separate incidents ¹⁰. On 31 January 2025, the UK's self-assessment tax deadline and one of the busiest banking days of the year, a mainframe fault at Barclays caused 56% of the bank's online payments to fail for the best part of three days. That incident is not included in the 803 hours, and Barclays expects that single incident to cost it between £5 million and £7.5 million in costumer compensation ¹¹.
These are firms operating under one of the most developed operational resilience regimes anywhere, years after the rules took effect, in some cases after they had already been assessed against them. The lesson for GCC firms isn't that the UK's approach failed. In fact, it is entirely possible that both the frequency and the severity of these incidents would have been worse without it. The lesson is that passing a resilience deadline and being resilient are two different things, and a regulator that has finished inspecting the paperwork hasn't thereby made the next outage less likely. It’s a discipline that has to keep running after the deadline, not stop at it.
Where the next upcoming test
There's a second gap the UK and EU have faced that the GCC hasn't experienced, which is what happens when the point of failure sits with a third-party rather than the regulated firm itself.
In July 2024, a faulty software update from the cybersecurity provider, CrowdStrike, took down an estimated 8.5 million Windows devices worldwide within hours, grounding flights, closing hospital systems and knocking banks offline across multiple continents ¹². No GCC financial institution caused that outage, and few could have prevented it through better internal controls alone. It was a concentration event whereby one provider, embedded across thousands of unrelated organisations, failed once.
The EU's answer, in its Digital Operational Resilience Act, binding since January 2025, was to stop treating this as the regulated firm's problem to manage alone. DORA brings the largest ICT providers serving the financial sector, cloud platforms among them, under direct regulatory oversight for the first time, rather than leaving firms to manage that concentration risk entirely through their own contracts and due diligence ¹³.
No GCC regulator has taken this step yet. Given how heavily the region's financial sector already depends on a small number of cloud and, increasingly, AI providers, it's plausible that GCC regulation could head the same way once the firms’ oversight of third-party & outsourcing risk is judged insufficient on its own. This would be the same conclusion that pushed the EU to legislate DORA.
What this means for firms building a programme now
The practical difference between a paper-based resilience programme and one that is practically embedded is best seen as ordinary situations, not necessarily dramatic events or breaches.
Take, for instance, a firm whose client onboarding depends on a third-party AI tool for document verification. A programme built for compliance produces a policy stating that a manual process exists. A programme built for capability has run that process under time pressure, knows how many staff it takes, how long it adds to onboarding, and at what point a queue starts to damage the client relationship. When the third-party has an outage, and on current form most firms depending on outside providers eventually will experience one, the second firm keeps onboarding clients, more slowly, while the first firm stops and waits.
We can also consider the outsourcing deadline the QFCRA has set for 30 September. A firm treating this as a compliance exercise will amend the wording in its agreements and move on. A firm treating it seriously will use the review to ask a harder question, which is does it know, for each material provider, what would happen to its operations if that provider failed for a day? And could it explain that to a client who asked? Regulators, and clients, are considerably less patient about these gaps than they were in 2018.
For CBUAE-regulated, where the requirement is now live, four questions are worth answering before the first supervisory conversation rather than during it:
Have critical operations been identified and formally mapped, including the third-party dependencies that support them?
Has the board itself, rather than a committee, approved the tolerance for disruption?
Do incident processes meet the Central Bank's notification timeframes, and if it was needed does anyone know who make that call at 2am?
Does the third-party register cover every arrangement relating to critical operations, with an assessment of how substitutable each provider is?
The choice for firms
The requirement is now in force at the CBUAE, the demonstration deadline arrives at the QFC by the end of the month, and the DFSA’s framework will follow. Kuwait has already set its own version, and it seems likely the rest of the region isn't far behind.
Firms that treat this as a paper exercise will produce a file. Firms that treat it as continuous discipline, something to be learnt from and not a deadline to complete, will have something a client can rely on when a provider fails, and something a regulator can test properly rather than review on paper. The UK's experience shows that regulation can force the first four years of that discipline. It can't force the fifth, or the fiftieth. That part is down to the firm, in London, in Dubai, or in Doha, whether the rulebook is watching or not.
J. Awan & Partners provides risk and resilience advisory support to regulated companies and organisations across the GCC. For a conversation about your firm's position, contact info@jawanpartners.com or visit jawanpartners.com.
References
1. Central Bank of the UAE. Operational Risk Management Regulation (Circular No. 1/2026). CBUAE Rulebook.
2. Governance and Controlled Functions Rules 2020 (CTRL), Rules 8.3.5 and 8.4.6. Qatar Financial Centre Regulatory Authority.
3. DFSA Consultation Paper No. 170: Operational Resilience (March 2026, consultation closed May 2026).
4. Cyber & Operational Resilience Framework, v1.0 (December 2025). Central Bank of Kuwait.
5. TSB IT migration: customer and complaint figures. Computing (2019 reporting).
6. Sabadell's U.K. TSB Chief Pester Exits After IT Meltdown (4 September 2018). Bloomberg.
7. TSB fined £48.65m for operational resilience failings (December 2022). FCA; Bank of England/PRA.
8. CBUAE Operational Risk Management Regulation, Article 12.5.
9. PS21/3, Building Operational Resilience (March 2021); SS1/21, Operational Resilience: Impact Tolerances for Important
Business Services, FCA and Bank of England/PRA; UK Operational Resilience Rules: Are You Ready for 31 March 2025? (January 2025), Sidley Austin.
10. More than one month's worth of IT failures at major banks and building societies in the last two years (2025). UK Parliament Treasury Committee.
11. UK banks hit a month of outages in the last two years; Barclays to shell out millions for IT downtime (2025). Finextra.
12. CrowdStrike global IT outage, July 2024 — widely reported across international press and cybersecurity industry analysis.
13. Regulation (EU) 2022/2554, Digital Operational Resilience Act (DORA), binding from 17 January 2025.
Operational resilience: what happened after the rules took effect
Four GCC regulators have moved on operational resilience inside a year, and what they ask for is broadly consistent: map your critical operations and the providers that deliver them, have the board itself approve how much disruption is tolerable, and test your continuity plans rather than hold them. Passing a resilience assessment and being resilient are two different things, and that gap is precisely what the new regulations are aimed at.
Operational resilience: what happened after the rules took effect
Four GCC regulators have moved on operational resilience inside a year, and what they ask for is broadly consistent: map your critical operations and the providers that deliver them, have the board itself approve how much disruption is tolerable, and test your continuity plans rather than hold them. Passing a resilience assessment and being resilient are two different things, and that gap is precisely what the new regulations are aimed at.
by Mark Scott, j. awan & partners | Risk Management Series
Four regulators across the GCC now have a regulatory framework for operational resilience that is either in force or nearing the point where these arrangements will soon take effect. The Central Bank of the UAE's Operational Risk Management Regulation, Circular 1/2026, came into effect on 14 September 2026, replacing Circular 163/2018 and the Operational Risk Standards issued in August that year. It requires firms to map their critical operations and the people, systems, data, facilities and third-party providers that deliver them, to set board-approved tolerances for disruption, and to maintain and regularly test incident response, business continuity and disaster recovery plans for each critical operation ¹.
In Qatar, all QFCRA-authorised firms other than captive insurers must be able to show, from 1 October, that they can remain below their approved impact tolerance for every critical operation under a severe but plausible disruption, not simply describe how they plan to ². Category A firms carry an additional deadline, with pre-2025 outsourcing agreements must be amended by 30 September to include the QFCRA's provider-premises access requirement ².
The DFSA released its own consultation on a comparable framework for DIFC firms in March, with comments closing on 26 May, with final rules expected before the end of the year³. In Kuwait, the Central Bank issued its own Cyber & Operational Resilience Framework in December 2025, describing the shift explicitly as a move “from foundational cybersecurity compliance to a resilience-first, maturity-oriented model⁴.
Other regulators in the region are moving the same way without calling out resilience as a specific set of regulations. SAMA folds resilience into its existing Business Continuity Management Framework and Cybersecurity Framework rather than a standalone regime. The ADGM's Financial Services Regulatory Authority addresses business continuity within its general Prudential Rules and has introduced a new Cyber Risk Management Framework, that was effective from 31 January 2026. Bahrain's central bank has covered the topic within its long-standing Operational Risk Management module for some years. The direction is consistent even where some approaches don’t quite extend into full resilience territory.
The UK went through a version of this process starting in 2021, and it's worth looking closely at what happened there, not necessarily as a model to copy, but as evidence of what regulation alone does and does not achieve. The UK's financial sector is more established than most of the GCC's, and its operational resilience regime is among the most developed in the world. However, that hasn't stopped, at times, the UK banks failing their customers, including the period after the rules were meant to have resolved the problem.
The failure that wrote the rules
TSB Bank is the case most often credited with shaping UK thinking on this. In April 2018, TSB migrated eight million customer records from Lloyds' systems onto a new platform over a single weekend. The migration failed. Roughly two million account holders were locked out of online and mobile banking, some for weeks. TSB received 204,000 complaints, around four times its normal volume, and 80,000 customers closed their accounts and moved to a competitor in the months that followed⁵. The total cost, once compensation, fraud losses, waived fees and additional staffing were added up, came to £330.2 million, against which TSB recovered £153 million from its IT provider. The bank posted a £101 million annual loss for 2018, and its chief executive left that September⁶.
The regulatory consequence took another four years to arrive. In December 2022, the FCA and PRA fined TSB £48.65 million, split £29.75 million and £18.9 million between them. The finding was not primarily about the technology. The regulators concluded that TSB had failed to organise and control the migration programme adequately and had failed to manage the operational risks arising from its IT outsourcing arrangements with a critical third-party supplier⁷.
Both parts of this matter. The governance element is the one usually quoted; a firm's resilience is not measured by the plan it holds on file, but by whether the people responsible understood, before the event, what could go wrong and what it would mean for customers. Eighty thousand customers didn't wait for TSB to explain itself. They moved their accounts. The outsourcing half is the one usually forgotten, and it is the same issue the region is now grappling with under a different name.
Reading the CBUAE regulation against that case, is how precisely the new UAE rules respond to it. Where a change is material to critical operations, an LFI must now test it thoroughly before implementation, hold a rollback plan, and, where one ICT system replaces another, run the old and new systems in parallel for a defined minimum period. It must appoint an external expert to provide independent assurance, have senior management review and respond to that report, notify the CBUAE at least 30 calendar days before implementation, and obtain the Central Bank's written no-objection before proceeding⁸.
A firm attempting the TSB migration in the UAE today would need the CBUAE’s consent before it began.
What happened after the rules were in force
The Bank of England, the PRA and the FCA finalised UK operational resilience rules in March 2021, brought them into force from March 2022, and required firms to prove by 31 March 2025 that they could stay within the impact tolerances they had set⁹. That is a three-year implementation window, and it runs almost exactly parallel to what the QFCRA is now asking of QFC firms. What it produced is more sobering than the rules themselves suggest.
UK Parliament's Treasury Committee found that nine major banks and building societies, Barclays, HSBC, Lloyds, Nationwide, Santander, NatWest, Danske Bank, Bank of Ireland and Allied Irish Bank, accumulated at least 803 hours of unplanned IT outages between January 2023 and February 2025, more than 33 days combined, across at least 158 separate incidents ¹⁰. On 31 January 2025, the UK's self-assessment tax deadline and one of the busiest banking days of the year, a mainframe fault at Barclays caused 56% of the bank's online payments to fail for the best part of three days. That incident is not included in the 803 hours, and Barclays expects that single incident to cost it between £5 million and £7.5 million in costumer compensation ¹¹.
These are firms operating under one of the most developed operational resilience regimes anywhere, years after the rules took effect, in some cases after they had already been assessed against them. The lesson for GCC firms isn't that the UK's approach failed. In fact, it is entirely possible that both the frequency and the severity of these incidents would have been worse without it. The lesson is that passing a resilience deadline and being resilient are two different things, and a regulator that has finished inspecting the paperwork hasn't thereby made the next outage less likely. It’s a discipline that has to keep running after the deadline, not stop at it.
Where the next upcoming test
There's a second gap the UK and EU have faced that the GCC hasn't experienced, which is what happens when the point of failure sits with a third-party rather than the regulated firm itself.
In July 2024, a faulty software update from the cybersecurity provider, CrowdStrike, took down an estimated 8.5 million Windows devices worldwide within hours, grounding flights, closing hospital systems and knocking banks offline across multiple continents ¹². No GCC financial institution caused that outage, and few could have prevented it through better internal controls alone. It was a concentration event whereby one provider, embedded across thousands of unrelated organisations, failed once.
The EU's answer, in its Digital Operational Resilience Act, binding since January 2025, was to stop treating this as the regulated firm's problem to manage alone. DORA brings the largest ICT providers serving the financial sector, cloud platforms among them, under direct regulatory oversight for the first time, rather than leaving firms to manage that concentration risk entirely through their own contracts and due diligence ¹³.
No GCC regulator has taken this step yet. Given how heavily the region's financial sector already depends on a small number of cloud and, increasingly, AI providers, it's plausible that GCC regulation could head the same way once the firms’ oversight of third-party & outsourcing risk is judged insufficient on its own. This would be the same conclusion that pushed the EU to legislate DORA.
What this means for firms building a programme now
The practical difference between a paper-based resilience programme and one that is practically embedded is best seen as ordinary situations, not necessarily dramatic events or breaches.
Take, for instance, a firm whose client onboarding depends on a third-party AI tool for document verification. A programme built for compliance produces a policy stating that a manual process exists. A programme built for capability has run that process under time pressure, knows how many staff it takes, how long it adds to onboarding, and at what point a queue starts to damage the client relationship. When the third-party has an outage, and on current form most firms depending on outside providers eventually will experience one, the second firm keeps onboarding clients, more slowly, while the first firm stops and waits.
We can also consider the outsourcing deadline the QFCRA has set for 30 September. A firm treating this as a compliance exercise will amend the wording in its agreements and move on. A firm treating it seriously will use the review to ask a harder question, which is does it know, for each material provider, what would happen to its operations if that provider failed for a day? And could it explain that to a client who asked? Regulators, and clients, are considerably less patient about these gaps than they were in 2018.
For CBUAE-regulated, where the requirement is now live, four questions are worth answering before the first supervisory conversation rather than during it:
Have critical operations been identified and formally mapped, including the third-party dependencies that support them?
Has the board itself, rather than a committee, approved the tolerance for disruption?
Do incident processes meet the Central Bank's notification timeframes, and if it was needed does anyone know who make that call at 2am?
Does the third-party register cover every arrangement relating to critical operations, with an assessment of how substitutable each provider is?
The choice for firms
The requirement is now in force at the CBUAE, the demonstration deadline arrives at the QFC by the end of the month, and the DFSA’s framework will follow. Kuwait has already set its own version, and it seems likely the rest of the region isn't far behind.
Firms that treat this as a paper exercise will produce a file. Firms that treat it as continuous discipline, something to be learnt from and not a deadline to complete, will have something a client can rely on when a provider fails, and something a regulator can test properly rather than review on paper. The UK's experience shows that regulation can force the first four years of that discipline. It can't force the fifth, or the fiftieth. That part is down to the firm, in London, in Dubai, or in Doha, whether the rulebook is watching or not.
J. Awan & Partners provides risk and resilience advisory support to regulated companies and organisations across the GCC. For a conversation about your firm's position, contact info@jawanpartners.com or visit jawanpartners.com.
References
1. Central Bank of the UAE. Operational Risk Management Regulation (Circular No. 1/2026). CBUAE Rulebook.
2. Governance and Controlled Functions Rules 2020 (CTRL), Rules 8.3.5 and 8.4.6. Qatar Financial Centre Regulatory Authority.
3. DFSA Consultation Paper No. 170: Operational Resilience (March 2026, consultation closed May 2026).
4. Cyber & Operational Resilience Framework, v1.0 (December 2025). Central Bank of Kuwait.
5. TSB IT migration: customer and complaint figures. Computing (2019 reporting).
6. Sabadell's U.K. TSB Chief Pester Exits After IT Meltdown (4 September 2018). Bloomberg.
7. TSB fined £48.65m for operational resilience failings (December 2022). FCA; Bank of England/PRA.
8. CBUAE Operational Risk Management Regulation, Article 12.5.
9. PS21/3, Building Operational Resilience (March 2021); SS1/21, Operational Resilience: Impact Tolerances for Important
Business Services, FCA and Bank of England/PRA; UK Operational Resilience Rules: Are You Ready for 31 March 2025? (January 2025), Sidley Austin.
10. More than one month's worth of IT failures at major banks and building societies in the last two years (2025). UK Parliament Treasury Committee.
11. UK banks hit a month of outages in the last two years; Barclays to shell out millions for IT downtime (2025). Finextra.
12. CrowdStrike global IT outage, July 2024 — widely reported across international press and cybersecurity industry analysis.
13. Regulation (EU) 2022/2554, Digital Operational Resilience Act (DORA), binding from 17 January 2025.