United Arab Emirates country pack.
United Arab Emirates pack covering CBUAE rules for banks, Islamic banks and finance companies (internal controls, compliance and internal audit, corporate governance, outsourcing, operational risk, consumer protection and Shari'ah governance) plus the 2025 federal AML/CFT law. It also covers large enterprises and listed companies through the federal data protection law, the UAE Information Assurance Regulation and the SCA governance guide, which are flagged as unverified in this edition.
Frameworks and regulations.
| Instrument | Applies to | Requirements | Status |
|---|---|---|---|
| Internal Controls, Compliance and Internal Audit Regulation and Standards Central Bank of the UAE · Regulation C 161/2018 with its Standards; in force from 30 October 2018 | Banks, Islamic banks | 30 | Source checked |
| Corporate Governance Regulation and Standards for Banks Central Bank of the UAE · Circular C 83/2019 (Regulation and Standards); in force from 18 July 2019 | Banks, Islamic banks | 28 | Source checked |
| Outsourcing Regulation for Banks Central Bank of the UAE · Circular C 14/2021; effective 31 May 2021 per the Rulebook; existing agreements to comply by 31 December 2023 | Banks, Islamic banks | 24 | Source checked |
| Operational Risk Management Regulation Central Bank of the UAE · Circular C 1/2026 (Notice CBUAE/BIS-RD/2026/4047); effective 14 September 2026 per secondary sources | Banks, Islamic banks, Insurers, Finance companies and more | 18 | Being confirmed |
| Consumer Protection Regulation and Consumer Protection Standards Central Bank of the UAE · Circular C 8/2020 (Regulation and Standards); effective 25 December 2020, with up to one year to comply | Banks, Islamic banks, Finance companies, Payment providers and more | 21 | Source checked |
| Federal Decree-Law No. (10) of 2025 on Anti-Money Laundering, Combating the Financing of Terrorism and Proliferation Financing, with Cabinet Resolution No. (134) of 2025 (Executive Regulations) UAE Federal Government · Decree-Law issued 30 September 2025, in force 14 October 2025; Cabinet Resolution 134/2025 issued 29 October 2025, Official Gazette No. 811 of 14 November 2025, effective 14 December 2025 | Banks, Islamic banks, Finance companies, Insurers and more | 23 | Source checked |
| Shari'ah Governance Standards for Islamic Financial Institutions (Shari'ah Governance Standard, Shari'ah Compliance Function Standard, External Shari'ah Audit Standard and ISSC Annual Report Guidance Note) Central Bank of the UAE and the Higher Shari'ah Authority · Shari'ah Governance Standard effective 21 April 2020; Guidance Note N 5330/2020 effective 10 December 2020; SCF Standard and External Shari'ah Audit Standard (issue dates not shown in the copies read) | Islamic banks, Banks, Finance companies | 29 | Source checked |
| Finance Companies Regulation Central Bank of the UAE · Circular C 3/2023 (dated 23 May 2023); in force from 29 September 2023 | Finance companies | 25 | Source checked |
| Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data UAE Federal Government; UAE Data Office · Issued 2021; in force 2 January 2022; Executive Regulations status not confirmed | Large enterprises, Listed companies, Finance companies, Insurers and more | 15 | Being confirmed |
| UAE Information Assurance Regulation Telecommunications and Digital Government Regulatory Authority (TDRA); UAE Cyber Security Council · TDRA Information Assurance Regulation (version 1.1 believed current), based on the UAE Information Assurance Standards; version not confirmed | Government bodies, Critical infrastructure, State-owned enterprises | 15 | Being confirmed |
| Joint Stock Companies Governance Guide (Securities and Commodities Authority) Securities and Commodities Authority · SCA Board Chairman's Decision No. (3/R.M) of 2020, as amended; number and amendments not confirmed | Listed companies | 15 | Being confirmed |
Checklists in the pack.
- CBUAE Internal Audit and Compliance Function Review
- CBUAE Outsourcing Arrangement Review
- CBUAE Consumer Protection Compliance Review
- CBUAE Shari'ah Governance and Compliance Audit
- UAE PDPL Compliance Review
Regulators.
- CBUAE Central Bank of the UAE
- HSA Higher Shari'ah Authority (at the CBUAE)
- FIU UAE Financial Intelligence Unit
- SCA Securities and Commodities Authority
- UAEDO UAE Data Office
- TDRA Telecommunications and Digital Government Regulatory Authority
- CSC UAE Cyber Security Council
- DESC Dubai Electronic Security Center
- MOF Ministry of Finance
- FTA Federal Tax Authority
Who it is for
Banks, Islamic banks, Finance companies, Insurers, Payment providers, Exchange houses, Capital market firms, Listed companies, Large enterprises, State-owned enterprises, Government bodies, Critical infrastructure.
Regulatory calendar.
20 recurring deliverables, each with the regulator, the instrument and the deadline rule. Some examples:
| Deliverable | Regulator | How often | Deadline |
|---|---|---|---|
| Annual risk-based internal audit plan approved by the audit committee | CBUAE | Every year | Approved before the plan year starts and updated at least once a year |
| Annual review of internal control effectiveness by the Board or audit committee | CBUAE | Every year | Once each financial year |
| Compliance risk report to senior management and the Board | CBUAE | Every quarter | At least once every quarter |
| External quality assurance of the compliance and internal audit functions | CBUAE | Every 5 years | At least once every five years, alongside annual performance assessments |
| Review of the internal audit charter | CBUAE | Every 3 years | At least every three years, with the charter published |
| Notify CBUAE of resignation of the head of compliance or internal audit and obtain no-objection for a replacement | CBUAE | When it happens | Promptly on resignation, with reasons; no-objection before any replacement or dismissal |
Reporting conventions.
- Reports in English and Arabic
- Amounts in AED
CBUAE regulations and standards are issued in Arabic and English, and the federal legislation portal states that the Arabic text prevails. Consumer disclosures must be given in both Arabic and English. HSA guidance is drafted in Arabic, and the Arabic version prevails. Gregorian dates and a January to December financial year are the norm, and finance companies must use that year. The ISSC annual Shari'ah report must follow the HSA template and be published with the financial statements. Amounts are in AED.
Kept current.
Content version 2026.10, reviewed 27 October 2026. Descriptions are AuditHD's own; each framework links to the official text. License this pack on its own or with other countries; International standards are always included.
See it with your own checklists.
Open the live demo now, or book a walkthrough and we will load one of your frameworks or work programmes.