The lead: a regulator asks for plans that are kept alive
On 14 September 2026, the Central Bank of the UAE’s Operational Risk Management Regulation (Circular 1/2026) came into force, replacing the 2018 regulation and standards. Its article on operational resilience asks licensed financial institutions to identify their critical operations and the assets needed to deliver them, and to develop, maintain and regularly review plans for contingencies and disruption, including incident response, business continuity and disaster recovery (Central Bank of the UAE rulebook).
The wording matters. It is not enough to write a plan once. A plan has to be maintained and reviewed, and it has to be built around the operations that matter most.
That is a useful test for any organisation, regulated or not. Most organisations in the region have emergency and continuity plans. Far fewer can show that those plans have been exercised, that the people named in them know their roles, and that the gaps found in testing have been closed.
A plan that has never been tested is a promise. A plan that has been exercised, corrected and exercised again is a capability. Three questions separate the two:
- When did we last test this plan with the people who would actually lead the response?
- What did that test show, and who owns each fix?
- Could we show a board, a regulator or an insurer the evidence?
What changed this month
UAE banking: incident reporting deadlines. A law-firm briefing on the new Central Bank regulation, dated 28 September 2026, describes incident notifications to the Central Bank within 4, 24 and 72 hours. Deadlines like these are easier to meet when roles, escalation and decision-making have been rehearsed before an incident. Source: Trowers & Hamlins briefing; rulebook.centralbank.ae.
Dubai: a new transport facility exercised before it opens. On 16 September the Roads and Transport Authority ran a three-hour drill at the VDX vertiport near Dubai International Airport with the Dubai Resilience Centre, Dubai Police, Dubai Civil Defence and Dubai Ambulance, ahead of the facility’s commercial launch. The RTA described it as part of efforts to strengthen preparedness, coordination and response across the agencies involved. Source: Dubai Week, 4 October 2026.
Also worth knowing: Abu Dhabi’s national continuity standard. Abu Dhabi has reported 89 entities in the emirate meeting the national business continuity standard (AE/SCNS/NCEMA 7000:2021), and has started work on a standard for the healthcare sector. Source: Abu Dhabi Media Office, 12 March 2025.
For your calendar: Understanding Risk Global Forum, 10 to 14 May 2027, ADNEC Abu Dhabi. The forum, hosted by the Abu Dhabi Emergencies, Crises and Disasters Management Centre with the World Bank’s Global Facility for Disaster Reduction and Recovery, has moved from October 2026. Source: Gulf News, 21 May 2026.
The pattern
A financial regulator asking for plans that are maintained and regularly reviewed. Authorities exercising a new facility before the first passenger arrives. A national continuity standard that entities are measured against. Across sectors, the expectation is moving from having a plan to showing that it works.
One question to ask your team this month
“If we had to show tomorrow that our most important plan works, what evidence would we put on the table?”
If the answer is a document rather than a test record, that is the place to start.
REDS helps leadership teams find out, with evidence, how ready they are: through the REDS Readiness Assessment, exercises built on your own risks, and business continuity work aligned with ISO 22301.
Resilience is not a document. It is a capability.