---
title: [OR] [R] Operational Resilience Related Regulations for Middle East FSI
description: [OR] Operational Resilience Related Regulations for Middle East FSI
image: https://blog.bcm-institute.org/hubfs/Operational%20Resilience%20OR/Operational%20Resilience%20Morepost/IC_Operational%20Resilience_Regulations.png
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience Regulations Series
# \[OR\] \[R\] Operational Resilience Related Regulations for Middle East FSI
Operational Resilience is the capability to absorb shocks to operations, incremental changes, and disruptive events, and then rebound to an operational level acceptable to management, employees, and stakeholders.
This is a consolidated list of major guidelines, policies, frameworks, regulations, and standards issued by Central Banks and Monetary Authorities in the Middle East, particularly those related to Business Continuity Management (BCM), Operational Resilience (OR), Cybersecurity, Technology Risk Management (TRM), Operational Risk, and Crisis Management.
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) May 31, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### Operational Resilience Related Regulations for Middle East FSI
#### Introduction
The Middle East does not yet have a single, region-wide operational resilience regulation equivalent to the Bank of England Operational Resilience Framework, Monetary Authority of Singapore Operational Resilience Guidelines, or the EU Digital Operational Resilience Act (DORA).
However, several Middle Eastern central banks have incorporated operational resilience requirements into regulations governing operational risk, technology risk, cybersecurity, BCM, and payment systems.
The following are the most significant and explicit operational resilience-related policies and frameworks.
### Saudi Arabia – SAMA
#### [SAMA Business Continuity Management Framework](https://rulebook.sama.gov.sa/en/business-continuity-management-framework-1?utm_source=chatgpt.com)
Issued by the Saudi Central Bank (SAMA).
This is currently one of the most comprehensive resilience-related frameworks in the Middle East.
##### Key Operational Resilience Requirements
- Critical business services identification
- Business Impact Analysis (BIA)
- Recovery strategies
- Crisis management structure
- Recovery time objectives (RTO)
- Recovery point objectives (RPO)
- Third-party resilience
- Alternate processing sites
- Annual testing and exercising
- Continuous improvement
The framework requires financial institutions to maintain the ability to continue critical operations during disruptions and recover within acceptable timeframes. It effectively moves beyond traditional disaster recovery into operational resilience principles.
---
### United Arab Emirates – Central Bank of UAE (CBUAE)
#### [Operational Risk Regulation](https://rulebook.centralbank.ae/en/rulebook/operational-risk-regulation?utm_source=chatgpt.com)
Issued by the Central Bank of the United Arab Emirates.
##### Operational Resilience Elements
Requires banks to:
- Establish operational risk governance
- Define risk appetite and tolerance
- Manage operational disruptions
- Monitor operational losses
- Conduct scenario analysis
- Maintain resilience against operational failures
The regulation establishes minimum standards for operational risk management to ensure financial sector stability.
---
#### [Operational Risk Standards](https://rulebook.centralbank.ae/en/rulebook/operational-risk-standards?utm_source=chatgpt.com)
This is the most operational resilience-focused document issued by CBUAE.
##### Requirements
Banks must:
- Identify critical processes and systems
- Assess operational vulnerabilities
- Monitor resilience capabilities
- Implement the Three Lines of Defence model
- Conduct operational risk assessments
- Evaluate third-party concentration risks
- Review resilience when introducing new products and technologies
The standards specifically require institutions to assess dependencies on external service providers and technology infrastructure.
---
#### [Technology Risk and Information Security Regulation](https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security?utm_source=chatgpt.com)
##### Operational Resilience Requirements
Financial institutions must establish:
- Cyber resilience frameworks
- Incident response plans
- Technology risk management programmes
- Penetration testing
- Cyber-attack simulation testing
- Service recovery capabilities
- Recovery strategies for critical services
The regulation explicitly requires institutions to identify, protect, detect, respond to, and recover from cyber incidents.
---
#### [Technology and Specific Risk Management Regulation](https://rulebook.centralbank.ae/en/rulebook/article-12-technology-and-specific-risk-management?utm_source=chatgpt.com)
##### Key Resilience Controls
Requires:
- Technology governance
- Cyber resilience
- Incident management
- Technology risk oversight
- Independent technology audit
This regulation is closely aligned with international operational resilience principles.
---
### UAE – Payment Services Sector
#### Retail Payment Services Regulation
##### Explicit Operational Resilience Controls
The regulation requires payment service providers to maintain:
- Business continuity programmes
- Recovery strategies
- Alternate recovery sites
- Crisis management protocols
- Customer communication plans
- Annual resilience testing
- Cloud resilience controls
- Third-party resilience management
Institutions must demonstrate the ability to restore critical payment services during severe disruptions.
---
### Bahrain – Central Bank of Bahrain (CBB)
#### [CBB Rulebook – Business Continuity and Disaster Recovery Requirements](https://cbben.thomsonreuters.com/entiresection/605708?utm_source=chatgpt.com)
Issued by the Central Bank of Bahrain.
##### Operational Resilience Requirements
The CBB requires licensees to:
- Establish BCM programmes
- Maintain business continuity policies
- Develop disaster recovery plans
- Conduct risk identification and reporting
- Maintain operational recovery capabilities
- Recover critical services within defined timelines
The rulebook emphasises minimising operational, financial, legal, and reputational impacts arising from disruptions.
---
### Arab Monetary Fund (AMF)
#### [Cyber Resilience Oversight Guidelines for the Arab Financial Sector](https://www.amf.org.ae/sites/default/files/publications/2022-01/cyber-resilience-guidelines-fintech-wg-13122019.pdf?utm_source=chatgpt.com)
Issued by the Arab Monetary Fund.
This is the closest regional framework supporting operational resilience across Arab central banks.
##### Coverage
- Cyber resilience governance
- Resilience oversight
- Incident management
- Threat intelligence
- Crisis response
- Recovery capabilities
- Supervisory expectations
- Third-party risk management
The guidelines encourage Arab regulators and financial institutions to strengthen operational resilience through cyber resilience programmes.
---
### Dubai Financial Services Authority (DFSA)
#### [Operational Efficiency and Resilience Requirements (AMI 5.5)](https://dfsaen.thomsonreuters.com/rulebook/ami-55-operational-efficiency-and-resilience?utm_source=chatgpt.com)
Issued by the Dubai Financial Services Authority.
##### Requirements
- Operational resilience governance
- Technology risk management
- Cyber resilience
- Service continuity
- Recovery capability
- Market infrastructure resilience
Applies particularly to financial market infrastructures and regulated entities operating within the DIFC.
---
#### Mapping Middle East Policies to Operational Resilience Components
| **Operational Resilience Component** | **SAMA** | **CBUAE** | **CBB Bahrain** | **AMF** | **DFSA** |
| --- | --- | --- | --- | --- | --- |
| **Critical Business Services** | **✓** | **Partial** | **Partial** | **Guidance** | **✓** |
| **Dependency Mapping** | **Partial** | **✓** | **Partial** | **Guidance** | **✓** |
| **Impact Tolerance** | **Emerging** | **Emerging** | **Limited** | **Guidance** | **Emerging** |
| **Scenario Testing** | **✓** | **✓** | **✓** | **Guidance** | **✓** |
| **Cyber Resilience** | **✓** | **✓✓** | **✓** | **✓✓** | **✓** |
| **Third-Party Risk** | **✓** | **✓✓** | **✓** | **✓** | **✓** |
| **Crisis Management** | **✓** | **✓** | **✓** | **✓** | **✓** |
| **Recovery Objectives** | **✓** | **✓** | **✓** | **Partial** | **✓** |
| **Operational Risk Integration** | **✓** | **✓✓** | **✓** | **Guidance** | **✓** |
| **Board Accountability** | **✓** | **✓✓** | **✓** | **✓** | **✓** |
---
#### Most Mature Operational Resilience Regulators in the Middle East
The current leaders in operational resilience regulation are:
1. Saudi Central Bank (SAMA)
2. Central Bank of the United Arab Emirates (CBUAE)
3. Central Bank of Bahrain (CBB)
4. Dubai Financial Services Authority (DFSA)
5. Arab Monetary Fund (AMF)
These regulators are increasingly adopting concepts similar to those used by the UK, Singapore, Australia, and the Basel Committee, including critical service identification, dependency mapping, cyber resilience, severe-but-plausible scenario testing, and enterprise-wide operational resilience governance.
#### Learn more about Blended Learning OR-300 \[BL-OR-3\] and OR-5000 \[BL-OR-5\]
To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-05-31T12:30:38.226Z",
"datePublished" : "2026-05-31T10:00:09.000Z",
"headline" : "[OR] [R] Operational Resilience Related Regulations for Middle East FSI",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/operational-resilience-related-regulations-for-middle-east",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```