---
title: [OR] [R] BCM, OR, CR, TRM, OpRisk and CM Regulations by Middle East Central Banks
description: "Operational Resilience in the UK Financial Services Sector: Proposed ‘Critical Third Party’ Regulations"
image: https://blog.bcm-institute.org/hubfs/Operational%20Resilience%20OR/Operational%20Resilience%20Morepost/IC_Operational%20Resilience_Regulations.png
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience Regulatory Series
# \[OR\] \[R\] BCM, OR, CR, TRM, OpRisk and CM Regulations by Middle East Central Banks
Operational Resilience is the capability to absorb shocks to operations, incremental changes, and disruptive events, and then rebound to an operational level acceptable to management, employees, and stakeholders.
This is a consolidated list of major guidelines, policies, frameworks, regulations, and standards issued by Central Banks and Monetary Authorities in the Middle East, particularly those related to:
- Business Continuity Management (BCM)
- Operational Resilience (OR)
- Cybersecurity (CS)
- Technology Risk Management (TRM)
- Operational Risk (OpsRisk)
- Crisis Management (CM)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) May 31, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### List of Major Guidelines, Policies, Frameworks, Regulations, and Standards issued by Central Banks and Monetary Authorities in the Middle East
##### Business Continuity Management (BCM), Operational Resilience (OR), Cybersecurity, Technology Risk Management (TRM), Operational Risk, and Crisis Management.
#### Introduction
Below is a consolidated list of major **guidelines, policies, frameworks, regulations, and standards issued by Central Banks and Monetary Authorities in the Middle East**, particularly those related to **Business Continuity Management (BCM), Operational Resilience (OR), Cybersecurity, Technology Risk Management (TRM), Operational Risk, and Crisis Management**.
---
#### Saudi Arabia
#### Saudi Central Bank (SAMA)
##### Business Continuity Management Framework (BCM Framework)
Issued by SAMA for all regulated financial institutions.
Key areas:
- BCM Governance
- Business Impact Analysis (BIA)
- Risk Assessment
- Recovery Strategies
- Crisis Management
- BCM Testing and Exercising
- Third-Party Resilience
- Continuous Improvement
The framework establishes minimum BCM requirements for all member organizations.
##### Cyber Security Framework
Key domains include:
- Cyber Governance
- Cyber Defense
- Cyber Resilience
- Third-Party Security
- Security Operations Centres (SOC)
- Incident Management
##### Operational Risk Management Requirements
Aligned with:
- Basel II
- Basel III
- Basel Committee Principles
---
#### United Arab Emirates (UAE)
#### Central Bank of the UAE
##### Operational Risk Regulation
Establishes minimum standards for operational risk management.
Focus areas:
- Operational Risk Governance
- Risk Appetite
- Risk Identification
- Monitoring and Reporting
- Loss Event Management
- Scenario Analysis
---
##### Operational Risk Standards
Requirements include:
- Business Continuity Policies
- Recovery Time Objectives (RTO)
- Recovery Point Objectives (RPO)
- Annual Testing Requirements
- Board Oversight
---
##### Technology Risk and Information Security Regulation
Covers:
- Technology Risk Management
- Cybersecurity Governance
- Information Security
- API Security
- Incident Response
- Cyber Resilience
---
##### Disaster Recovery and Business Continuity Management Requirements
Key requirements:
- Business Impact Analysis
- Alternate Recovery Sites
- Recovery Strategies
- Crisis Management
- Annual BCP Testing
- Management Review
---
##### Cyber Risk and Operational Resilience Framework
Major domains:
- Cyber Governance
- Cyber Risk Management
- Security Operations
- Incident Management
- Third-Party Risk
- Operational Resilience
- Regulatory Reporting
---
##### Retail Payment Services and Card Schemes Regulation
Includes:
- Technology Risk Management
- Cyber Incident Response
- BCM Requirements
- Disaster Recovery
- Penetration Testing
- Cyber-Attack Simulation Testing
---
#### Qatar
#### Qatar Central Bank
##### Information Security Risk Management Framework
Key requirements:
- Cybersecurity Governance
- Data Protection
- Security Operations
- Incident Response
- Vendor Risk Management
##### Business Continuity Management Guidelines
Focus areas:
- BCM Governance
- BIA
- Disaster Recovery
- Crisis Management
- Testing and Exercising
##### Operational Risk Management Framework
Aligned with:
- Basel Standards
- Enterprise Risk Management
- Operational Risk Reporting
---
#### Bahrain
#### Central Bank of Bahrain
##### Operational Risk Module (OM)
Part of the CBB Rulebook.
Includes:
- Operational Risk Governance
- Internal Controls
- Risk Reporting
- Outsourcing Risk
- Business Continuity
##### Cybersecurity and Information Security Requirements
Focus:
- Cyber Risk Management
- Security Governance
- Incident Reporting
- Third-Party Security
##### Business Continuity and Disaster Recovery Requirements
Key elements:
- BCM Programme
- Crisis Management
- Recovery Planning
- Testing and Validation
---
#### Oman
#### Central Bank of Oman
##### Risk Management Guidelines
Includes:
- Operational Risk
- Technology Risk
- Information Security
- Business Continuity
##### Cybersecurity Framework for the Banking Sector
Focus areas:
- Cyber Governance
- Threat Intelligence
- Incident Management
- Security Monitoring
##### BCM and Disaster Recovery Guidelines
Requirements include:
- BIA
- Recovery Strategies
- Alternate Sites
- Crisis Communications
---
#### Kuwait
#### Central Bank of Kuwait
##### Information Security and Cybersecurity Framework
Key domains:
- Cyber Governance
- Cyber Defense
- Security Monitoring
- Incident Response
##### Operational Risk Management Instructions
Coverage:
- Operational Risk Governance
- Key Risk Indicators (KRIs)
- Risk Reporting
- Loss Event Management
##### Business Continuity Management Requirements
Includes:
- BCP Development
- Testing and Exercising
- Recovery Site Management
- Crisis Management
---
#### Jordan
#### Central Bank of Jordan
##### Cybersecurity Framework
Key requirements:
- Security Governance
- Security Operations
- Cyber Resilience
- Third-Party Risk Management
##### BCM and Disaster Recovery Regulations
Areas covered:
- BCM Governance
- BIA
- Recovery Objectives
- Testing Programmes
---
#### Egypt
#### Central Bank of Egypt
##### Cybersecurity Framework for Banks
Focus:
- Information Security Governance
- Security Operations
- Incident Response
- Cyber Resilience
##### Operational Risk Framework
Requirements:
- Operational Risk Policies
- Scenario Analysis
- Risk Monitoring
- Internal Controls
##### Business Continuity and Disaster Recovery Guidelines
Coverage:
- BCM Governance
- Recovery Strategies
- Crisis Management
- Testing and Exercising
---
#### Regional Arab Banking Guidance
#### Arab Monetary Fund
##### Cyber Resilience Oversight Guidelines for the Arab Financial Sector
A regional guideline supporting Arab central banks and financial institutions.
Key areas:
- Cyber Governance
- Cyber Resilience
- Incident Response
- Threat Intelligence
- Third-Party Risk
- Supervisory Oversight
---
##### Common Regulatory Themes Across Middle East Central Banks
Most Middle East regulators are increasingly aligning with:
- Basel Committee on Banking Supervision Operational Risk Principles
- Financial Stability Board Operational Resilience Principles
- International Organisation for Standardisation ISO 22301 (Business Continuity Management)
- International Organisation for Standardisation ISO 27001 (Information Security)
- National Institute of Standards and Technology Cybersecurity Framework
- CPMI-IOSCO Principles for Financial Market Infrastructures (PFMI)
Increasingly, regulators are requiring institutions to:
1. Identify Critical Business Services (CBS).
2. Map interdependencies and interconnections.
3. Establish impact tolerances.
4. Conduct severe-but-plausible scenario testing.
5. Strengthen cyber resilience.
6. Manage third-party and cloud risks.
7. Demonstrate operational resilience rather than only disaster recovery capabilities.
For operational resilience benchmarking, the most mature and detailed regulatory frameworks in the Middle East currently come from the Saudi Central Bank (SAMA) and the Central Bank of the UAE, particularly in BCM, cyber resilience, operational risk, and technology risk management.
#### Learn more about Blended Learning OR-300 \[BL-OR-3\] and OR-5000 \[BL-OR-5\]
To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-05-31T09:58:54.518Z",
"datePublished" : "2026-05-31T09:58:54.000Z",
"headline" : "[OR] [R] BCM, OR, CR, TRM, OpRisk and CM Regulations by Middle East Central Banks",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-r-bcm-or-cr-trm-oprisk-and-cm-regulations-by-middle-east-central-banks",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```