CBUAE Third-Party Risk Management

• CBUAE Rulebook: Outsourcing Regulation for Banks
• CBUAE Rulebook: Outsourcing Standards for Banks
• CBUAE Rulebook: Outsourcing

The CBUAE Rulebook states that the objective of the Outsourcing Regulation for Banks is to establish minimum acceptable standards for banks' approach to managing risks related to outsourcing arrangements. The Outsourcing Standards form part of the Outsourcing Regulation for Banks and expand on the regulation.

CBUAE wants banks to remain in control when activities are outsourced. Outsourcing should not reduce the bank's ability to meet obligations to customers or to the Central Bank. It should not block supervision, weaken data protection, create unmanaged operational risk, or leave the bank unable to continue or exit a service.

The CBUAE standards are especially operational: they address governance and risk management, materiality, outsourcing registers, data protection, minimum contract content, Central Bank access, outsourcing outside the UAE, internal audit and compliance, non-objection, reporting, and Islamic banking considerations.

Banks should be able to show:

• a risk governance framework that includes outsourcing risk;
• policies and procedures for assessing and approving outsourcing of material business activities;
• a documented materiality assessment;
• an outsourcing register;
• due diligence and risk assessment before engaging a provider;
• contracts with required protections, including data, access, audit, confidentiality, and Central

Bank access;

• controls for outsourcing outside the UAE and subcontractor locations;
• internal audit and compliance review;
• non-objection materials for material business activity outsourcing where required;
• regular reporting to the Central Bank in the required format and frequency.

• Outsourcing policy, risk governance framework, and board or committee approvals.
• Outsourcing register with materiality, service, provider, contract, location, data, owner, and

monitoring fields.

• Materiality assessment, risk assessment, and due diligence records.
• Internal audit and compliance confirmations where required.
• Contract review evidence for minimum content and Central Bank access rights.
• Data protection and location evidence.
• Non-objection submission materials and CBUAE correspondence where applicable.
• Monitoring results, incidents, issues, remediation, and reporting records.
• Business continuity, termination, and exit evidence.

• The bank can list outsourcing providers but cannot quickly show which arrangements are material

and why.

• Non-objection evidence is treated as a one-time submission rather than part of the live risk

record.

• Contract terms are reviewed, but Central Bank access, data location, subcontracting, and reporting

evidence are not monitored after signature.

• Outsourcing outside the UAE is not connected to data protection, customer confidentiality,

continuity, and supervisory access analysis.

• Internal audit and compliance review evidence is stored separately from the outsourcing record.

Halbarad helps CBUAE-regulated teams maintain an outsourcing and third-party risk record that is usable after approval. It can connect materiality, governance, due diligence, contracts, data, locations, subcontractors, non-objection evidence, monitoring, issues, and reporting.

Halbarad can help teams:

• maintain outsourcing registers with materiality and regulatory evidence fields;
• use Spark Assessment to assemble initial provider evidence from public sources, attestations,

trust centers, and incident history;

• use Nth-Party Discovery to identify subcontractors, fourth parties, fifth parties, offshoring, and

concentration exposure;

• use Continuous Monitoring to detect provider outages, incidents, advisories, status changes, and

material changes;

• route approvals, internal audit or compliance evidence, residual risk, remediation, reporting, and

audit trail through Governance workflows.

Halbarad helps operationalize and evidence the work. It does not replace CBUAE rulebook review, legal advice, or institution-specific supervisory engagement.