TRW & Co · Banking, Finance & Capital Markets
Financial Services Outsourcing in the UAE
Financial services outsourcing in the UAE is regulated by where a firm is licensed, not where its provider sits. Banks need Central Bank non-objection for material outsourcing and must keep core data in the country, while DIFC and ADGM firms follow their own rulebooks. This guide explains the rules, the contract terms regulators expect and how to avoid common failures.
Key pointA UAE bank cannot outsource risk management, compliance, internal audit or credit decision-making, and its master system of record must stay in the UAE, so the regulatory design of an outsourcing deal has to come before the commercial one.
At a glance
Prior non-objection for banks
Under CBUAE Circular No. 14/2021, a bank needs the Central Bank's prior non-objection before outsourcing any material activity, including to a group company.
Core functions stay in-house
The CBUAE will generally not allow banks to outsource senior management oversight, risk management, compliance, internal audit or management of credit, investment and treasury.
Master record in the UAE
Banks must store their master system of record in the UAE and need CBUAE approval and written customer consent before confidential customer data leaves the country.
New Central Bank law
Federal Decree-Law No. (6) of 2025 took effect on 16 September 2025, widening CBUAE powers and capturing technology platforms that facilitate financial services.
Free zone scrutiny rising
The ADGM FSRA's January 2026 thematic review found missed intragroup and software outsourcing and asked all authorised persons to run a gap analysis.
Swipe or scroll →
What financial services outsourcing in the UAE covers
Financial services outsourcing in the UAE is the set of rules that applies when a bank, insurer, finance company, payment provider or DIFC or ADGM firm hands an activity it could perform itself to someone else. That someone may be a cloud platform, a core banking vendor, a call centre, a collections agency, a fund administrator, an outsourced compliance officer or simply another company in the same group.
The commercial logic is familiar: cost, speed, specialist skills and scale. The regulatory logic is different. Every UAE financial regulator starts from the same principle: the licensed firm keeps full responsibility for an activity even after it moves to a provider, and outsourcing must never weaken the regulator's ability to supervise. Contracts, data flows and exit plans are judged against that principle, not against what is normal in the technology market.
The legal question usually arises earlier than firms expect. A new vendor that touches customer data, a group decision to centralise operations in India or London, an onboarding tool that performs part of customer due diligence, or a regulator's request for the outsourcing register can each trigger approval, notification or remediation obligations. This page focuses on the regulatory overlay for licensed financial institutions; for the general commercial and data position, see our page on cloud and outsourcing in the UAE.
The legal and regulatory framework
There is no single outsourcing statute. The rules sit in each regulator's legislation and rulebook, and which one applies depends on where the firm is licensed rather than where the provider sits.
Onshore: the Central Bank of the UAE
Onshore banks, finance companies, exchange houses, payment and stored value providers and insurers are supervised by the Central Bank of the UAE (CBUAE). Its powers now come from Federal Decree-Law No. (6) of 2025 regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business, which came into force on 16 September 2025 and replaced the 2018 Central Bank law and the 2023 insurance law. The new law gives the CBUAE wider examination and enforcement powers and states that using a particular technology or business model does not by itself take an activity outside the licensing perimeter.
Consolidated texts sit in the CBUAE Rulebook. For banks, the core instrument is the Outsourcing Regulation for Banks (Circular No. 14/2021), supported by accompanying Outsourcing Standards. All existing arrangements had to comply by 31 December 2023. In February 2026 the CBUAE added an Operational Risk and Operational Resilience Regulation requiring licensed financial institutions to maintain operational risk and resilience frameworks, which pulls third-party dependencies into board-level resilience planning. Instruments issued under the 2018 law continue to apply until they are replaced.
DIFC and ADGM
Firms authorised by the Dubai Financial Services Authority in the DIFC follow the outsourcing provisions of the DFSA's General (GEN) module, including a duty to notify the DFSA of outsourcing arrangements. In ADGM, the Financial Services Regulatory Authority applies GEN 3.3.31 and 3.3.32, which define outsourcing (expressly including group arrangements), require due diligence and continuing oversight, set out mandatory contract content including regulator access, and require contingency plans for material arrangements.
| Firm type | Regulator | Main outsourcing rules | Regulator engagement |
|---|---|---|---|
| Onshore bank (including foreign branch) | CBUAE | Outsourcing Regulation for Banks 14/2021 and Standards; Operational Risk and Operational Resilience Regulation (2026) | Prior non-objection for material outsourcing; immediate notice of material breaches |
| Onshore insurer, finance company, payment or SVF provider | CBUAE | Sector regulations, governance and operational resilience rules; licensee remains responsible for outsourced functions | Depends on licence conditions and sector rules; check before signing |
| DIFC authorised firm | DFSA | GEN module systems and controls rules on outsourcing | Notification of outsourcing arrangements |
| ADGM authorised person | FSRA | GEN 3.3.31 and 3.3.32; AML 9.3.1 for reliance on third parties for due diligence; FUNDS rules for delegation by fund managers | Supervisory review; contract must give the FSRA access |
Materiality and what cannot be outsourced
The first analytical step in any project involving financial services outsourcing in the UAE is classification. Is the arrangement outsourcing at all, and if so, is it material? Firms routinely get both questions wrong.
Is it outsourcing?
The CBUAE regulation defines outsourcing as a continuing arrangement with a party inside or outside the UAE, including a related party, for an activity the bank does or could do itself. The FSRA's January 2026 thematic review found that firms often failed to recognise outsourcing at all, particularly third-party software that performs core functions and intragroup arrangements. It also noted that an external audit is not outsourcing, while internal audit can be. One-off purchases of goods are generally outside the concept; recurring services that replace an internal function are inside it.
Is it material?
Under the bank regulation, a material business activity is one whose disruption could significantly affect operations or the bank's ability to manage risk. Banks must have a board-approved process for deciding materiality, and the board (or a board committee) must approve each material outsourcing. Materiality is not about contract value. A modest contract for a payments switch or sanctions screening engine can be material; a large facilities management contract may not be.
Functions that stay in-house
The CBUAE will generally not permit banks to outsource core banking activities and key functions: senior management oversight, risk management, compliance, internal audit, and management of risk-taking functions such as credit, investment and treasury. Banks may buy tools and specialist support for these functions, but decision-making and accountability must remain inside the bank. In the free zones, outsourced compliance officers and MLROs are permitted in some cases, but the FSRA has said it is increasing scrutiny of outsourced controlled functions where individuals lack sufficient time for the role.
A regulator will rarely object to a firm using a capable provider. It objects when the firm can no longer explain, evidence or control what that provider does.
Data location, confidentiality and regulator access
Data is where financial services outsourcing in the UAE differs most from other markets. For banks, the CBUAE requires the master system of record, the data needed for core activities, to be maintained and stored in the UAE. Foreign bank branches may, with approval, keep a UAE copy updated at least daily.
Confidential customer data may not be shared outside the UAE without CBUAE approval and the customer's prior written consent, including an acknowledgement that the data may be accessed in foreign legal proceedings. Banks must not use providers in jurisdictions that cannot offer equivalent safeguards or whose secrecy laws would restrict supervisory access. The 2025 Central Bank law reinforces customer confidentiality as a statutory duty, subject to defined exceptions.
The federal Personal Data Protection Law does not apply to banking and credit data governed by their own legislation, so sector rules lead onshore. DIFC and ADGM firms must also satisfy their own data protection laws when data leaves the centre; our page on cross-border data transfers in the UAE explains those mechanisms. In practice, offshore support models (for example, a group service centre in India or Bangladesh viewing UAE accounts) need a deliberate design: masking, access controls, logging and, for banks, the CBUAE approval and consent route.
Remote access is a transfer. A provider's engineer in another country who can view production data is accessing it from abroad, even if every server sits in a UAE data centre. Map who can see what, from where, before telling the regulator that data "stays in the UAE".
Key decisions: structure, provider and location
Most outsourcing programmes turn on three choices, and each has regulatory consequences.
Intragroup or third party
Group service companies are attractive because the provider shares the firm's culture and controls. Regulators treat them as outsourcing all the same. The CBUAE regulation requires prior non-objection for material related-party outsourcing, and the FSRA criticised firms that relied on group due diligence without local input. A UAE subsidiary needs its own documented assessment, a written agreement, service levels and the ability to exit even if the group would rather not.
Onshore or offshore delivery
Offshore delivery can reduce cost substantially, but for banks it brings the data rules above, plus country-risk assessment of the provider's jurisdiction and confirmation that the CBUAE can exercise its access rights there. Many firms adopt hybrid models: UAE-hosted systems with offshore support under strict access controls.
Cloud and technology platforms
Cloud services are outsourcing under every UAE financial regime. Hyperscaler regions inside the UAE have made residency easier, but standard cloud terms rarely give regulator audit rights, sub-processor controls or exit assistance in the form regulators expect. The 2025 Central Bank law adds another angle: platforms and technology infrastructure that facilitate financial services may themselves fall within the licensing perimeter, so fintech partners need their own regulatory analysis. Our fintech regulation page covers that question.
How to run a compliant outsourcing project
- Classify the arrangement. Decide whether it is outsourcing and whether it is material, applying the board-approved methodology and recording the reasoning, including for intragroup services.
- Run proportionate due diligence. Assess the provider's financial standing, security, resilience, subcontractors, conflicts and jurisdiction. The FSRA has warned against narrow AML-only checks and reviews performed by conflicted staff.
- Design data flows and access. Identify where data is stored and from where it is accessed; for banks, decide whether the master record stays in the UAE and whether CBUAE approval and customer consent are needed for any offshore access.
- Engage the regulator. For a bank's material outsourcing, obtain the CBUAE's prior non-objection before signing or going live. DIFC firms make their DFSA notification; ADGM firms confirm their approach meets FSRA rules and licence conditions.
- Negotiate the contract. Include the mandatory terms below, aligned with the bank's or firm's policy and the provider's actual operating model.
- Approve and record. Obtain board or committee approval for material arrangements, update the outsourcing register and integrate the provider into business continuity and disaster recovery plans.
- Oversee and test. Monitor service levels, incidents and subcontracting; test contingency plans; and have internal audit review the arrangement periodically.
- Exit cleanly. On termination, retrieve data, confirm destruction of copies and transition services without disruption, notifying the regulator where required.
Contract terms and documents to assemble
The CBUAE bank regulation lists minimum contract terms, and the DFSA and FSRA rules impose similar expectations. A compliant agreement for financial services outsourcing in the UAE typically needs:
- Confirmation that the firm owns its data and customers own theirs, with unrestricted access during the term and after termination.
- Express access, information and on-site inspection rights for the firm, its auditors and its regulator.
- Confidentiality obligations, information security standards (including recognised UAE information assurance standards for banks) and prompt breach notification.
- Limits on subcontracting, with flow-down of the same obligations and prior consent for material subcontractors.
- Service levels with measurable metrics, reporting, and default and termination rights, including termination where the regulator requires it.
- Business continuity commitments, exit assistance and secure data return and destruction.
Alongside the contract, assemble the materiality assessment, due diligence file, board paper and minutes, data flow map, regulator correspondence, register entry and contingency plan. These are the documents an inspection will ask for first. For the commercial drafting of service agreements more generally, see our outsourcing agreements page.
Risks and common mistakes
Signing before the regulator has been engaged
For a bank, the CBUAE expects a prior notice of non-objection before any material activity is outsourced. Procurement timetables often treat this as a formality to be handled after signature, but a contract signed first leaves the bank negotiating with the regulator from a weak position and may require costly amendments if conditions are imposed. Build the regulatory step into the project plan from the outset, prepare the submission alongside the commercial negotiation and include a condition precedent or termination right in the contract tied to regulatory approval.
Missing outsourcing hidden inside software and group services
Regulators keep finding outsourcing that firms did not label as such: software-as-a-service tools that perform core processes, onboarding vendors that carry out customer verification, and group entities that run IT, HR or finance. Because the arrangement was never classified, it has no due diligence file, no compliant contract and no contingency plan. Run a periodic sweep of accounts payable and IT inventories against the outsourcing register. Anything recurring that replaces an internal function should be assessed, even if the vendor calls it a licence.
Accepting standard technology terms
Global technology contracts are drafted for unregulated customers. They often reserve broad rights to change sub-processors, cap liability at a few months' fees, limit audit to third-party certifications and offer minimal exit support. Several of these terms are inconsistent with UAE regulatory expectations. Large providers usually have financial services addenda that give regulator access and better exit rights; ask for them. Where a provider will not move, record the gap, the compensating controls and the board's acceptance of the residual risk.
Under-resourced outsourced controlled functions
Smaller DIFC and ADGM firms commonly use outsourced compliance officers or MLROs. The FSRA's 2026 thematic review found individuals with insufficient hours to perform the role properly and signalled closer scrutiny. The firm, not the consultant, bears the regulatory consequence. Document the time commitment, reporting lines, access to records and how the individual escalates issues, and review whether the arrangement still fits as the business grows.
No credible exit plan
Contingency planning is often a paragraph in a policy rather than a tested plan. When a provider fails, is acquired or loses its own licence, the firm discovers that data is in a proprietary format, transition assistance is chargeable at the provider's discretion and no alternative has been identified. For material arrangements, identify a realistic alternative, agree data export formats and transition assistance in the contract, and test the plan before you need it.
Cross-border outsourcing and group structures
Many UAE financial institutions are part of groups headquartered in the UK, India, Singapore, China, Saudi Arabia or elsewhere, and group policy often favours shared service centres. Each layer of regulation then applies at once. A UK-headquartered bank's UAE branch must satisfy CBUAE data and approval rules even where UK rules permit the group model, and a Saudi group's UAE subsidiary faces the same issue in reverse.
For groups linked to Bangladesh, a common model is technology or back-office support delivered from Dhaka. That can work, but the arrangement must be documented as outsourcing, data access must be controlled and logged, and for banks the offshore-access rules apply in full. We coordinate with the relevant foreign advisers so that the group agreement, local addenda and regulatory submissions tell the same story. Firms should also check AML responsibilities when providers perform any part of customer due diligence; our AML compliance page explains the reliance rules.
Where a group operates both onshore and in a financial free zone, the same provider may need to satisfy the CBUAE and the DFSA or FSRA at once. One contract with regulator-specific schedules is usually more manageable than separate contracts with conflicting terms. Our pages on DIFC financial regulation and ADGM financial regulation explain the wider supervisory relationship.
How TRW & Co helps
We advise licensed financial institutions, fintechs and their technology providers on financial services outsourcing in the UAE, from the first materiality call to the regulator inspection.
Outsourcing framework reviews
We review outsourcing policies, materiality methodologies and registers against CBUAE, DFSA or FSRA requirements and recent thematic findings. The output is a prioritised remediation plan the board can approve and track.
Regulatory submissions
We prepare CBUAE non-objection requests, DFSA notifications and supporting papers that explain the arrangement, data flows and controls in the way supervisors expect, and we handle follow-up questions.
Contract negotiation
We draft and negotiate outsourcing, cloud and intragroup service agreements, including financial services addenda with global providers, so that regulator access, data, subcontracting and exit terms meet UAE rules.
Data and offshore access design
We work with technology and risk teams to map data storage and remote access, assess whether approvals or customer consents are needed and document the safeguards for offshore support models.
Vendor and fintech perimeter advice
For technology providers serving UAE financial institutions, we assess whether the service itself may be licensable under the 2025 Central Bank law and help prepare for the contractual and audit demands of regulated clients.
Incidents and inspections
When a provider suffers an outage or breach, or an inspection identifies gaps, we advise on notifications, remediation and correspondence with the regulator. Where representation before UAE onshore courts or the DIFC/ADGM Courts is required, we work alongside locally licensed advocates and registered practitioners.
For the full range of our financial services work, see banking and finance in the UAE or browse all our practices.
Checklist for decision-makers
- Do we have a complete, current outsourcing register covering material, non-material and intragroup arrangements?
- Has every recurring vendor that performs a function we could do ourselves been assessed for outsourcing and materiality?
- For material arrangements, do we have regulator non-objection or notification on file, plus board approval?
- Do we know where our data is stored and from which countries it can be accessed, and do we hold any approvals and consents required for offshore access?
- Do our contracts give us and our regulator access, audit and information rights, and do they control subcontracting?
- Is each material provider in our business continuity plan, with a tested exit route and agreed data return?
- Are outsourced controlled functions adequately resourced and supervised?
- Have we reviewed the arrangement against the 2025 Central Bank law and the 2026 operational resilience requirements?
If any answer is uncertain, a short review now is far cheaper than remediation under supervisory pressure. Contact TRW & Co to discuss financial services outsourcing in the UAE for your institution.
Frequently asked questions
01Does a UAE bank need Central Bank approval to outsource?
For material outsourcing, yes. The CBUAE Outsourcing Regulation for Banks requires a bank to obtain the Central Bank's prior notice of non-objection before outsourcing any material activity, including to a related party, and each request is assessed on its merits. Non-material arrangements do not need prior non-objection but must still be on the outsourcing register and managed under the bank's policy. The bank must also notify the CBUAE immediately of material breaches or developments affecting an outsourced activity.
02Can a bank send customer data to a group service centre abroad?
Only with care. The master system of record must remain in the UAE, and confidential customer data may not be shared outside the country without CBUAE approval and the customer's prior written consent, including an acknowledgement that it may be accessed in foreign legal proceedings. Remote viewing from abroad counts. Many banks therefore keep data in the UAE and allow tightly controlled, logged offshore access only after the approval and consent route has been addressed.
03Is cloud computing treated as outsourcing?
Yes. Under the CBUAE, DFSA and FSRA regimes, using a cloud provider to run systems or store data that the firm would otherwise manage itself is outsourcing. It must be assessed for materiality, contracted on terms that give the firm and its regulator access and audit rights, and covered by continuity and exit planning. UAE-based cloud regions can simplify data residency but do not remove the other requirements.
04Are intragroup arrangements exempt from outsourcing rules?
No. Both the CBUAE bank regulation and the FSRA's rules expressly include arrangements with group companies. A UAE entity must assess the group provider, sign a written agreement with clear service levels, keep it on the register and, for a bank's material arrangement, obtain CBUAE non-objection. Relying entirely on the parent's due diligence without a local assessment is a common supervisory finding.
05What changed for outsourcing under the 2025 Central Bank law?
Federal Decree-Law No. (6) of 2025 replaced the 2018 law from 16 September 2025. It strengthens the CBUAE's examination and enforcement powers, reinforces customer confidentiality and states that technology or business model alone does not take an activity outside the licensing perimeter. Existing outsourcing regulations continue to apply until replaced, and the CBUAE issued an Operational Risk and Operational Resilience Regulation in 2026 that brings third-party risk into resilience frameworks.
06Can a DIFC or ADGM firm outsource its compliance officer or MLRO?
In some cases, yes, but the firm remains responsible for the function. The FSRA's 2026 thematic review found outsourced compliance officers and MLROs with insufficient time for the role and said it is increasing scrutiny. Document the individual's time commitment, access to records and escalation lines, check that the arrangement fits the firm's licence and size, and review it as the business grows.
07What happens if we discover non-compliant outsourcing arrangements?
Act before the regulator finds them. Classify each arrangement, prioritise material ones, and remediate contracts, data flows and approvals. Where a bank has a material arrangement without CBUAE non-objection, it should take advice on how and when to approach the Central Bank. The CBUAE can require termination of non-compliant arrangements and impose sanctions, so a documented remediation plan approved by the board is the best evidence of good faith.
Sources and official materials
- CBUAE Outsourcing Regulation for Banks (Circular No. 14/2021) — Bank outsourcing, data location and non-objection
- Federal Decree-Law No. (6) of 2025 (announcement) — New Central Bank and financial institutions law
- CBUAE Rulebook — Consolidated Central Bank regulations and standards
- FSRA Dear SEO letter: Outsourcing Thematic Review (January 2026) — ADGM outsourcing findings and expectations
- Dubai Financial Services Authority — DIFC rulebook including GEN outsourcing rules
- Abu Dhabi Global Market — FSRA rules and guidance
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
