Context

On 27 March 2026, the Dubai Financial Services Authority (“DFSA”) issued Consultation Paper No. 170 on Operational Resilience, setting out proposals to strengthen how firms operating in or from the Dubai International Financial Centers (“DIFC”) prepare for and respond to operational disruptions.

The consultation reflects a broader shift in regulatory focus, both globally and within the United Arab Emirates (“UAE”), towards ensuring that financial institutions are able not only to prevent disruptions, but also to continue delivering critical services during periods of stress.

Who Does it Apply To?

The proposed framework is expected to apply across the DIFC ecosystem, including authorised firms, applicants, and other market participants such as auditors and professional advisors.

The DFSA is consulting with the market, with responses due by 26 May 2026, and final rules will follow this process, Firms are likely to be given an implementation period of up to 24 months once the framework is confirmed.

Objective of the Consultation

The DFSA’s intention is to introduce a more formal operational resilience framework, broadly aligned with international standards. At its core, the objective is to ensure that firms are able to:

• Protect clients and users of financial services;
• Maintain market stability and confidence; and
• Strengthen the overall resilience of the DIFC financial system

The approach is expected to be proportionate and risk-based, recognising that not all firms will face the same level of complexity or exposure.

Overview of the Proposed Framework

At a high level, the DFSA proposes that firms adopt a structured approach to operational resilience built around five key elements:

• Identification of critical business services.
• Setting impact tolerances (i.e. acceptable level of disruption).
• Mapping resources required to deliver those services.
• Scenario testing under severe but plausible disruptions.
• Notification to the DFSA of material disruptions.

Not all firms will be subject to the full set of requirements. However, all firms will need to assess whether they provide critical services. Governance is also a key theme, with senior management expected to be actively involved in overseeing these decisions.

What Does This Signal for the Future?

This consultation, together with recent DFSA alerts on cyber threats and fraud, suggests a clear regulatory direction: operational resilience is likely to become a more structured and enforceable requirement in the DIFC, in line with other leading financial centres.

Practical Considerations for Firms

Although the framework is still in consultation, this is a good moment for firms to start reflecting on their current position.

In practice, this means thinking about:

• Which services are truly critical to clients and the market.
• How those services could be affected in a disruption scenario.
• Whether existing business continuity and incident response arrangements are sufficient.
• How resilience is currently governed at senior level.

At the same time, recent DFSA alerts serve as a reminder of the basics: maintaining good cyber practices, ensuring timely reporting of incidents, and strengthening awareness around fraud and impersonation risks.

Key Takeaway

The DFSA is moving towards a more formal and structured operational resilience regime, signalling increased regulatory attention on firms’ ability to withstand and operate through disruption, rather than simply prevent it.