What the date actually means
Federal Decree-Law No. 6 of 2025 came into force on 16 September 2025, consolidating the regulation of banks, insurers, payment providers and technology enablers under one framework. Article 184 grants in-scope entities a one-year transitional period — until 16 September 2026 — to regularise their status: licensing, governance and compliance arrangements aligned with the new law. The Central Bank holds discretion to extend; nothing obliges it to.
For resilience and continuity specifically, the practical question an institution must be able to answer by that date is unchanged from the Rulebook's Article 7 — but the supervisory attention around the transition raises the cost of a weak answer: can you demonstrate, with dated evidence, that critical functions survive a severe disruption within stated recovery objectives?
By August 2026 most of the calendar below has already run. The closed windows are kept here for the record — they show what the evidence pack was supposed to accumulate and when — while the work that is still available is the August evidence assembly and a deliberately quiet first fortnight of September.
The countdown, window by window
| Window | What must be finished | Why then |
|---|---|---|
| Q4 2025 + Q1 2026 | Gap assessment against Article 7 and the new law's scope; BIA refresh; remediation plan approved by the board | Consultant and internal calendars were still open in that window, and findings need months to fix |
| Q2 2026 | Plans rewritten and short; technology recovery arrangements verified; first full test executed with timings | A first test failed in Q2 was a finding to close; failed later, it becomes a risk carried into the examination |
| Jul-Aug 2026 | Second test if the first produced material findings; evidence pack assembled: policy, BIA, BCP, test reports, board minutes | The August 2026 queue is real — external reviewers and internal sign-offs jam before regulatory dates |
| 1-16 Sep 2026 | Buffer. Nothing new starts here | Late fixes fail interviews; a quiet fortnight signals control |
The rule of thumb from every regulatory deadline we have worked through: institutions that finished testing a quarter early spend September 2026 answering questions calmly; those still testing in August 2026 spend it writing explanations.
Three mistakes that consume the transitional year
- Treating it as a legal-only project. Licensing paperwork regularises status; it does not create a tested continuity capability. Examiners interview operations, not lawyers.
- Scheduling the test last. The test is where gaps surface. Put it in the middle of the plan, leave time to fix what it finds and test again.
- Building the evidence pack in September 2026. Dated evidence cannot be backfilled. A test report written the week before the deadline reads exactly like what it is.
Frequently asked questions
Will CBUAE extend the deadline?
Article 184 allows the Central Bank to extend at its discretion. No institution can rely on it — and an extension, if granted, tends to come with closer attention to those who needed it.
We are a payment company newly in scope. Where do we start?
With a scope-and-gap exercise: which licensing category you fall under, which Rulebook requirements attach, and where your continuity arrangements stand against Article 7 logic. That is 2-3 weeks of work and it sets the order of everything that follows.
Is one annual test enough?
One test is the regulatory minimum. If your first test produces material findings — most first tests do — plan a second before the deadline to show the loop closed.