What the date actually means
Federal Decree-Law No. 6 of 2025 came into force on 16 September 2025, consolidating the regulation of banks, insurers, payment providers and technology enablers under one framework. Article 184 grants in-scope entities a one-year transitional period — until 16 September 2026 — to regularise their status: licensing, governance and compliance arrangements aligned with the new law. The Central Bank holds discretion to extend; nothing obliges it to.
For resilience and continuity specifically, the practical question an institution must be able to answer by that date is unchanged from the Rulebook's Article 7 — but the supervisory attention around the transition raises the cost of a weak answer: can you demonstrate, with dated evidence, that critical functions survive a severe disruption within stated recovery objectives?
The countdown, quarter by quarter
| Window | What must be finished | Why then |
|---|---|---|
| Now → Q4 2025 + Q1 2026 | Gap assessment against Article 7 and the new law's scope; BIA refresh; remediation plan approved by the board | Consultants and internal calendars are still free; findings need months to fix |
| Q2 2026 | Plans rewritten and short; technology recovery arrangements verified; first full test executed with timings | A failed first test in Q2 is a finding you fix; in Q3 it is a risk you carry |
| Jul-Aug 2026 | Second test if the first produced material findings; evidence pack assembled: policy, BIA, BCP, test reports, board minutes | The August queue is real — external reviewers and internal sign-offs jam before regulatory dates |
| 1-16 Sep 2026 | Buffer. Nothing new starts here | Late fixes fail interviews; a quiet fortnight signals control |
The rule of thumb from every regulatory deadline we have worked through: the institutions that finish testing one quarter early spend September answering questions calmly; the ones that test in August spend it writing explanations.
Three mistakes that consume the year
- Treating it as a legal-only project. Licensing paperwork regularises status; it does not create a tested continuity capability. Examiners interview operations, not lawyers.
- Scheduling the test last. The test is where gaps surface. Put it in the middle of the plan, leave time to fix what it finds and test again.
- Building the evidence pack in September. Dated evidence cannot be backfilled. A test report written the week before the deadline reads exactly like what it is.
Frequently asked questions
Will CBUAE extend the deadline?
Article 184 allows the Central Bank to extend at its discretion. No institution can rely on it — and an extension, if granted, tends to come with closer attention to those who needed it.
We are a payment company newly in scope. Where do we start?
With a scope-and-gap exercise: which licensing category you fall under, which Rulebook requirements attach, and where your continuity arrangements stand against Article 7 logic. That is 2-3 weeks of work and defines the rest of your year.
Is one annual test enough?
One test is the regulatory minimum. If your first test produces material findings — most first tests do — plan a second before the deadline to show the loop closed.