Managed IT services for banks in the UAE, built around Central Bank rules.

Managed IT services for banks means an outside provider runs part or all of a bank’s IT under a written contract and SLA: a helpdesk for staff, on-site engineers, monitoring, patching and backups for servers, networks and cloud, 24/7 security monitoring and application support. The bank stays accountable, so the provider works within its outsourcing, risk and information security policies and the Central Bank’s rules.

For banks licensed by the Central Bank of the UAE, the main ones are the Operational Risk Management Regulation (Circular No. 1/2026, in force since 14 September 2026), the Outsourcing Regulation for Banks (Circular No. 14/2021) and the Consumer Protection Standards. Banks in DIFC and ADGM follow the cyber risk rules of the DFSA and the FSRA. Banks on SWIFT also attest each year against its Customer Security Controls Framework, and card systems fall under PCI DSS.

For material outsourcing, yes. The Outsourcing Regulation for Banks requires a prior notice of non-objection from the Central Bank before a bank outsources a material activity, and the Operational Risk Management Regulation requires one before outsourcing anything that could significantly affect critical operations if disrupted. Your outsourcing team decides whether a service is material; we give them the scope, data flows and exit plan the request needs, and our contracts accept the clauses the rules call for, including audit and on-site access for your bank and the Central Bank, breach notice and limits on subcontracting.

Yes, and the rules require it. A bank’s Master System of Record must stay in the UAE, including when work is outsourced, and the Consumer Protection Standards require consumer and transaction data to be held in the UAE with a secure backup in a separate location. We can keep systems, backups and security logs in Microsoft Azure’s UAE regions in Dubai and Abu Dhabi, the AWS Middle East (UAE) region or your own data centers.

In the UAE. Our 24/7 helpdesk and security operations center staff work in the UAE, and engineers visit sites in Dubai and Abu Dhabi. Systems, backups and security logs can stay in UAE cloud regions or your own data centers, which helps your outsourcing team meet the Central Bank’s rule on confidential data leaving the country.

Under the Operational Risk Management Regulation, events that significantly affect critical operations, such as one that triggers business continuity or disaster recovery plans, must be notified within 4 hours, with a summary of the impact, actions and recovery time within 24 hours. High-risk incidents must be notified within 72 hours, and significant personal data breaches immediately under the Consumer Protection Standards. Our 24/7 SOC calls your named contacts when an incident is confirmed and gives your team the facts these reports need.

Yes. Our security operations center monitors endpoints, servers, email, identities and cloud 24/7, manages endpoint detection and response, tracks missing patches and vulnerabilities, and leads incident response with your team. Logs can stay in your own UAE cloud tenancy or data center, and monthly reports give your risk and audit teams the evidence they ask for.

Yes. Branch and head-office staff reach our helpdesk 24/7, and engineers visit branches and offices in Dubai and Abu Dhabi for hardware faults, new starters, moves and anything that can’t be fixed remotely. Branches in the other emirates are supported remotely.

Yes, within the Central Bank’s rules. The Guidelines for Financial Institutions Adopting Enabling Technologies, issued jointly by the CBUAE, SCA, DFSA and FSRA in November 2021, set principles for cloud computing; the Master System of Record must stay in the UAE; and material outsourcing to a cloud provider needs the Central Bank’s non-objection. Microsoft Azure runs UAE North in Dubai and UAE Central in Abu Dhabi, and AWS runs a Middle East (UAE) region.

Not to personal banking and credit data that has its own legislation: Article 2 of Federal Decree-Law No. 45 of 2021 excludes it, and the Central Bank sets data rules for the institutions it licenses. Banks in DIFC and ADGM follow their free zone’s data protection law. Your legal team should confirm which regime covers each type of data you hold.

Either. We can run your IT end to end, or work alongside your team as co-managed IT, adding 24/7 cover, on-site engineers, security monitoring or application support while your team keeps control of priorities.

It depends on the number of users, branches and devices, how much on-site cover you need, the hours and response times you need, and whether security monitoring and application support are included. We send a written quote after a short assessment, so you know the cost before you sign.