Banking & Financial Cybersecurity Regulations Across GCC Countries

The GCC Financial Cybersecurity Regulatory Landscape

Financial services in the GCC operate under a dual regulatory burden: they must comply with national cybersecurity laws and data protection regulations, while also meeting the financial sector-specific mandates issued by their respective central banks and monetary authorities. For example, a bank operating in both the UAE and Qatar must satisfy the requirements of the Central Bank of the UAE (CBUAE) and the Qatar Central Bank (QCB), alongside national frameworks like the UAE's National Cybersecurity Strategy and Qatar's National Cybersecurity Framework. This patchwork of regulations demands a structured, multi-jurisdictional compliance strategy, often best supported by a comprehensive GRC compliance automation platform.

United Arab Emirates: CBUAE Cybersecurity Standards

The Central Bank of the UAE (CBUAE) issued its Cybersecurity Standards in 2020, which remain the primary regulatory benchmark for all banks, finance companies, and payment system operators in the UAE. These standards are risk-based and aligned with international frameworks like NIST CSF and ISO 27001, but are tailored to the operational realities of the UAE financial sector.

Key Requirements of the CBUAE Standards

The CBUAE framework mandates a multi-layered defense strategy. Financial institutions must implement a robust cybersecurity governance structure, with a named board member or senior executive ultimately responsible for cybersecurity risk. Mandatory controls include continuous security monitoring, a formal vulnerability management program, and a dedicated Cyber Security Operations Centre (CSOC) or the use of a managed security service provider. The standards also require the deployment of SIEM technology for log aggregation and correlation, along with endpoint detection and response (EDR) solutions.

Qatar: Qatar Central Bank Cybersecurity Framework

The Qatar Central Bank (QCB) has enforced its QCB Cybersecurity Framework since 2020, building upon the earlier 2017 QCB Information Security Framework. The framework applies to all banks, finance companies, and payment service providers licensed in Qatar. It is heavily influenced by the NIST Cybersecurity Framework and mandates a comprehensive set of controls across identify, protect, detect, respond, and recover functions.

Specific QCB Compliance Obligations

QCB-regulated entities must establish a formal cybersecurity function independent from IT operations, conduct mandatory annual penetration testing, and ensure they have a tested business continuity and disaster recovery plan. The framework also imposes strict requirements on cloud computing and outsourcing, requiring prior approval from the QCB for any material third-party arrangements. Organizations must also adhere to the Qatar Data Protection Law (Law No. 13 of 2016), which applies to all personal data processing within the state.

Bahrain: Central Bank of Bahrain Cyber Framework

The Central Bank of Bahrain (CBB) introduced its Cyber Security Framework in 2023, which is arguably one of the most mature and prescriptive frameworks in the region. It applies to all licensed financial institutions, including banks, insurance companies, and investment firms. The CBB framework is structured around 7 domains and 24 mandatory controls, with a strong emphasis on governance and board-level accountability.

Kuwait, Oman, and Saudi Arabia

The regulatory environments in Kuwait, Oman, and Saudi Arabia are equally demanding, although they vary in their level of prescriptiveness and maturity.

Kuwait: Central Bank of Kuwait

The Central Bank of Kuwait (CBK) mandates cybersecurity controls through its Information Security and Cybersecurity Framework, which applies to all local and foreign banks operating in Kuwait. The framework is aligned with international standards and requires robust identity and access management (IAM), network segmentation, and incident response capabilities. Kuwait also has its own data protection law (Law No. 20 of 2014) which imposes additional obligations on financial institutions handling personal data.

Oman: Central Bank of Oman

The Central Bank of Oman (CBO) has issued mandatory Cybersecurity Regulations for Banks and Financial Institutions, which entered into force in 2022. These regulations require the establishment of a dedicated cybersecurity function, mandatory reporting of cyber incidents within 24 hours, and regular independent security assessments. Omani institutions must also comply with the Oman Data Protection Law (Royal Decree 6/2022), which has extraterritorial reach and requires explicit consent for data processing.

Saudi Arabia: SAMA and NCA

Saudi Arabia presents a unique dual-regulator environment. The Saudi Central Bank (SAMA) enforces the SAMA Cybersecurity Framework (CSF), which applies to all banks, insurance companies, and finance companies. Additionally, the National Cybersecurity Authority (NCA) issues mandatory standards such as the Essential Cybersecurity Controls (ECC) and Critical Cybersecurity Controls (CCC), which apply across all sectors, including finance. A bank in Saudi Arabia must therefore satisfy both the SAMA CSF and the relevant NCA controls, alongside the Saudi Personal Data Protection Law (PDPL).

Common Compliance Themes Across All GCC Jurisdictions

Despite their individual differences, all GCC banking cybersecurity regulations converge on several critical themes that financial institutions must address.

• Board-Level Accountability: Every framework mandates that cybersecurity is a board-level responsibility. Boards must approve the cybersecurity strategy, risk appetite, and budget, and they must receive regular reporting on the institution's security posture.
• Third-Party and Cloud Risk Management: Regulators across the GCC are increasingly focused on supply chain risk. Financial institutions must conduct rigorous due diligence on all third-party vendors, especially cloud service providers, and in many cases require prior regulatory approval for material outsourcing arrangements.
• Incident Response and Reporting: Mandatory incident reporting is a universal requirement. Timelines vary—from 24 hours (Oman, Saudi Arabia) to 72 hours (UAE, Qatar)—but all frameworks require a formal, tested incident response plan.
• Continuous Monitoring and Threat Detection: The deployment of security monitoring technologies, including SIEM, SOAR, and EDR, is a mandatory control in all frameworks. Regulators expect institutions to have real-time visibility into their security events and automated response capabilities.
• Data Protection and Privacy: With the introduction of comprehensive data protection laws across the GCC (UAE PDPL, Qatar PDPPL, Bahrain PDPL, Oman PDPL, Saudi PDPL), financial institutions must integrate data privacy controls into their cybersecurity programs, including data mapping, consent management, and breach notification.

The Compliance Challenge and Technology Solutions

Given the density and complexity of these overlapping regulations, relying on manual compliance processes is no longer viable for any financial institution of significant size. The cost of non-compliance—including regulatory fines, reputational damage, and potential loss of licence—far outweighs the investment required to automate compliance.

Modern GRC and compliance automation platforms enable financial institutions to map controls across multiple frameworks (e.g., mapping a SAMA CSF control to an equivalent CBUAE control), automate evidence collection from existing security tools, and generate compliance-ready reports for multiple regulators simultaneously. For example, the CyberSilo GRC Automation platform can ingest data from your existing SIEM, IAM, and vulnerability management solutions to automatically evidence compliance with NCA ECC, SAMA CSF, and CBUAE standards.

Assessing Your GCC Compliance Posture

For CISOs and compliance officers responsible for financial institutions in the GCC, a pragmatic approach to achieving and maintaining compliance involves a phased assessment and remediation plan. The following process outlines a proven methodology.

The Role of a SIEM in Meeting GCC Banking Regulations

A Security Information and Event Management (SIEM) system is a foundational technology required by virtually every GCC banking cybersecurity framework. However, regulators are no longer satisfied with basic log collection. They expect Next-Gen SIEM capabilities, including user and entity behavior analytics (UEBA), SOAR integration for automated response, and built-in compliance reporting modules. A platform like ThreatHawk SIEM is designed to meet these elevated expectations out of the box, with pre-built correlation rules for SAMA CSF, CBUAE, and QCB requirements.