17/06/2026
Most financial institutions in the GCC have a business continuity plan. Fewer have tested it in the last twelve months. Fewer still could tell you with confidence how long their most critical services could withstand a disruption before causing real harm to clients, to the business, or to their regulator's patience.
That distinction, between having a plan and being operationally resilient, is at the heart of where regulatory expectations across the region are now heading.
The DFSA published Consultation Paper No. 170 in March, setting out a new operational resilience framework for all authorised firms. The QFCRA embedded its rules in 2024. The CBUAE framework is expected to follow. SAMA has resilience built into its Cybersecurity Framework. And the FCA, which many GCC regulators actively reference, published self-assessment observations earlier this year flagging the same gaps repeatedly: business services defined too broadly, impact tolerances without clear methodology, governance signed off in name but not interrogated in practice.
The firms best placed going into 2027 are the ones treating resilience as an operational reality rather than a compliance exercise, and that can demonstrate the difference.
The latest piece in our Risk Management Series, written by Mark Scott, our Executive Director - Risk Management, sets out what good looks like, the questions worth asking now, and the cost of leaving the work late.
Read it here: https://www.jawanpartners.com/insights/operational-resilience
