Materiality and approvals
Support the institution’s assessment. Do not label the arrangement or start a regulated approval path on the institution’s behalf.
UAE Compliance
Build the evidence your institution needs to stay in control.
SQUALE FZCO is a delivery provider, not a regulator. The licensed institution decides materiality, legal basis, data treatment, outsourcing classification and every required approval or non-objection.
This page describes a delivery approach. It is not legal advice, regulatory approval or a statement that one control set fits every UAE institution.
Institution-led
Accountability does not move to the supplier.
The institution defines its regulatory route. We make the delivery boundary, facts, decisions, evidence and contract inputs reviewable.
Due diligence inputs
Provide the service description, delivery roles, subcontractor facts, data flows, controls, dependencies, continuity path and exit plan.
Written control boundary
Put access, confidentiality, audit, incident, subcontracting, retention, deletion, handover and supervisory-access requirements into the agreed documents.
Data and access
Choose the data boundary before the build.
Classify
Identify personal, confidential, customer, model and operational data before any transfer or tool selection.
Locate
Record where the master system, copies, logs, backups, model endpoints and support access will be located.
Control
Define least-privilege access, segregation, encryption, secrets, audit trails, retention and deletion evidence.
Approve
Let the institution confirm consent, legal basis, cross-border conditions and any CBUAE approval or non-objection before use.
Software evidence
Make the delivered process inspectable and transferable.
Traceability
Connect requirements, source facts, policy rules, model tasks, human decisions, tests and acceptance results.
Supply chain
Record components, versions, licences, models, datasets, external services and replacement boundaries.
Operating control
Deliver monitoring, evaluation, quality limits, fallback, rollback, incident paths and a named operator.
Exit
Deliver source access, dependency records, runbook, current tests, open issues and a tested transfer route.
Sector route
Banks and insurers have their own outsourcing duties.
CBUAE rules require banks and insurance companies to assess outsourcing risk, keep responsibility for outsourced activity and obtain a prior non-objection for material outsourcing. The institution must determine whether and how those rules apply to the proposed scope.
The UAE Personal Data Protection Law also governs personal-data processing and cross-border transfer. The institution and its counsel must confirm the applicable legal basis and controls.
Free zones and other Middle East or Asian jurisdictions can have different regimes. The proposal must identify the client, sector, data path and governing requirements. We do not promise generic regional compliance.
Primary sources
Official references used for this delivery approach.
- CBUAE Outsourcing Regulation for BanksMateriality, governance, due diligence, data, access and prior non-objection requirements.
- CBUAE Outsourcing Standards for BanksOperational standards for contracts, controls, continuity, data and supervisory access.
- CBUAE Insurance Company Outsourcing RegulationRisk, accountability, contracts, data location and prior non-objection for material activity.
- UAE Personal Data Protection Law overviewOfficial UAE Government overview of Federal Decree-Law No. 45 of 2021.
Rules can change. The institution must use the current official text and professional advice for its scope.
Control path
Start with the institution’s required evidence.
Bring the proposed process, data categories, deployment boundary, supplier policy and approval owners.