ADGM FSRA Implements New Cyber Risk Management Framework Amendments For Financial Services

The Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market (ADGM) has introduced changes to its regulatory framework concerning cyber risk management for Authorised Persons and Recognised Bodies. These changes will become mandatory on 31st January 2026. The amendments are a result of extensive industry consultation and feedback from Consultation Paper No. 3 of 2025.

Firms are now required to incorporate cyber risk management into their existing risk frameworks. This builds on the FSRA’s existing guidelines on Information Technology Risk Management and Governance Principles aimed at mitigating cyber threats and crime. The amendments are seen as a natural progression in the FSRA’s regulatory approach to this evolving risk area.

Feedback during the consultation period supported these changes, recognising them as necessary for adapting to dynamic risks. In response, the FSRA has provided firms with a six-month compliance window. This period allows firms to align with the clarified principles of proportionality and integration within their cyber risk management frameworks.

Guidance and Notification Updates

The FSRA has also updated its guidance to help firms assess the significance of cyber incidents. Additionally, there are plans to revise the cyber incident notification template by year-end. These updates aim to enhance clarity and efficiency in reporting cyber incidents.

Emmanuel Givanakis, CEO of ADGM’s FSRA, stated, "These amendments reflect the FSRA’s ongoing commitment to operational resilience and cybersecurity. By continuing to integrate global best practices into our framework, we safeguard the integrity of the financial services industry in ADGM. These recent developments demonstrate our ongoing dedication to responsible innovation and further position ADGM as a leading jurisdiction for secure and forward-looking financial activity."

The FSRA has also adapted requirements for arrangements with IT service providers, ensuring they align with the new regulatory expectations. This adaptation is part of a broader effort to ensure that all aspects of cyber risk management are effectively integrated into firms’ operations.

These regulatory updates underscore ADGM's commitment to maintaining a secure financial environment while fostering innovation within its jurisdiction. By aligning with global best practices, ADGM aims to strengthen its position as a leader in secure financial activities.

With inputs from WAM