Free self-assessment

UAE residency and messaging compliance checklist

Nineteen controls across communication channels, data residency, outsourcing and evidence. Work through them honestly and you will have a fair picture of your exposure — and a list of what to fix first. Nothing is submitted; your progress is saved in your own browser.

Last reviewed 29 July 2026 · approximately 10 minutes to complete

0 of 19 controls confirmed (0%)

Communication channels 5 controls

Every WhatsApp, Telegram, Botim and personal-device channel used with clients is inventoried, including relationship-manager side channels. Instant messaging is disabled for transaction confirmation, OTP and PIN delivery, and document exchange containing personal or financial data. Clients have been formally notified of the channel change and given a compliant alternative. The replacement channel produces a complete, tamper-evident record of every conversation. Staff conduct rules prohibit off-channel client contact, and the prohibition is monitored rather than merely stated.

Data residency 5 controls

A current data map shows where consumer and transaction data is stored, processed, cached and backed up. All primary storage of consumer and transaction data sits inside the UAE. Backups, disaster-recovery copies and log archives are also in-country — not only the production database. Third-party SaaS vendors touching customer data have been assessed for where they store and process it. Encryption keys are managed inside the UAE, not by an offshore provider.

Outsourcing & vendors 4 controls

Outsourcing contracts oblige the provider to meet security, encryption and audit expectations. Contracts require retrieval or destruction of all personal data on termination. Third parties are contractually barred from onward sharing or secondary use of customer data. Vendor security is verified periodically, not assumed at signature.

Evidence & governance 5 controls

Access to customer data is logged, reviewed and least-privilege by default. Retention and deletion schedules are defined and actually executed. Communication records are exportable in a format a supervisor will accept. An owner is named for residency compliance, with a reporting line to the board. The control set is re-tested on a defined cadence and the results are documented.

Reading your result

Under 60%

Material exposure

Unchecked items in the communication and residency groups are the ones a supervisor would ask about first. Treat this as a remediation programme, not a backlog item.

60–85%

Partial coverage

Usually means the obvious systems are handled and the copies are not — backups, logs and third-party SaaS. A data mapping exercise will find the rest quickly.

Above 85%

Largely covered

The remaining work is usually evidence rather than engineering: documenting controls, naming owners and setting a re-test cadence so the position holds.

This is a self-assessment aid, not a compliance certification. The controls are drawn from published CBUAE material and general practice. Your actual obligations depend on your licence category, entity structure and free-zone status — confirm them with qualified UAE counsel.

Want a second opinion on your answers?

Send us your result and we will tell you which gaps we would close first, and roughly what each would take.

Book a compliance review

UAE residency and messaging compliance checklist

Communication channels 5 controls

Data residency 5 controls

Outsourcing & vendors 4 controls

Evidence & governance 5 controls

Reading your result

Material exposure

Partial coverage

Largely covered

What to do about the gaps

Channel gaps

Residency gaps

Understanding the rules

Want a second opinion on your answers?

UAE residency and messaging compliance checklist

The checklist

Communication channels 5 controls

Data residency 5 controls

Outsourcing & vendors 4 controls

Evidence & governance 5 controls

Reading your result

Material exposure

Partial coverage

Largely covered

What to do about the gaps

Channel gaps

Residency gaps

Understanding the rules

Want a second opinion on your answers?