Why Scenarios
The Emirates’ regulatory landscape is not one regime. It is a federation of federal, free zone and national-security authorities, each with its own perimeter, expectations and examination style. An integrated architecture earns its integration by modulating to each — not by replicating itself across four audiences.
What follows describes how the same architecture lands under each authority: which obligations dominate the register, how continuity tolerances are set, where security risk concentrates, and which evidence carries the examination.
Scenario One — The Licensed Financial Institution
Supervision: Central Bank of the UAE.
The dominant obligations. AML/CFT frameworks, consumer protection standards and prudential requirements form the center of gravity of the register. Circular No. 1/2026 on Operational Risk Management gives those obligations operational form: resilience frameworks, continuity of critical operations, reporting to the supervisor on prescribed cycles.
How the architecture lands. The obligations register is weighted toward AML/CFT controls and their evidence chains — customer due diligence, transaction monitoring, suspicious activity reporting — each with designated owners and prescribed retention. Continuity tolerances are set from the reporting obligations themselves: the intervals at which the supervisor expects information define the recovery objectives of the systems that produce it. Security risk concentrates around the confidentiality of customer data and the integrity of reporting channels.
The evidence that counts. The ability to produce, on the supervisor’s demand, the control records behind a transaction, a report, or an escalated alert — traced from the event back to the obligation and the decision that established the control.
Scenario Two — The Free Zone Entity
Supervision: DFSA in the DIFC; FSRA in the ADGM.
The dominant obligations. Conduct of business, client asset protection, senior management accountability and the rulebook requirements specific to each regime. The free zone institutions share a structural feature: they answer to a regulator whose rulebook is often closer in texture to Anglo-American supervisory practice than to federal civil law.
How the architecture lands. The register distinguishes federal obligations from free zone obligations where both apply, and documents the mapping — a group with licensed entities inside and outside a perimeter holds both regimes in one architecture, without maintaining two registers. Continuity tolerances attach to client-facing services and settlement cycles. Security risk concentrates around client asset segregation records and the confidentiality of mandate information.
The evidence that counts. Coherence between what the rulebook requires, what the institution’s governance records say it does, and what the operating evidence shows actually happens — the triangulation a DFSA or FSRA examination constructs.
Scenario Three — The Virtual Asset Service Provider
Supervision: VARA.
The dominant obligations. Virtual asset activity rules: custody, exchange, transfer and advisory activities, each with its own control expectations. The sector’s defining exposure is that the assets themselves — the cryptographic keys and wallets holding client holdings — make information security the load-bearing wall of the entire compliance structure.
How the architecture lands. Here the triad inverts its usual order of emphasis: ISO 27001 controls — key management, access control, incident response — move from supporting role to the register’s center of gravity, because a security failure is a compliance failure is a client-asset failure. Continuity tolerances attach to the availability of custody operations and the integrity of transaction records, at the tightest tolerance any scenario in this sequence admits: near-zero. The obligations register maps every VARA rule to the technical control that satisfies it and the evidence that demonstrates it.
The evidence that counts. Demonstrated control over the custody chain — key ceremonies, access grants, segregation between client and house assets — in the form an authority coming to the sector from first principles expects to read.
Scenario Four — The Critical Infrastructure Operator
Supervision: NCEMA, under the national business continuity standard AE/SCNS/NCEMA 7000:2021.
The dominant obligations. Business continuity itself is the mandate: the ability to continue prioritized activities under emergency, crisis and disruption, with conformity to the national standard assessed by the authority directly — while ISO 22301 certification, in this scenario as in the others, remains the work of an accredited registrar.
How the architecture lands. ISO 22301 certification supplies the systematic core — clause structure, BIA, exercised plans — and the architecture extends it toward the national standard’s additional expectations: integration with national crisis management structures, escalation paths that align with state coordination, and documentation the authority itself reads. Continuity tolerances derive from consequence: which disrupted services cascade into public-order or sectoral effects. Security risk concentrates on operational technology and the integrity of control systems.
The evidence that counts. Exercised plans with recorded results, recovery tested against the tolerances the BIA derived — and the traceability, unique to this scenario, of every continuity decision to the national standard the authority examines against.
The Common Denominator
Four landings, one architecture. In each scenario the same obligations register, the same continuity mechanics, the same security controls modulate around a different center of gravity — because the design principle is constant: the authority defines what must be defensible, and the architecture ensures that it is.