How UAE financial firms can meet new CBUAE climate risk expectations

UAE banks and insurance companies regulated by the Central Bank of the UAE (CBUAE) are now operating under enhanced climate-related financial risk regulation. 

That supervisory shift sits alongside the UAE's wider climate legislative agenda, including Federal Decree-Law No. 11 of 2024 on the Reduction of Climate Change Effects, which took effect on 30 May 2026. Together, those developments mean climate-related obligations are moving from policy ambition to evidence-based compliance across both financial institutions and the wider UAE economy. 

Institutions that cannot demonstrate full compliance with the CBUAE framework are expected to submit a plan to the CBUAE explaining the reasons for non-compliance and the steps they will take to reach full compliance. These obligations change the board dynamic; firms now need to evidence compliance. In the UAE, as in the UK under the PRA's Supervisory Statement SS5/25, the debate has moved from readiness to evidence, with direct implications for board accountability, risk frameworks, capital adequacy, scenario analysis, sustainable finance product governance, disclosures and senior management responsibility. 

From principles to operational reality 

The CBUAE's principles for climate risk management, reinforced by its guidance on climate-related financial risks, set expectations for institutions to identify, assess, manage, monitor and disclose climate-related financial risks across governance, strategy, risk management, metrics and targets. 

The CBUAE has been explicit that climate-related financial risks – including physical risks such as extreme weather, heat stress and sea-level rise, and transition risks driven by policy, technology and market shifts – are material prudential risks. This is not voluntary sustainability reporting. Firms are expected to embed them into the internal capital adequacy assessment process (ICAAP) and consider risk appetite, credit underwriting and liquidity risk management. 

The CBUAE's framework is proportionate, but proportionality does not mean optionality. Regulated financial institutions must assess climate-related risks by reference to their own exposures, document and justify materiality judgements, and revisit them as data, modelling capability and business exposures evolve. Where risks are material, firms should be able to show how they have been embedded into governance, risk appetite, business strategy, controls and escalation routes. 

The practical question is whether the board can evidence today that the climate risk governance framework is genuinely embedded, operationally tested, linked to prudential risk management and capable of supporting a credible compliance or remediation plan if challenged by the CBUAE. 

Governance likely to be the first line of scrutiny 

The CBUAE's principles place board ownership and senior management accountability at the centre of its climate risk supervisory expectations. Boards are expected to approve the financial institution's climate risk strategy and risk appetite, ensure that designated senior management accountability for climate risk oversight is clearly allocated, and maintain clear escalation routes when material risks are identified or risk appetite is approached. 

This creates a challenge for firms that have developed climate risk frameworks and sustainability strategies but have not tested whether they operate in practice. A climate risk policy, board-approved sustainability strategy or environmental, social, and governance (ESG) committee will not be enough unless the institution can show how climate risk information flows through the organisation, informs credit and investment decisions, and appears in board and committee deliberations. 

The transition finance dimension 

The UAE's position as a regional hub for sustainable and transition finance, reinforced by COP28, its Net Zero by 2050 Strategic Initiative and the Abu Dhabi and Dubai sustainable finance ecosystems, together create significant commercial opportunity for UAE financial institutions. It also creates regulatory and reputational obligations. 

The CBUAE's sustainable finance framework sets clear expectations for green bonds, sustainability-linked loans, transition finance facilities and other ESG-labelled products. Financial institutions need product governance frameworks that ensure sustainability claims are accurate and verifiable, ESG-labelled products are appropriately structured, and financing activities do not create greenwashing exposure. 

The UAE Climate Change Law, which came into effect on 30 May 2025, reinforces that point. As businesses prepare for emissions measurement, reporting and reduction obligations, financial institutions will increasingly need to assess whether borrowers, issuers and counterparties have credible emissions data, governance and transition plans. The more climate regulation that applies across the real economy, the harder it becomes for financial institutions to rely on unsupported transition claims. 

Institutions therefore need robust frameworks for assessing the sustainability credentials of borrowers, projects and issuers, clear internal standards for what qualifies as green, sustainable or transitional finance aligned to recognised taxonomies, as well as governance arrangements that ensure claims made externally are consistent with internal underwriting judgements and risk assessments. 

Greenwashing risk sits at the intersection of product governance, disclosure integrity and live CBUAE supervisory expectations, and should be treated with the same rigour that institutions apply to any other conduct or prudential risk. 

International investor scrutiny and disclosure 

The CBUAE's supervisory framework lands in a landscape of increasing investor, counterparty and market scrutiny of climate governance, transition planning and corporate disclosures. The immediate challenge is to ensure that climate-related statements made to supervisors, boards, investors, rating agencies, counterparties and the market are consistent with the underlying governance evidence and risk management processes. 

That means the same evidence base must serve several purposes at once: CBUAE supervisory engagement, board assurance, audit committee oversight, investor conversations, annual and sustainability reporting, transition finance decisions and internal governance records. Withstanding scrutiny across those dimensions requires legal structuring discipline, disclosure control and governance rigour.

The interaction with international disclosure standards is particularly important. The CBUAE expects external disclosures to align with internal risk management, while ISSB-aligned IFRS S2 standards point towards greater connectivity between financial reporting, risk governance and climate-related assumptions. 

Gap assessments require investigations discipline 

Many UAE financial institutions have conducted some form of internal review or gap assessment against the CBUAE's climate risk expectations. The critical question now is whether those reviews were sufficiently robust, and whether they were structured with the rigour and legal discipline needed to support a credible remediation position. 

A review that is too narrow may miss implementation weaknesses. A review that is too informal may fail to create a reliable evidence base. A review that is not properly governed may create additional risk if it identifies gaps but does not support coherent remediation or escalation to the board. 

A CBUAE climate risk gap assessment should be structured with investigation-grade discipline: clear scoping, reliable evidence gathering, appropriate stakeholder interviews, findings analysis, escalation protocols, remediation planning and careful reporting to the board or relevant committee. 

Legal privilege may also be relevant where a review could identify historic weaknesses, governance failures or evidence relevant to supervisory engagement or investor challenge. Where a gap assessment identifies a weakness under the live supervisory standard, the institution should manage scope, privilege, evidence handling, reporting lines and remediation carefully.

What good looks like 

A defensible approach is clear: UAE financial institutions should be able to show that climate-related financial risks have been assessed, embedded into governance and risk management, managed through controls, and disclosed accurately and consistently. 

In practice, a defensible position is likely to require: 

• a board-approved climate risk materiality assessment, containing documented assumptions, limitations and evidence of board challenge; 
• clear allocation of senior management accountability for climate risk oversight, supported by committee terms of reference that reflect that accountability in practice; 
• integration of climate-related risks into the ICAAP, risk appetite framework and risk registers; 
• documented climate scenario analysis that has informed strategic and capital decisions, with a clear audit trail showing how outputs were used; 
• product governance frameworks for sustainable and transition finance products that address greenwashing risk; 
• data governance arrangements that acknowledge limitations and support prudent interpretation of climate-related data; 
• consistency between internal risk management, board reporting and external ESG and climate disclosures; and 
• a prioritised gap remediation roadmap, with clear ownership and timelines. 

The institutions best placed to respond will be those that can connect climate science, financial risk, governance evidence and disclosure. The CBUAE is not asking firms to predict the future with certainty.

It is asking them to show that they understand the risks, have made reasoned and documented judgements, and have embedded those judgements into how their business is governed. 

Preparing for CBUAE engagement 

CBUAE supervisory engagement on climate risk may include supervisory conversations, targeted information requests, thematic reviews and firm-specific follow-ups. Institutions should prepare now to evidence their compliance position, explain any gaps and show how remediation is governed. 

That means identifying who owns the response, where key documents sit, how board and committee materials are organised, how materiality judgements can be explained, and how known gaps are being remediated. 

A structured assurance review can help institutions identify gaps before the regulator does, develop a credible remediation plan, and give the board a coherent and defensible narrative on climate-related financial risk. 

Four immediate priorities

UAE boards and senior management should focus on four immediate priorities before the CBUAE requests evidence of compliance: 

• assess whether the institution has a board-approved climate risk governance framework that clearly allocates accountability, covers both physical and transition risks, and is integrated into existing prudential governance structures – rather than operating as a standalone sustainability initiative outside core risk governance;
• review the institution's climate scenario analysis capability: whether scenarios cover a sufficient range of transition and physical risk pathways consistent with the UAE's Net-Zero commitment and the CBUAE's guidance, whether outputs are being used in ICAAP and strategic planning, and whether the methodology, assumptions and limitations are documented and could be explained to a regulator;
• conduct a product governance review of any existing or proposed green, sustainable or transition finance products – assessing whether ESG claims are accurate, verifiable and consistent with internal underwriting standards, and whether there is adequate documentation to address any greenwashing concern; and
• consider whether the institution's current external disclosures are consistent with its internal climate risk assessments and governance evidence – and where gaps exist, as well as developing a prioritised plan to address them before those inconsistencies attract regulatory, or investor attention. 

The CBUAE's framework marks a clear shift from climate risk as a policy concern to climate risk as a prudential governance issue. The UAE climate compliance landscape is now developing on two fronts: prudential climate risk supervision for financial institutions and economy-wide obligations under the UAE Climate Change Law. 

The test is simple: if the CBUAE asked tomorrow for evidence of compliance, an explanation of gaps and a credible remediation plan, the institution must be prepared to respond confidently, consistently and with robust evidence.