UAE Central Bank CPD Requirements: The Training Plan You Must File

Of all the competence regimes covered in this series, the UAE’s has the lowest hours requirement and the most intrusive oversight. Ten CPD hours a year — and a Board-approved training plan that must be filed with the Central Bank at the start of every financial year.

The rules sit in the Central Bank of the UAE’s Fitness and Propriety Regulation (C 4/2024) and its accompanying Standards (C 4/2024 STA), both effective from 31 October 2024.

Who is caught

The Regulation and Standards apply to all Licensed Financial Institutions, Insurance Companies, Takaful Insurance Companies and Insurance-Related Professions — collectively defined as Licensees. So banking, insurance and takaful sit under one instrument rather than separate sectoral rulebooks.

Within those firms, the CPD obligation attaches to Authorized Individuals and Material Risk Takers. And the scope provisions extend the framework to persons engaged by a Licensee where a function is outsourced, where applicable — so outsourcing a controlled function does not move the competence obligation off the Licensee’s books.

Ten hours, with no carry-over

Article 9.3 of the Regulation sets the floor: unless otherwise specified, the minimum is ten hours per calendar year for Authorized Individuals and Material Risk Takers. Article 9.4 reserves the Central Bank’s power to set further requirements for specified functions, including particular programmes, and to determine which programmes, training or qualifications it considers adequate.

The Standards add two constraints. Hours completed in one year must not be carried over to another. And the content must be directly relevant to the specific function of the person — so generic compliance training banked across a workforce will not satisfy it for roles it does not address.

Ten hours is modest by regional comparison. Singapore requires up to 30 for an investment product adviser, Hong Kong 10 rising to 12 for responsible officers, Ireland 15 for MiFID and insurance staff. The UAE’s demands sit in the process rather than the volume.

What counts

The Standards list qualifying activities as participation at conferences, lectures, workshops, seminars, formal training courses and appropriate electronic learning platforms.

That explicit inclusion of electronic learning platforms is worth noting, because several regimes restrict it. Hong Kong requires activities to involve interaction with other persons, and New York requires live or fully interactive delivery for some CLE credit. The UAE places no such constraint in its list.

The training plan: the obligation that sets this regime apart

Under the Standards, at the start of each financial year a Licensee must submit to the Central Bank a Board-approved training plan. The Licensee must also be able to demonstrate that the plan contributes to the suitability of persons and to the Board’s Collective Suitability.

Three things follow, and they change how a training function has to operate.

The plan is a regulatory filing, not an internal document. It needs Board approval before the year starts, which means the planning cycle must complete before the financial year does — a timetable most L&D functions do not currently run to.

It must be justified by reference to suitability. Not engagement, not completion, not cost. The test is whether the plan contributes to individual suitability and to the Board’s collective suitability, which requires the plan to map to roles and to the composition of the Board.

It is reviewable. Having filed it, the Licensee has told the regulator what it intends to do, and can be asked why it did something else.

Breaches must be self-reported

The Standards require Licensees to document and inform the Central Bank of any breaches of CPD requirements. This is a positive self-reporting duty on training shortfalls specifically, which is unusual — most regimes discover CPD failures through audit or at renewal rather than through notification.

Alongside it, at least annually, Licensees must report to the Central Bank on vacant Designated Functions and on CPD undertaken by persons where required. The Regulation also requires the results of the Fit and Proper Process to be submitted immediately upon finalisation, and breaches of the Regulation and Standards to be reported.

Exemptions are available: the Central Bank may grant them in exceptional circumstances, including cases of serious illness.

Records: specified in content, unspecified in duration

Licensees must maintain detailed records of CPD participation with supporting documents — the Regulation names attendance or completion certificates and course receipts among them. Those records must be submitted to the Central Bank where required, and made available on request.

What the instruments do not state is a retention period. As with APRA’s standard, the duration is left to the Licensee to set and justify. Firms operating across jurisdictions will find the UAE sets the content of the record while Singapore sets five years, Hong Kong three, and the FCA three, five or indefinite depending on the activity.

The course receipt requirement is a small but telling detail: it suggests the Central Bank expects to be able to verify that training was actually procured, not merely recorded.

A note on the DIFC and ADGM

This guide covers the onshore UAE regime administered by the Central Bank. The Dubai International Financial Centre and Abu Dhabi Global Market operate their own regulators — the DFSA and the FSRA respectively — with separate rulebooks and their own authorised or approved person regimes. Their requirements are not covered here and should not be assumed to match. Firms operating in those jurisdictions should work from the relevant rulebook directly.

For the comparable Asian regimes, see our guides to MAS competency requirements in Singapore and the SFC’s continuous professional training rules in Hong Kong. Our CPD course library covers the compliance and governance material these requirements draw on.

Frequently asked questions

How many CPD hours does the UAE Central Bank require?

Ten hours per calendar year for Authorized Individuals and Material Risk Takers, unless otherwise specified by applicable regulations. The Central Bank may set additional requirements for particular functions.

Can unused hours be carried forward?

No. The Standards state that CPD hours completed in one year must not be carried over to another year.

Does a training plan have to be submitted to the regulator?

Yes. At the start of each financial year a Licensee must submit a Board-approved training plan to the Central Bank, and must be able to demonstrate that it contributes to the suitability of persons and to the Board’s Collective Suitability.

Does e-learning count?

Yes. The Standards list appropriate electronic learning platforms alongside conferences, lectures, workshops, seminars and formal training courses, without the interaction requirement some other regimes impose.

What must be reported to the Central Bank?

Breaches of CPD requirements must be documented and notified. At least annually, Licensees report on vacant Designated Functions and CPD undertaken where required, and the results of the Fit and Proper Process must be submitted immediately upon finalisation.

How long must CPD records be kept?

The instruments do not specify a retention period. They require detailed records with supporting documents, including attendance or completion certificates and course receipts, to be submitted where required and available on request — leaving the Licensee to set a defensible retention rule.