Prepared. Business Continuity
Diagnostic Tool

The regional conflict has created a wide variety of operational challenges and pressures for firms across the GCC, including supply chains, cloud infrastructure, financial markets, and working arrangements for staff. A ceasefire is currently in place, but the situation remains fluid and the risk of further escalation has not passed. This diagnostic is designed to help you assess your firm's preparedness honestly and identify where action is needed now. It takes around 8 to 10 minutes.

Getting started
Getting Started

Tell us about your organisation

This helps us tailor the diagnostic and its output to your firm type, size, and footprint. GCC financial services regulators expect controls to be proportionate to a firm's scale and complexity, and so does this tool.

Which best describes your organisation? (select one)
Bank or Deposit-Taking Institution
Retail, commercial, or wholesale banking
Investment Firm or Broker-Dealer
Discretionary or advisory investment management, brokerage, market making
Asset Manager or Fund Manager
Collective investment schemes, fund management, portfolio management
Family Office
Single or multi-family office
Insurance or Re-insurance Firm
Insurers, re-insurers, captives, insurance managers and brokers
Payment Service Provider or Fintech
Payment institutions, stored value facilities, digital financial services
Corporate Finance or Capital Markets Firm
Arranging, underwriting, structured finance, sukuk issuance
Professional Services or Compliance Advisory
Legal, audit, risk, or regulatory advisory firms operating under a licence
Government-Linked or Sovereign Entity
Sovereign wealth, government investment vehicles, public sector financial entities
How many employees does your firm have globally? (select one)
In which GCC countries does your firm have a physical presence? (select all that apply)
Does your firm have offices or operations outside the GCC? (select all that apply)
Section 1 of 10 — People & Workforce

Do you know where your people are, and are they supported?

The GCC has one of the highest concentrations of expatriate professionals in the world. Staff locations, morale, and key person cover are foundational continuity questions right now.

1.Do you have an up-to-date record of where all staff are currently based, including senior management and those in control functions?
2.Are you maintaining regular structured communication with your team, including at least twice-weekly touchpoints and support for personal pressures such as school closures or family concerns?
3.Have you identified key person dependencies and documented interim cover arrangements, and considered what a sustained reduction in your expatriate workforce would mean for your minimum viable operations?
Section 2 of 10 — Operational Continuity

Can your operations absorb third-party disruption, and do you have visibility before it hits?

Third-party disruption and counterparty delays can compound quietly before becoming a crisis. The most important question is whether a disruption would be visible to you in time to act.

4.Have you mapped your critical third parties, outsourced providers, and counterparties, and confirmed their current operational status?
5.Have you identified alternative third parties and/or outsourced providers, including cloud providers, for critical services, and confirmed remote access and supervision controls for staff working from home?
6.Is your firm prepared to switch from its primary IT systems and applications to contingency or manual arrangements if required, and has this been tested?
Section 3 of 10 — Cyber & Information Risk

Are your systems and data resilient to the current threat environment?

Cyber and infrastructure risks are no longer abstract in the current environment. Cloud data centre disruptions have already occurred in the region during this conflict. The threat environment has also significantly elevated phishing, fraud, and state-sponsored cyber activity targeting GCC firms.

7.Do you know where your critical systems and data are hosted, including cloud provider locations? Cloud infrastructure concentration risk has materialised as a live operational issue during this conflict. Have you validated your backup and failover arrangements and confirmed you are not wholly dependent on a single provider or region?
8.Have you issued targeted staff guidance on heightened phishing, fraud, and information-sharing risks, including the obligation to use internal escalation channels rather than sharing operational details externally?
Section 4 of 10 — Regulatory & Client Continuity

Are you staying ahead with your regulator and your clients?

Regulators notice when firms go quiet. Clients remember how their advisors responded during uncertain periods long after the situation resolves. Both require personal engagement, not generic communications.

9.Have you proactively engaged your regulator(s)? Given that staff departures, office access restrictions, and operational disruptions have been a reality for many GCC firms during this conflict, regulators will expect to be kept informed of any material changes to your operating position.
10.Have senior leaders made personal, direct contact with your key clients, not a newsletter or circular, but a genuine conversation about their situation and yours?
Section 5 of 10 — Financial Resilience

Do you have the financial visibility and buffers to absorb disruption?

Financial risks in the current environment often have an operational dimension. Delayed payments, disrupted transactions, and compounding cash flow pressures can build before they become visible.

11.Have you stress-tested your cash flow and liquidity position against a 90-day disruption scenario using current-environment assumptions rather than last year's planning cycle?
12.Have you reviewed your expected inflows and receivables, and proactively engaged counterparties where payment delays are possible, recognising that the risk is often operational rather than credit-related?
13.Have you paused or deferred non-critical projects, recruitment, or system upgrades to reduce operational strain and preserve capacity for what matters now?
Section 6 of 10 — Governance & Strategy

Is leadership owning this?

Firms with board-level sponsorship of BCM and clear documented arrangements are consistently better positioned to navigate and recover from disruption quickly and proportionately.

14.Has your board or management committee formally met to document the firm's current position and response strategy, with clear ownership assigned across key risk areas?
15.Has your firm reviewed and updated its Business Continuity Plan within the last 12 months, and does it reflect your current operating model, staff arrangements, and third-party dependencies?
Section 7 of 10 — Crisis Communications & Social Media

Is your firm communicating with one clear, controlled voice?

In the GCC, reputational risk can move quickly across a small, relationship-driven market. The current environment has also generated significant volumes of misinformation and AI-generated content on social media, creating real risk for firms whose staff engage with or share it.

🔒
Advanced Resilience Area. The questions in sections 7 to 10 go beyond immediate response and assess your firm's structural preparedness. Firms that score well here are typically in the strongest position as conditions evolve.
16.Do you have a designated spokesperson and a defined crisis communications protocol, covering internal messaging, client communications, media enquiries, and regulatory notifications?
17.Have you issued clear guidance to staff on social media use during the current environment, including the risks of sharing unverified content, AI-generated material, or information that may conflict with government communications or attract regulatory attention?
Section 8 of 10 — AML & Financial Crime Continuity

Are your financial crime controls holding up under disruption?

Disrupted environments create elevated financial crime risk. Sanctions evasion, payment rerouting, and fraud increase when controls are under pressure. Maintaining AML and KYC capabilities during a crisis is a regulatory expectation across the GCC.

18.Have you confirmed that your AML, KYC, and transaction monitoring capabilities remain fully operational, including where staff are working remotely or key personnel are absent?
19.Have you reviewed your sanctions screening and escalation procedures in light of the current geopolitical environment, including any changes to relevant sanctions lists or guidance from your regulator?
Section 9 of 10 — Data Residency & Insurance Coverage

Are two often-overlooked areas of your resilience framework holding up?

Data residency breaches can occur quietly when staff work across borders. Many firms discover only during a crisis that their insurance policies do not respond to the scenario they are facing.

20.Have you confirmed that data residency, data privacy agreements, and client confidentiality requirements continue to be met under current working arrangements, particularly where staff are working remotely from outside the GCC or in the event of a temporary switch to servers located outside the UAE?
21.Have you reviewed your insurance policies, including business interruption, political risk, professional indemnity, and D&O, to understand whether they respond to geopolitical disruption scenarios and whether war or political risk exclusions apply?
Section 10 of 10 — Scenario Planning & Testing

Has your resilience framework actually been tested against what is happening now?

Many firms have BCPs designed for IT failure or pandemic scenarios. Geopolitical disruption tests different things, and regulators across the GCC are increasingly expecting evidence that firms have exercised their plans, not just documented them.

22.Has your firm run a tabletop exercise or scenario test against a geopolitical or regional disruption scenario, and has your BCP been reviewed and tested against a denial-of-access scenario as well as full evacuation?
23.Do you have a documented process for escalating from business-as-usual monitoring to formal BCP invocation, and does your team know what triggers that decision and who makes it?