Resilience is not only about cash reserves, backup servers or alternative suppliers. It also depends on whether a company’s legal rights and permissions still work when the business is under pressure.

By: Maroun Abou Harb, Associate at BSA LAW

Resilience is discussed as an operational or financial discipline. Businesses test liquidity, back up systems and diversify supply chains. Yet every continuity plan rests on legal infrastructure: licenses, delegated authorities, contracts, data permissions, employment arrangements, security rights and evidence.

That infrastructure can fail when needed most. The replacement supplier cannot be appointed without third-party consent. Customer data cannot lawfully be moved to the backup provider. An insurance claim is compromized by late notification. A guarantee was signed incorrectly. The company owns a platform, but not all of its intellectual property.

The most dangerous legal risk is not the missing clause. It is the right management assumes the business has, but cannot use.

In the UAE, the Central Bank’s 2026 Operational Risk Management Regulation now requires licensed financial institutions to implement a comprehensive operational risk and resilience proecedure. The principle is valuable for every company: identify what must continue, locate the legal points of failure and test them before disruption does.

1. Can the business lawfully act?

Start with corporate authority, check that licenses match actual activities, constitutional documents reflect the ownership and governance structure, and beneficial-owner, shareholder and director records are accurate. Review reserved matters, signing matrices, powers of attorney and banking mandates.

A deal, borrowing or emergency payment can stall because the authorized signatory is unavailable, a power has expired or an approval threshold was misunderstood. Group companies should confirm which entity employs people, owns assets, contracts with customers and receives revenue.

Run this scenario: if the chief executive and chief financial officer were unreachable tomorrow, who could bind the company, access its accounts and appoint an alternative supplier? If the answer is uncertain, the business has a legal single point of failure.

• Which contracts become dangerous under stress?

Most contract reviews examine value and liability. A resilience review asks a different question: what happens when performance is interrupted?

Build a heat map of critical customer and supplier contracts, ranked by operational importance and consequence of failure. For each, test termination and suspension rights, force majeure and change-in-law provisions, service levels, price-adjustment mechanisms, liability caps, indemnities, insurance, governing law and dispute forum, subcontracting, assignment and change-of-control restrictions. Check notice methods and cure periods; a valuable right can disappear if a notice is sent late or to the wrong address.

Then examine optionality, can the company use a replacement supplier, obtain transition assistance, retrieve its data in a usable format and continue using essential intellectual property? Is there a source-code escrow or step-in mechanism where appropriate?

The aim is not to renegotiate every contract. It is to know which five contracts could stop the business and to fix those first.

• Can technology fail without the legal part failing too?

A technical recovery plan is incomplete if the contracts do not support it. Cloud, payment, telecommunications and managed-service arrangements should align promised recovery times with the company’s tolerance for disruption. Audit rights, incident cooperation, subcontractor controls, data-location commitments and exit assistance should be tested.

The incident playbook must allocate legal decisions. Who determines whether regulators, customers, insurers or affected individuals must be notified? Who preserves evidence and engages external advisers? How will legal privilege or professional confidentiality be preserved? A cyber incident moves quickly; ambiguity over decision-making wastes the hours that matter most.

Conduct an exercise with management, technology, legal, communications and finance. Introduce a realistic vendor outage or data breach and follow the contracts: who calls whom, what must be notified, and what can actually be recovered?

• Does the company know what data and technology it is using?

Across the GCC, privacy and cybersecurity regimes increasingly regulate how data is collected, processed, retained, transferred and protected. A company cannot comply, or recover confidently, without knowing where its data goes.

Create a data map covering customers, employees, vendors and website users. Record the purpose and legal basis for processing, storage location, access rights, retention period, cross-border transfers and third-party processors.

The same exercise should include artificial intelligence, by identifying public and embedded AI tools, the information supplied to them, the outputs relied upon and the human review applied. Confidential information, personal data and third-party intellectual property should not enter a tool because an employee can access it. An approved-use policy, procurement review and output-verification process are proportionate safeguards.

• Can the company protect value when conditions deteriorate?

Management should monitor covenant breaches, unpaid taxes, overdue receivables, expiring insurance, threatened claims and counterparties showing signs of insolvency. The legal team should know which rights permit suspension, security enforcement, contract termination or protective court relief, and whether exercising them could create risk.

People and intellectual property also require continuity planning. Confirm that employment and consultancy terms contain appropriate confidentiality, invention-assignment and post-termination protections, tailored to the governing law. Identify key-person dependencies, succession gaps and access held by departing staff. Register intellectual property where appropriate and maintain evidence of creation and ownership.

Business needs also to review insurance as a contract, not a certificate. Map material risks to coverage, exclusions, deductibles, notification deadlines and consent requirements. The policy is only useful if the company knows how to activate it.

In brief, the output should be that for every critical risk, record the business service affected, relevant entity and contract, responsible owner, required action, deadline and escalation threshold.

Report the highest exposures to the board and repeat the exercise after major acquisitions, restructurings, regulatory changes or technology deployments.

A focused review can produce four useful assets:

1. an authority and obligations calendar;
2. a critical-contract heat map;
3. a data and AI inventory; and
4. a tested incident playbook.

No company can remove disruption. It can, however, remove the uncertainty surrounding who may act, what must be done and which rights remain available.

Al Ansari Exchange, the UAE’s leading remittance and foreign exchange company and a subsidiary of Al Ansari Financial Services PJSC (DFM: ALANSARI), and Dubai Municipality are celebrating a decade-long partnership that has enhanced access to government payment services, with annual collections rising by approximately 710% over the course of 10 years.

Established in 2016, the partnership enables individual and corporate customers to pay for Dubai Municipality services through Al Ansari’s extensive branch network across the UAE, expanding the availability of government services.

This growth reflects strong customer adoption, the service’s operational reliability, and rising demand for convenient payment channels. The collaboration also supports Dubai’s vision for customer-centric, digitally enabled government services by connecting public services with trusted private-sector payment infrastructure.

Marking the tenth anniversary of the partnership, Sayed Ismail Al Hashemi, Acting CEO of the Corporate Support Services Sector at Dubai Municipality, said: “We highly value our decade-long partnership with Al Ansari Exchange. This collaboration has contributed to enhancing service delivery efficiency and simplifying the customer journey for the payment of Dubai Municipality fees.”

Al Hashemi added: “The partnership has had a tangible impact by improving payment collection efficiency and expanding the range of available payment channels, making our services more accessible and enhancing customer satisfaction. At Dubai Municipality, we remain committed to leveraging digital transformation to deliver smart and efficient services that enhance the quality of life and wellbeing of our customers.”

Rashed A. Al Ansari, Group Chief Executive Officer of Al Ansari Financial Services, added: “Our ten-year partnership with Dubai Municipality reflects a shared commitment to making essential services more convenient and accessible. Over the past decade, we have combined Dubai Municipality’s service excellence with our extensive network and payment capabilities to provide customers with a reliable and efficient channel for completing their transactions. We look forward to building on this strong foundation and continuing to support Dubai’s evolving smart service ecosystem.”

Building on these foundations, both organisations will explore new opportunities to strengthen the partnership and support the continued evolution of Dubai’s smart service ecosystem.

From enhanced carbon capture at gas processing plants to grid modernisation and renewable energy storage, the technology reshaping the UAE’s oil and gas industry, has acquired a new dimension. As of the 2026, a significant portion of the research and development (R&D) behind it can be converted into a corporate tax credit of up to 50 percent under the country’s first dedicated R&D Tax Credit regime. According to Dhruva, a Ryan Affiliate, the opportunity for the energy sector is substantial, but the design of the regime rewards companies that act early and penalises those that treat it as a year-end exercise.

The regime was established by Cabinet Decision No. 215 of 2025 and made operational by Ministerial Decision No. 24 of 2026, issued on 18 March 2026. It applies to tax periods and fiscal years beginning on or after 1 January 2026, with the first claims expected in 2027. Credits are calculated on a tiered basis, rising from 15 percent to a headline 50 percent. Qualifying expenditure is capped at AED 5 million per qualifying entity or tax group per year, which produces a maximum credit of AED 2 million.

“The UAE’s energy transition has been told as a sustainability story and an investment story. From this year it is also a tax story. The work being undertaken to decarbonise hydrocarbon production, including enhanced oil recovery, carbon capture and storage, methane abatement, and the development of digital twins for processing plants, exemplifies the systematic, uncertainty-driven R&D that this regime is designed to reward. The catch is that the value sits in the documentation, and the documentation has to be built in real time. You cannot retrospectively reconstruct a year’s worth of R&D evidence in 2027,” said Nimish Goel, Leader, Middle East, Dhruva, Ryan LLC Affiliate.

For an industry as engineering-intensive as oil and gas, the central question is not whether qualifying activity exists. It is whether companies can tell the difference between routine engineering and genuine R&D, and prove it. Applying an established recovery method to a new reservoir does not, in itself, qualify. By contrast, systematically resolving technical uncertainty, whether relating to reservoir behaviour, materials performance under high-pressure conditions, the capture of CO₂ from sulphur recovery flue gas, or the integration of new digital control systems,  may qualify, provided the systematic experimentation and its outcomes are documented as the work is carried out.

“Two features will catch international energy companies off guard. Only R&D performed inside the UAE qualifies, and subcontracted R&D counts only when it is carried out by UAE-based third parties. Much of the sector’s historical R&D has run through global technology centres and group affiliates abroad. Companies will need to look hard at where their R&D actually physically takes place, before they assume they qualify,” said Fran Wilhelm, Associate Partner, Dhruva, Ryan LLC Affiliate.

The regime’s defining feature is a dual threshold that links the credit rate to both qualifying spend and headcount. The first AED 1 million of qualifying spend earns 15 percent and requires at least two R&D staff on average; spend between AED 1 million and AED 2 million earns 35 percent and requires at least six; and spend between AED 2 million and AED 5 million earns the top 50 percent rate and requires at least fourteen. Both conditions must be met for each band. Where the headcount falls short, the claim drops back to the highest band where both the spend and the staffing tests are satisfied. A minimum of AED 500,000 of qualifying expenditure applies to each R&D project.

This is where oil and gas companies face a structural choice that other sectors may not. R&D in the industry is often capital-intensive rather than people-intensive: a single carbon capture or enhanced oil recovery pilot can absorb millions in equipment and consumables while employing only a handful of dedicated researchers. Under the dual threshold, that profile caps the credit at the lowest band regardless of how much is spent. Reaching the higher rates means building R&D headcount physically in the UAE.

Pre-approval from the Emirates Research and Development Council is mandatory before any credit can be claimed, with no exceptions. No pre-approval means no credit, however strong the underlying scientific or technological uncertainty. Businesses must keep detailed technical records of objectives, methods, experiments and outcomes for at least seven years. The credit is also currently non-refundable, so it benefits companies that have a corporate tax or top-up tax liability to offset, which describes most established producers and service contractors in the sector. That said, it has been suggested that Phase 2 may include a refundable credit and an increase in both application and generosity, meaning all businesses should start planning ahead, irrespective of their tax position.

“Companies that map their qualifying projects now, secure pre-approval and build the evidence trail through the 2026 financial year will capture real value when claims open in 2027. Those that wait will find that the spend was eligible but the proof was never created. In this regime, the documentation is the asset,” concluded Nimish Goel.