1. The information and accounting systems, risk management and internal control systems set out in this Article do not apply to licensed banks that carry out the SVF business in the State. Banks must comply with the relevant regulations in these areas issued by the Central Bank for banks.

Information and accounting systems

2. A Licensee must have in place robust information and accounting systems to (a) record all business activities in a timely and accurate manner; (b) provide quality management information to enable effective and efficient management of business and operations; and (c) maintain appropriate audit trail to demonstrate effectiveness of controls.
    
3. A Licensee must properly maintain books and accounts and prepare financial statements and returns in compliance with all applicable regulatory reporting requirements and accounting standards in the State.

Record keeping

4. A Licensee must have in place adequate record keeping policies and systems for maintaining accurate and sufficient records of its books, accounts, management decisions and business activities, including transactions of Customers.

Data protection

5. A Licensee must have in place adequate policies, measures and procedures to protect its information and accounting systems, databases, books and accounts, and other records and documents from unauthorized access, unauthorized retrieval, tampering and misuse.
    
6. A Licensee must also adequately protect the Customer data (including Customer identification and transaction records) which are required to be stored and maintained in the State. Such data can only be made available to the corresponding Customer, the Central Bank, other regulatory authorities following prior approval of the Central Bank, or by a UAE court order. A Licensee must store and retain all Customer and transaction data for a period of five years from the date of the creation of the Customer data, or longer if required by other laws.