Kuwait

Applies to all CBK-regulated entities, including banks, exchange and finance companies, e-payment companies, credit information companies and open banking service providers. It sets cyber resilience, operational resilience and third-party risk baselines, with a cloud services domain, an annual self-assessment and an annual independent third-party assessment. The document control table shows first release (version 1.0) on 3 December 2025.

CBK's rules for e-payment and e-money services, including registration and approval requirements, fraud and periodic reporting to the CBK, card-data security and AML/CFT requirements for e-payment providers. The CBK page notes that the English translation is for information only and the Arabic text is the only legal version.

Issued 17 July 2023 and published 18 July 2023. Bars the use of virtual assets as a payment tool or currency, dealing in them as an investment or offering that service to clients, the licensing of virtual asset service providers, and virtual asset mining; securities regulated by the CBK or CMA are excluded. Firms must warn clients of the risks, and Art. 15 of Law No. 106 of 2013 applies to violators.

Dated 17 July 2023 and addressed to financial institutions and designated non-financial businesses and professions. Prohibits using virtual assets as a payment instrument, dealing in them as an investment, licensing virtual asset services and mining; requires customers to be warned of the risks. Penalties under Art. 15 of Law No. 106 of 2013 apply.

Dated 16 November 2022. Directs local banks to embed ESG factors in governance and risk management, identify and measure climate-related risks in the ICAAP, and report annually on sustainability. It sets no implementation deadline.

Implements the insurance law. The IRU page lists amending decisions covering fees, penalties, complaints committee procedures (Arts. 50, 51, 53, 57), the fee schedule (Art. 19) and licensing requirements (Art. 70). Art. 28 refers AML/CFT rules to Law No. 106 of 2013 and says the Unit issues corporate governance rules.

Governs the licensing, supervision and conduct of insurance companies, brokers and related businesses in Kuwait and underpins the Insurance Regulatory Unit. The linked PDF is the Official Gazette correction notice of 15 September 2019 (Issue No. 1462) that republishes the law after an error in Issue No. 1460 of 1 September 2019. Art. 10(20) empowers the Unit to set AML/CFT rules for the sector.

Issued on 24 January 2016. Creates Nazaha, sets officials' asset and liability disclosure duties (Arts. 30 to 35), the duty of every person to report corruption offences (Art. 37) and protection of whistleblowers from the time of reporting (Art. 40). Art. 51 penalises disclosing a whistleblower's identity and Art. 52 makes administrative action taken against a whistleblower void and a disciplinary matter. Executive Regulations were issued by Decree No. 300 of 2016. Kuwait has no separate whistleblower statute in the sources read.

Sets up CITRA as the regulator of communications and information technology. The CITRA page publishes the combined version, the amending Law No. 98 of 2015 and the Executive Regulations.

Issued 10 February 2010 and published in the Official Gazette on 21 February 2010. It repealed the earlier private-sector labour code (Law No. 38 of 1964 per ILO NATLEX; the ESCWA page says 1963). Law No. 109 of 2013 set up the Public Authority of Manpower as the law provides.

Establishes the CMA and regulates securities activity in thirteen chapters, from definitions to penalties. Issued 21 February 2010 and published in the Official Gazette on 28 February 2010. Amended by Law No. 108 of 2014, Law No. 22 of 2015 and Decree-Law No. 91 of 2026, according to the CMA page.

Sets out the currency, the constitution and powers of the Central Bank of Kuwait, and the regulation of banking. The CBK page notes some clauses were amended by Decree Law No. 130 of 1977 and that the English version is for information only; the Arabic text is the legal version.

AML/CFT rules for CMA-licensed persons, implementing Law No. 106 of 2013. They cover a senior compliance officer (Arts. 2-2 and 4-5), customer due diligence (Art. 5-3), record keeping of at least five years (Art. 6-4) and immediate reporting to the Unit (Art. 1-5). The cover is dated January 2023 and individual pages carry revision stamps from November 2015 to February 2024.

The CMA's executive regulations in nineteen books, including Book 10 (Disclosure and Transparency), Book 12 (Listing Rules), Book 15 (Corporate Governance), Book 16 (AML/CFT) and Book 19 (Financial Technology). Each book is published as a separate PDF on the CMA site, with version numbers in the file names.

Framework for the Wolooj Regulatory Sandbox, a supervised environment in which startups and fintech firms test new products and services. Applicants go through pre-application, application, guidance, pilot (testing and soft launch with volunteer customers, with monthly progress reports) and graduation, with a sandbox licence requested after CBK's letter of acceptance. The document shows no date, version or eligibility criteria.