Kuwait’s New Cybersecurity Rules 2026 for Financial Companies

Financial companies in Kuwait face tighter expectations for protecting customer information, preventing cyber incidents, and keeping services running during disruptions. The Central Bank of Kuwait (CBK) introduced its Cyber and Operational Resilience Framework (CORF) on 3 December 2025, replacing the earlier 2020 cybersecurity framework with a broader approach to cyber risk and operational recovery. In October 2026, further reported instructions addressed external assessments for additional categories of financial service providers.

Kuwait’s New Cybersecurity Rules matter to banks, exchange companies, payment service providers and other regulated financial businesses because a cyber incident can affect transactions, customer data and day-to-day operations. Companies need to understand which requirements apply to their licence, assess their current controls and prepare the evidence their regulator expects.

Finsoul Network Kuwait offers IT consulting and cybersecurity consulting services for businesses reviewing their security controls and compliance requirements. Financial companies should first identify the rules that apply to their licence and activities, then assess their existing systems and address any gaps before a regulatory assessment.

What Are Kuwait’s New Cybersecurity Rules for 2026?

The main development for CBK-regulated banks and financial institutions is CORF. The framework moves beyond protecting networks and information systems. It also addresses how institutions prepare for disruptions, manage cyber incidents and restore services after an attack or operational failure. The CBK states that the updated framework took effect on 3 December 2025.

A further development was reported in October 2026. According to reporting published by Times Kuwait on 20 October, the CBK instructed exchange companies, electronic payment service providers, electronic money service providers, electronic payment system operators and credit information exchange companies to obtain approval before engaging an external assessment firm. The reported deadline for obtaining approval was 30 November 2026, with the assessment report due within six months of contracting the firm.

Financial companies should confirm the exact circular, applicable dates and requirements directly with the CBK before making compliance decisions. The October announcement should not be treated as a universal deadline for every business operating in Kuwait.

Which Financial Companies Need to Review the Requirements?

The applicable requirements depend on the institution’s activities, licence, and regulator. Businesses should establish whether they fall under CBK supervision or another authority before deciding which controls and assessments they need.

The CBK’s published CORF documentation identifies regulated entities within its supervisory remit and requires a Statement of Applicability (SoA) to establish which framework domains and sub-domains apply to an institution. This assessment must reflect the business model, licensed activities, and services provided.

Companies should not assume that requirements issued for CBK-regulated banks automatically apply to every investment firm or financial business. Firms under the CMA should review the authority’s own regulations and circulars.

What Does the Cyber and Operational Resilience Framework Require?

Kuwait’s New Cybersecurity Rules place greater emphasis on how financial institutions manage risk before, during, and after a disruption. The exact controls depend on the applicable framework and the institution’s approved scope.

1. Cybersecurity governance and risk assessment

Management needs a clear understanding of the company’s main cyber risks, the systems exposed to those risks, and the controls used to reduce them. Responsibilities should be assigned to appropriate personnel, with material risks reported to the relevant decision-makers.

A financial company should maintain records of identified risks, control weaknesses, decisions, and corrective actions. These records help management track unresolved issues and demonstrate how cyber risks are being addressed.

2. Access controls and data protection

Financial institutions handle sensitive information, including customer details, transaction records, and account data. Access should be restricted according to job responsibilities, with appropriate authentication and monitoring in place.

Companies should review privileged accounts, remove access when employees leave or change roles, and examine how third-party providers access internal systems. Backups should also be protected against unauthorised changes or deletion.

3. Incident response and recovery

Preventing every cyber incident is not realistic. Financial businesses need procedures for detecting suspicious activity, containing an incident, notifying the appropriate parties and restoring affected services.

Recovery plans should identify critical systems, responsible staff, communication channels and recovery priorities. Testing these arrangements helps expose problems before an actual incident interrupts payments, customer services or internal operations.

4. Third-party and technology risks

Banks and payment providers often depend on external software, cloud services, technology suppliers and specialist contractors. A supplier’s security failure could affect the financial company even when its own systems remain protected.

Companies should record important suppliers, assess their access to sensitive information and review contractual security obligations. They should also understand how services will continue if a supplier suffers an outage or cannot meet its responsibilities.

How Should Financial Companies Prepare for Compliance?

Businesses reviewing Kuwait’s New Cybersecurity Rules should begin with their actual regulatory obligations and existing security arrangements. A practical review can follow these steps:

• Confirm the regulator and scope. Identify the company’s licence, regulated activities and applicable CBK or CMA requirements.

• Review existing controls. Examine security policies, system access, incident records, backups, recovery plans and supplier arrangements.

• Map requirements against evidence. Record which controls are in place, what documents support them and where further work is needed.

• Assign responsibility. Give each identified gap an owner, priority and completion date.

• Test the arrangements. Use appropriate technical testing, incident exercises and recovery checks to establish whether documented procedures work in practice.

• Prepare for assessment. Organise policies, risk assessments, testing records and corrective-action evidence before engaging an approved external assessor where required.

This process also gives management a clearer view of the cost, staff time and technical work involved. It is better to identify missing evidence early than to discover during an assessment that a control exists in practice but has not been documented properly.

Do Financial Companies Need an External Cybersecurity Assessment?

The reported October 2026 directive makes external assessment an immediate issue for the categories of providers named in the report. These businesses should confirm the CBK’s approval process, the qualifications and eligibility of assessment firms, the required scope and the deadline for submitting the report.

An external assessment is different from an internal review. Internal teams can identify weaknesses and monitor progress throughout the year, while an independent assessor examines compliance against the applicable requirements and records the findings. Before appointing an assessor, a company should confirm:

• Whether prior CBK approval is required.
• Which framework domains and systems fall within the assessment.
• What documents and technical evidence the assessor needs.
• How findings will be reported and corrective actions tracked.
• The contractual timetable and the regulator’s reporting deadline.

A financial company should not assume that hiring an assessor transfers its regulatory responsibilities to that firm. Management remains responsible for addressing findings and meeting the obligations that apply to the business.

When Should a Company Engage Cybersecurity Consultants?

A company should consider independent advice when it lacks the internal expertise to interpret the requirements, assess its current controls or prepare for an external review. A cybersecurity firm may offer technical testing, security assessments or incident response, but businesses should check the precise scope of each service before appointing a provider.

A cyber security consultancy may focus on regulatory gap assessments, policy reviews and preparation of compliance evidence. Other providers specialise in penetration testing, security architecture or recovery planning. These services address different needs, so the company should select them according to the gaps identified in its review.

When comparing cybersecurity consultants, ask about their experience with regulated financial institutions, assessment methods, reporting format and ability to explain technical findings to management. Also establish whether the provider is eligible for the particular external assessment and has the required CBK approval. General cybersecurity experience alone does not establish regulatory approval.

The right scope should be agreed in writing. It should identify the systems covered, the framework being assessed, the documents to be reviewed, the expected deliverables and the process for reporting serious weaknesses.

What Are the Common Compliance Mistakes?

Financial companies can face avoidable delays when they treat cybersecurity compliance as a paperwork exercise rather than a review of actual controls. Common problems include:

• Using outdated policies: Documents do not reflect current systems, suppliers or business processes.
• Leaving gaps without owners: Findings are recorded but no individual is responsible for resolving them.
• Ignoring supplier access: External providers retain permissions that are no longer needed.
• Failing to test recovery: Backup arrangements exist, but the company has not tested whether critical data and services can be restored.
• Assuming one framework covers everything: The company overlooks additional obligations arising from its licence, activities or other applicable regulations.
• Appointing an assessor too late: Approval, contracting, evidence collection and reporting take longer than expected.

A cybersecurity consultancy should be assessed on the work it will perform, not simply on its ability to produce policies. If technical weaknesses require changes to systems or staff practices, the company needs a clear plan for completing and testing those changes.

Conclusion

Kuwait’s New Cybersecurity Rules require financial companies to pay close attention to cyber risk, service continuity and evidence of compliance. The CBK’s CORF framework sets out the wider requirements for regulated institutions, while the reported October 2026 instructions introduce additional assessment steps for specified financial service providers.

Finsoul Network Kuwait offers cybersecurity consulting services for financial companies reviewing their security controls before an assessment. Businesses should confirm the requirements that apply to their licence, address gaps in existing controls and check regulatory approval and reporting deadlines before appointing an external assessor.

Frequently Asked Questions

What are Kuwait’s new cybersecurity requirements for financial companies in 2026?

The main development is the CBK’s Cyber and Operational Resilience Framework, introduced on 3 December 2025. In October 2026, additional instructions concerning external assessments were reported for specified financial service providers. Companies should confirm the applicable requirements directly with the CBK.

Does every financial company in Kuwait need an external cybersecurity assessment?

The requirement depends on the regulator, the company’s activities and the applicable instructions. The October 2026 report identifies specific categories of CBK-regulated providers. Companies should confirm whether the directive applies to them.

What documents should a company prepare for a cybersecurity assessment?

Depending on the applicable framework, records may include cybersecurity policies, risk assessments, access-control procedures, incident response plans, recovery testing results, supplier assessments and evidence of corrective actions.

How should a company choose a cybersecurity provider?

Check the provider’s relevant experience, proposed scope, reporting methods and technical capabilities. If the work is a regulated external assessment, confirm that the provider meets the CBK’s approval requirements before signing a contract.

What happens if a financial company fails to meet cybersecurity requirements in Kuwait?

A company that fails to meet applicable cybersecurity requirements may face regulatory action, requests to correct deficiencies or other consequences under the rules governing its activities. Financial institutions should document identified weaknesses, assign responsibility for corrective work, and meet any deadlines set by the relevant regulator.