The Central Bank of Kuwait (CBK) has directed exchange companies and a range of electronic payment and financial service providers to obtain external assessments of their cybersecurity and operational resilience, as part of efforts to strengthen the business environment and reinforce safeguards across the financial sector.
Under the directive, exchange companies, electronic payment service providers, electronic money service providers, electronic payment system operators and credit information exchange companies, known as “Cynet,” must comply with the requirements of the Cyber and Operational Resilience Framework (CORF).
The CBK has instructed the entities to obtain its approval before contracting an external auditing firm to assess their compliance with the framework. Approval must be secured no later than November 30, according to a report published by Al-Rai on October 19. Banks were instructed to implement the same procedure last year.
The entities must submit a report assessing their compliance with the framework within six months of contracting the company responsible for the assessment. The central bank stressed the importance of meeting the regulatory requirements within the specified deadlines.
The framework seeks to connect governance and regulatory requirements with operational practices, moving financial institutions beyond a traditional, technology-focused approach to cybersecurity towards a broader model centred on resilience and organisational maturity.
Under this approach, institutions are expected to assess their existing level of preparedness, identify gaps in their ability to withstand disruptions and strengthen their capacity to respond to and recover from cyber incidents, operational failures and crises as threats and technologies evolve.
Economic outlook
The directive highlights the growing importance of cybersecurity and operational resilience to Kuwait’s financial infrastructure as electronic payments and digital financial services expand. For exchange companies, payment providers and credit information businesses, independent assessments will add a regulatory compliance requirement while placing greater emphasis on their ability to maintain services and recover from disruptions.
For the wider financial sector, stronger resilience can help support the continuity and reliability of financial services. The effectiveness of the framework will depend on institutions’ ability to identify weaknesses, address compliance gaps and implement the required measures within the CBK’s deadlines.