Kuwait's compliance landscape rests on four pillars that reach almost every operating company: the Companies Law issued by Law No. 1 of 2016, the Capital Markets Authority regime created by Law No. 7 of 2010, the anti-money-laundering framework of Law No. 106 of 2013 as amended in 2025, and the data protection rules issued by the Communication and Information Technology Regulatory Authority. Each pillar carries its own filing duties, evidence standards and penalties. This article maps the framework, then turns to the practical discipline that decides whether a Kuwaiti entity can defend its decisions: evidence and escalation.
The framework: four regimes, one company
The Companies Law, Law No. 1 of 2016, governs every Kuwaiti commercial company and sets the governance floor: board formation, shareholder meetings, disclosure and director liability. Its Implementing Regulation was issued by Ministerial Decision No. 287 of 2016. Companies licensed in securities activities add the Capital Markets Authority, established by Law No. 7 of 2010, whose Executive Bylaws were issued by CMA Board Resolution No. 72 of 2015 and now run to nineteen modules. Any company that qualifies as a financial institution or a designated non-financial business or profession under Article 1 of Law No. 106 of 2013 carries anti-money-laundering duties, and CITRA-licensed service providers processing personal data answer to the Data Privacy Protection Regulation issued by Decision No. 26 of 2024.
The mistake we see most often is treating these as separate projects owned by separate teams. A single approval, for example onboarding a new corporate customer for a brokerage licensed by the CMA, can trigger securities licensing conditions under Module Five of the Executive Bylaws, disclosure duties under Module Ten, customer due diligence under Law No. 106 of 2013, and, where a CITRA-licensed service provider processes the customer's personal data, the data handling rules of Decision No. 26 of 2024, several of them at once. Compliance design in Kuwait therefore starts with a regulatory map per entity and per activity, not with a policy template.
The governance baseline: Companies Law No. 1 of 2016
For shareholding companies, the Companies Law sets hard structural rules. Article 181 requires management by a board of directors of no fewer than five members, elected for renewable three-year terms; Article 182 requires election by secret ballot. Article 186 anchors corporate governance principles in the law itself, and Article 187 allows supervisory authorities to require qualified independent board members, elected by the ordinary general meeting, capped at half the board and exempt from share ownership. Article 199 requires a general-assembly license for board members' interests in company contracts, and Article 209 lets the company's articles adopt cumulative voting, so minority shareholders can concentrate votes for board seats.
Director accountability has teeth and a clock. Article 201 exposes board members to liability claims, and Article 205 provides that the claim lapses five years after the general meeting resolution discharging the board or establishing the error, unless the act constitutes a criminal offense, in which case the claim survives with the criminal case. Boards that minute their deliberations, record dissents and document the information they relied on build their defense in real time; boards that do not leave the five-year window open to reconstruction against them.
The CMA regime: Law No. 7 of 2010 and the Executive Bylaws
Law No. 7 of 2010 established the Capital Markets Authority and gave it regulatory, supervisory and enforcement power over securities activities in Kuwait. The Executive Bylaws issued by Resolution No. 72 of 2015 organize the regime into modules: Module Five licenses securities activities and registers persons, Module Ten governs disclosure and transparency, Module Twelve contains the listing rules, and Module Fifteen imposes corporate governance requirements, including board committees and independence standards, on listed companies and entities the CMA supervises.
For a licensed or listed company, the bylaws are not background reading; they are the operating system. Module Five conditions the license on fit and proper persons, approved controllers and continuing capital and conduct obligations. Module Fifteen requires functioning audit, risk, and nominations and remuneration structures with documented charters. In our compliance reviews for Kuwaiti licensees, we test the module obligations against actual board calendars, committee minutes and filing records, because the CMA inspects the evidence, not the policy binder.
Disclosure discipline under Module Ten
Module Ten of the Executive Bylaws imposes continuing disclosure and transparency duties: material information must be disclosed accurately and on time, insiders are restricted in dealing ahead of disclosure, and the company must be able to show who knew what and when. The practical core is a disclosure decision trail: how a fact travels from the business to a materiality assessment, who signs the assessment, and how the disclosure or the decision not to disclose is recorded.
Weak disclosure files share a pattern: materiality judged informally, no contemporaneous record of the reasoning, and insider lists that lag behind reality. A defensible file contains the fact as received, the assessment against Module Ten standards, the decision with names and timestamps, the insider list update, and the eventual disclosure text. When the CMA asks, and it does ask, the file answers in one pass. We structure disclosure protocols so that the file is a by-product of the decision, not a reconstruction after the fact.
Anti-money-laundering: Law No. 106 of 2013
Law No. 106 of 2013 on combating money laundering and terrorism financing is the foundation of Kuwaiti AML compliance. Article 1 defines the obliged population: financial institutions and designated non-financial businesses and professions, a category that reaches lawyers, accountants, real estate brokers and dealers in precious metals when they perform covered transactions for clients. Obliged entities must identify and verify customers, understand the purpose of the relationship, apply ongoing monitoring, report suspicious transactions to the Kuwait Financial Intelligence Unit, and keep records for the statutory retention periods.
The compliance burden is procedural, not rhetorical. A risk-based onboarding file must show who was identified, what was verified, which screening was run and what the risk rating is; monitoring must be able to surface unusual patterns; and the escalation route from a front-line flag to a suspicious transaction report must be short, documented and independent of the relationship owner. Training and testing close the loop: Kuwaiti examiners ask for attendance records, sampling results and remediation evidence, not for the policy PDF.
The 2025 amendment: targeted sanctions and Article 33 bis
In June 2025 the Council of Ministers approved a Decree-Law amending Law No. 106 of 2013 to align the framework with United Nations Security Council resolutions. The amendment replaced Article 25: the Council of Ministers, on the recommendation of the Minister of Foreign Affairs, may now issue decisions implementing Security Council resolutions under Chapter VII, including listing and delisting, freezing of funds and assets, and prohibitions on dealings, with safeguards for third parties acting in good faith, and may delegate these powers to a minister.
The amendment also added Article 33 bis, which fines any person violating a decision issued under Article 25 no less than 10,000 Kuwaiti dinars and no more than 500,000 dinars per violation, without prejudice to regulatory measures against institutions under Article 15. For compliance teams the message is operational: sanctions screening must refresh against Kuwaiti implementing decisions, not only foreign lists; hits must be escalated, frozen and documented the same day; and the audit trail must show the list version screened against. A stale screening list is now a fine risk measured per violation.
Data privacy: CITRA and Decision No. 26 of 2024
CITRA was established by Law No. 37 of 2014, whose Article 15 empowers it to issue the rules needed for compliance with the law. Acting on that mandate, CITRA issued the Data Privacy Protection Regulation by Decision No. 26 of 2024 dated 7 February 2024 and published in the Official Gazette on 18 February 2024, replacing the earlier Regulation under Decision No. 42 of 2021; in parallel, Decision No. 34 of 2024 repealed the 2021 data classification policy. The Regulation applies to CITRA-licensed service providers that collect, process or store personal user data, wholly or partly, by automated means or otherwise, whether the processing occurs inside or outside Kuwait.
The Regulation demands consent discipline and fast escalation. Service providers must obtain prospective consent to the use of personal data, and breach notification runs on two clocks: under Article 4, mistaken disclosure of personal data exposing a large number of users must be reported to CITRA within seventy-two hours, and under Article 6, data breaches must be notified within twenty-four hours, with reporting duties extending to affiliates, parent companies and connected third parties, and with disclosure of whether the data is stored in Kuwait or abroad. A one-year grace period ran from publication in the Official Gazette, so the regime is now fully in force. Telecom and technology operators in Kuwait need an incident runbook that names who calls CITRA, on which clock, with what content.
Evidence: test the decision, not the policy
Our standing advice in Kuwait is to test compliance against a real decision, not against the policy text. Take an actual approval, a supplier onboarding or a gift request from the Kuwait operation and trace it: who decided, which checks ran, what evidence remains. Compare the signing limits in the policy with actual system rights, and record every off-system approval with its date and reason. If the policy names a committee that never meets, fix the process or the document, because an examiner will find the gap either way.
Exceptions deserve an accountable route, not quiet tolerance. An exception log should name the decision-maker, the reason, the expiry and the follow-up test. Complaint intake should be separated from the function being complained about: whistleblowing and misconduct reports need a channel that does not run through the manager whose decision is questioned, and original records must be preserved rather than harmonized into a single account. These mechanics are what turn the statutory duties under the Companies Law, the CMA bylaws and Law No. 106 of 2013 into defensible conduct.
Incidents and investigations under Kuwaiti duties
When an allegation surfaces, the first forty-eight hours decide the quality of everything that follows. Preserve original records, define the investigation scope, run a conflict check on the reviewer and map the confidentiality and employment implications before interviews begin. Where the facts touch personal data processed by a CITRA-licensed provider, the twenty-four and seventy-two hour clocks of Decision No. 26 of 2024 may already be running; where they touch customer assets at a CMA licensee, Module Ten disclosure analysis may be required in parallel.
Escalation abroad needs care. Kuwaiti entities in international groups should verify, before transmitting investigation material cross-border, what the data rules and the sector regulator expect, and should document the legal basis for each transfer. An investigation report that will support a regulator response or a labor decision should separate allegation from finding, cite the records relied on, and preserve the underlying evidence so an independent reviewer can reproduce the conclusion. This is the standard we apply when our office in Kuwait supports internal investigations.
Third parties, outsourcing and group arrangements
Kuwaiti compliance fails through third parties as often as through staff. Agents, distributors, brokers, cloud and IT providers, and group service companies all touch regulated duties: an introducer can create customer-due-diligence exposure under Law No. 106 of 2013, an outsourced processor that is a CITRA-licensed service provider can create exposure under Decision No. 26 of 2024, and a group company sharing premises or staff can blur the licensed perimeter of a CMA-regulated entity under Module Five. Every material third party needs a contract that allocates the duty, an onboarding check proportionate to its risk, and a right to obtain evidence when the regulator asks.
We recommend a third-party register that records, for each relationship, the regulatory duty it touches, the checks performed, the contract protections and the renewal date. Group arrangements deserve the same rigor as external ones: cost-sharing, secondments and shared systems should be papered and priced as real arrangements. Where a third party sits outside Kuwait, the contract should anticipate the evidence the Kuwaiti entity will need, including screening data, breach notifications and audit access, so the local duty never depends on a foreign counterparty's goodwill.
Building the Kuwait compliance calendar
Sustainable compliance is a calendar, not a campaign. We build for clients a twelve-month map that joins the obligations of each regime: Companies Law general meeting and board cycles, including the three-year board term under Article 181; CMA periodic filings, committee reporting and disclosure rehearsals under the Executive Bylaws; AML program review, training and screening-list refresh under Law No. 106 of 2013 as amended; and, for CITRA-licensed service providers, incident drills and consent-record audits under Decision No. 26 of 2024. Each item gets a named owner, a deadline and a repeatable test.
The failures repeat across sectors: policies that do not match system rights, insider lists and screening lists that are months stale, breach clocks discovered during the incident, and board minutes too thin to support the Article 205 limitation analysis years later. Each requires evidence discipline, not new law. A compliance function that can reproduce its last ten decisions is ahead of the enforcement curve.
What we review in a Kuwait compliance engagement
When our office in Kuwait runs a compliance review, we start with the regulatory map: which of the Companies Law, the CMA Executive Bylaws, Law No. 106 of 2013 and the CITRA Regulation binds which entity and activity. We then test governance against Articles 181 to 209 of the Companies Law, disclosure files against Module Ten, AML onboarding, screening and reporting against Law No. 106 of 2013 as amended in 2025, and data incident readiness against Decision No. 26 of 2024. The deliverable is a remediation plan with owners, deadlines and retests, plus the evidence architecture, including exception logs, escalation routes and minute standards, that keeps the company defensible between reviews.
See also: our Kuwait company formation guide and our Kuwait construction law guide, plus our commercial and corporate practice.
Frequently asked questions
Which companies must comply with the CMA Executive Bylaws?
Companies carrying on securities activities licensed under Module Five, companies listed under Module Twelve, and other persons the CMA supervises under Law No. 7 of 2010; the specific module obligations follow the license and listing status.
What are the core board rules for a Kuwaiti shareholding company?
Under the Companies Law, Article 181 requires a board of at least five members serving renewable three-year terms, Article 182 requires secret-ballot election, Article 209 lets the company's articles adopt cumulative voting, and Article 187 allows supervisory authorities to require independent members capped at half the board.
How long can directors remain exposed to liability claims?
Article 205 of the Companies Law provides that the claim lapses five years after the general meeting resolution discharging the board or establishing the error, unless the act is a criminal offense, in which case exposure follows the criminal case.
Who must comply with Law No. 106 of 2013?
Financial institutions and designated non-financial businesses and professions under Article 1, which include lawyers, accountants, real estate brokers and precious-metals dealers when performing covered transactions; duties include customer due diligence, monitoring, suspicious transaction reporting to the Kuwait Financial Intelligence Unit and record retention.
What did the 2025 AML amendment change?
A Decree-Law approved in June 2025 replaced Article 25 to empower Kuwaiti implementation of UN Security Council Chapter VII resolutions, including listing, freezing and dealing prohibitions, and added Article 33 bis fining violations of those decisions between 10,000 and 500,000 Kuwaiti dinars per violation.
Which data protection rules apply in Kuwait?
CITRA-licensed service providers are governed by the Data Privacy Protection Regulation issued by Decision No. 26 of 2024 under Law No. 37 of 2014, covering processing inside or outside Kuwait; the earlier regulation issued by Decision No. 42 of 2021 was replaced.
How fast must data breaches be reported?
Under the Regulation, Article 4 requires notification to CITRA within seventy-two hours for mistaken disclosures exposing many users, and Article 6 requires notification within twenty-four hours for data breaches, with duties extending to affiliates and connected third parties.
Can your firm run a compliance health check in Kuwait?
Yes. Our office in Kuwait scopes the regimes that bind you, tests evidence and escalation against the statutes cited above, and delivers a remediation plan. Contact us through our contact page to arrange a review.