Kuwait country pack.
Kuwait pack for banks, Islamic banks, finance and exchange companies, listed companies and large enterprises. It covers CBK bank governance and the annual Internal Control Review (ICR), the CBK Cyber and Operational Resilience Framework (CORF), CBK AML/CFT and Shari'ah supervisory governance rules, CMA Module 15 for listed companies, and the CITRA privacy regulation and NCSC baseline controls for the wider economy.
Frameworks and regulations.
| Instrument | Applies to | Requirements | Status |
|---|---|---|---|
| Corporate Governance Rules and Systems for Kuwaiti Banks Central Bank of Kuwait · Edition amended by CBK Board resolution of 10 September 2019 (first issued 2012) | Banks, Islamic banks | 21 | Source checked |
| Instructions to Banks Concerning Internal Control Systems Central Bank of Kuwait · CBK compilation No. 28 (circulars A to L, 1994 onwards), including the General Guidelines Manual of 14 November 1996 | Banks, Islamic banks | 24 | Source checked |
| Cyber and Operational Resilience Framework (CORF) Central Bank of Kuwait · Version 1.0, launched 3 December 2025 | Banks, Islamic banks, Finance companies, Exchange houses and more | 30 | Being confirmed |
| CBK Instructions to Banks on Anti-Money Laundering and Combating the Financing of Terrorism Central Bank of Kuwait · Circular 2/BS/IBS/432/2019 (replacing 2/BS, IBS/308/2013), updated by Circular 2/BS/IBS/507/2023 of 16 February 2023; under Law No. 106 of 2013 as amended by Decree-Law No. 76 of 2025 | Banks, Islamic banks, Finance companies, Exchange houses | 19 | Being confirmed |
| Instructions on Shari'ah Supervisory Governance for Kuwaiti Islamic Banks Central Bank of Kuwait · CBK Board resolution of 20 December 2016; compliance by 31 December 2017; effective 1 January 2018 | Islamic banks | 19 | Source checked |
| CBK Instructions for Finance Companies and Exchange Companies (internal control, governance and AML/CFT) Central Bank of Kuwait · Finance companies: Circular 2/FS, IFS/312/2013 of 3 September 2013 and Ministerial Resolution No. 38 of 2011; exchange companies: AML/CFT Instructions 2/ES/310/2013 as revised by 2/ES/457/2020 | Finance companies, Exchange houses | 15 | Being confirmed |
| Executive Bylaws of Law No. 7 of 2010, Module Fifteen: Corporate Governance Capital Markets Authority (Kuwait) · Executive Bylaws issued by CMA Resolution No. 72 of 2015 (Module 15 derived from Resolution No. 25 of 2013, CMA/S.S/C.G/3/2013); later amendments not checked | Listed companies, Capital market firms | 21 | Being confirmed |
| Data Privacy Protection Regulation Communication and Information Technology Regulatory Authority (CITRA) · CITRA Decision No. 26 of 2024 (replacing Decision No. 42 of 2021) | Large enterprises, Critical infrastructure | 11 | Being confirmed |
| National Basic Cybersecurity Controls National Cyber Security Center (Kuwait) · NCSC Decision No. 2 of 2026 (Kuwait Alyawm, reported 5 April 2026) | Government bodies, Large enterprises, Critical infrastructure | 8 | Being confirmed |
Checklists in the pack.
- CBK Internal Control Review (ICR) Readiness
- CBK CORF Maturity Self-Assessment
- CMA Module 15 Corporate Governance Review
- CBK Shari'ah Supervisory Governance Audit
Regulators.
- CBK Central Bank of Kuwait
- CMA Capital Markets Authority
- KFIU Kuwait Financial Intelligence Unit
- CITRA Communication and Information Technology Regulatory Authority
- NCSC National Cyber Security Center
- MOCI Ministry of Commerce and Industry
Who it is for
Banks, Islamic banks, Finance companies, Exchange houses, Payment providers, Capital market firms, Listed companies, Large enterprises, Government bodies, Critical infrastructure.
Regulatory calendar.
19 recurring deliverables, each with the regulator, the instrument and the deadline rule. Some examples:
| Deliverable | Regulator | How often | Deadline |
|---|---|---|---|
| Internal Control Review (ICR) report to CBK by a CBK-approved firm (banks) | CBK | Every year | Within the timetable in CBK's annual letter of instruction and no later than four months after the end of the period examined; notify CBK in writing if a delay is expected (market practice cites 30 June). |
| ICR report to CBK (finance and exchange companies) | CBK | Every year | By 30 June each year (per Baker Tilly Kuwait; confirm with CBK). |
| ICR report to CBK (e-payment service providers and system operators) | CBK | Every year | By 31 July each year (per Baker Tilly Kuwait; confirm with CBK). |
| Internal Control Report filed with the CMA | CMA | Every year | Within 90 days after financial year-end (per Baker Tilly Kuwait). |
| Independent review of the internal audit function by a different audit firm | CMA | Every 3 years | Every three years; first cycle ended 30 June 2019 per a 2018 CMA reminder cited by Baker Tilly; report to the audit committee and board. |
| Board review of internal control adequacy and effectiveness | CBK | Every year | At least once a year, before approval of the annual report. |
Reporting conventions.
- Reports in Arabic and English
- Amounts in KWD
Arabic is the legally binding language of CBK and CMA instruments; CBK states that its English versions are for information only. CBK circulars carry Gregorian dates with the Hijri date alongside, but regulatory deadlines run on the Gregorian calendar. Arabic-language reports often use Arabic-Indic digits. Amounts are stated in Kuwaiti dinars (KD/KWD, three decimals). The CBK ICR report follows CBK's proforma auditor's report with an appendix of exceptions.
Kept current.
Content version 2026.10, reviewed 27 October 2026. Descriptions are AuditHD's own; each framework links to the official text. License this pack on its own or with other countries; International standards are always included.
See it with your own checklists.
Open the live demo now, or book a walkthrough and we will load one of your frameworks or work programmes.