Is a payment provider, in Kuwait

Law No. 9 of 2019 Regulating the Exchange of Credit Information, arts. 3 to 7, 10 and 13 to 16 · Read the law's page

• A credit information company must be a Kuwaiti public shareholding company licensed by the Central Bank of Kuwait and registered with it before it operates, and no other company may engage in the exchange of credit information (Article 3).
• Obtain the customer's authorization before an inquiry into the customer's information is made (Article 4), and do not gather or exchange information on a natural person's private life, opinions, beliefs or health condition (Article 6).
• Keep credit information, credit records and credit reports confidential, and do not reveal them without the customer's consent or a request of the competent judicial authorities (Article 7).
• Protect and secure the information against loss, damage and unlicensed or unsecure access, use or alteration (Article 10, item 4), and reply in writing to a customer's complaint, with grounds, within 15 days (Article 13).

Circular No. (2/PS/527/2023) of the Central Bank of Kuwait, Minimum Cybersecurity and Business Continuity Requirements, under Article 28 of the Instructions Regulating the Electronic Payment of Funds · Read the law's page

• This binds an e-payment service provider or an e-money service provider supervised by the Central Bank of Kuwait, current or newly established (reached by declaring that you are a payment provider).
• Keep cybersecurity and information technology tasks separate, and if you are a large provider create an information security position independent of information technology; a small provider may instead give the position the autonomy it needs to complete its tasks (control 1).
• Have your higher management (chief executive or board) approve and sign your information security, business continuity and crisis management policies, measures and plans, and specify the interval for their review by an independent auditor (control 2).
• If you keep records of or process bank card data, obtain PCI-DSS certification approved by a third party and renew it regularly, and notify the Central Bank of Kuwait if the certification is revoked or not renewed (control 3).
• Have a third party run comprehensive security assessment tests on a product or service before you launch it, and address every observation in the report under a clear plan (control 4).

Cyber and Operational Resilience Framework for All Local Banks and Financial Institutions (CORF), Version 1.0, Chapters 1 and 3 · Read the law's page

• This binds every institution under the supervision of the Central Bank of Kuwait (the Framework names these Regulated Entities), reached by declaring that you provide financial services.
• Submit a Statement of Applicability to the Central Bank of Kuwait declaring which domains and sub-domains of the Framework apply to your licensed activities, before you undergo any assessment against the Framework (Chapter 3, section 4).
• Complete an inherent risk profile when you onboard to the Framework and update it every year, or when your operational, technological or organizational landscape changes significantly (Chapter 3, section 6.1).
• Implement the controls in the Cyber Resilience, Operational Resilience and Third-Party Risk Management Baselines that your Statement of Applicability marks applicable, which the Framework describes as the minimum requirements Regulated Entities are expected to implement (Chapter 1, section 9.4).
• Submit your assessment results to the Central Bank of Kuwait together with your latest inherent risk profile, which the Framework says Entities are required to do (Chapter 1, section 11).
• Comply with the circulars the Central Bank of Kuwait issues under the Framework; compliance with them is mandatory (Chapter 1, section 9.3.5).

Incident Reporting to the Central Bank of Kuwait under the Cyber and Operational Resilience Framework (CORF), Version 1.0, Chapter 5, sections 8.2.2.1 to 8.2.2.5 · Read the law's page

• This binds every institution under the supervision of the Central Bank of Kuwait (the Framework names these Regulated Entities), reached by declaring that you provide financial services.
• Report a high severity incident to the Central Bank of Kuwait within 1 hour of discovery and a medium severity incident within 4 hours of discovery (Chapter 5, section 8.2.2.1).
• Update the Central Bank of Kuwait on a high severity incident every 4 hours from the prior notification and on a medium severity incident daily, or when it asks (section 8.2.2.2).
• Submit a closure report to the Central Bank of Kuwait once a medium or high severity incident is resolved, and report low severity incidents consolidated each month (section 8.2.2.3).
• State the estimated financial loss in your initial progress report and confirm the final loss amount in the closure report (section 8.2.2.4).
• Report using the Central Bank of Kuwait's predefined incident templates and communication channels (section 8.2.2.5).