KuwaitCircular No. (2/PS/527/2023), Minimum Cybersecurity and Business Continuity Requirements for E-Payment and E-Money Service Providers
Circular No. (2/PS/527/2023) of the Central Bank of Kuwait Minimum Cybersecurity and Business Continuity Requirements, under Article 28 of the Instructions Regulating the Electronic Payment of Funds
In force.
A sector security regimes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an e-payment service provider or an e-money service provider supervised by the Central Bank of Kuwait, current or newly established (reached by declaring that you are a payment provider).
- Keep cybersecurity and information technology tasks separate, and if you are a large provider create an information security position independent of information technology; a small provider may instead give the position the autonomy it needs to complete its tasks (control 1).
- Have your higher management (chief executive or board) approve and sign your information security, business continuity and crisis management policies, measures and plans, and specify the interval for their review by an independent auditor (control 2).
- If you keep records of or process bank card data, obtain PCI-DSS certification approved by a third party and renew it regularly, and notify the Central Bank of Kuwait if the certification is revoked or not renewed (control 3).
- Have a third party run comprehensive security assessment tests on a product or service before you launch it, and address every observation in the report under a clear plan (control 4).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Kuwait, which may issue a resolution imposing measures or restrictions on an activity services provider that violates the Instructions, including ceasing new business engagements, modifying or cancelling rules of the business activity, or ceasing any e-payment activity in whole or in part.
Settledness
- As of
- Open questions
- What monetary penalty applies to an e-payment or e-money service provider that is not a bank, given that Article 45 of the Instructions points to Article 85 of Law No. 32 of 1968 or Article 15 of Law No. 106 of 2013 as the case requires?
What this law does
Circular No. (2/PS/527/2023) applies to all E-Payment Service Providers and E-Money Service Providers, both current and newly established. Large providers must keep cybersecurity and information technology tasks separate and create an information security position independent of information technology. Information security, business continuity and crisis management policies, measures and plans must be approved and signed by the provider's higher management.
A provider that keeps record of or processes bank card data must obtain PCI-DSS certification approved by a third party and renew it regularly. The Central Bank of Kuwait must be notified where the PCI-DSS certification is revoked or fails to be renewed for any reason. A third party must conduct comprehensive security assessment tests of the product or service before launch, and every observation in its report must be addressed under a clear plan.
Article 28 of the Instructions Regulating the Electronic Payment of Funds requires activity services providers to implement the instructions the Central Bank of Kuwait issues in relation to cybersecurity. Article 45 of the Instructions applies the penalties under Article 85 of Law No. 32 of 1968 or Article 15 of Law No. 106 of 2013, as the case requires, to activity services providers.
When LexLint raises it
When your app profile says your app is a payment provider.