KuwaitCyber and Operational Resilience Framework (CORF), Baselines, Statement of Applicability and Risk Profile
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- This binds every institution under the supervision of the Central Bank of Kuwait (the Framework names these Regulated Entities), reached by declaring that you provide financial services.
- Submit a Statement of Applicability to the Central Bank of Kuwait declaring which domains and sub-domains of the Framework apply to your licensed activities, before you undergo any assessment against the Framework (Chapter 3, section 4).
- Complete an inherent risk profile when you onboard to the Framework and update it every year, or when your operational, technological or organizational landscape changes significantly (Chapter 3, section 6.1).
- Implement the controls in the Cyber Resilience, Operational Resilience and Third-Party Risk Management Baselines that your Statement of Applicability marks applicable, which the Framework describes as the minimum requirements Regulated Entities are expected to implement (Chapter 1, section 9.4).
- Submit your assessment results to the Central Bank of Kuwait together with your latest inherent risk profile, which the Framework says Entities are required to do (Chapter 1, section 11).
- Comply with the circulars the Central Bank of Kuwait issues under the Framework; compliance with them is mandatory (Chapter 1, section 9.3.5).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 85(b) of Law No. 32 of 1968 caps the financial penalty on a bank at fifty thousand Dinars; the same article also provides a warning, restrictions on the bank's business and removal of responsible officers
- Rule
- Fixed only
- As of
- Currency
- KWD
- Fixed cap
- 50,000
Who enforces it
Enforcement body
The Central Bank of Kuwait, which oversees the implementation of the Framework across all Regulated Entities.
Settledness
- As of
- Open questions
- Does Article 85 of Law No. 32 of 1968, which reaches a bank that violates the decisions and instructions issued under that Law, also carry the Framework as an instruction, and which provision sanctions a finance, investment, exchange or credit information company that breaches it?
What this law does
The Cyber and Operational Resilience Framework applies to all Regulated Entities under the supervision of the Central Bank of Kuwait. The Statement of Applicability is a mandatory submission required from all Regulated Entities under the supervision and oversight of the Central Bank of Kuwait. The inherent risk profile is mandatory for all Regulated Entities and is updated annually or upon significant changes to operational, technological or organizational landscape.
Compliance with the circulars the Central Bank of Kuwait issues under the Framework is mandatory to all Regulated Entities. The Cyber Resilience Baselines define the foundational controls and minimum requirements that Regulated Entities are expected to implement under the Framework. The Framework cites Article 15 of Law No. 32 of 1968 as the mandate under which the Central Bank of Kuwait regulates and oversees the banking sector.
Article 85 of Law No. 32 of 1968 lets the Central Bank of Kuwait impose financial penalties of up to fifty thousand Dinars on a bank that violates the decisions and instructions issued under that Law. The Framework records version 1.0 as the first release by the Central Bank of Kuwait, dated .
When LexLint raises it
When your app profile says your app provides financial services.