One Regulator, Two Directions – What the Central Bank of Kuwait’s Latest Rules Really Ask of Kuwaiti Banks

Kuwaiti banks got two very different signals from their regulator within a few months of each other. In December 2025, the Central Bank of Kuwait (CBK) replaced its 2020 Cybersecurity Framework with something far more demanding – the Cyber and Operational Resilience Framework (CORF). Then in March 2026, CBK went the other way on capital and liquidity, temporarily easing several key ratios to give banks more breathing room. Read separately, these look like contradictory moves. Read together, they show a regulator being selective about where it wants flexibility and where it wants far more rigour than before.

CORF is the bigger story for anyone running technology, testing or operations inside a Kuwaiti bank. It replaces a relatively lean cybersecurity baseline with 27 domains, 93 sub-domains, 200 control areas and 876 individual controls organised around three pillars – cyber resilience, operational resilience and third-party risk management. It applies not just to banks but to finance companies, exchange houses, e-payment providers, credit information companies and open banking service providers, a far wider net than the framework it replaced. Compliance isn’t a matter of ticking a policy document; CORF explicitly requires independent assessments, documented maturity scoring and audit-ready evidence across every one of those control areas.

Meanwhile, on the Balance Sheet, CBK Loosened Its Grip

The same regulator that just multiplied its operational control requirements gave banks room to breathe financially. Circular No. 2/RB/RBA/619/2026, issued on 26 March 2026, temporarily reduced the Liquidity Coverage Ratio and Net Stable Funding Ratio from 100% to 80%, cut the Regulatory Liquidity Ratio from 18% to 15% and eased the capital adequacy requirement from 13% to 12%, all framed as precautionary support during a period of regional geopolitical pressure, not a response to any weakness in the sector. CBK has already begun asking banks how much time they’d need to return to the original thresholds, which tells you this relief was never meant to be permanent.

Put the two developments side by side and a clear pattern appears: CBK is willing to loosen numbers on a balance sheet temporarily, but it is becoming considerably less tolerant of gaps in how banks actually run their systems day to day.

The Complaint Clock Tightened Too

A third change reinforces the same direction. CBK’s updated Bank Customer Protection Guide, fully in force since April 2026, cut the maximum complaint resolution window from 15 working days to 5. That’s not a paperwork change it only works if a bank’s case management, CRM and core banking systems pass information to each other without delay, regardless of which channel a complaint originated from. A workaround that quietly patched over a gap at 15 days won’t survive at 5.

What This Means in Practice

Three regulatory threads, one underlying expectation: prove your systems hold up, don’t just say they do.

For CORF specifically, that means banks need to demonstrate maturity across 876 controls, with third-party vendors and open banking service providers falling under the same scrutiny as the bank itself. For the liquidity relief, it means being ready to operate cleanly under both today’s relaxed thresholds and the stricter baseline that’s coming back. For the Customer Protection Guide, it means complaint-handling systems that genuinely function end-to-end, not just on paper.

Sitting quietly behind all of this is Kuwait’s Open Banking Regulatory Framework, still in draft since CBK first published it for consultation in June 2025. It hasn’t moved to formal licensing yet, but CORF’s inclusion of open banking service providers within its scope is a strong signal of where the requirements are heading before that framework is finalised. Banks and fintechs already testing ideas through CBK’s regulatory sandbox, Wolooj, have the advantage of shaping their approach ahead of that curve rather than reacting to it once the rules are locked in.

What Readiness Looks Like Right Now

• CORF-grade resilience evidence — independent assessments, maturity scoring and audit-ready documentation across cyber, operational and third-party risk domains, not just a policy binder.
• Dual-threshold financial systems — lending and liquidity processes tested against both today’s eased ratios and the stricter levels CBK is expected to reinstate.
• A complaint process that actually closes in 5 days — case management, CRM and core systems tested together under real transaction volumes, not in isolation.

How Testhouse Helps Kuwaiti Banks Meet This Bar

• For CORF compliance — we run independent testing and assessment across cyber resilience, operational resilience and third-party risk domains, producing the audit-ready evidence CBK’s 876 controls require.
• For liquidity and capital-threshold resilience — we validate lending and credit systems against both the current relaxed ratios and the stricter baseline likely to return.
• For the 5-day complaint standard — we test complaint workflows end-to-end across every customer channel, so response times hold under genuine volume.
• For Open Banking readiness — we support early API, security and integration testing so banks are positioned ahead of formal licensing, not scrambling once it lands.

Across all of it, the goal is the same – evidence a bank can put in front of CBK the moment it’s asked for, not something assembled after the fact.

To get a Readiness Assessment of your AML, CORF, liquidity and complaint-handling systems, write to contact@testhouse.net