Banking Law and Embedded Finance Transformation of Banking in Kuwait

Introduction

Embedded finance describes the integration of banking and financial services directly into non-bank digital platforms. Instead of visiting a bank separately, a customer may receive payments, financing, electronic-money, instalment credit or other financial functionality inside an e-commerce platform, mobile application or technology service.

In Kuwait, embedded finance is transforming the traditional model of banking, but it does not remove financial activity from regulation. The Central Bank of Kuwait (CBK) remains the principal regulator under Law No. 32 of 1968 concerning Currency, the Central Bank of Kuwait and the Regulation of Banking.

Law No. 20 of 2014 concerning Electronic Transactions additionally gives the CBK extensive authority over electronic payments. In 2023 the CBK modernised its electronic-payment regulations to accommodate new payment and electronic-money business models.

Regulatory Framework

1. Law No. 32 of 1968

Law No. 32 of 1968 remains the foundation of banking supervision.

Banks cannot avoid CBK requirements simply by delivering their services through another company's application. Where the underlying activity constitutes regulated banking, lending or payment activity, the relevant regulatory requirements continue to apply.

Embedded finance therefore changes the distribution channel, but it does not necessarily change the legal nature of the underlying financial service.

2. Electronic Transactions Law No. 20 of 2014

Law No. 20 of 2014 provides legal recognition for electronic records, electronic transactions and electronic signatures and gives the CBK authority over electronic payment activities.

The legislation also addresses financial institutions' responsibilities concerning secure electronic services and customer protection.

This is particularly important for embedded finance because contracts, instructions, authentication and payments frequently occur entirely electronically.

3. CBK Electronic Payment Regulations

In May 2023, the CBK issued updated Instructions for Regulating the Electronic Payment of Funds.

The framework provides five forms of licensing corresponding to the nature and scale of payment-related activities.

Regulated entities must comply with requirements concerning:

corporate governance;

risk management;

AML/CFT;

cybersecurity;

business continuity;

customer protection; and

operational controls.

The framework therefore creates a regulated pathway for fintech businesses while preventing financial services from moving outside the CBK supervisory perimeter.

4. Embedded Payments and Electronic Money

Payments are one of the clearest examples of embedded finance.

A commercial application may allow customers to pay merchants without directly navigating to a conventional banking interface. Behind the application, however, the transaction may involve a licensed payment-service provider, electronic-money provider or bank.

The CBK's regulatory framework distinguishes activities according to their nature and scale.

Accordingly, technology companies cannot assume that describing themselves as “platforms” automatically removes licensing requirements.

5. Embedded Credit and Buy Now Pay Later

Embedded finance also transforms lending.

A customer purchasing a product online may receive credit during checkout rather than submitting a traditional bank-loan application.

Kuwait expressly incorporated Buy Now Pay Later (BNPL) into its regulatory framework. CBK controls apply to local banks, financing companies and qualifying large electronic-money service providers offering BNPL services.

This illustrates an important regulatory principle:

technology may simplify the customer journey, but credit risk and consumer protection remain regulated.

Providers must therefore consider affordability, disclosure, governance and risk-management requirements.

6. Open Banking and APIs

Embedded finance is closely connected with open banking, because APIs can permit financial information or payment functionality to be integrated into third-party applications.

In June 2025 the CBK issued a draft Open Banking Regulatory Framework. Its stated objective included enabling banks to share customer data securely with CBK-licensed open-banking service providers where the customer gives explicit approval.

Potential services include consolidated account information, expenditure analysis and faster processes relating to loans and guarantees.

This represents an important structural transformation from banking as a closed institution toward banking as a regulated digital infrastructure.

7. Outsourcing and Third-Party Risk

Embedded finance creates complex relationships between banks and technology providers.

A customer may interact only with a retailer's application even though the financial product is legally supplied by another institution.

Banks must therefore manage:

outsourcing risk;

cloud and technology dependencies;

cybersecurity;

API security;

operational continuity;

data confidentiality;

fraud risk; and

responsibility for third-party conduct.

A bank cannot necessarily escape regulatory responsibility merely because customer interaction has been outsourced.

8. AML and Customer Identification

Embedded financial services remain subject to Law No. 106 of 2013 concerning Anti-Money Laundering and Combating the Financing of Terrorism.

Digital onboarding therefore requires reliable identification and verification.

Institutions must also identify beneficial owners, monitor transactions and investigate unusual activity.

Automation can improve these functions, but automated systems do not remove the legal responsibility of regulated institutions.

Case Laws

There is still limited reported Kuwaiti jurisprudence expressly using the modern expression “embedded finance.” The following decisions are relevant because they establish principles governing digital banking, electronic payments, lending, fraud and regulatory responsibility.

1. Kuwait Court of Cassation – Digital Banking Forgery Case

In a Kuwaiti Court of Cassation case involving unauthorised use of another person's bank-card credentials, funds were transferred through electronic banking systems.

The Court treated electronically generated banking records as capable of constituting banking documents for purposes of forgery law.

Principle: Digital banking transactions have real legal consequences even when no traditional paper instrument exists.

Embedded-finance significance: Transactions initiated through apps and digital platforms remain legally attributable and evidentially significant.

2. Court of Cassation – Electronic Trading Fraud Case, 2024

The Court of Cassation issued a final judgment involving an electronic investment fraud operation in which victims transferred money through digital channels.

The proceedings involved fraud, embezzlement and money laundering.

Principle: Using an online or technological platform does not insulate financial misconduct from ordinary criminal and financial law.

Embedded-finance significance: Platform-based financial activity requires effective transaction monitoring and fraud controls.

3. Court of Cassation – Bank Fraud Evidence Case, 2024

The Court of Cassation considered accusations involving bank fraud and approximately KD 2 million.

The Court excluded video evidence obtained without legally required authorisation and upheld acquittal where the required proof was lacking.

Principle: Digital and financial enforcement remains governed by rules of lawful evidence and due process.

Embedded-finance significance: Technology does not weaken ordinary evidentiary safeguards.

4. Kuwait Court of Cassation – KCC 580/2000

This case involved regulatory action concerning an individual's status in relation to a bank's board of directors.

Principle: Banking governance and participation in regulated financial institutions depend upon substantive regulatory requirements.

Embedded-finance significance: Digital transformation does not eliminate governance and fitness requirements applicable to regulated institutions.

5. Kuwait Court of Cassation – Loan and Guarantee Instruments Decision, 2025

The Court held that amounts already repaid under a loan had to be taken into account and rejected treating related guarantee instruments as independent sources of additional debt.

Principle: Courts may examine the substantive economic relationship rather than relying only on the formal structure of financial instruments.

Embedded-finance significance: Digitising or repackaging a financing product does not change the underlying legal debt relationship.

6. Kuwait Court of Cassation – Banking Loan Interest Case KCC 508/2016

This authority concerned changes to interest under a banking loan and the interaction between contractual arrangements and Central Bank regulation.

Principle: Banking contracts operate within mandatory CBK rules.

Embedded-finance significance: Credit embedded inside a commercial platform remains subject to applicable lending regulation even though the customer experiences it as part of a non-bank service.

7. Kuwait Banking Jurisprudence on Electronic Account Transactions

Kuwaiti courts have also recognised that unauthorised electronic access and transfers may engage banking, criminal and electronic-transactions rules.

Principle: Authentication credentials, transaction records and the authority of the person initiating a transfer are central to determining responsibility.

This principle becomes increasingly important as financial services migrate from physical branches to applications, wallets and API-based systems.

Transformation of the Banking Model

Embedded finance changes banking from a model in which the bank controls the entire customer interface into a system where regulated financial functions can be distributed through other digital businesses.

The transformation can be summarised as:

Traditional banking:
Bank → Customer.

Embedded finance:
Bank or licensed provider → Technology platform → Customer.

The additional intermediary creates convenience but also creates new questions concerning licensing, responsibility, data protection, cyber risk and customer redress.

Regulatory Sandbox and Innovation

The CBK has created the Wolooj Regulatory Sandbox as part of its Innovation Hub.

It allows qualifying fintech innovations to be tested within a controlled regulatory environment. Open banking, artificial intelligence and other technology-based financial solutions are among the areas capable of regulatory experimentation.

The sandbox reflects Kuwait's broader regulatory strategy: innovation is encouraged, but it should develop within an identifiable supervisory framework.

Conclusion

Embedded finance is transforming Kuwaiti banking by moving payments, electronic money, credit and other financial services into digital platforms that customers may not perceive as traditional banks.

Nevertheless, the underlying activities remain governed by Law No. 32 of 1968, Law No. 20 of 2014, Law No. 106 of 2013, CBK electronic-payment rules, BNPL controls and related prudential requirements.

The emerging open-banking framework is likely to strengthen this transformation by enabling secure, consent-based connections between banks and regulated third-party providers.

Kuwaiti case law also supports a fundamental principle: technology changes how financial services are delivered, but it does not remove their underlying legal character.

The future of embedded finance in Kuwait therefore depends upon maintaining a balance between innovation and regulatory accountability, particularly in licensing, consumer protection, AML/CFT, cybersecurity, data governance and responsibility for third-party platforms.