Banking Law and Regulation of Payment Initiation Services in Kuwait

1. Introduction

Payment initiation services (PIS) allow a payment service provider or financial-technology platform to initiate a payment from a customer's bank or payment account after receiving the customer's authorization.

A simple example is:

Customer → fintech/payment interface → customer's bank/account → merchant/beneficiary

Instead of the customer manually entering a bank's payment interface for every transaction, an authorized service can transmit or initiate the customer's payment instruction.

In Kuwait, payment initiation services do not operate under a single PSD2-style statute equivalent to the European Union's regime. They instead fall within an interconnected framework involving the Central Bank of Kuwait (CBK), Kuwait's banking legislation, electronic-payment rules, cybersecurity requirements, AML/CFT obligations, consumer-protection requirements and electronic-transactions legislation.

Because standalone Kuwaiti reported judgments specifically concerning modern PIS providers are limited, the most relevant case-law principles also come from Kuwaiti decisions concerning electronic banking, unauthorized transactions, banking instructions, signatures, customer authentication, contractual responsibility and evidential proof. It is important not to present ordinary banking disputes as if they were dedicated PIS precedents.

2. Principal Regulatory Authority

The Central Bank of Kuwait is the central regulatory institution for banking and regulated payment activity.

The principal statutory foundation is Law No. 32 of 1968 concerning Currency, the Central Bank of Kuwait and the Organization of Banking Business, as amended.

The CBK's broader responsibilities include matters relating to:

• banks;
• monetary and financial stability;
• payment and settlement infrastructure;
• regulated financial activities;
• risk management;
• electronic payment activities;
• consumer protection;
• AML/CFT controls.

Consequently, a company providing payment initiation functionality cannot assume that describing itself as a "technology company" removes it from financial regulation.

3. What Constitutes a Payment Initiation Service?

A payment initiation arrangement generally exists where a third-party provider enables a customer to instruct that money be transferred from the customer's payment account to another person.

For example:

A customer buys goods online for KWD 100. The customer selects a fintech payment option. The fintech securely communicates the customer's payment instruction to the customer's financial institution. The bank authenticates the customer and executes the transfer to the merchant.

The legal relationships potentially involve:

1. customer;
2. payment-initiation provider;
3. customer's bank;
4. merchant;
5. merchant's bank;
6. payment infrastructure operator.

Each participant can have separate contractual and regulatory obligations.

4. CBK Regulation of Electronic Payments

Kuwait has developed a regulatory framework for electronic payment and settlement systems and electronic payment service providers.

CBK regulation is particularly important where a business provides payment functionality involving:

• electronic payment services;
• payment gateways;
• payment aggregation;
• digital payment platforms;
• stored-value facilities;
• electronic wallets;
• payment processing;
• related fintech services.

Whether a particular PIS business requires registration, licensing or another form of CBK authorization depends on the precise business model and regulated activities performed.

The legal analysis therefore focuses on what the provider actually does, rather than simply what the provider calls the service.

5. Authorization and Licensing

A payment-initiation provider should determine whether its activities fall within a category requiring CBK authorization.

Regulators may examine factors including:

• whether the provider controls customer funds;
• whether it merely transmits instructions;
• whether it executes payments;
• whether it maintains customer accounts;
• whether it operates a payment system;
• whether it provides a payment gateway;
• whether it holds stored monetary value;
• whether it has access to sensitive banking information.

A provider performing regulated payment activities without the required authorization may face regulatory consequences.

6. Payment Initiation vs Holding Customer Money

This distinction is especially important.

Pure initiation model

The provider sends a customer's authenticated payment instruction to a financial institution.

The money moves:

Customer's bank → beneficiary

without being held by the initiator.

Custodial model

Money moves:

Customer → fintech/provider → beneficiary

The second structure creates substantially greater regulatory concerns because the provider may be:

• receiving customer funds;
• holding client money;
• operating accounts;
• providing stored value;
• performing regulated payment services.

Therefore, changing the flow of funds can change the legal classification of the entire service.

7. Customer Authorization

A payment should generally be initiated only after obtaining valid customer authorization.

A reliable PIS arrangement should establish:

• who gave the instruction;
• which account was involved;
• the beneficiary;
• the payment amount;
• the time of authorization;
• the authentication method;
• whether authorization was successfully completed.

This becomes critical when a customer subsequently alleges:

"I never authorized this payment."

Electronic records then become central evidence.

8. Electronic Transactions Law

Law No. 20 of 2014 concerning Electronic Transactions is highly relevant.

It provides the legal framework for matters including:

• electronic records;
• electronic documents;
• electronic signatures;
• electronic communications;
• evidential recognition of electronic transactions.

Payment initiation normally occurs electronically.

Therefore, a properly maintained electronic record can potentially establish:

instruction → authentication → authorization → transmission → execution.

The law makes digital evidence particularly important in payment disputes.

9. Authentication and Security

Authentication is one of the most important PIS risks.

A provider should implement security proportionate to the payment service, potentially including:

• secure authentication;
• encrypted communications;
• credential protection;
• session management;
• fraud detection;
• device monitoring;
• transaction monitoring;
• secure APIs;
• access controls.

The precise regulatory requirements depend on the provider and payment architecture.

A payment platform should not assume that possession of a customer's username or password alone establishes legally sufficient authorization in every dispute.

10. Protection of Banking Credentials

A payment initiator can potentially obtain access to highly sensitive information.

Examples include:

• account identifiers;
• payment credentials;
• authentication information;
• transaction information;
• customer identity information.

Such information should only be accessed where legally justified and necessary for the service.

Security architecture should seek to prevent:

• unauthorized credential storage;
• credential interception;
• account takeover;
• unauthorized reuse;
• employee misuse;
• disclosure to third parties.

11. Data Protection

Kuwaiti payment services must also consider applicable privacy and data-protection requirements, including the regulatory framework governing the processing and protection of personal information.

A PIS provider should therefore identify:

• what customer information it collects;
• why the information is required;
• where it is stored;
• who can access it;
• whether it is transferred to third parties;
• how long it is retained;
• what cybersecurity controls protect it.

Payment data is particularly sensitive because a compromise can produce both privacy and financial harm.

12. AML/CFT Obligations

Law No. 106 of 2013 regarding Anti-Money Laundering and Combating the Financing of Terrorism is another important part of the framework.

Depending upon the regulated status and activities of the payment provider, relevant controls can include:

• customer identification;
• customer due diligence;
• beneficial-owner identification;
• transaction monitoring;
• suspicious-transaction reporting;
• record keeping;
• sanctions screening;
• enhanced due diligence for higher-risk relationships.

Payment technology cannot be structured merely to increase transaction speed while ignoring financial-crime controls.

13. Payment Initiation and Open Banking

Payment initiation becomes particularly important in open-banking architecture.

An open-banking model can allow a customer to authorize a third party to communicate with a bank through controlled technological interfaces.

The model may look like:

Customer

↓

Payment Initiation Provider

↓

Secure API

↓

Bank

↓

Payment infrastructure

↓

Beneficiary

The principal regulatory concerns include:

• customer consent;
• third-party authorization;
• API security;
• authentication;
• data minimization;
• operational resilience;
• allocation of liability.

14. CBK Open-Banking Framework

The CBK has developed an open-banking regulatory framework as part of Kuwait's fintech modernization.

The framework is relevant to services involving controlled third-party access to banking functionality.

The important legal principle is that open banking does not mean unrestricted access to bank accounts.

Access should be:

• authorized;
• secure;
• purpose-specific;
• technically controlled;
• consistent with CBK requirements.

This provides an important foundation for regulated payment initiation.

15. Liability for Unauthorized Payments

Suppose a payment of KWD 5,000 is initiated and the customer says:

"I did not authorize it."

Several questions arise:

1. Did the customer authenticate the instruction?
2. Were credentials compromised?
3. Did the bank's systems authenticate correctly?
4. Did the PIS provider alter the instruction?
5. Was the beneficiary substituted?
6. Was there phishing or account takeover?
7. Were appropriate security controls operating?
8. What do the electronic logs establish?

Liability cannot automatically be assigned to the customer, bank or PIS provider without determining the source of the failure.

16. Operational Resilience

A PIS provider depends heavily on technology.

Regulatory risk therefore extends beyond fraud.

Potential failures include:

• API outage;
• bank connectivity failure;
• duplicated payments;
• delayed instructions;
• cybersecurity attacks;
• incorrect beneficiary routing;
• software errors;
• cloud-service outages.

Providers should consequently maintain suitable:

• business-continuity arrangements;
• disaster-recovery systems;
• incident-response procedures;
• cybersecurity controls;
• backup infrastructure.

17. Outsourcing

Payment providers frequently rely on external technology suppliers.

Examples include:

• cloud providers;
• authentication services;
• fraud-detection platforms;
• API providers;
• data centres.

Outsourcing normally does not eliminate the regulated entity's responsibility.

A regulated provider should therefore address matters such as:

• audit rights;
• cybersecurity;
• confidentiality;
• subcontracting;
• service availability;
• data location;
• termination;
• business continuity.

18. Consumer Protection

A payment-initiation service should provide customers with sufficiently clear information concerning the transaction.

Important matters include:

• transaction amount;
• applicable charges;
• beneficiary;
• authorization;
• processing status;
• refund procedures where applicable;
• complaints;
• error resolution.

A user should not be induced into authorizing a payment through a misleading interface.

This is especially important for mobile applications where poorly designed screens can make it difficult to distinguish between:

logging into an account

and

authorizing an actual transfer.

19. Kuwaiti Case-Law Position

Kuwait does not have the same large published body of dedicated PIS litigation found in some jurisdictions.

Consequently, PIS disputes are more realistically analysed through established Kuwaiti banking-law principles concerning:

• bank/customer contracts;
• unauthorized transactions;
• electronic evidence;
• negligence;
• authentication;
• forged or disputed instructions;
• professional duties of banks.

The following case-law categories are particularly relevant.

20. Case Law 1 — Court of Cassation: Bank's Professional Duty

Kuwaiti Court of Cassation banking jurisprudence has treated banks as professional institutions required to exercise appropriate care when conducting banking operations.

Principle

A bank cannot necessarily escape liability merely by showing that its computer system technically processed an instruction.

Where an instruction contains suspicious circumstances or where the bank fails to observe the professional standard required of it, civil liability may arise if:

fault + damage + causation

are established.

PIS application

The principle can apply where a bank receives an electronically initiated payment containing indicators of fraud or authentication failure.

21. Case Law 2 — Court of Cassation: Customer Instructions

Kuwaiti banking jurisprudence also recognizes the importance of the customer's actual instructions.

Banks generally have contractual obligations to execute transactions consistently with valid customer mandates.

PIS application

A PIS provider cannot lawfully transform:

"Transfer KWD 100 to Merchant A"

into:

"Transfer KWD 1,000 to Merchant B."

The electronic payment record becomes essential for determining what was actually authorized.

22. Case Law 3 — Court of Cassation: Burden and Evidential Proof

Kuwaiti Court of Cassation jurisprudence gives substantial importance to documentary and technical evidence in banking disputes.

The party asserting payment, authorization, discharge or liability must establish the relevant facts according to applicable evidential principles.

PIS relevance

Important evidence may include:

• authentication records;
• transaction IDs;
• timestamps;
• IP/device information where lawfully retained;
• bank logs;
• API logs;
• payment confirmations.

Therefore, record keeping is not merely an IT issue. It is a litigation-risk control.

23. Case Law 4 — Court of Cassation: Forged or Unauthorized Banking Instructions

Kuwaiti banking cases involving disputed or forged instructions establish a broader principle that the validity and authenticity of a banking mandate matter when allocating responsibility.

PIS relevance

The same principle can be applied functionally to:

• compromised credentials;
• fraudulent API requests;
• account takeover;
• unauthorized mobile transactions.

Digital authorization changes the evidence, but it does not eliminate the underlying legal question:

Did the customer actually authorize the transaction?

24. Case Law 5 — Court of Cassation: Contractual Banking Liability

Kuwaiti Court of Cassation jurisprudence recognizes that the bank/customer relationship is substantially contractual.

Liability can therefore arise where a financial institution fails to perform contractual obligations correctly and causes compensable damage.

PIS application

The contracts between:

• customer and bank;
• customer and PIS provider;
• PIS provider and bank;
• merchant and payment provider

become extremely important.

Contract terms should clearly allocate matters such as:

• authorization;
• security responsibilities;
• errors;
• complaints;
• transaction execution.

Mandatory regulatory requirements, however, cannot simply be contracted away.

25. Case Law 6 — Court of Cassation: Causation and Banking Loss

Another recurring principle in Kuwaiti civil and banking jurisprudence is that compensation normally requires a sufficient causal relationship between the alleged wrongful conduct and the financial loss.

For example:

Security weakness alone does not necessarily determine the amount of recoverable damages.

The claimant must establish the legally required relationship between:

breach → unauthorized transaction → financial loss.

PIS significance

In a cyber-fraud dispute involving a bank, PIS provider and customer, determining where the transaction chain failed is therefore critical.

26. Important Qualification About the Case Law

The six categories above should not be cited as six reported Kuwaiti "payment initiation service cases."

That would overstate the available jurisprudence.

They represent established categories of Kuwaiti banking and civil-law reasoning that can be applied to new PIS disputes.

Because modern API-based payment initiation is relatively new, disputes may initially be resolved by applying older legal principles concerning:

• mandate;
• consent;
• contractual liability;
• professional negligence;
• electronic evidence;
• causation.

This is common when financial technology develops faster than reported case law.

27. Example

Assume a Kuwaiti fintech provides an app allowing users to initiate bank transfers.

A customer authorizes:

KWD 50 → Merchant X.

Because of a software defect, the API sends:

KWD 500 → Merchant X.

The legal analysis would examine:

Fintech

Did its system incorrectly generate the instruction?

Bank

Did it receive an instruction for KWD 500, and what authentication occurred?

Customer

What amount did the customer actually authorize?

Electronic evidence

What do the application, authentication and API logs establish?

Contract

How are erroneous instructions and liability allocated?

Regulation

Did the provider comply with applicable CBK requirements?

The decisive issue would therefore not simply be that "the computer transferred KWD 500." The entire authorization and execution chain must be reconstructed.

28. Payment Initiation vs Card Payments

PIS should also be distinguished from traditional card transactions.

Card transaction

Customer → card network/acquirer → issuer → merchant.

Account-based PIS transaction

Customer → PIS provider/API → customer's financial institution → beneficiary.

Different infrastructure can produce different:

• authorization mechanisms;
• settlement arrangements;
• fraud risks;
• contractual relationships.

The legal classification must therefore follow the actual payment architecture.

29. Cross-Border Payment Initiation

A Kuwait-based PIS may interact with:

• foreign banks;
• international payment processors;
• overseas merchants;
• cloud infrastructure outside Kuwait.

This creates additional issues involving:

• jurisdiction;
• applicable law;
• foreign regulatory requirements;
• data transfers;
• sanctions;
• AML/CFT;
• currency controls;
• dispute resolution.

A CBK authorization, where required, should therefore not automatically be treated as authorization to provide regulated financial services in every foreign jurisdiction.

30. Key Compliance Framework

A payment-initiation business operating in Kuwait should generally structure its legal analysis around:

1. CBK regulatory status — determine whether authorization is required.
2. Customer consent — obtain demonstrable payment authorization.
3. Authentication — establish reliable identity and transaction authentication.
4. Cybersecurity — protect credentials and payment infrastructure.
5. AML/CFT — apply required financial-crime controls.
6. Data protection — limit and secure customer information.
7. Record keeping — preserve reliable transaction evidence.
8. Operational resilience — prepare for outages and cyber incidents.
9. Outsourcing governance — control third-party technology risk.
10. Consumer protection — provide transparent transaction information and complaint procedures.

31. Legal Framework Summary

32. Conclusion

The regulation of payment initiation services in Kuwait is best understood as part of the country's wider transition toward regulated digital and open banking.

The Central Bank of Kuwait occupies the central regulatory position. A payment-initiation provider must first determine whether its particular business model falls within regulated electronic-payment or open-banking activity. From there, the principal legal requirements concern customer authorization, authentication, cybersecurity, privacy, AML/CFT compliance, operational resilience, record keeping and consumer protection.

Kuwait presently has comparatively limited published jurisprudence dealing specifically with modern API-based PIS providers. Consequently, disputes are likely to rely heavily on established Court of Cassation principles concerning the bank/customer relationship, valid customer mandates, unauthorized or forged instructions, professional banking duties, documentary and electronic evidence, contractual breach and causation.

The central legal principle is straightforward: technology changes how a payment instruction is communicated, but it does not eliminate the fundamental requirements of valid authorization, regulatory compliance, security and accountability.