Banking Law and Criminal Liability for Banking Misconduct in Kuwait

Introduction

Banking misconduct in Kuwait can create criminal liability where a bank, its directors, managers, employees, agents, or customers engage in fraud, money laundering, terrorist financing, forgery, disclosure of protected information, unlawful diversion of funds, cyber-enabled theft, or deliberate regulatory deception.

A poor business decision, a loan default, or an inaccurate forecast does not automatically amount to a crime. Criminal liability usually requires proof of a prohibited act and the required criminal intent, knowledge, recklessness, deception, or abuse of a professional position. However, banking is a highly regulated activity. Therefore, conduct that begins as a breach of internal policy or Central Bank of Kuwait (CBK) instruction can become criminal where it involves dishonesty, concealment, false documentation, or knowing participation in financial crime.

Legal and Regulatory Framework

The core banking statute is Law No. 32 of 1968 concerning Currency, the Central Bank of Kuwait and the Regulation of Banking Business, as amended. It establishes the CBK, regulates licensed banks, imposes supervisory duties, and gives the CBK enforcement powers over institutions that breach the law or CBK instructions. Articles 85 and 85 bis provide for regulatory penalties, which may operate alongside criminal proceedings where the facts disclose an offence

Other major sources of criminal liability include:

• Kuwait Penal Code, Law No. 16 of 1960 — fraud, embezzlement, breach of trust, bribery, forgery, use of forged documents, and participation in crime.
• Law No. 106 of 2013 on Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT), as amended — laundering criminal proceeds, financing terrorism, failures involving prohibited dealing, confiscation, and liability of legal persons.
• Law No. 63 of 2015 on Combating Information Technology Crimes — unlawful access, interference with banking systems, electronic fraud, theft of financial data, and misuse of electronic records.
• Commercial Companies Law and corporate-governance duties — relevant where directors or managers misuse corporate assets, approve sham transactions, or knowingly cause false accounts to be issued.
• CBK instructions on governance, AML/CFT, internal controls, cybersecurity, customer due diligence, and suspicious-transaction reporting.

Main Forms of Banking Misconduct

1. Fraud and Misrepresentation

Fraud may arise where an employee or officer deliberately misrepresents a borrower’s financial position, collateral value, creditworthiness, or purpose of financing. Examples include approving a loan using forged salary certificates, inflating collateral valuations, creating fictitious customers, or concealing a connected-party relationship.

A bank officer may also face liability for knowingly issuing false statements to the CBK, auditors, shareholders, or customers. Criminal exposure is strongest where the person intended to obtain money, approval, personal benefit, or an improper advantage.

2. Misappropriation and Breach of Trust

Bank employees handle customer deposits, payment instructions, collateral documents, and confidential financial data. Using these assets for an unauthorised purpose can amount to embezzlement or breach of trust.

Typical examples include transferring customer funds to a personal account, using dormant accounts without authority, diverting loan proceeds, or releasing collateral without required approval. Senior managers may be liable if they personally participated, instructed the act, knowingly approved it, or intentionally ignored clear evidence of wrongdoing.

3. Money Laundering and Terrorist Financing

Law No. 106 of 2013 criminalises dealing with funds known to be derived from criminal activity where the person transfers, conceals, disguises, possesses, acquires, or uses the funds with the required knowledge. Terrorist financing is separately criminalised and attracts particularly serious sanctions.

Banks must conduct customer due diligence, identify beneficial owners, monitor transactions, retain records, apply enhanced scrutiny in high-risk cases, and submit suspicious transaction reports to the Kuwait Financial Intelligence Unit (KWFIU). The duty is not to prove the customer’s guilt; it is to identify and report a reasonable suspicion through the proper confidential channel.

An employee commits a serious offence where they knowingly assist laundering, warn a customer about a suspicious-report investigation, create a false transaction trail, or accept corrupt payment to ignore suspicious activity. Individuals convicted of money laundering may face imprisonment and a fine linked to the value of the funds, while legal persons may also face substantial fines and confiscation. KWFIU AML/CFT legislation

4. Cyber-Enabled Banking Crime

Modern banking misconduct may occur through phishing, credential theft, unauthorised access to core banking systems, manipulation of payment instructions, SIM-swap fraud, malware, or misuse of customer data.

Law No. 63 of 2015 is relevant where a person unlawfully accesses or interferes with a system, obtains banking data, commits electronic fraud, or uses technology to steal funds. A bank employee who misuses privileged system access can be prosecuted even if no physical document or cash is involved. Kuwait Law No. 63 of 2015

Individual and Corporate Liability

Kuwaiti criminal law is primarily concerned with the culpability of natural persons. Accordingly, a director is not automatically criminally liable merely because misconduct occurred at the bank. Prosecutors must normally show personal participation, direction, knowledge, deliberate concealment, or a legally significant failure to act.

However, a legal person can be separately liable under the AML/CFT framework. A bank may face fines, confiscation, restrictions, and regulatory measures where the crime was committed for its benefit or because of serious organisational failure. The CBK may additionally impose administrative sanctions, require remedial action, restrict activities, or take measures affecting management and licensing.

Case Law and Judicial Principles

Published Kuwaiti banking-crime judgments are less accessible in English than European case law, but Kuwait Court of Cassation jurisprudence consistently applies the following principles:

1. Fraud requires deception and causation.
   The prosecution must show that deceptive conduct caused the victim or institution to hand over money, credit, property, or a financial advantage. Mere failure to repay a debt normally remains civil unless it was accompanied by dishonest conduct from the beginning.
2. Breach of trust requires lawful initial possession followed by unlawful conversion.
   A bank employee who lawfully receives funds or documents through their role can become criminally liable when they later divert, conceal, or use them contrary to the entrusted purpose.
3. Forgery includes the knowing use of a forged document.
   Liability may arise not only for the person who creates a false salary certificate, cheque, identity record, guarantee, or account statement, but also for the employee or borrower who knowingly relies on it to obtain financing or release funds.
4. Money laundering is distinct from the predicate offence.
   A person may be prosecuted for laundering even where another person committed the underlying offence, provided the defendant knew, or the court can infer from the circumstances, that the funds were criminal proceeds.
5. Criminal intent may be inferred from objective conduct.
   Courts may infer knowledge from false documentation, unusual transaction patterns, concealment of beneficial ownership, repeated structuring of payments, use of shell companies, or deliberate bypassing of internal controls.
6. Professional position can aggravate responsibility.
   Where an officer exploits banking access, customer confidence, confidential information, or authority over approvals, the breach is treated more seriously than an ordinary private dispute.

Enforcement and Defences

Investigations may involve the Public Prosecution, CBK, KWFIU, police authorities, auditors, and forensic experts. Relevant evidence includes account records, payment trails, internal emails, approval memoranda, customer files, audit reports, digital logs, and witness testimony.

A proper defence may challenge the existence of intent, the reliability of the evidence, authority for the transaction, authenticity of documents, causation of loss, or whether the matter is merely a contractual or civil dispute. Good-faith reliance on documented information may be relevant, but it will not protect an officer who ignored obvious warning signs or deliberately avoided knowledge.

Conclusion

Kuwait’s banking-crime framework combines the Banking Law, Penal Code, AML/CFT Law, Cybercrime Law, and CBK supervision. Criminal liability is most likely where banking misconduct involves fraud, misuse of entrusted funds, false records, laundering, terrorist financing, cyber theft, or knowing concealment.

For banks, the practical protection is strong governance: clear approval limits, independent credit review, transaction monitoring, segregation of duties, reliable audit trails, protected whistleblowing, regular AML training, and immediate escalation of suspicious conduct.