Banking Law and Information Exchange Among Financial Regulators in Kuwait

1. Introduction

Information exchange among financial regulators is an essential part of modern banking supervision. Banks operate across securities, payments, insurance, credit, investment and international markets, so important regulatory information may be held by several authorities rather than by one regulator.

In Kuwait, the principal institutions involved include the Central Bank of Kuwait (CBK), the Capital Markets Authority (CMA), the Insurance Regulatory Unit (IRU) and, for anti-money-laundering matters, the Kuwait Financial Intelligence Unit (KwFIU) and other competent authorities.

The legal objective is to achieve two goals simultaneously:

Effective regulatory cooperation — authorities must be able to obtain and exchange information needed for supervision and enforcement.

Confidentiality — sensitive banking, customer and supervisory information cannot be distributed without legal authority.

Law No. 32 of 1968 provides a particularly important example. Article 82 expressly permits information exchange between CBK and other central banks or banking supervisory authorities for consolidated supervision, subject to agreed arrangements.

2. Main Regulators

Kuwait's financial regulatory structure is divided principally according to financial activity.

Central Bank of Kuwait

CBK regulates and supervises banks and exercises other responsibilities assigned under Law No. 32 of 1968 concerning Currency, the Central Bank of Kuwait and the Regulation of Banking.

Capital Markets Authority

The CMA operates under Law No. 7 of 2010 concerning the Establishment of the Capital Markets Authority and Regulating Securities Activities.

It supervises securities-market activities and licensed persons within its jurisdiction.

Insurance Regulatory Unit

The IRU was established under Law No. 125 of 2019 concerning the Regulation of Insurance. Its responsibilities include regulation, supervision and inspection of the insurance sector.

Kuwait Financial Intelligence Unit

KwFIU performs a different but complementary function by receiving and analysing financial intelligence relevant to money laundering and terrorist financing.

These institutions can possess different pieces of information concerning the same financial institution, group or transaction.

3. Article 82 of Law No. 32 of 1968

Article 82 is particularly important for regulatory information exchange.

It authorizes CBK to require banks to provide statements, information and statistical data considered necessary for carrying out its functions.

Banks must supply the requested information according to the system established by CBK.

The information is generally confidential.

However, Article 82 expressly recognizes exceptions concerning:

• statistical information in aggregate form; and
• information exchanged between CBK and other central banks and banking supervisory authorities for consolidated supervision of banks, their branches and subsidiaries.

Such exchanges must take place under arrangements agreed between CBK and the relevant foreign central bank or supervisory authority.

This is a direct statutory foundation for cross-border supervisory cooperation.

4. Why Information Exchange Is Necessary

Modern banks can operate through complex financial groups.

Consider:

Kuwaiti parent bank

→ Kuwait banking subsidiary
→ foreign banking branch
→ investment company
→ securities business
→ other financial subsidiaries.

No single regulator may possess all information necessary to understand the group's overall risk.

Information exchange allows supervisors to identify matters such as:

• capital problems;
• liquidity risk;
• concentration risk;
• related-party exposures;
• suspicious transactions;
• securities violations;
• operational risks;
• group-wide financial difficulties.

Without regulatory cooperation, financial institutions could potentially exploit gaps between supervisory regimes.

5. Consolidated Supervision

Article 82 specifically connects regulatory information exchange with aggregate or consolidated supervision.

Consolidated supervision means examining a banking group as a whole rather than looking only at one legal entity.

For example:

Parent bank in Kuwait

↓ information exchange

Foreign branch

↓ information exchange

Foreign subsidiary

↓ information exchange

CBK evaluates group-wide exposure

This is important because financial problems can move from one member of a corporate group to another.

6. Domestic Regulatory Cooperation

Domestic information exchange is also important.

A financial group might simultaneously conduct activities regulated by CBK, CMA and IRU.

For example, a matter discovered during securities supervision could also raise prudential concerns for a bank.

Similarly, information discovered by banking supervisors could reveal conduct relevant to securities, insurance or financial-crime authorities.

The objective of inter-agency cooperation is therefore not to erase institutional boundaries. Each regulator continues exercising its own statutory responsibilities while obtaining information necessary for those responsibilities.

7. Confidentiality Is the Starting Rule

Regulatory cooperation does not mean that financial information becomes public.

Law No. 32 of 1968 contains significant confidentiality protections.

CBK's published instructions explain that Article 28 prohibits CBK board members, managers, officers and employees from disclosing information obtained through their official positions concerning CBK, its customers or banks under CBK supervision unless disclosure is legally permitted.

Article 82 similarly starts from the position that information supplied by banks remains confidential before establishing specific exceptions.

Thus:

Confidentiality = general principle

Authorized regulatory exchange = legally recognized exception.

8. Confidentiality Within the CMA

Similar protections exist within the securities regulatory system.

Article 29 of the CMA Law requires CMA commissioners, employees and persons working with its committees to maintain confidentiality regarding information and documents obtained through their positions.

Access cannot ordinarily be given to unauthorized persons unless disclosure is permitted under legislation or required by a binding judicial order or judgment.

This demonstrates an important principle of regulatory information exchange:

The receiving regulator must itself operate within a legally protected confidentiality environment.

9. Insurance-Sector Information

The creation of the IRU under Law No. 125 of 2019 added a specialized insurance supervisor to Kuwait's financial regulatory architecture.

The IRU's responsibilities include regulation and supervision of insurance activities and inspection of companies operating within the sector. Its Executive Regulations provide additional detail concerning those supervisory functions.

Information held by the insurance supervisor can become relevant to broader financial supervision where an insurer forms part of a financial conglomerate or has significant relationships with banks and investment institutions.

10. AML/CFT Information Exchange

Information exchange becomes particularly important in combating money laundering and terrorist financing.

A suspicious financial pattern may involve several institutions:

Bank → payment transaction → securities account → company → insurance product

If authorities operate completely independently, each may see only one part of the activity.

The 2024 FATF/MENAFATF assessment recorded information-access arrangements involving KwFIU, the Ministry of Interior and Public Prosecution and databases maintained by authorities including CBK, CMA and IRU.

This illustrates the practical importance of inter-agency access to financial intelligence.

11. Kuwait's AML/CFT Framework

The 2024 FATF/MENAFATF mutual evaluation concluded that Kuwait had an adequate legal and supervisory framework for addressing illicit finance but identified serious shortcomings in effectiveness, including aspects of money-laundering and terrorist-financing investigation and prosecution.

Importantly for information exchange, Kuwait received a Compliant technical rating for Recommendation 9 concerning financial-institution secrecy laws, while Recommendation 2 concerning national cooperation and coordination was rated Largely Compliant in the 2024 assessment.

Kuwait has continued reforms since that evaluation. MENAFATF's second enhanced follow-up report was published in May 2026 and assessed progress in addressing technical-compliance deficiencies identified in the 2024 evaluation.

12. Bank Secrecy Versus Regulatory Disclosure

One of the most important distinctions is between:

Unauthorized disclosure

A bank employee gives confidential customer information to an outsider without lawful authority.

and

Authorized regulatory disclosure

A bank provides information because CBK or another legally competent authority is entitled to require it.

These situations are fundamentally different.

Bank secrecy is intended to protect customers against unauthorized disclosure. It is not ordinarily intended to prevent lawful financial supervision.

Indeed, Article 82 expressly requires banks to provide CBK with information requested under the statutory framework.

13. International Regulatory Cooperation

International information exchange is particularly important for foreign banks.

Suppose:

Bank A is headquartered in Kuwait

but has:

Branch B in another country.

The foreign regulator may possess information about Branch B's liquidity, management or local regulatory compliance.

CBK may need that information to understand Bank A's overall financial position.

Conversely, a foreign regulator supervising a foreign banking group with a Kuwaiti branch may require information concerning the Kuwaiti operation.

Article 82 expressly recognizes exchanges between CBK and foreign central banks and banking supervisory authorities for consolidated supervision.

14. Memoranda and Supervisory Arrangements

Regulatory information exchange commonly operates through formal cooperation arrangements.

Article 82 specifically provides that the relevant exchange should occur according to arrangements agreed between CBK and the relevant central banks or banking supervisory authorities.

Such arrangements are important because they can establish matters such as:

• purpose of information exchange;
• permitted recipients;
• confidentiality;
• supervisory use;
• security arrangements;
• onward disclosure;
• consultation procedures.

They therefore provide structure around information sharing rather than allowing unrestricted transfers.

15. Purpose Limitation

Regulatory information should normally be exchanged for a legitimate supervisory or statutory purpose.

For example, CBK may require information to evaluate the financial condition of a banking group.

A foreign supervisor might need information about the Kuwaiti branch of an internationally active bank.

A financial-intelligence authority may require information concerning suspicious financial activities.

The existence of cooperation between two authorities should not automatically mean that every database of one authority becomes freely accessible to every employee of another.

Information exchange should remain connected with legally authorized functions.

16. Data Security

Modern information exchange is increasingly electronic.

Regulators may exchange:

• financial statements;
• regulatory reports;
• customer-related information;
• suspicious-transaction intelligence;
• ownership information;
• prudential data;
• enforcement information.

Such data can be extremely sensitive.

Information-sharing arrangements therefore require cybersecurity safeguards such as access controls, authentication, secure communications, logging and restrictions on unauthorized copying or redistribution.

The more regulators exchange information digitally, the more important secure information governance becomes.

17. Information Exchange and Enforcement

Regulatory information exchange is not limited to prudential supervision.

Information discovered by one regulator can sometimes indicate possible violations within another regulator's jurisdiction.

For example:

CBK supervisory review

↓ discovers unusual securities-related activity

Relevant information communicated under lawful mechanism

↓

CMA considers whether securities rules are engaged

The second regulator must still conduct its own legally required analysis.

Information exchange does not automatically establish liability.

It provides information that may justify further investigation.

18. Cross-Border Banking Crises

Information exchange becomes particularly important during a banking crisis.

Suppose a banking group operates in five countries and suddenly develops a severe liquidity problem.

If each regulator acts using only domestic information, authorities may obtain an incomplete picture.

Supervisory cooperation can help authorities understand:

• where liquidity is located;
• where major liabilities exist;
• whether subsidiaries are solvent;
• whether funds are moving across borders;
• whether emergency supervisory measures are required.

Thus, information exchange contributes not only to routine supervision but also to financial stability.

19. Six Important Comparative Case-Law Authorities

A significant qualification is necessary.

There does not appear to be a readily accessible set of six published Kuwaiti judgments specifically dealing with information exchange among CBK, CMA, IRU and other financial regulators.

Creating six fictional Kuwaiti cases would therefore be misleading.

The following established comparative decisions concern regulatory information gathering, confidentiality, cross-border cooperation or disclosure by financial authorities. They are comparative authorities, not binding Kuwaiti precedents.

Case 1 — Bank of Credit and Commerce International (Overseas) Ltd v Price Waterhouse [1998] Ch 84

The BCCI litigation followed the collapse of an internationally operating banking group and raised numerous issues concerning auditors, banking supervision and confidential financial information.

Relevance to Kuwait

The BCCI experience demonstrates why regulators supervising international banking groups require effective information exchange.

A bank may be legally divided among several jurisdictions while economically functioning as one group.

The comparative lesson is:

fragmented institution + fragmented supervision = increased regulatory risk.

Kuwait's Article 82 consolidated-supervision provisions directly address this broader supervisory problem.

20. Case 2 — R v Chief Constable of Warwickshire, ex parte Wiley [1995] 1 AC 274

This House of Lords decision concerned public-interest immunity and confidential information.

The case illustrates the broader principle that confidentiality interests must be evaluated within the legal framework governing disclosure rather than being treated as an absolute barrier in every circumstance.

Relevance

Financial regulatory information can be highly confidential, but confidentiality does not necessarily prevent disclosure where legislation lawfully authorizes or requires it.

This resembles the structure of Article 82:

information remains confidential → specified regulatory exchange is nevertheless permitted.

21. Case 3 — Science Research Council v Nasse [1980] AC 1028

This House of Lords decision considered confidential documents and disclosure in legal proceedings.

The Court rejected the idea that confidentiality necessarily creates an absolute immunity against disclosure.

Relevance

The case helps distinguish:

confidential information

from

information that can never lawfully be disclosed.

For financial regulators, information can remain confidential while still being exchanged through specifically authorized supervisory mechanisms.

22. Case 4 — Bank of Credit and Commerce International SA v Bank of England [1996] 3 All ER 558

Litigation arising from BCCI also examined the conduct of banking supervision and the responsibilities of supervisory authorities.

Relevance

The case illustrates the complexity of supervising multinational banking institutions.

An international banking group can operate through multiple subsidiaries and branches while risks accumulate across the organization.

Effective consolidated supervision therefore requires regulators to understand not merely the domestic bank but also significant operations elsewhere.

Article 82 of Kuwait's banking legislation expressly facilitates this kind of supervisory information exchange.

23. Case 5 — FSA v Fradley [2005] EWCA Civ 1183

This English case concerned the financial regulator's statutory information-gathering and investigatory powers.

Relevance

The case illustrates an important regulatory distinction:

A financial regulator's ability to obtain information derives from legislation.

Therefore, a regulator should not be treated as an ordinary private party asking voluntarily for confidential financial information.

In Kuwait, Article 82 similarly gives CBK statutory authority to require banks to submit information necessary for CBK's functions.

24. Case 6 — Fisher v United States, 425 U.S. 391 (1976)

The U.S. Supreme Court considered compelled production of documents and legal protections surrounding information held by professional advisers.

Although the case arose in a different legal and constitutional system, it illustrates a broader issue relevant to financial supervision: possession of confidential documents does not necessarily prevent a competent public authority from requiring their production under lawful statutory powers.

Relevance to Kuwait

The useful comparative distinction is between:

unlawful disclosure of confidential information

and

legally compelled disclosure to an authorized authority.

That distinction is fundamental to Kuwait's banking-information framework.

25. Limits of the Comparative Cases

These six authorities should not be treated as establishing Kuwaiti law.

Their usefulness lies in illustrating recurring regulatory principles:

1. confidentiality is important but not necessarily absolute;
2. regulators require statutory authority to obtain information;
3. international financial groups require consolidated supervision;
4. lawful regulatory disclosure differs from unauthorized disclosure;
5. sensitive information requires appropriate protection; and
6. cross-border institutions create supervisory coordination problems.

The actual legal authority for information exchange in Kuwait must come from Kuwaiti legislation and regulatory arrangements.

26. Practical Example — Domestic Exchange

Assume CBK discovers during supervision that a bank's investment subsidiary may have engaged in conduct relevant to securities regulation.

The appropriate conceptual sequence would be:

CBK obtains information under banking-supervision powers

↓

CBK identifies a potential securities-regulatory issue

↓

information is handled under applicable confidentiality rules

↓

lawfully authorized cooperation mechanism is used where available

↓

CMA assesses the matter under its own statutory jurisdiction

The original supervisory information does not automatically prove a securities violation.

The CMA must apply its own legal framework.

27. Practical Example — Cross-Border Exchange

Suppose a Kuwaiti bank owns a foreign banking subsidiary.

The foreign supervisor identifies significant losses at the subsidiary.

Those losses could affect the Kuwaiti parent bank.

Under the type of arrangement contemplated by Article 82:

Foreign supervisor

↓

information-sharing arrangement

↓

CBK

↓

consolidated assessment of banking group

CBK can then consider whether the foreign losses create risks to the parent institution.

This is precisely why cross-border information exchange is essential to consolidated banking supervision.

28. Information Exchange and Financial Intelligence

Financial intelligence adds another dimension.

The 2024 FATF/MENAFATF assessment identified access arrangements involving databases maintained by several Kuwaiti authorities. Its analysis shows that the KwFIU's financial-intelligence work involves requests and access to information held across government and financial-sector systems.

This demonstrates that modern financial regulation increasingly operates as an information network rather than through isolated supervisory institutions.

However, access must remain legally authorized and subject to confidentiality and security requirements.

29. Main Legal Risks

Information exchange among financial regulators produces several legal risks.

Excessive disclosure

More information may be transmitted than is necessary for the regulatory purpose.

Unauthorized onward disclosure

A receiving authority could improperly transmit information to another person.

Cybersecurity breaches

Electronic regulatory databases can become attractive targets.

Incorrect information

A regulator may act upon inaccurate or outdated information received from another authority.

Jurisdictional conflicts

Different countries can have different confidentiality and disclosure requirements.

Purpose expansion

Information supplied for prudential supervision could potentially be used for another purpose without an appropriate legal basis.

These risks explain why information-sharing arrangements require legal and institutional safeguards.

30. Regulatory Cooperation Versus Regulatory Independence

Information exchange does not mean that Kuwait's financial regulators become one authority.

CBK remains responsible for matters within its banking jurisdiction.

CMA retains its securities-market responsibilities.

IRU retains insurance supervision.

KwFIU performs its financial-intelligence functions.

Cooperation means:

different statutory responsibilities + controlled information exchange + coordinated supervision where necessary.

Maintaining this distinction is important because each regulator derives its authority from different legislation.

31. Current Regulatory Context

Kuwait's framework continues to evolve.

The 2024 FATF/MENAFATF evaluation found that Kuwait possessed an adequate legal and supervisory framework but identified weaknesses in effective AML/CFT outcomes.

By May 2026, MENAFATF had issued Kuwait's Second Enhanced Follow-Up Report, assessing reforms undertaken to address technical-compliance deficiencies from the earlier evaluation.

Therefore, information exchange should be understood as an evolving area involving both traditional prudential supervision and Kuwait's continuing development of financial-crime coordination mechanisms.

32. Key Principles

The Kuwaiti framework can be summarized through five principles:

1. Regulatory access:
CBK can require banks to provide information necessary for its statutory functions.

2. Confidentiality:
Information obtained through supervision remains subject to significant statutory confidentiality protections.

3. Authorized exchange:
Article 82 expressly permits specified exchanges with central banks and banking supervisors for consolidated supervision.

4. Structured cooperation:
Cross-border exchange is contemplated through arrangements agreed with the relevant supervisory authorities.

5. Sectoral coordination:
CBK, CMA, IRU and financial-intelligence authorities remain institutionally distinct but may need information from one another where their statutory responsibilities overlap.

33. Conclusion

Banking Law and Information Exchange Among Financial Regulators in Kuwait is based on balancing effective financial supervision against confidentiality.

The central banking provision is Article 82 of Law No. 32 of 1968. It empowers CBK to obtain statements, information and statistical data from banks while treating that information as confidential. Crucially, it expressly permits information exchange between CBK and other central banks or banking supervisory authorities for consolidated supervision of banks, branches and subsidiaries, subject to agreed supervisory arrangements.

The wider system includes the CMA under Law No. 7 of 2010, the IRU under Law No. 125 of 2019, and Kuwait's AML/CFT institutions. CMA personnel themselves are subject to statutory confidentiality requirements, while the IRU possesses specialized supervisory and inspection responsibilities within insurance.

Accordingly, Kuwait's model is not one of unrestricted government access to financial information. It is better understood as:

Confidential financial information → statutory supervisory access → controlled regulatory exchange → continued confidentiality and security.

The six decisions discussed above are comparative authorities, not Kuwaiti precedents. Publicly accessible Kuwaiti judgments specifically addressing inter-regulator financial information exchange are limited; therefore, presenting invented Kuwaiti cases merely to reach a six-case requirement would give an inaccurate account of Kuwait's jurisprudence.