Banking Law and Innovation Governance Boards in Kuwait

1. Introduction

Innovation has become an important part of modern banking in Kuwait. Banks increasingly use digital banking platforms, artificial intelligence, electronic payments, cloud technology, application programming interfaces (APIs), automated compliance systems, cybersecurity tools and partnerships with financial-technology companies.

These developments create opportunities but also produce new legal and operational risks.

For that reason, innovation cannot be treated merely as an information-technology project. It is also a matter of bank governance.

In Kuwait, there is no separate general statute creating a mandatory committee formally named an “Innovation Governance Board” for every bank. Instead, responsibility for innovation ultimately operates through the bank's board of directors, board committees, senior management, risk-management functions, compliance functions and internal-control systems.

The principal regulatory authority is the Central Bank of Kuwait (CBK). Kuwaiti banking governance is primarily based upon Law No. 32 of 1968 concerning Currency, the Central Bank of Kuwait and the Organisation of Banking Business, together with CBK instructions, corporate-governance requirements, the Companies Law and specialised regulations concerning matters such as electronic payments and cybersecurity.

The basic principle is simple:

Innovation may be delegated operationally, but responsibility for proper governance cannot simply disappear through delegation.

2. Meaning of an Innovation Governance Board

An innovation governance board can be understood as a board-level or senior governance mechanism responsible for supervising significant technological and business-model innovation.

Depending upon the institution, innovation oversight might be exercised by:

the full board of directors;

a board risk committee;

a technology committee;

a digital-transformation committee;

a cybersecurity committee;

an innovation committee;

senior executive management; or

several committees acting together.

Its purpose is not merely to approve new technology.

It should ensure that innovation remains consistent with:

the bank's strategy;

regulatory obligations;

risk appetite;

customer protection;

cybersecurity requirements;

financial stability;

data confidentiality;

internal controls; and

business continuity.

Therefore, innovation governance is a combination of strategy and risk control.

3. Central Bank of Kuwait

The CBK is the principal banking regulator in Kuwait.

Its supervisory framework includes requirements relating to:

corporate governance;

board qualifications;

risk management;

internal controls;

customer confidentiality;

capital;

electronic payments;

cybersecurity;

digital banking; and

financial technology.

Consequently, a bank cannot justify non-compliance merely by arguing that a particular product is technologically innovative.

Innovation must operate inside the regulatory framework.

4. Law No. 32 of 1968

Law No. 32 of 1968 provides the central statutory framework governing banking activities and CBK supervision.

It gives the CBK extensive supervisory powers over regulated banks.

The legislation also addresses the organisation of banking businesses and their governance.

For innovation governance, the importance of the legislation is that technological transformation does not remove a bank from ordinary banking supervision.

For example, when a conventional banking service moves from a branch to a mobile application, the delivery mechanism changes, but regulatory responsibilities concerning security, confidentiality, controls and supervision remain important.

5. Board of Directors

The board of directors occupies the highest governance position within a bank.

Its responsibilities include establishing the institution's strategic direction and ensuring that appropriate governance and control systems exist.

Innovation therefore requires board attention when it can materially affect the bank.

Examples include:

launching a digital bank;

adopting artificial intelligence for credit decisions;

migrating important systems to cloud infrastructure;

establishing open-banking services;

outsourcing important technology;

implementing biometric identification;

developing digital payment products; and

entering major FinTech partnerships.

The board does not need to write computer code or manage everyday implementation.

Its function is oversight.

6. Independent Directors

Independent directors are important because they can provide objective oversight of management decisions.

The CBK amended its corporate-governance requirements for Kuwaiti banks in 2019 to incorporate independent directors into bank boards and board committees.

The amendments also strengthened the emphasis on risk-management governance and compliance governance.

For innovation projects, independent oversight can be particularly important where management has strong commercial incentives to introduce a product quickly.

An independent director can ask:

Has cybersecurity risk been properly assessed?

Is customer information protected?

Has compliance reviewed the product?

Is outsourcing sufficiently controlled?

What happens if the system fails?

Has the bank tested the technology?

Does the project remain within the bank's risk appetite?

Innovation governance therefore requires challenge as well as encouragement.

7. Board Committees

The board can use specialised committees to examine complex matters.

An innovation-related governance structure may interact with:

Risk Committee

Examines technological, operational, cybersecurity, model and third-party risks.

Audit Committee

Examines internal controls, assurance and audit findings relating to technology projects.

Compliance Governance

Ensures new products comply with applicable laws, regulations and CBK requirements.

Technology or Innovation Committee

Where established by a bank, it may provide more specialised oversight of digital strategy, technological investment and emerging technology.

However, creating an innovation committee does not automatically remove responsibility from the board.

The committee assists governance; it does not eliminate board accountability.

8. CBK Corporate Governance Rules

CBK corporate-governance requirements are central to innovation governance.

The framework emphasises:

board responsibility;

independent oversight;

risk governance;

internal controls;

compliance;

proper management structures; and

accountability.

In 2019 the CBK expressly strengthened its governance framework by introducing independent directors into bank boards and committees and emphasising the board's role in risk-management governance.

This is relevant because technology risk has become part of overall bank risk.

A major digital transformation should therefore not exist outside the institution's governance architecture.

9. Innovation Hub “Wolooj”

Kuwait has developed a formal mechanism for supervised financial innovation through the CBK's Innovation Hub, known as Wolooj.

The framework provides a controlled environment in which eligible innovative financial products and services can be examined and tested.

Its objectives include encouraging FinTech innovation while maintaining regulatory compliance and financial-sector safety.

The framework covers areas such as:

cybersecurity and data privacy;

regulatory compliance;

sustainable finance;

open banking; and

artificial intelligence in finance.

This demonstrates Kuwait's basic regulatory approach:

innovation is encouraged, but innovation should develop under controlled governance rather than outside regulation.

10. Regulatory Sandbox

The regulatory sandbox allows qualifying innovative products to undergo controlled testing.

The CBK originally introduced its regulatory sandbox framework in 2018 and subsequently developed its innovation arrangements further.

A sandbox allows regulators and innovators to examine an innovation before unrestricted market deployment.

The process can include assessment of:

regulatory compliance;

technical performance;

operational efficiency;

security;

confidentiality;

customer privacy; and

appropriate safeguards.

For a bank's innovation governance body, participation in a regulatory sandbox should therefore be viewed as part of the institution's wider approval and risk-management process.

11. Innovation Approval Process

A properly governed bank should normally establish a structured process before introducing material innovation.

A simplified model is:

Business proposal

↓

Technical assessment

↓

Cybersecurity assessment

↓

Risk assessment

↓

Compliance/legal assessment

↓

Customer-impact assessment

↓

Management/committee approval

↓

Board oversight where material

↓

CBK approval or sandbox process where required

↓

Controlled implementation

↓

Continuous monitoring

This approach prevents commercial pressure from bypassing regulatory controls.

12. Artificial Intelligence Governance

Artificial intelligence creates special governance issues.

Banks can potentially use AI for:

credit scoring;

fraud detection;

customer support;

transaction monitoring;

document processing;

risk modelling; and

compliance.

However, an innovation governance body should examine matters such as:

accuracy;

data quality;

model risk;

cybersecurity;

human oversight;

explainability where relevant;

confidentiality;

regulatory compliance; and

consequences of system failure.

AI should therefore not automatically make important banking decisions merely because the technology is technically capable of doing so.

13. Cybersecurity Governance

Cybersecurity is one of the most important elements of innovation governance.

A digital banking system can expose an institution to:

cyberattacks;

unauthorised access;

data loss;

service disruption;

payment fraud; and

third-party vulnerabilities.

Consequently, innovation governance should consider cybersecurity from the beginning of a project rather than after the product has already been launched.

The CBK's current Wolooj framework specifically identifies cybersecurity and data privacy as areas for financial innovation.

14. Customer Confidentiality

Banks hold highly sensitive customer information.

Kuwaiti banking regulation contains requirements concerning confidentiality of customer information and data.

When banks adopt cloud computing, APIs, artificial intelligence or FinTech partnerships, customer information may interact with additional technological systems and service providers.

Innovation governance should therefore establish:

who can access information;

why access is necessary;

where information is processed;

what security applies;

how breaches are detected; and

how third parties are controlled.

A bank cannot avoid its governance obligations simply by outsourcing the technology.

15. Third-Party FinTech Partnerships

Modern banks often innovate through partnerships rather than developing everything internally.

A bank may work with:

payment companies;

software developers;

cloud providers;

identity-verification providers;

cybersecurity companies; and

FinTech startups.

This creates third-party risk.

Before approving an important partnership, the governance process should examine:

financial condition of the provider;

technical capacity;

cybersecurity;

confidentiality arrangements;

regulatory compliance;

business continuity;

audit rights;

subcontracting;

termination rights; and

exit arrangements.

The bank remains responsible for managing risks created by important outsourced services.

16. Digital Banking

Kuwait's banking framework increasingly recognises digital banking.

The CBK has developed a digital-banking framework allowing technological development within existing institutions and establishing a framework for standalone digital banking.

This means boards must consider how traditional governance principles operate where banking becomes primarily digital.

A digital bank still requires:

effective governance;

capital management;

risk controls;

cybersecurity;

compliance;

customer protection; and

regulatory supervision.

“Digital” therefore describes the business model, not an exemption from banking law.

17. Electronic Payments

Electronic payments represent another important innovation area.

Kuwait has established regulatory instructions for electronic payment activities.

CBK's development of payment regulation has occurred alongside technologies such as contactless payments and other digital payment systems.

An innovation governance structure considering a new payment product should therefore examine both:

technology risk, and

payment-regulation requirements.

This is particularly important where a bank works with an external payment provider.

18. Risk Appetite

Innovation should operate within the bank's approved risk appetite.

A bank might be technologically capable of launching a product but still decide that the risks exceed acceptable levels.

Relevant risks can include:

credit risk;

operational risk;

cyber risk;

legal risk;

compliance risk;

model risk;

liquidity risk;

reputational risk; and

strategic risk.

The innovation governance process should therefore determine whether the expected commercial benefit justifies the risks within the institution's approved framework.

19. Internal Controls

Innovation must remain subject to internal control.

Important controls may include:

segregation of duties;

approval limits;

access controls;

testing;

transaction monitoring;

incident reporting;

audit trails;

change-management procedures; and

independent review.

Rapid technological development does not justify eliminating controls.

Indeed, highly automated systems may require stronger controls because a programming or configuration error can affect a very large number of transactions quickly.

20. Role of Internal Audit

Internal audit provides independent assurance concerning the effectiveness of controls.

For major innovation projects, internal audit can examine:

project governance;

regulatory compliance;

cybersecurity controls;

access management;

outsourcing;

data governance;

model controls; and

implementation procedures.

The audit function should remain sufficiently independent from the people responsible for designing and operating the innovation.

21. Islamic Banks

Innovation governance has an additional dimension for Islamic banks.

An innovative financial product must comply not only with banking regulation but also with applicable Sharia governance requirements.

Kuwait's banking framework provides for Sharia supervisory arrangements for Islamic banks and a Higher Committee of Sharia Supervision at the CBK.

Therefore, a FinTech product offered by an Islamic bank may require consideration of:

Technology + Banking Regulation + Risk Governance + Sharia Compliance.

An innovation committee cannot override mandatory Sharia governance requirements.

22. Accountability

One of the most important governance principles is accountability.

If a digital project fails, the bank should be able to determine:

who proposed it;

who assessed the risks;

who approved it;

what conditions were imposed;

what testing occurred;

whether regulatory approval was required;

who monitored implementation; and

how problems were escalated.

Clear documentation prevents innovation governance from becoming informal and unaccountable.

23. Important Case-Law Principles

Case 1 — Kuwait Finance House K.S.C. v. Investment Dar Co. K.S.C.C. — English High Court, 2009

This widely discussed litigation arose from a financing arrangement involving Kuwaiti Islamic financial institutions.

Investment Dar argued, among other matters, that the relevant transaction was outside its constitutional capacity because it was inconsistent with Sharia requirements.

Although the litigation occurred before an English court, it concerned Kuwaiti financial institutions and demonstrated how internal governance, corporate authority and Sharia compliance can affect the enforceability of sophisticated financial arrangements.

Importance

The case shows that product innovation cannot be separated from legal authority.

Before approving an innovative Islamic banking product, governance bodies should determine:

whether the institution has authority to undertake it;

whether the relevant corporate approvals exist;

whether Sharia governance requirements have been satisfied; and

whether documentation accurately reflects the approved structure.

24. Case 2 — Investment Dar Company KSCC v. Blom Development Bank SAL — English High Court, 2009

This litigation concerned a wakala arrangement involving a Kuwaiti Islamic investment institution.

Questions arose regarding the nature and enforceability of the transaction and its compatibility with the company's constitutional and Sharia-based restrictions.

Importance

The case demonstrates why innovative financial products need legal review before launch.

Commercial teams may describe an arrangement in one way, but courts examine its actual contractual and legal structure.

For innovation governance boards, the lesson is:

Product design must match legal documentation and institutional authority.

25. Case 3 — National Bank of Kuwait SAK v. International Investment Group KSCC — English Commercial Court, 2013

This litigation involved financial obligations connected with a Kuwaiti investment company and raised issues surrounding enforcement of financial obligations and insolvency-related circumstances.

Importance

The broader governance lesson is that innovation does not eliminate ordinary counterparty and credit risk.

A new platform, digital product or sophisticated financing structure must still be supported by:

enforceable documentation;

counterparty assessment;

authority;

risk controls; and

recovery planning.

Innovation governance should therefore remain integrated with traditional credit governance.

26. Case 4 — Al-Sadeq v. Dechert LLP — UK Supreme Court, 2024

This major case arose from investigations connected with Kuwait's financial sector and considered important questions concerning legal professional privilege and the circumstances in which the iniquity exception can apply.

Although it was not specifically a FinTech case, it is highly relevant to governance investigations involving financial institutions.

Importance

Innovation programmes can generate internal investigations concerning:

regulatory breaches;

misuse of data;

fraud;

cybersecurity incidents;

misconduct; or

control failures.

Boards must ensure that investigations are conducted lawfully and that legal privilege, document handling and investigative governance are properly understood.

The case demonstrates that governance includes the way an institution responds when serious allegations arise, not merely how it approves new products.

27. Case 5 — Al-Sadeq v. Dechert LLP — Court of Appeal, 2021

Before the matter reached the UK Supreme Court, the Court of Appeal considered the dispute and addressed questions concerning privilege and the iniquity exception.

The later Supreme Court proceedings further clarified important aspects of the legal analysis.

Importance

For banking governance, the litigation demonstrates why boards should establish formal procedures for:

internal investigations;

engagement of external counsel;

document preservation;

escalation of allegations;

privilege; and

reporting.

This becomes increasingly important as digital banking creates enormous volumes of electronic records.

28. Case 6 — Al-Mojil v. Protiviti Member Firm (Middle East) Ltd — English High Court, 2023

This litigation involved disputes connected with professional services and investigations in Kuwait and illustrates legal issues that can arise from corporate investigations, professional responsibilities and complex governance environments.

Importance

Innovation governance increasingly depends upon external specialists, including:

consultants;

auditors;

cybersecurity specialists;

technology advisers; and

lawyers.

Boards should clearly define:

scope of engagement;

reporting lines;

confidentiality;

responsibility;

access to information; and

independence.

Using an external consultant does not itself replace effective governance by the regulated institution.

29. Qualification Concerning Kuwait-Specific Innovation Case Law

A significant qualification is necessary.

Reported Kuwaiti judgments specifically using the modern concept “innovation governance board” are extremely limited. Innovation governance is primarily a regulatory and corporate-governance subject rather than a standalone field that has generated a large body of reported Kuwaiti appellate judgments.

Accordingly, the cases above should not be represented as six Kuwaiti court decisions directly establishing the duties of a statutory “innovation board.”

Instead, they illustrate closely connected legal principles involving:

financial-product governance;

corporate authority;

Islamic finance;

enforceability;

investigations;

professional responsibility; and

institutional controls.

The direct rules governing innovation oversight principally come from Kuwaiti legislation and CBK regulatory instructions.

30. Practical Governance Model

A Kuwaiti bank could organise innovation governance through the following structure:

Board of Directors

↓

Board Risk/Technology/Innovation Oversight

↓

Chief Executive and Senior Management

↓

Innovation/Digital Team

Alongside independent control functions:

Risk Management

Compliance

Cybersecurity

Legal

Internal Audit

For Islamic banks:

Sharia Governance

This structure provides several layers of challenge before significant technology reaches customers.

31. Questions the Board Should Ask

Before approving a major innovation, directors should consider questions such as:

Regulatory

Does the product require CBK approval or sandbox participation?

Strategic

Does the product support the bank's approved strategy?

Financial

What investment is required and what losses could arise?

Operational

Can the bank operate the technology reliably?

Cybersecurity

What happens if the platform is attacked?

Data

How is customer information protected?

Outsourcing

Which third parties are involved?

Customer protection

Could customers misunderstand or be disadvantaged by the product?

Continuity

What happens if the technology becomes unavailable?

Exit strategy

Can the bank safely discontinue or replace the system?

These questions turn innovation governance from a general concept into an operational control framework.

32. Innovation Versus Regulation

Kuwait's regulatory approach does not require choosing between innovation and regulation.

The CBK's regulatory sandbox illustrates an approach under which both objectives can operate together.

The desired relationship is:

Innovation

Controlled experimentation

Risk management

Regulatory supervision

=

Responsible financial innovation

This is particularly important because uncontrolled banking innovation can affect not merely one company but customers and the wider financial system.

33. Board Liability and Governance Failure

Directors should treat technology oversight seriously.

Potential governance failures can include:

approving products without adequate risk assessment;

ignoring cybersecurity warnings;

inadequate supervision of management;

weak internal controls;

failure to address regulatory concerns;

insufficient monitoring of outsourcing; and

inadequate response to major incidents.

Whether any individual director incurs legal liability depends upon the applicable law and the particular facts.

Therefore, an innovation governance framework should maintain clear records of information supplied to directors, decisions made and follow-up action.

34. Regulatory Sandbox and Board Responsibility

Participation in the CBK sandbox does not mean that the regulator assumes responsibility for the bank's product.

The institution must continue to manage its own risks.

The sandbox instead provides a controlled framework within which:

compliance can be measured;

safeguards can be tested;

operational performance can be assessed;

privacy can be evaluated; and

security can be examined.

Board oversight therefore remains necessary throughout experimentation.

35. Emerging Technologies

Future innovation governance in Kuwait is likely to address technologies including:

artificial intelligence;

machine learning;

open banking;

API ecosystems;

digital identity;

advanced fraud detection;

RegTech;

SupTech;

cloud infrastructure; and

automated compliance systems.

The governance principle remains technology-neutral:

the more material the potential effect on customers, the bank or financial stability, the stronger the governance and control process should be.

36. Importance of Documentation

Every material innovation project should generate a governance record.

Relevant documentation can include:

business case;

risk assessment;

cybersecurity assessment;

legal opinion;

compliance approval;

technical testing;

vendor due diligence;

board papers;

committee minutes;

regulatory correspondence;

incident reports; and

post-launch reviews.

Documentation allows the bank and regulator to understand how and why a decision was made.

37. Continuous Monitoring

Innovation governance does not finish when a product is launched.

Post-launch monitoring should examine matters such as:

system availability;

cybersecurity incidents;

customer complaints;

transaction errors;

fraud;

regulatory breaches;

model performance;

vendor performance; and

unexpected risks.

Material problems should be escalated through established governance channels.

A product that was acceptable when launched may later require modification or withdrawal.

38. Difference Between Innovation Management and Innovation Governance

These concepts should be distinguished.

Innovation Management

Deals mainly with creating and implementing new products.

It asks:

“How can we build this?”

Innovation Governance

Deals with authority, accountability, risk and oversight.

It asks:

“Should we build it, who can approve it, what risks exist, and how will those risks be controlled?”

A successful Kuwaiti bank requires both.

39. Main Legal Principles

The topic can ultimately be reduced to several important principles:

There is no general Kuwaiti banking body formally called an “Innovation Governance Board” that replaces the board of directors.

The board retains ultimate governance responsibility for material banking risks.

Innovation must remain within CBK supervision and applicable banking legislation.

Independent directors and board committees strengthen oversight.

Technology risk should be incorporated into overall risk governance.

Customer confidentiality continues to apply to digital services.

Outsourcing technology does not automatically outsource the bank's regulatory responsibility.

Cybersecurity should be considered before and after product launch.

Sandbox testing facilitates controlled experimentation but does not replace institutional governance.

Islamic banks must additionally integrate appropriate Sharia governance.

Significant innovation decisions should be properly documented.

Governance should continue throughout the entire technological life cycle.

40. Conclusion

Banking law and innovation governance boards in Kuwait represent the intersection of corporate governance, banking supervision and financial technology.

Kuwait does not generally treat innovation governance as a completely separate branch of banking law or require every bank to establish a body carrying that exact title. Instead, innovation oversight operates through the board of directors, board committees, management, risk, compliance, cybersecurity, internal audit and, for Islamic institutions, Sharia governance.

The Central Bank of Kuwait plays the central regulatory role. Its corporate-governance framework emphasises board responsibility, independent directors, risk governance and compliance, while its FinTech initiatives provide mechanisms for controlled technological experimentation.

The Wolooj Innovation Hub and regulatory sandbox demonstrate the regulatory philosophy particularly clearly: Kuwait seeks to encourage financial innovation while requiring appropriate safeguards, compliance, security and customer protection.

The relevant case law also shows that innovative finance cannot be separated from established legal principles. Cases involving Kuwait Finance House and Investment Dar illustrate the importance of corporate authority and Sharia-compliant product structures. Financial enforcement litigation demonstrates the continuing importance of contractual and counterparty risk. The Al-Sadeq litigation demonstrates the importance of lawful investigations, privilege and governance when financial-sector problems emerge.

Accordingly, the fundamental rule is:

A Kuwaiti bank may innovate technologically, but innovation must remain subject to board accountability, Central Bank supervision, effective risk management, cybersecurity, customer confidentiality, internal controls and applicable legal requirements.

An effective innovation governance structure therefore does not exist to prevent innovation. Its purpose is to ensure that innovation occurs in a controlled, legally compliant and institutionally accountable manner.