Kuwait banks ordered to use facial recognition and OTPs to protect low-income workers
The Central Bank of Kuwait (CBK) has introduced a comprehensive set of banking procedures to detect fictitious salary payments in the private sector and ensure that employees genuinely receive and retain control over their wages. The measures are designed to prevent employers from using workers’ bank accounts to create the appearance of salary payments while subsequently recovering the money or restricting employees’ access to it.
The new requirements follow the launch of the Kuwait Wage Payment System (KWPS) on September 28, a central electronic platform established to monitor private-sector salary payments through local banks.
Banks have been given three months from the system’s launch to complete the registration of employer information and are required to submit monthly reports through the platform by the fifth working day of the month following each payroll cycle.
A key element of the new framework is mandatory two-factor authentication for beneficiaries earning monthly salaries of up to 300 dinars. Banks must apply this requirement to every withdrawal, transfer or payment transaction worth 25 dinars or more from the account designated to receive the employee’s salary, regardless of the banking channel used.
The 300-dinar threshold determines which employees fall under the requirement, while the 25-dinar threshold applies to individual transactions. Salary deposits themselves do not require additional authentication.
Banks will use two separate verification factors, potentially including facial recognition and one-time passwords (OTPs), to confirm that the employee personally approves each transaction. Before authentication, the beneficiary must be shown the transaction details, including its type, amount and recipient. Verification at the time of account registration or initial access alone will not be sufficient.
To prevent employers or other parties from controlling employees’ banking facilities, banks must directly verify beneficiaries’ contact information and authentication methods whenever accounts are registered, modified or recovered. Information supplied by employers cannot be accepted without independent verification with the employee. Banks must also examine accounts used to transfer salaries or portions of wages back to employers or parties connected to them.
The CBK has made clear that successful authentication does not automatically rule out coercion or pressure on employees to return their wages. Banks must therefore continue monitoring suspicious transactions, including those below the 25-dinar authentication threshold.
Under the monitoring guidelines, banks should pay particular attention to cases where 80 percent or more of an employee’s salary is withdrawn or transferred within 72 hours of being credited, when this pattern occurs in two of the previous three salary cycles.
Other warning signs include transferring at least 50 percent of a salary to an employer or related party within 72 hours, pooling wages from five or more employees of the same company into a common beneficiary account, and unusual concentrations of withdrawals by employees of one employer at the same ATM or bank branch.
Additional indicators include unexplained transfers of wages back to employers, employers retaining workers’ bank cards, PINs or online banking credentials, and recovering salary payments after they have been recorded as paid in the system. Banks must also report documented complaints from employees who say they were forced to return their wages or prevented from freely using their accounts.
Other patterns requiring attention include repeated withdrawals of most of a salary, account balances falling to unusually low levels shortly after payday, accounts used almost exclusively for receiving and withdrawing wages, frequent unexplained changes to banking details, and repeated salary reversals or refunds without valid operational or technical reasons.
When suspicious activity is detected, banks must investigate transactions covering the preceding six months, compare the beneficiary’s financial behaviour with previous salary cycles, examine possible links between employees and employers, and review customer identification records and the banking channels used.
They must also check whether similar transaction patterns exist among other employees of the same company and investigate salary refunds or reversals. All findings, supporting information and decisions must be documented in a comprehensive electronic record.
The CBK has established three risk classifications for suspected fictitious salary payments. High-risk cases involve strong indications such as direct transfers of wages to employers or related parties, recurring suspicious patterns among several employees, evidence of employer control over bank accounts or documented complaints of forced salary recovery.
Medium-risk cases involve repeated withdrawals or transfers of most of the salary alongside additional suspicious indicators. Low-risk cases remain under observation when an isolated indicator appears without supporting evidence.
The monitoring requirements also extend to employers’ payroll funding arrangements. Banks must verify the source of funds used to finance salary files and assess whether the amounts correspond with the company’s business activity, workforce size and total wage obligations. Particular attention must be given to temporary funding immediately before payroll processing, followed by the recovery of funds or transfers of similar amounts back to the original funding source.
Banks must also monitor unexplained changes in employee numbers or total payroll amounts, repeated cancellation and resubmission of salary files, the use of intermediary accounts, and transfers of wages to company owners, partners, managers, authorized signatories or other related parties. Shared contact details, electronic devices, addresses and access methods across multiple employee accounts may also indicate that accounts are being controlled by employers or third parties.
Importantly, the CBK stressed that withdrawing a salary in cash, either fully or partially, does not by itself constitute evidence of fictitious payment. Such transactions must be assessed alongside additional indicators, the employee’s income level and normal financial behavior. Banks are also prohibited from delaying salary deposits or restricting beneficiaries’ access to their money merely because a suspicious indicator has emerged, unless a valid legal basis permits such action.
Through these measures, the CBK aims to ensure that salary payments recorded through the banking system represent genuine wages received and controlled by employees, while strengthening banks’ ability to identify employers who may be using payroll transactions to circumvent labour regulations.
