Inside the Exchange Companies’ AML Rulebook
What the Central Bank of Kuwait Expects Before a Remittance Leaves the Counter
By Legal Counsel Suha Alsahli
Emtithal Law Firm
On 26 August 2026, the Central Bank of Kuwait (CBK) instructed banks, exchange companies and the other financial institutions it supervises to strengthen the due diligence they apply when executing transactions where information, evidence or indicators suggest a link to money laundering, terrorist financing or the financing of the proliferation of weapons of mass destruction. The circular expressly directs these institutions back to the CBK’s instructions of 16 February 2023.
The circular is the latest in a series of 2026 developments. In January, the CBK circulated Resolution No. 176 of 2025 on the implementation of United Nations Security Council resolutions, stressing that sanctions decisions must be applied immediately and without delay. In February, it set new minimum requirements for the content of compliance officers’ reports, effective 1 April 2026.
When an ordinary remittance becomes a costly violation
Consider a customer who visits an exchange company to send money abroad. He presents a valid civil ID and the transaction appears entirely routine. However, the funds belong to someone else, who has asked him to send them on their behalf.
The instructions require the exchange company to obtain a certificate signed by the customer confirming that he is the beneficial owner of the transaction and is not acting on behalf of another person. Where the company identifies that he is acting for someone else, it must verify the identity of the true requester of the transaction and apply due diligence proportionate to that person’s risk. If the identity of the customer or the beneficial owner cannot be verified, the company must refrain from executing the transaction and consider whether the case should be reported to the Kuwait Financial Intelligence Unit (KFIU).
Consider another customer, this time a politically exposed person (PEP), or a close associate or relative of one up to the second degree. The remittance may be perfectly legitimate, but the instructions require the prior approval of the company’s management before the relationship begins, measures to identify the source of funds and wealth, and enhanced, ongoing monitoring of the relationship.
The remittance itself carries obligations. Every outward electronic transfer must carry the sender’s full name, civil ID number and address, as well as the beneficiary’s name. An exchange company that cannot meet these requirements must refrain from executing the transfer. Inward remittances that arrive without this information must be monitored and the beneficiary’s identity verified.
Sanctions screening is equally strict. Exchange companies must have efficient systems to screen the names of customers, the persons they authorise to deal with the company and the beneficial owners of requested transactions. No financial or related service may be provided to a listed person, entity or group as soon as the relevant decision is issued.
Even identifying a suspicious transaction does not conclude the company’s obligations. The KFIU must be notified within two business days of any suspicious transaction or attempted transaction, regardless of its value, and employees, managers and anyone with knowledge of the report are prohibited from disclosing it to the customer or to others.
When compliance is measured on paper
The instructions also impose a demanding set of documentary obligations.
Each exchange company must prepare a written study of the money laundering and terrorist financing risks it faces, updated periodically, covering its customers, the countries it deals with and its products and services. The study, like the company’s AML/CFT policy and procedures, must be approved by its management and all partners.
Customer information must also be updated periodically depending on each customer’s risk tier. Relationships with correspondents abroad carry their own requirements. Before contracting with a foreign correspondent, an exchange company must prepare a written study setting out the need for the relationship and the information gathered on the correspondent. The study must confirm that the company has obtained the correspondent’s licence to carry out money transfers, evidence that it is subject to AML/CFT supervision, and its undertakings to apply due diligence and to provide transaction documents, including proof that the beneficiary received the funds, within a set time period. A contract defining each party’s AML/CFT responsibilities must be signed before dealings begin. These requirements also apply to existing relationships, including correspondents the company previously dealt with without a contract.
An exchange company that cannot evidence these steps for each of its correspondents is in breach of the instructions, even if no transfer through that correspondent has ever raised concern.
The compliance officer must report to the company’s manager and all partners periodically, including on any suspicious transactions identified, and the compliance function must itself be independently examined as part of the company’s internal audit plan.
The February 2026 circular raises the standard for those reports. Each report must now include an executive summary, an assessment of the company’s AML programme, an action plan to address deficiencies, and conclusions and recommendations, and must be approved by the board or the owners and partners. Its appendices include, among other things, the number of high-risk customers, a statement of the company’s beneficial owners, the suspicious transaction reports submitted to the KFIU and the training provided, including to partners.
For smaller exchange companies, these requirements can be resource-intensive. However, a deficiency in any one of them is a violation of the instructions in its own right, whether or not a suspicious transaction has ever passed through the company.
For exchange companies, the absence of suspicious transactions is insufficient. The question is whether their risk study, policies, procedures and records would withstand the next CBK inspection as that is where compliance is measured.
