Kuwait Banks to Monitor Low-Income Workers’ Salary Transactions
CBK mandates two-factor authentication for transactions of KD 25 or more by private-sector employees earning KD 300 or less, effective December 31, 2026.
• Employees earning 300 dinars or less: Two-factor authentication will apply to withdrawals, transfers and payments of 25 dinars or more from their salary accounts, from December 31.
• Employees who withdraw cash: They can still withdraw their entire salary. Cash withdrawal alone is not evidence of wage manipulation.
• Employers: Retaining employees’ bank cards or PINs, or pressuring workers to return salaries, may trigger scrutiny.
• Banks: Must verify each covered transaction, monitor suspicious patterns and report cases that meet the required suspicion criteria.
• Workers without smartphones: Banks must provide secure alternative authentication methods.
• The CBK is not limiting how workers spend their salaries. It is seeking to ensure that the money genuinely belongs to them and that they are free to use it.
The Central Bank of Kuwait (CBK) has instructed local banks to introduce additional safeguards for the salaries of low-income private sector employees, requiring two-factor authentication for withdrawals, transfers and payments of 25 dinars or more from accounts belonging to workers earning monthly salaries of 300 dinars or less.
The new measures will take effect on December 31, 2026, and form part of the Central Bank’s efforts to protect workers from the so-called fictitious wage payments, in which employers record salaries as paid but may subsequently pressure employees to return the money or surrender control over their accounts.
The instructions complement the Kuwait Wage Payment System (KWPS), launched on September 28 to verify that private sector salaries reach their rightful recipients and that employees can freely access and use their wages.
Under the new rules, banks must apply two-factor authentication to every withdrawal, transfer or payment of 25 dinars or more made from an account designated for salary payments, including transactions through linked payment methods. The requirement applies regardless of the banking channel used. Salary deposits themselves are exempt from this additional verification.
An employee’s eligibility for the new safeguards will be determined by the latest monthly salary information recorded by the bank, rather than the account balance or the amount of an individual transaction. The classification must be updated whenever the employee’s salary changes.
What employees should expect
For transactions covered by the rules, banks must verify the employee’s identity and confirm their consent each time. Simply logging into a banking application or another banking channel will not be sufficient.
The verification process must also involve two employees from different categories at the bank. Before approving a transaction, the bank must clearly display its type, amount and beneficiary so the account holder knows exactly where the money is going and can confirm the transaction.
Authentication methods must be personally linked to the employee. Banks are also required to verify the accuracy of contact details directly with the employee whenever these details are registered, changed or retrieved, rather than relying solely on information supplied by the employer.
The CBK has further instructed banks to provide secure alternatives for employees who do not own smartphones or cannot use banking applications, ensuring that they are not excluded from accessing their wages.
Banks must monitor suspicious transactions
The Central Bank stressed that two-factor authentication alone cannot prevent all forms of wage manipulation. An employee may still be pressured to return a salary after receiving it, meaning banks must continue monitoring transactions and reporting suspicious activity, including transactions below the 25-dinar threshold.
Banks must investigate unusual financial activity by reviewing transactions over the six months preceding the detection of a suspected case and comparing them with the employee’s normal banking behavior. They must also examine whether transactions are connected to the employer or parties affiliated with the company and document their findings.
The CBK has identified several indicators that may point to fictitious wage payments or pressure on employees. These include salaries being returned to an employer or an affiliated party without an apparent legitimate reason, employers retaining employees’ bank cards or PINs, and documented complaints that workers are being forced to return their wages.
Other warning indicators include an employee withdrawing or transferring 80 percent or more of their salary within 72 hours in at least two of the previous three payroll cycles. Transferring 50 percent or more of the salary to the employer or an affiliated party within 72 hours is also considered a warning indicator.
Banks must also look for similar transaction patterns involving five employees or 20 percent of a company’s workforce, whichever is lower. Repeated group withdrawals from a single ATM and the transfer of salaries into joint accounts linked to an employer are among the patterns requiring scrutiny.
Withdrawals are not automatically suspicious
The Central Bank has made clear that withdrawing an entire salary in cash is not, by itself, proof of fictitious payment or wrongdoing. The identified thresholds are guidance indicators for banks to assess transactions, not restrictions on employees’ access to their money or a ban on cash withdrawals.
Cases will be classified according to their level of risk. A case may be considered high risk when there is strong evidence, medium risk when suspicious behavior is repeated and supported by additional evidence, and low risk when only a single indicator is identified.
Banks are required to conduct an initial review within two days. Where sufficient grounds for suspicion are established, the case must be reported by the end of that day. A further three days of monitoring may be used to complete a detailed investigation, while urgent cases must be reported immediately.
The CBK has also stressed that banks cannot delay recording salary payments or restrict employees’ access to their funds merely because a suspicious indicator has emerged, unless there is a legal basis for doing so. Investigating employer violations and protecting workers’ labor rights remain the responsibility of the Public Authority for Manpower and other competent authorities.
Banks face reporting and compliance requirements
Local banks must complete their technical and operational preparations before December 31. They are also required to submit monthly reports on monitoring and investigation results by the fifth working day of the following month.
In addition, banks must establish supervisory policies and procedures subject to annual internal audits. Institutions that fail to comply may face supervisory measures determined by the Central Bank.
Through these requirements, the CBK aims to ensure that private sector wages are not only deposited into bank accounts on paper, but genuinely reach employees and remain under their control.
