Kuwait: technology regulation at a glance

Framework: Coordinated circulars of 17 July 2023 issued by the Central Bank of Kuwait, Capital Markets Authority (CMA Circular No. 10/2023), and Insurance Regulatory Unit (Circular No. 6/2023); reinforced by Ministry of Interior enforcement action of April 2025

Kuwait enforces an absolute prohibition on all virtual-asset activities following coordinated circulars issued on 17 July 2023 by the Central Bank of Kuwait, the Capital Markets Authority (CMA), and the Insurance Regulatory Unit. The ban explicitly covers use as payment, investment dealings, provision of VASP services, and mining; no licence for any virtual-asset service has ever been issued in Kuwait. Enforcement intensified in April 2025 when the Ministry of Interior formally declared mining illegal under multiple laws, detained 26 individuals, and reported the discovery and seizure of more than 1,000 illegal mining sites.

Framework: Draft Kuwait National AI Strategy (2025-2028); CITRA Law No. 37 of 2014; CITRA Resolution No. 26 of 2024 (Data Privacy Protection); Central Agency for Information Technology (CAIT)

Kuwait has no binding AI-specific law in force as of May 2026. Existing sectoral instruments, CITRA's telecommunications law, 2024 data-privacy resolution, and cloud-computing framework, apply to AI activities by extension. CAIT published a Draft National AI Strategy (2025-2028) aligned with Kuwait Vision 2035, proposing dedicated AI governance structures, but that strategy had not been formally enacted as legislation as of mid-2026.

Framework: CITRA Data Privacy Protection Regulation (Decision No. 26/2024); Electronic Transactions Law No. 20/2014; Cybercrime Law No. 63/2015. Supervisory authority: Communications and Information Technology Regulatory Authority (CITRA), jurisdiction limited to licensed telecom/IT service providers.

Kuwait lacks a single comprehensive, cross-sector data protection law. Data privacy is governed by a patchwork of sectoral instruments: CITRA's Data Privacy Protection Regulation (DPPR, most recently updated by Decision No. 26 of 2024) covers telecom and internet licensees only, while the Electronic Transactions Law No. 20/2014 and Cybercrime Law No. 63/2015 provide supplementary protections for electronic records and unauthorized data access. No omnibus national data protection authority with economy-wide jurisdiction exists as of mid-2026.

Framework: Central Bank of Kuwait (CBK), Instructions for Regulating the Electronic Payment of Funds, issued by Resolution No. 45/471/2023 (May 2023), which repealed the earlier 2018 regime (Resolution No. 44/430 of 2018). Statutory basis is CBK Law No. 32 of 1968 (as amended).

Kuwait operates a clear, in-force licensing regime for digital payments administered by the Central Bank of Kuwait. The 2023 e-payment instructions define multiple license categories (e-payment service providers and operators) with capital, governance, AML/CFT and cybersecurity requirements, and a national instant-payment rail (WAMD) is live. Open banking, by contrast, is still at the draft-framework consultation stage and not yet a finalized regime.

Framework: Aliens' Residency Law No. 17 of 1959, as substantially reformed by Ministerial Resolution No. 2249 of 2025 (in force 23 December 2025), supplemented by kafala (employer-sponsorship) rules administered by the Ministry of Interior

Kuwait has no dedicated digital-nomad visa and its foundational kafala system still ties most expatriate residency to employer sponsorship. A sweeping residency overhaul effective December 2025 introduced tiered long-stay categories (self-sponsored Article 24, 10-year property-owner, 15-year investor), providing indirect pathways for financially self-sufficient remote workers. A freelance visa allowing independent work without a sponsor was publicly proposed by the Minister of Interior in February 2026 but had not been formally enacted as of May 2026.

Framework: Law No. 63/2015 on Combating Information Technology Crimes; Law No. 8/2016 on Electronic Media; CITRA (Communications and Information Technology Regulatory Authority) content-blocking and data-privacy regulations

Kuwait governs online content and safety through overlapping sector-specific statutes rather than a single comprehensive online-safety law. The 2015 Cybercrime Law criminalises a broad range of online expression including criticism of the head of state, while the 2016 Electronic Media Law imposes licensing and content-liability obligations on online publishers. CITRA administers ISP-level website blocking and issued updated telecom-sector data-privacy rules in 2024; a broader draft Media Law consolidating these frameworks remains under parliamentary consideration as of 2025-2026.

Framework: NCSC Decision No. 2/2026 (National Basic Cybersecurity Controls, NBCC/KNBCC); Law No. 63/2015 on Combating Information Technology Crimes; CITRA established under Law No. 37/2014; National Cybersecurity Strategy (CITRA/NCSC)

Kuwait has established a mandatory, cross-sector cybersecurity baseline through NCSC Decision No. 2 of 2026 (the National Basic Cybersecurity Controls), which applies to all government bodies, military and security agencies, and critical private-sector entities with an 18-month compliance deadline (approx. October 2027). This sits atop a pre-existing cybercrime law (Law No. 63/2015) and CITRA's regulatory and enforcement powers over telecoms and ICT services. A companion data classification framework (NCSC Decision No. 1/2025) and cloud-sector breach-notification rules further define incident-reporting duties.

Framework: Kuwait Companies Law (Law No. 1 of 2016) and Foreign Direct Investment Promotion Law (Law No. 116 of 2013), administered by the Ministry of Commerce and Industry (MOCI) and the Kuwait Direct Investment Promotion Authority (KDIPA)

Foreign investors establishing a standard company in Kuwait are normally limited to 49% ownership, with a Kuwaiti national or entity holding the remaining 51%. However, KDIPA can grant investment licences permitting up to 100% foreign equity in approved sectors on a case-by-case basis, and a January 2024 reform additionally allows wholly-owned foreign branch offices without a local partner. Bureaucratic complexity and sector exclusions mean the overall environment remains moderate rather than straightforward.