The Central Bank of Kuwait has ordered local banks to tighten oversight of salary accounts belonging to private-sector employees earning KD 300 or less a month. Withdrawals, transfers and payments of KD 25 or more will require two-factor authentication from December 31, 2026.

The rules aim to protect workers' wages and stop employers from recording fictitious salary payments or pressuring staff to hand back money once it reaches their accounts. Salary deposits themselves will not require extra authentication. Eligibility will be based on the latest monthly salary recorded by the bank, not on the account balance or the size of a single transfer.

Logging into a banking app will not count as authentication on its own. Before approving a transaction, employees must be shown its type, amount and beneficiary. Banks must also offer secure alternatives for customers who do not own smartphones or cannot use banking apps.

Where suspicious indicators emerge, banks must review the employee's transactions over the previous six months, compare them with the employee's usual financial behaviour and examine any links to the employer. Warning signs include withdrawing or transferring 80 percent or more of a salary within 72 hours in at least two of the last three pay cycles, sending 50 percent or more to the employer or an affiliated party within 72 hours, and employers holding workers' bank cards or PINs.

The central bank stressed that banks must not delay salary deposits or restrict workers' access to their money on suspicion alone unless there is a legal basis for doing so. Withdrawing an entire salary in cash is not, by itself, evidence of a violation. The requirements complement the Kuwait Wage Payment System (KWPS), which was launched on September 28.