The Central Bank of Kuwait has told local banks to require two-factor authentication from December 31 for withdrawals, transfers and payments of 25 Kuwaiti dinars or more from the salary accounts of private-sector employees earning 300 dinars a month or less. The measure is meant to protect workers’ wages and stop employers recording fictitious salary payments or forcing employees to return money after it is deposited.
Banks must verify the employee’s identity and consent for each transaction using two separate verification elements from different categories, and authenticating when logging into a banking app or other channel will not be enough. The employee must also see the transaction’s type, amount and beneficiary before approving it. The rule covers associated payment methods and different banking channels.
The central bank said authentication methods must be personally linked to the employee. Banks must directly verify customers’ contact details when they are registered, changed or retrieved rather than relying only on information from employers, and must provide secure alternatives for employees who do not own smartphones or cannot use banking apps. Eligibility depends on the latest monthly salary recorded by the bank, not the account balance or the size of a transfer.
The instructions acknowledge that successful authentication does not rule out wage manipulation or pressure on workers to return their pay, so banks remain responsible for monitoring, including suspicious transactions below 25 dinars. Indicators include withdrawing or transferring 80 percent or more of a salary within 72 hours in at least two of the previous three pay cycles, transferring 50 percent or more to an employer or affiliated party within 72 hours, employers holding workers’ bank cards or PINs, and groups of employees repeatedly withdrawing from the same ATM.
When suspicious indicators appear, banks must review the employee’s transactions over the preceding six months, compare them with the employee’s usual behavior and examine possible links with the employer. They have two days for an initial review and a further three days of monitoring to complete a detailed investigation, and urgent cases must be reported immediately. Banks may not delay salary deposits or restrict employees from using their money solely because of a suspicion unless there is a legal basis.
Banks must complete technical and operational preparations before December 31 and submit monthly reports by the fifth working day of the following month. The requirements complement the Kuwait Wage Payment System, launched on September 28 to address fictitious wage payments.
Sources: Arab Times
–
By the ID Tech Editorial Team
