Kuwait Credit Card Fraud and Money Laundering Laws

Overview of Online Financial Crimes Under Kuwait Law

Kuwait Law No. 63 of 2015 addresses two major categories of financial cybercrime that are particularly relevant to expats:

1. Electronic payment and credit card fraud (Article 5)
2. Online money laundering (Article 9)

Both offenses are treated with extreme seriousness under Kuwaiti law, and penalties escalate significantly depending on whether the crime results in financial gain.

Credit Card and Electronic Payment Fraud (Article 5)

What the Law Says

It is a criminal offense under Article 5 to use information networks or any information technology means to access, without authorization:

• Credit card numbers or data
• Debit card numbers or data
• Any equivalent electronic payment card information

Penalties for Credit Card Offenses

• Basic offense (unauthorized access to card data): Up to 1 year imprisonment and/or a fine of KD 1,000 to KD 3,000
• Aggravated offense (if financial benefit is obtained as a result): Penalties increase substantially — both the imprisonment term and fines are elevated

What Counts as a Violation?

Examples of behavior that could trigger Article 5 charges include:

• Phishing: Creating fake websites or emails to collect card details from victims
• Skimming data: Using software or devices to capture electronic payment information
• Unauthorized use of stored card data: Accessing payment details stored in a database you are not authorized to access
• Purchasing or selling stolen card data online, even if you did not steal it yourself
• Using another person's card details for online purchases without their consent

Online Money Laundering (Article 9)

What the Law Says

Article 9 targets individuals who use information networks or information technology means to:

• Launder money (conceal the criminal origin of funds)
• Transfer or move unlawful funds electronically
• Disguise or hide the illegal source of money through digital transactions
• Assist others in any of the above activities

Penalties for Online Money Laundering

• Up to 10 years imprisonment and/or a fine of KD 20,000 to KD 50,000
• These are among the most severe penalties in the entire cybercrime law

Why This Matters for Expats

Expats working in banking, financial services, cryptocurrency, or fintech in Kuwait should be particularly vigilant. Activities that might seem routine in other jurisdictions — such as facilitating certain cryptocurrency transfers or moving large sums through digital channels — could attract scrutiny under this provision.

Disruption of Electronic Financial Services (Article 4)

Article 4 also penalizes anyone who deliberately disrupts or obstructs access to electronic service websites, software, devices, or data sources. In a financial services context, this could include:

• Launching or participating in a denial-of-service (DoS) attack against a bank's website
• Interfering with online payment processing systems

Penalty: Up to 2 years imprisonment and/or a fine of KD 2,000 to KD 5,000

Confiscation and Business Closure

Under Article 13, courts may order:

• Confiscation of devices, software, or tools used in committing financial cybercrimes
• Confiscation of proceeds obtained from the offense
• Closure of premises or websites involved in the crime for up to one year, if the owner was aware of the illegal activity

Corporate and Employer Liability

If you manage a business or hold a position of authority in a company in Kuwait:

• Under Article 14, the legal representative of a company can face the same financial penalties as the individual offender if their negligence contributed to a cybercrime
• The company itself is responsible for paying any fines handed down by the court
• Implementing proper cybersecurity and data protection policies is not just good practice — it is a legal safeguard

Practical Guidance for Expats

• Never access payment systems or financial databases unless you have explicit, documented authorization
• If you work in IT or system administration for a financial institution, ensure your access rights are formally defined and regularly reviewed
• Report suspicious financial activity on digital platforms to your compliance officer and, if appropriate, to Kuwaiti authorities
• Be cautious with cryptocurrency transactions — the traceability of digital assets does not make them exempt from money laundering laws
• If you receive unexpected access to someone else's financial data (e.g., a database error), do not access or use the data and report it immediately to your employer and system provider

Statute of Limitations for Financial Cybercrimes

Given that money laundering and serious financial offenses carry penalties exceeding 3 years, the statute of limitations for prosecution is 5 years from the date of the offense. Civil compensation claims must be filed within 3 years of when the victim became aware of the harm.