Insurance Regulatory Unit Resolution No. 57 of 2023 Issuing the Rules on Combating Money Laundering and Terrorist Financing in the Insurance Sector

Insurance Regulatory Unit Resolution No. 57 of 2023
Issuing the Rules on Combating Money Laundering and Terrorist Financing in the Insurance Sector

Article One

Issuing the Rules on Combating Money Laundering and Terrorist Financing in the Insurance Sector, the texts of which are attached to this Resolution.

Article Two

The Rules on Combating Money Laundering and Terrorist Financing in the Insurance Sector shall come into force from the date of publication of this Resolution in the Official Gazette. These Rules shall also apply to all persons subject to the provisions of Law No. (125) of 2019 on Insurance Regulation and its Executive Regulations, and Resolution No. (38) of 2021 Issuing the Rules on Combating Money Laundering and Terrorist Financing in the Insurance Sector, or any resolution that conflicts with this Resolution, is hereby repealed.

Chapter One: Definitions

Article 1

The words and expressions used in these Rules shall have the meanings assigned to them in the Law and its Executive Regulations, and in Law No. (106) of 2013 on Combating Money Laundering and Terrorist Financing and its Executive Regulations, which shall be deemed an integral part of these Rules; and the following words and expressions shall have the meaning set out opposite each of them, unless the context requires otherwise:
1. The Law: the Insurance Regulation Law.
2. The Unit: the Insurance Regulatory Unit.
3. The Rules: the Rules on Combating Money Laundering and Terrorist Financing in the Insurance Sector.
4. Persons Subject to the Rules: companies licensed to carry on life insurance activities and capital formation operations, insurance agents and insurance brokers.
5. Violations: any act or omission that results in a breach of the obligations, controls, systems or requirements set out in the aforementioned Law No. (106) of 2013 and its Executive Regulations, or in these Rules, or in the Unit’s resolutions on combating money laundering and terrorist financing shall be deemed a violation.
6. Internal Regulations: the internal policies, work procedures, systems and controls for combating money laundering and terrorist financing operations.
7. Know Your Customer (KYC) Form for Natural Persons: a form in which the customer attests to the accuracy of his personal and financial data, the nature of his work, his job title, the amount of his income, his sources of wealth, the purpose of the dealing, the data of the beneficial owner of the insurance policy, whether the customer or any of his relatives is a politically exposed person, and any other data enabling the Persons Subject to the Rules to identify the customer.
8. Know Your Customer (KYC) Form for Legal Persons: a form in which the customer attests to the accuracy of its basic data, its organisational structure, the nature of its activity, the amount of its income, its sources of wealth, the purpose of the dealing, the data of the authorised signatory, the data of the beneficial owner, and any other data enabling the Persons Subject to the Rules to identify the customer.
9. Due Diligence: taking measures towards all customers that ensure that financial institutions and designated non-financial businesses and professions obtain all documents showing the basic and financial data of customers and of the beneficiaries of financial transactions, in order to carry out a risk assessment and to monitor them.
10. Enhanced Due Diligence: includes taking additional due diligence measures where the risks of money laundering or terrorist financing operations occurring are high, for example: intensifying the degree and nature of monitoring of the business relationship in order to determine whether these transactions or activities are unusual or suspicious, requesting additional information on the customer, requesting additional information on the nature of the intended business relationship, and requesting information on the source of the customer’s funds or wealth, or any other information and documents justifying the nature of the financial transactions that have been or may be carried out.

Chapter Two: The Compliance Officer

Article 2

Persons Subject to the Rules shall appoint a compliance officer at senior management level who shall be responsible for implementing the requirements of the aforementioned Law No. (106) of 2013 and its Executive Regulations, these Rules, and the resolutions, instructions and directives issued by the Unit on combating money laundering and terrorist financing.
Persons Subject to the Rules may establish a compliance unit reporting to senior management and headed by the compliance officer appointed at senior management level.
The compliance officer shall be appointed in accordance with the conditions set out for registrable positions in the Rules on Compliance with Professional Ethics, Competence and Integrity for Licensed Persons.

Article 3

An insurance broker shall be exempt from appointing a compliance officer if it does not provide brokerage services for life insurance activities and capital formation operations, provided that it submits to the Unit proof that it does not provide such services.

Article 4

The compliance officer shall enjoy independence in performing his duties, provided that he shall be accountable to senior management. He shall supervise the application by the Persons Subject to the Rules of the requirements of the aforementioned Law No. (106) of 2013 and its Executive Regulations, of these Rules, and of the resolutions, instructions and directives issued by the Unit on combating money laundering and terrorist financing, and their implementation, and in particular the following:
1. Supervising the implementation of the internal policies, work procedures, systems and controls relating to combating money laundering and terrorist financing, and preparing a report thereon to be submitted to senior management, and to the Unit upon its request.
2. Supervising the implementation of the requirements for assessing the risks of customers and transactions, updating them, and submitting them to the Unit upon its request.
3. Reviewing the suspicion indicators of the Persons Subject to the Rules and notifying senior management, for the purpose of reporting suspicious transactions to the Financial Intelligence Unit, and retaining the reports so as to submit them to the Unit upon its request.
4. Supervising and monitoring compliance with the provisions of Article (25) of the aforementioned Law No. (106) of 2013, and compliance with the resolutions of the Committee for the Implementation of Security Council Resolutions formed at the Ministry of Foreign Affairs.
5. Following up the resolutions of the United Nations sanctions committees and of the United Nations Security Council, and any related resolutions.
6. Ensuring that records, transactions and studies are retained, and submitting them to the Unit upon its request.
7. Supervising the implementation of due diligence and enhanced due diligence measures on customers and the beneficial owner.
8. Giving the technical opinion and the final decision on suspicious transactions.
Carrying out any other duties assigned to him by senior management or by the Unit relating to combating money laundering and terrorist financing.

Chapter Three: Internal Regulations, Systems and Controls

Internal Regulations

Article 5

Persons Subject to the Rules shall adopt Internal Regulations commensurate with the size, nature and scope of operations of the institution subject to the Rules, provided that they are approved by the senior management of the Persons Subject to the Rules, apply to all local and foreign branches and to the subsidiaries of the group, if any, and are updated every two years or at the request of the Unit. They shall verify that their foreign branches and subsidiaries implement the requirements of the aforementioned Law No. (106) of 2013, in particular Article (10) of that Law, to the extent permitted by the local laws of the host country.

Article 6

Where the laws of the host country do not permit the requirements referred to in the preceding Article to be applied in full, the Persons Subject to the Rules shall apply appropriate additional measures to manage the risks of money laundering and terrorist financing and shall include them in the Internal Regulations.
Persons Subject to the Rules shall put in place mechanisms for exchanging available information and maintaining its confidentiality across all local and foreign branches and the subsidiaries of the group, if any.

Precautionary Measures

Article 7

Persons Subject to the Rules shall apply the following precautionary measures:

Risk Assessment

Article 8

Persons Subject to the Rules shall put in place appropriate procedures to identify, assess, monitor, manage and mitigate the risks of money laundering and terrorist financing, to identify the potential factors constituting high-risk situations that require the application of enhanced due diligence measures, and to update and review the assessment process periodically, provided that these are included in the Internal Regulations of the Persons Subject to the Rules, and include, by way of example and not limitation:
1. Risk factors associated with customers:
a. A business relationship conducted in unusual circumstances.
b. A customer who is not resident in the State.
c. A legal person or legal arrangement that manages the assets of third parties.
d. A company that has nominee shareholders or bearer shares.
e. Activities that deal in cash or are exposed to money laundering and terrorist financing risks.
f. A company ownership structure that is unusual or excessively complex and has no apparent economic or lawful purpose in view of the nature of its activity.
g. A business relationship and transactions that are not conducted in the customer’s physical presence.
h. The establishment’s business relationships with or in the countries specified in Clause (2) of this Article.
i. Politically exposed persons or persons associated with a politically exposed person.
j. Customers who own substantial assets or whose source of income or assets is unclear.
2. Geographical risk factors or risk factors associated with other countries:
a. Countries identified by the Financial Action Task Force, through published mutual evaluation reports or follow-up reports, as countries that do not have adequate systems for combating money laundering and terrorist financing.
b. Countries classified by the Financial Intelligence Unit as high-risk countries.
c. Countries subject to sanctions, embargoes or similar measures issued, for example, by the United Nations or any other credible international body.
d. Countries identified by credible sources as having high levels of corruption or other criminal activity.
e. Countries or geographical areas identified by credible sources as providing funding or support for terrorist activities, or within whose territory designated terrorist organisations operate.
Credible sources include all governmental bodies and international and regional organisations concerned with evaluating countries and establishing procedures and regulations.
3. Risk factors associated with products, services, transactions or delivery channels:
a. Anonymous transactions that may involve cash amounts.
b. Transactions conducted with a customer who is not physically present for identification purposes.
c. Payments received from an unknown party or from a party with no known connection to the recipient.
Persons Subject to the Rules shall also identify the money laundering and terrorist financing risks that may arise from the following operations:
1. Developing new products and new business practices, including new delivery mechanisms for products and services.
2. Using new or developed technologies for both existing and new products.
Customers shall be assessed, on the basis of the above items, at three levels (high – medium – low).

Article 9

Persons Subject to the Rules shall put in place appropriate risk management systems to determine whether the customer or the beneficial owner is a domestic or foreign politically exposed person.
The procedures for identifying a politically exposed person, whether a customer or a beneficial owner, shall include the following:
1. Requesting relevant information from the customer.
2. Referring to the available customer information.
3. Referring to electronic databases on the commercial affairs of politically exposed persons, where available.

Identification Requirements

Article 10

First: Persons Subject to the Rules shall obtain, as the case may be, valid documents for the purposes of the Know Your Customer (KYC) Form and of identifying the customer or the beneficial owner, which are the following:
1. The civil identity card for citizens and residents.
2. The passport or travel document for persons not resident in Kuwait.
3. The commercial licence issued by the Ministry of Commerce and Industry for companies and establishments registered in Kuwait, or the documents issued by the competent authorities in the other country in the case of branches of foreign companies and establishments.
4. The documents, papers and court judgments proving that he is the legal representative of the person concerned.
5. Approved official identity documents certified by the competent official authorities or bodies that issued those documents, for customers who do not fall within the scope of the preceding paragraphs of this Article.
Second: Persons Subject to the Rules shall understand the purpose and nature of the business relationship and obtain information for that purpose.
This shall be done on an ongoing basis throughout the relationship with customers, and they shall ensure that the documents and papers submitted are kept up to date on an ongoing basis, in particular for high-risk customers.
Where the broker carries out the transaction, the broker shall complete the data of the Know Your Customer (KYC) Form before delivering it to the insurance company, and the company shall be responsible for verifying the said data and the documents submitted and for requesting any other data or documents from the broker or the customer in order to complete the application.
Persons Subject to the Rules shall update the Know Your Customer (KYC) Form according to the customers’ risk assessment, as follows:
High risk: every year, or as needed.
Medium risk: every two years, or as needed.
Low risk: every three years, or as needed.

Article 11

Persons Subject to the Rules shall:
1) When carrying out the customer identification procedures, ascertain from the customer whether there are life insurance policies, whether inside or outside Kuwait, under which he is entitled to benefit or to which he is a party.
2) Where there are policies under which the customer is a beneficiary party, he shall state his relationship to the policies, their details and value, the local or foreign companies insuring him, and the reasons that led him to take out the new policy.
Where the customer does not agree to this, consideration shall be given to whether or not to notify the Kuwait Financial Intelligence Unit.

Article 12

Persons Subject to the Rules shall take the due diligence measures required for the customer, the beneficiary and the beneficial owner of life insurance policies or capital formation operations as soon as the beneficiary or the beneficial owner is identified, as follows:
1. Obtaining the name, in the case of a beneficiary designated as a natural or legal person or a legal arrangement.
2. Obtaining sufficient information about the beneficiary to enable the Persons Subject to the Rules to ascertain the identity of the beneficiary at the time of payment of the indemnity, in the case of a beneficiary designated by a particular category, such as family members up to the second degree upon the occurrence of the insured event, or by other means such as a will.
3. Treating the beneficiary of an insurance policy referred to in this Article as one of the high-risk factors associated with the transaction that require the application of enhanced due diligence procedures, including taking reasonable measures to identify and verify the identity of the beneficiary or the beneficial owner at the time of payment.

Article 13

Persons Subject to the Rules shall take the necessary measures to determine whether the customer is acting on behalf of one or more beneficial owners, by obtaining a certificate signed by the customer when the transaction is carried out stating that the customer is not acting or carrying out the transaction on behalf of another person, or through any other sources.
Where it becomes apparent to the Persons Subject to the Rules that the customer is acting on behalf of the beneficial owner, they shall:
1. Verify the identity of the beneficial owner using relevant information or data obtained from a reliable source that confirms the identity of the beneficial owner.
2. Apply due diligence measures commensurate with the risks associated with the beneficial owner or beneficial owners in this case.

Article 14

Persons Subject to the Rules shall obtain the customer identification documents where the customer is a legal person, and shall take measures to identify and verify the identity of its shareholders or beneficial owners and of the persons exercising actual control over it.
This shall not apply where it is listed on a stock exchange and is subject to transparency and disclosure rules that disclose the identity of the beneficial owner.

Article 15

Persons Subject to the Rules are prohibited from establishing business relationships with anonymous customers or customers using fictitious names, and they shall identify and verify the identity of the customer and the beneficial owner at the following stages:
1. Before carrying out any transaction with the customer.
2. Where money laundering or terrorist financing is suspected.
3. Where there are doubts about the accuracy or adequacy of the previously obtained customer identification data.

Article 16

Where the customer is a legal person or a legal arrangement, the Persons Subject to the Rules shall take appropriate measures to understand the ownership and control structure of the customer, including the beneficial owner who owns or controls it, as follows:
1. With respect to legal persons,
the beneficial owner of a legal person shall be:
a. Any position, agreement or ownership of shares or interests, whether individual ownership or ownership through affiliated or allied parties, exceeding 25% of the shares or interests, or control over the appointment of the majority of the members of the board of directors or of the manager, as the case may be, or over the decisions issued by it or by the General Meeting of the company concerned.
b. The beneficial owner shall be traced through any number of legal persons or legal arrangements of any kind.
c. Where all possible means have been exhausted and no natural person holding ultimate controlling ownership as set out in Clause (a) of this Article has been identified, or where there is doubt as to whether the natural person holding controlling ownership is the beneficial owner, the natural person exercising control over the legal person through other means shall be the beneficial owner.
d. Where no natural person is identified as set out in the preceding Clause of this Article, the beneficial owner shall be deemed to be the natural person who holds the position of senior managing official.
2. With respect to legal arrangements, the identity of the settlor, the trustee, the beneficiary or any other person entrusted with similar functions shall be verified as the beneficial owner as set out in Paragraph (1) of this Article.

Politically Exposed Persons and High-Risk Persons

Article 17

Where it is determined that the customer or the beneficial owner is a politically exposed person or a high-risk person, the Persons Subject to the Rules shall apply additional due diligence measures, whether the high-risk or politically exposed person is foreign or domestic, as follows:
a. Obtaining senior management approval before establishing or continuing the business relationship with that person.
b. Taking all appropriate measures to establish the source of funds and assets.
c. Applying enhanced and ongoing monitoring of the business relationship.
In all of the above cases, senior management shall be informed before any rights relating to life insurance policies and/or capital formation operations are exercised or before the indemnities due under those policies are paid, and a thorough examination shall be conducted of the business relationship of the policyholder, and consideration shall be given to submitting a report to the Financial Intelligence Unit in each case.

Due Diligence, Enhanced Due Diligence and Reliance on Third Parties

Article 18

Persons Subject to the Rules shall monitor customers’ transactions on an ongoing basis, including the following:
1. Scrutinising customers’ transactions to verify that they are carried out in accordance with their knowledge of the customer, his risk profile, and the sources of his funds and assets.
2. Monitoring the predetermined limits on the amount, volume and type of transactions.

Article 19

Persons Subject to the Rules shall take enhanced due diligence measures in accordance with the identified risks, as well as in cases where the risks of money laundering or terrorist financing are higher, and shall ensure that complex and unusual transactions and their purpose are examined, as well as all unusual patterns of transactions that have no apparent economic or lawful purpose, including politically exposed persons and customers who do not deal face to face.
The enhanced due diligence measures applicable to a high-risk transaction shall include, for example:
1. Obtaining additional information on the customer, such as occupation, volume of assets and the information available on him, and updating the data of the customer and the beneficial owner regularly.
2. Obtaining additional information on the nature of the expected transaction.
3. Obtaining information on the sources of the customer’s funds or assets.
4. Obtaining information on the reasons for the expected or previously executed transactions.
5. Certifying documents in accordance with the relevant laws and procedures.
6. Requesting any additional documents and putting in place independent procedures to verify the identity of the customer and/or contact him.
Enhanced due diligence measures shall be applied to high-risk customers on an ongoing basis at every stage of the due diligence process as long as the relationship with the customer continues.

Article 20

Persons Subject to the Rules may rely on third parties to carry out the due diligence measures specified in Articles (10), (13) and (14), provided that the following are met:
1. The approval of the Unit.
2. The possibility of obtaining immediately and electronically the required information on due diligence measures.
3. Ensuring that the third party will provide, upon request and without delay, a copy of the identification data and other documents relating to due diligence measures.
4. Ensuring that the third party complies with the due diligence and record-keeping requirements.
In all cases, the ultimate responsibility for identifying and verifying the identity of the customer shall rest with the Persons Subject to the Rules.

Article 21

Persons Subject to the Rules are prohibited from the following:
– Dealing in cash, regardless of the value of the transaction, in life insurance and capital formation operations.
– Receiving payments from anyone other than the insured or parties directly related to him; the details of that relationship shall be stated and verified.

Article 22

Where an insurance policy is cancelled, the company shall:
1. Obtain from the customer a statement of the reasons for cancelling the policy, on a form showing them.
2. Not pay any amounts in cash, but pay the funds to the same person who initiated the transaction.
In all cases, consideration shall be given to submitting a report to the Financial Intelligence Unit on each case of cancellation.

Obligations to Report Suspicious Transactions

Article 23

Persons Subject to the Rules shall notify the Financial Intelligence Unit, within two working days at most, of any transaction or attempted transaction, regardless of its value, if they suspect that such transactions are being carried out with funds that constitute proceeds of crime or funds related to money laundering or terrorist financing operations, or that may be used to carry out such operations.
A transaction shall be deemed suspicious where one or some of the indicators published by the Kuwait Financial Intelligence Unit and the Financial Action Task Force are present, or any other indicators associated with the customer, the transaction, the products or the geographical location, and any indicators issued by the Insurance Regulatory Unit.

Article 24

Persons Subject to the Rules and their managers and employees are prohibited from disclosing to the customer or to third parties that the Kuwait Financial Intelligence Unit has been or will be contacted, or that there is an investigation into money laundering or terrorist financing. This shall not prevent disclosure or communication between the managers and employees of the Persons Subject to the Rules, lawyers, the competent authorities and the Public Prosecution.

Termination of the Business Relationship

Article 25

Persons Subject to the Rules shall terminate the relationship with the customer and consider notifying the Financial Intelligence Unit if they are unable to verify the identity of the beneficial owner while the business relationship is in force, or if they are unable to comply with the due diligence measures required towards the customer.

Record Keeping

Article 26

Persons Subject to the Rules shall retain the following documents and information:
1. Copies of all records obtained through the due diligence process, including documents evidencing the identities of customers and beneficial owners, accounting files and business correspondence, for at least ten years after the end of the business relationship or after the date of execution of the transaction for a customer who has no business relationship with the Persons Subject to the Rules.
2. Copies of all domestic and international transactions, whether actually executed or attempted, for at least ten years after the execution or attempted execution of the transaction; such transactions shall be sufficiently detailed to permit the reconstruction of the steps of each individual transaction.
3. Copies of the reports submitted and the related documents, for at least ten years after the date on which the report was submitted to the Financial Intelligence Unit.
4. Copies of suspicion cases and of the studies made of any operations or transactions considered for reporting to the Financial Intelligence Unit, together with the final decision on them and its reasons, for at least ten years.
5. Copies of the information relating to risk assessment required by the Unit, for ten years from the date on which the assessment was carried out or updated.
6. A register of all life insurance policies.
7. A register of all investment-linked insurance policies (capital formation), in the capacity of insurer or of broker of the insurance contract.
8. A register of life insurance indemnities, regardless of their value.
9. A register of cancelled life insurance policies and/or capital formation operations.
The records shall contain all personal data of the policyholders, beneficiaries or investors.

Other Obligations

Article 27

Persons Subject to the Rules shall comply with the following:
1. Granting the compliance officer and other relevant staff direct access to customer identification data and other information relating to due diligence measures, transaction records and other relevant information.
2. Periodic review by senior management of the periodic reports relating to the requirements of the aforementioned Law No. (106) of 2013 and its Executive Regulations, and of the Rules, resolutions, instructions and directives issued by the Unit on combating money laundering and terrorist financing; these reports shall include a statement of all suspicious transactions detected and of the measures taken by the compliance officer to strengthen the policies, work procedures, systems and controls of the Person Subject to the Rules.
3. Review by senior management of the results of any on-site inspection conducted by the Unit, including the corrective measures that the Persons Subject to the Rules are required to apply.
4. Conducting independent audits and examinations to verify that the compliance officer and the staff of the Person Subject to the Rules perform their duties in accordance with its internal policies, work procedures, systems and controls in the field of combating money laundering and terrorist financing.
5. The auditor’s report shall include an assessment of the internal control systems of the Persons Subject to the Rules and of the extent of their compliance with the laws.

Article 28

Persons Subject to the Rules and licensed to carry on life insurance and capital formation activities shall provide the Unit with any reports and data relating to combating money laundering and terrorist financing and preventing the proliferation of weapons, in accordance with the forms prepared for that purpose, and in accordance with the resolutions, circulars and time limits issued by the Unit, as required.

* Replaced by Resolution No. 36 of 2026 (Kuwait Al-Youm, Issue No. 1795, 14 June 2026).

Chapter Four: Sanctions and Penalties

Penalties and Legal Measures

Article 29

Without prejudice to the criminal liability provided for in the aforementioned Law No. (106) of 2013, Persons Subject to the Rules shall be penalised if they commit a violation, and the Disciplinary Board may impose one or more of the following measures or penalties for each violation:
Issuing written warnings of the violation.
Issuing an order requiring compliance with specific procedures.
Issuing an order to submit regular reports on the measures taken to remedy the violation concerned.
Imposing a financial penalty not exceeding five hundred thousand dinars for each violation.
Barring the violator from working in the relevant activity for a period determined by the Disciplinary Board.
Restricting the powers of the members of the board of directors, the members of executive or supervisory management or its managers, and the controlling owners, including appointing a temporary monitor.
Removing, or requesting the replacement of, the members of the board of directors, the members of executive or supervisory management or its managers.
Suspending, restricting or prohibiting the practice of the activity, business or profession.
Suspending the licence.
Revoking the licence.
The Disciplinary Board may apply any other measures in accordance with Law No. 125 of 2019 and its Executive Regulations.

Issued on 6 November 2023 and published in the Official Gazette Kuwait Al-Youm on 12 November 2023.