Tightened Oversight on Electronic Client Authentication with New Measures to Combat Data and Financial Piracy

- Banks and “K-NET” are required to comply with providing the minimum mandatory data for conducting transactions.

- Include in the transaction the execution time, beneficiary name, and debit source.

- The list includes transactions that have both direct and indirect financial impacts.

- Enhance service security and reduce the risks of exploiting authentication procedures.

In the context of mitigating the risks of cyber fraud and the theft of login credentials and verification codes, local banks have begun taking steps to tighten security procedures for digital banking services. This involves strengthening identity verification mechanisms when customers access banking applications and when executing online purchases.

In this regard, the Central Bank of Kuwait has directed all local banks and the Joint Automated Banking Services Company “K-NET” to adhere to the minimum data requirements that must be included during electronic authentication for electronic banking services.

It was clarified that these measures are part of the efforts by the regulatory authority, the banking sector, and relevant entities to enhance the security of electronic banking services and minimize the risks associated with the exploitation of electronic authentication procedures.

The new procedures, as confirmed by the Central Bank, mandate the inclusion of transaction-related data within the electronic authentication process, taking into account the varying nature of transactions, channels, and systems used, as follows:

1. Transactions with direct financial impact: The database in this regard must include the transaction execution time, beneficiary name, and debit source. The debit source should be displayed by showing the last four digits of the used card number or bank account number in an encrypted format, along with the transaction value and purpose.

In this context, banks and “K-NET” are required to issue a clear alert to customers not to share the verification code or any authentication data or content with any third party.

2. Transactions without direct financial impact: The database must include the transaction execution time, the requesting entity, and the purpose of the transaction. A clear alert must also be issued to customers not to share the One-Time Password (OTP) or any authentication data or content with any third party.

Regarding the selection of the channel to receive the verification code or authentication request, banks must provide a mechanism enabling customers to choose their preferred channel for receiving the OTP or the necessary authentication request before completing the transaction. This must be done through one of the secure and bank-approved channels, including the bank’s mobile application or Short Message Service (SMS).

Banks may provide an alternative means to access the verification code or authentication content if the customer’s chosen channel is unavailable, provided that the customer is notified in advance of the availability of this alternative method and how to use it, in compliance with the requirements outlined in the Cyber and Operational Resilience Framework documents for local banks and financial institutions.

Regulatory authorities have emphasized that banks must confirm to the Central Bank their compliance with the directives issued in this regard and take necessary measures to ensure the actual implementation of these requirements through relevant banking channels and systems.