Face recognition and OTP is compulsory for low salary transfers

If you earn KD 300 a month or less and your salary lands in a Kuwaiti bank account, your bank is about to start checking in with you a lot more often. Before any withdrawal, transfer or payment of KD 25 or more leaves that account, you’ll need to confirm it’s really you, and that you actually agreed to it.

This comes from the Central Bank of Kuwait (CBK), which has rolled out a detailed set of rules to stop employers from faking salary payments. The idea is simple: some employers deposit a worker’s wage to look compliant, then quietly take it back or control the account so the worker never really gets the money. CBK wants that stopped, and it’s giving banks a clear rulebook to catch it. This builds on the Kuwait Wage Payment System launched on 28 September, a central platform that tracks private-sector salary payments through local banks.

So who does this actually affect?

This applies to private-sector employees in Kuwait whose monthly salary is KD 300 or less. That covers a large number of lower-paid workers, including many domestic and service-sector employees, as our earlier piece on what the digital salary system means for expat workers explained.

The KD 300 figure decides who the rule covers. The KD 25 figure is separate – it’s the size of transaction that triggers the extra check, once someone falls under the rule. Getting your salary paid in doesn’t need any extra verification. It’s only when money moves out of the account that the checks kick in.

How the verification actually works

Banks must use two separate checks, not just one, to confirm the employee personally approves a transaction. The source names facial recognition and OTPs as the main options. Before asking for this approval, the bank has to show the employee exactly what the transaction is: the type, the amount and who’s receiving it.

One important detail: verifying someone once, when they open the account or first log in, is not enough. CBK wants banks checking in on every qualifying transaction, every time.

Banks also now have to verify a worker’s phone number and authentication method themselves, directly with the employee, whenever an account is opened, changed or recovered. They can no longer simply accept contact details handed over by the employer. That’s a direct response to cases where employers set up or control a worker’s banking details without the worker’s real involvement.

Readers who’ve followed our coverage of the KD 300 salary and KD 25 transaction monitoring rules will recognise these thresholds – this is the same framework, now with the facial recognition and OTP detail added.

What banks are told to watch for

CBK has given banks a long list of red flags. The main ones are:

• 80% or more of a salary withdrawn or transferred within 72 hours of being paid, happening in 2 of the last 3 pay cycles.
• At least 50% of a salary sent to the employer or someone connected to them within 72 hours.
• Wages from 5 or more employees of the same company pooled into one account.
• Unusual clusters of withdrawals by staff of one employer at the same ATM or branch.
• Employers holding onto a worker’s bank card, PIN or online banking login.
• Salary payments recovered after they were already marked as paid in the system.
• Documented complaints from workers saying they were forced to hand wages back, or blocked from using their own account.

Other signals include accounts used almost only to receive and withdraw wages, sudden drops in balance right after payday, and frequent unexplained changes to banking details or odd repeated refunds.

What happens when something looks suspicious

If a bank spots one of these patterns, it has to dig into the account’s last 6 months of activity, compare the employee’s recent behaviour with past salary cycles, and check for links between that employee and their employer. It must also look at whether other staff from the same company show similar patterns, and write up everything it finds in a full electronic record.

CBK has set up 3 risk levels for these cases. High-risk covers things like direct transfers of wages back to the employer, matching suspicious patterns across several staff, or proven complaints of forced repayment. Medium-risk is repeated withdrawals or transfers of most of a salary, plus some other warning sign. Low-risk is just one odd sign on its own, with nothing else to back it up – these stay under watch rather than triggering immediate action.

Employers’ payroll funds get checked too

It’s not only worker accounts under watch. Banks must also check where employers get the money to pay salaries, and whether it actually matches the size of the company, its number of staff and its total wage bill. A red flag here is money dropped into an account right before payroll, then pulled back out or moved elsewhere straight after.

Banks will also watch for unexplained swings in employee numbers or total payroll, salary files cancelled and resubmitted repeatedly, use of middle-man accounts, and wages going to company owners, partners or managers instead of staff. Shared phone numbers, devices or addresses across several employee accounts are treated as a possible sign that someone other than the worker controls the account.

Readers following the wider push on banking oversight might also want our piece on CBK’s call to report unlicensed money transfers, part of the same tightening of financial rules this year.

What this means for you

If you’re a lower-paid worker, this rule is built to protect you. It makes it much harder for an employer to quietly pull your wages back or keep your card and PIN. If your bank suddenly asks you to confirm a transaction with a face scan or a code sent to your phone, that’s this rule working, not a problem with your account.

CBK was clear on one point worth remembering: withdrawing your salary in cash, in full or in part, is not by itself suspicious. Banks must look at other signs too, and they’re not allowed to freeze your money or delay your salary just because one single flag came up, unless there’s a proper legal reason.

For employers, this means payroll funding and employee account patterns are now under real scrutiny. Readers can find more on how this system connects to recent bank-linked wage verification rules and the broader wage protection system we’ve covered on this site. For more context on how Kuwait’s financial rules are shifting this year, see our Local news coverage.

Quick answers